diff --git a/.clang-format b/.clang-format
index 4f191fc18..1aadf2cad 100644
--- a/.clang-format
+++ b/.clang-format
@@ -8,7 +8,7 @@ BraceWrapping:
   AfterUnion: true
   SplitEmptyRecord: false
 PointerAlignment: Middle
-FixNamespaceComments: false
+FixNamespaceComments: true
 SortIncludes: Never
 #IndentPPDirectives: BeforeHash
 SpaceAfterCStyleCast: true
@@ -32,3 +32,4 @@ IndentPPDirectives: AfterHash
 PPIndentWidth: 2
 BinPackArguments: false
 BreakBeforeTernaryOperators: true
+SeparateDefinitionBlocks: Always
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 000000000..2bea19741
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,6 @@
+# bulk initial re-formatting with clang-format
+e4f62e46088919428a68bd8014201dc8e379fed7 # !autorebase ./maintainers/format.sh --until-stable
+# meson re-formatting
+385e2c3542c707d95e3784f7f6d623f67e77ab61 # !autorebase ./maintainers/format.sh --until-stable
+# nixfmt 1.0.0
+1d943f581908f35075a84a3d89c2eba3ff35067f # !autorebase ./maintainers/format.sh --until-stable
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index a5005f8a0..af94c3e9e 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -45,7 +45,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open bug issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nixos.org/manual/nix/unstable/
+[latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug
 
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index c75a46951..fe9f9dd20 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -30,7 +30,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open feature issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nixos.org/manual/nix/unstable/
+[latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open feature issues and pull requests]: https://github.com/NixOS/nix/labels/feature
 
diff --git a/.github/ISSUE_TEMPLATE/installer.md b/.github/ISSUE_TEMPLATE/installer.md
index ed5e1ce87..070e0bd9b 100644
--- a/.github/ISSUE_TEMPLATE/installer.md
+++ b/.github/ISSUE_TEMPLATE/installer.md
@@ -38,7 +38,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open installer issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nixos.org/manual/nix/unstable/
+[latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open installer issues and pull requests]: https://github.com/NixOS/nix/labels/installer
 
diff --git a/.github/ISSUE_TEMPLATE/missing_documentation.md b/.github/ISSUE_TEMPLATE/missing_documentation.md
index 6c334b722..4e05b626d 100644
--- a/.github/ISSUE_TEMPLATE/missing_documentation.md
+++ b/.github/ISSUE_TEMPLATE/missing_documentation.md
@@ -22,7 +22,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open documentation issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nixos.org/manual/nix/unstable/
+[latest Nix manual]: https://nix.dev/manual/nix/development/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open documentation issues and pull requests]: https://github.com/NixOS/nix/labels/documentation
 
diff --git a/.github/actions/install-nix-action/action.yaml b/.github/actions/install-nix-action/action.yaml
new file mode 100644
index 000000000..c299b3956
--- /dev/null
+++ b/.github/actions/install-nix-action/action.yaml
@@ -0,0 +1,50 @@
+name: "Install Nix"
+description: "Helper action for installing Nix with support for dogfooding from master"
+inputs:
+  dogfood:
+    description: "Whether to use Nix installed from the latest artifact from master branch"
+    required: true # Be explicit about the fact that we are using unreleased artifacts
+  extra_nix_config:
+    description: "Gets appended to `/etc/nix/nix.conf` if passed."
+  install_url:
+    description: "URL of the Nix installer"
+    required: false
+    default: "https://releases.nixos.org/nix/nix-2.30.2/install"
+  github_token:
+    description: "Github token"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: "Download nix install artifact from master"
+      shell: bash
+      id: download-nix-installer
+      if: inputs.dogfood == 'true'
+      run: |
+        RUN_ID=$(gh run list --repo "$DOGFOOD_REPO" --workflow ci.yml --branch master --status success --json databaseId --jq ".[0].databaseId")
+
+        if [ "$RUNNER_OS" == "Linux" ]; then
+          INSTALLER_ARTIFACT="installer-linux"
+        elif [ "$RUNNER_OS" == "macOS" ]; then
+          INSTALLER_ARTIFACT="installer-darwin"
+        else
+          echo "::error ::Unsupported RUNNER_OS: $RUNNER_OS"
+          exit 1
+        fi
+
+        INSTALLER_DOWNLOAD_DIR="$GITHUB_WORKSPACE/$INSTALLER_ARTIFACT"
+        mkdir -p "$INSTALLER_DOWNLOAD_DIR"
+
+        gh run download "$RUN_ID" --repo "$DOGFOOD_REPO" -n "$INSTALLER_ARTIFACT" -D "$INSTALLER_DOWNLOAD_DIR"
+        echo "installer-path=file://$INSTALLER_DOWNLOAD_DIR" >> "$GITHUB_OUTPUT"
+
+        echo "::notice ::Dogfooding Nix installer from master (https://github.com/$DOGFOOD_REPO/actions/runs/$RUN_ID)"
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}
+        DOGFOOD_REPO: "NixOS/nix"
+    - uses: cachix/install-nix-action@c134e4c9e34bac6cab09cf239815f9339aaaf84e # v31.5.1
+      with:
+        # Ternary operator in GHA: https://www.github.com/actions/runner/issues/409#issuecomment-752775072
+        install_url: ${{ inputs.dogfood == 'true' && format('{0}/install', steps.download-nix-installer.outputs.installer-path) || inputs.install_url }}
+        install_options: ${{ inputs.dogfood == 'true' && format('--tarball-url-prefix {0}', steps.download-nix-installer.outputs.installer-path) || '' }}
+        extra_nix_config: ${{ inputs.extra_nix_config }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 29cb33f56..e7e103b63 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,7 +2,15 @@ name: "CI"
 
 on:
   pull_request:
+  merge_group:
   push:
+  workflow_dispatch:
+    inputs:
+      dogfood:
+        description: 'Use dogfood Nix build'
+        required: false
+        default: true
+        type: boolean
 
 permissions: read-all
 
@@ -10,11 +18,16 @@ jobs:
   eval:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
-    - run: nix --experimental-features 'nix-command flakes' flake show --all-systems --json
+    - uses: ./.github/actions/install-nix-action
+      with:
+        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+        extra_nix_config:
+          experimental-features = nix-command flakes
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+    - run: nix flake show --all-systems --json
 
   tests:
     strategy:
@@ -24,34 +37,69 @@ jobs:
           - scenario: on ubuntu
             runs-on: ubuntu-24.04
             os: linux
+            instrumented: false
+            primary: true
+            stdenv: stdenv
           - scenario: on macos
             runs-on: macos-14
             os: darwin
+            instrumented: false
+            primary: true
+            stdenv: stdenv
+          - scenario: on ubuntu (with sanitizers / coverage)
+            runs-on: ubuntu-24.04
+            os: linux
+            instrumented: true
+            primary: false
+            stdenv: clangStdenv
     name: tests ${{ matrix.scenario }}
     runs-on: ${{ matrix.runs-on }}
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
+    - uses: ./.github/actions/install-nix-action
       with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
         # The sandbox would otherwise be disabled by default on Darwin
-        extra_nix_config: |
-          sandbox = true
-          max-jobs = 1
+        extra_nix_config: "sandbox = true"
     - uses: DeterminateSystems/magic-nix-cache-action@main
     # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
     # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
     - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       if: matrix.os == 'linux'
-    - run: scripts/build-checks
-    - run: scripts/prepare-installer-for-github-actions
+    - name: Run component tests
+      run: |
+        nix build --file ci/gha/tests/wrapper.nix componentTests -L \
+          --arg withInstrumentation ${{ matrix.instrumented }} \
+          --argstr stdenv "${{ matrix.stdenv }}"
+    - name: Run flake checks and prepare the installer tarball
+      run: |
+        ci/gha/tests/build-checks
+        ci/gha/tests/prepare-installer-for-github-actions
+      if: ${{ matrix.primary }}
+    - name: Collect code coverage
+      run: |
+        nix build --file ci/gha/tests/wrapper.nix codeCoverage.coverageReports -L \
+          --arg withInstrumentation ${{ matrix.instrumented }} \
+          --argstr stdenv "${{ matrix.stdenv }}" \
+          --out-link coverage-reports
+        cat coverage-reports/index.txt >> $GITHUB_STEP_SUMMARY
+      if: ${{ matrix.instrumented }}
+    - name: Upload coverage reports
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage-reports
+        path: coverage-reports/
+      if: ${{ matrix.instrumented }}
     - name: Upload installer tarball
       uses: actions/upload-artifact@v4
       with:
         name: installer-${{matrix.os}}
         path: out/*
+      if: ${{ matrix.primary }}
 
   installer_test:
     needs: [tests]
@@ -68,19 +116,19 @@ jobs:
     name: installer test ${{ matrix.scenario }}
     runs-on: ${{ matrix.runs-on }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Download installer tarball
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: installer-${{matrix.os}}
         path: out
-    - name: Serving installer
-      id: serving_installer
-      run: ./scripts/serve-installer-for-github-actions
+    - name: Looking up the installer tarball URL
+      id: installer-tarball-url
+      run: echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
     - uses: cachix/install-nix-action@v31
       with:
-        install_url: 'http://localhost:8126/install'
-        install_options: "--tarball-url-prefix http://localhost:8126/"
+        install_url: ${{ format('{0}/install', steps.installer-tarball-url.outputs.installer-url) }}
+        install_options: ${{ format('--tarball-url-prefix {0}', steps.installer-tarball-url.outputs.installer-url) }}
     - run: sudo apt install fish zsh
       if: matrix.os == 'linux'
     - run: brew install fish
@@ -99,17 +147,17 @@ jobs:
   check_secrets:
     permissions:
       contents: none
-    name: Check Docker secrets present for installer tests
+    name: Check presence of secrets
     runs-on: ubuntu-24.04
     outputs:
       docker: ${{ steps.secret.outputs.docker }}
     steps:
-      - name: Check for secrets
+      - name: Check for DockerHub secrets
         id: secret
         env:
           _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
         run: |
-          echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
+          echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT
 
   docker_push_image:
     needs: [tests, vm_tests, check_secrets]
@@ -122,13 +170,7 @@ jobs:
       github.ref_name == 'master'
     runs-on: ubuntu-24.04
     steps:
-    - name: Check for secrets
-      id: secret
-      env:
-        _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
-      run: |
-        echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
     - uses: cachix/install-nix-action@v31
@@ -174,8 +216,13 @@ jobs:
   vm_tests:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: actions/checkout@v5
+      - uses: ./.github/actions/install-nix-action
+        with:
+          dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+          extra_nix_config:
+            experimental-features = nix-command flakes
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: |
           nix build -L \
@@ -190,17 +237,45 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout nix
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Checkout flake-regressions
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: NixOS/flake-regressions
           path: flake-regressions
       - name: Checkout flake-regressions-data
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: NixOS/flake-regressions-data
           path: flake-regressions/tests
-      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: ./.github/actions/install-nix-action
+        with:
+          dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+          extra_nix_config:
+            experimental-features = nix-command flakes
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH MAX_FLAKES=25 flake-regressions/eval-all.sh
+
+  profile_build:
+    needs: tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    if: >-
+      github.event_name == 'push' &&
+      github.ref_name == 'master'
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
+    - uses: ./.github/actions/install-nix-action
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+        extra_nix_config: |
+          experimental-features = flakes nix-command ca-derivations impure-derivations
+          max-jobs = 1
+    - uses: DeterminateSystems/magic-nix-cache-action@main
+    - run: |
+        nix build -L --file ./ci/gha/profile-build buildTimeReport --out-link build-time-report.md
+        cat build-time-report.md >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 23a5d9e51..16038cb21 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         sync-labels: false
diff --git a/.mergify.yml b/.mergify.yml
index 8941711a9..1c220045a 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -150,3 +150,25 @@ pull_request_rules:
         labels:
           - automatic backport
           - merge-queue
+
+  - name: backport patches to 2.30
+    conditions:
+      - label=backport 2.30-maintenance
+    actions:
+      backport:
+        branches:
+          - "2.30-maintenance"
+        labels:
+          - automatic backport
+          - merge-queue
+
+  - name: backport patches to 2.31
+    conditions:
+      - label=backport 2.31-maintenance
+    actions:
+      backport:
+        branches:
+          - "2.31-maintenance"
+        labels:
+          - automatic backport
+          - merge-queue
diff --git a/.version b/.version
index 6a6900382..7cca401c7 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-2.30.0
+2.32.0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index ad8678962..7231730bb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -89,7 +89,7 @@ Check out the [security policy](https://github.com/NixOS/nix/security/policy).
 
 ## Making changes to the Nix manual
 
-The Nix reference manual is hosted on https://nixos.org/manual/nix.
+The Nix reference manual is hosted on https://nix.dev/manual/nix.
 The underlying source files are located in [`doc/manual/source`](./doc/manual/source).
 For small changes you can [use GitHub to edit these files](https://docs.github.com/en/repositories/working-with-files/managing-files/editing-files)
 For larger changes see the [Nix reference manual](https://nix.dev/manual/nix/development/development/contributing.html).
diff --git a/ci/gha/profile-build/default.nix b/ci/gha/profile-build/default.nix
new file mode 100644
index 000000000..2b7261b71
--- /dev/null
+++ b/ci/gha/profile-build/default.nix
@@ -0,0 +1,101 @@
+{
+  nixFlake ? builtins.getFlake ("git+file://" + toString ../../..),
+  system ? builtins.currentSystem,
+  pkgs ? nixFlake.inputs.nixpkgs.legacyPackages.${system},
+}:
+
+let
+  inherit (pkgs) lib;
+
+  nixComponentsInstrumented =
+    (nixFlake.lib.makeComponents {
+      inherit pkgs;
+      getStdenv = p: p.clangStdenv;
+    }).overrideScope
+      (
+        _: _: {
+          mesonComponentOverrides = finalAttrs: prevAttrs: {
+            outputs = (prevAttrs.outputs or [ "out" ]) ++ [ "buildprofile" ];
+            nativeBuildInputs = [ pkgs.clangbuildanalyzer ] ++ prevAttrs.nativeBuildInputs or [ ];
+            __impure = true;
+
+            env = {
+              CFLAGS = "-ftime-trace";
+              CXXFLAGS = "-ftime-trace";
+            };
+
+            preBuild = ''
+              ClangBuildAnalyzer --start $PWD
+            '';
+
+            postBuild = ''
+              ClangBuildAnalyzer --stop $PWD $buildprofile
+            '';
+          };
+        }
+      );
+
+  componentsToProfile = {
+    "nix-util" = { };
+    "nix-util-c" = { };
+    "nix-util-test-support" = { };
+    "nix-util-tests" = { };
+    "nix-store" = { };
+    "nix-store-c" = { };
+    "nix-store-test-support" = { };
+    "nix-store-tests" = { };
+    "nix-fetchers" = { };
+    "nix-fetchers-c" = { };
+    "nix-fetchers-tests" = { };
+    "nix-expr" = { };
+    "nix-expr-c" = { };
+    "nix-expr-test-support" = { };
+    "nix-expr-tests" = { };
+    "nix-flake" = { };
+    "nix-flake-c" = { };
+    "nix-flake-tests" = { };
+    "nix-main" = { };
+    "nix-main-c" = { };
+    "nix-cmd" = { };
+    "nix-cli" = { };
+  };
+
+  componentDerivationsToProfile = builtins.intersectAttrs componentsToProfile nixComponentsInstrumented;
+  componentBuildProfiles = lib.mapAttrs (
+    n: v: lib.getOutput "buildprofile" v
+  ) componentDerivationsToProfile;
+
+  buildTimeReport =
+    pkgs.runCommand "build-time-report"
+      {
+        __impure = true;
+        __structuredAttrs = true;
+        nativeBuildInputs = [ pkgs.clangbuildanalyzer ];
+        inherit componentBuildProfiles;
+      }
+      ''
+        {
+          echo "# Build time performance profile for components:"
+          echo
+          echo "This reports the build profile collected via \`-ftime-trace\` for each component."
+          echo
+        } >> $out
+
+        for name in "''\${!componentBuildProfiles[@]}"; do
+          {
+            echo "<details><summary><strong>$name</strong></summary>"
+            echo
+            echo '````'
+            ClangBuildAnalyzer --analyze "''\${componentBuildProfiles[$name]}"
+            echo '````'
+            echo
+            echo "</details>"
+          } >> $out
+        done
+      '';
+in
+
+{
+  inherit buildTimeReport;
+  inherit componentDerivationsToProfile;
+}
diff --git a/scripts/build-checks b/ci/gha/tests/build-checks
similarity index 100%
rename from scripts/build-checks
rename to ci/gha/tests/build-checks
diff --git a/ci/gha/tests/default.nix b/ci/gha/tests/default.nix
new file mode 100644
index 000000000..74d0b8c7e
--- /dev/null
+++ b/ci/gha/tests/default.nix
@@ -0,0 +1,229 @@
+{
+  nixFlake ? builtins.getFlake ("git+file://" + toString ../../..),
+  system ? builtins.currentSystem,
+  pkgs ? nixFlake.inputs.nixpkgs.legacyPackages.${system},
+  nixComponents ? (
+    nixFlake.lib.makeComponents {
+      inherit pkgs;
+      inherit getStdenv;
+    }
+  ),
+  getStdenv ? p: p.stdenv,
+  componentTestsPrefix ? "",
+  withSanitizers ? false,
+  withCoverage ? false,
+  ...
+}:
+
+let
+  inherit (pkgs) lib;
+  hydraJobs = nixFlake.hydraJobs;
+  packages' = nixFlake.packages.${system};
+  stdenv = (getStdenv pkgs);
+
+  enableSanitizersLayer = finalAttrs: prevAttrs: {
+    mesonFlags =
+      (prevAttrs.mesonFlags or [ ])
+      ++ [
+        # Run all tests with UBSAN enabled. Running both with ubsan and
+        # without doesn't seem to have much immediate benefit for doubling
+        # the GHA CI workaround.
+        #
+        # TODO: Work toward enabling "address,undefined" if it seems feasible.
+        # This would maybe require dropping Boost coroutines and ignoring intentional
+        # memory leaks with detect_leaks=0.
+        (lib.mesonOption "b_sanitize" "undefined")
+      ]
+      ++ (lib.optionals stdenv.cc.isClang [
+        # https://www.github.com/mesonbuild/meson/issues/764
+        (lib.mesonBool "b_lundef" false)
+      ]);
+  };
+
+  collectCoverageLayer = finalAttrs: prevAttrs: {
+    env =
+      let
+        # https://clang.llvm.org/docs/SourceBasedCodeCoverage.html#the-code-coverage-workflow
+        coverageFlags = [
+          "-fprofile-instr-generate"
+          "-fcoverage-mapping"
+        ];
+      in
+      {
+        CFLAGS = toString coverageFlags;
+        CXXFLAGS = toString coverageFlags;
+      };
+
+    # Done in a pre-configure hook, because $NIX_BUILD_TOP needs to be substituted.
+    preConfigure = prevAttrs.preConfigure or "" + ''
+      mappingFlag=" -fcoverage-prefix-map=$NIX_BUILD_TOP/${finalAttrs.src.name}=${finalAttrs.src}"
+      CFLAGS+="$mappingFlag"
+      CXXFLAGS+="$mappingFlag"
+    '';
+  };
+
+  componentOverrides =
+    (lib.optional withSanitizers enableSanitizersLayer)
+    ++ (lib.optional withCoverage collectCoverageLayer);
+in
+
+rec {
+  nixComponentsInstrumented = nixComponents.overrideScope (
+    final: prev: {
+      nix-store-tests = prev.nix-store-tests.override { withBenchmarks = true; };
+
+      mesonComponentOverrides = lib.composeManyExtensions componentOverrides;
+    }
+  );
+
+  /**
+    Top-level tests for the flake outputs, as they would be built by hydra.
+    These tests generally can't be overridden to run with sanitizers.
+  */
+  topLevel = {
+    installerScriptForGHA = hydraJobs.installerScriptForGHA.${system};
+    installTests = hydraJobs.installTests.${system};
+    nixpkgsLibTests = hydraJobs.tests.nixpkgsLibTests.${system};
+    rl-next = pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
+      LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${../../../doc/manual/rl-next} >$out
+    '';
+    repl-completion = pkgs.callPackage ../../../tests/repl-completion.nix { inherit (packages') nix; };
+
+    /**
+      Checks for our packaging expressions.
+      This shouldn't build anything significant; just check that things
+      (including derivations) are _set up_ correctly.
+    */
+    packaging-overriding =
+      let
+        nix = packages'.nix;
+      in
+      assert (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src.patches == [ pkgs.emptyFile ];
+      if pkgs.stdenv.buildPlatform.isDarwin then
+        lib.warn "packaging-overriding check currently disabled because of a permissions issue on macOS" pkgs.emptyFile
+      else
+        # If this fails, something might be wrong with how we've wired the scope,
+        # or something could be broken in Nixpkgs.
+        pkgs.testers.testEqualContents {
+          assertion = "trivial patch does not change source contents";
+          expected = "${../../..}";
+          actual =
+            # Same for all components; nix-util is an arbitrary pick
+            (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src;
+        };
+  };
+
+  componentTests =
+    (lib.concatMapAttrs (
+      pkgName: pkg:
+      lib.concatMapAttrs (testName: test: {
+        "${componentTestsPrefix}${pkgName}-${testName}" = test;
+      }) (pkg.tests or { })
+    ) nixComponentsInstrumented)
+    // lib.optionalAttrs (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) {
+      "${componentTestsPrefix}nix-functional-tests" = nixComponentsInstrumented.nix-functional-tests;
+    };
+
+  codeCoverage =
+    let
+      componentsTestsToProfile =
+        (builtins.mapAttrs (n: v: nixComponentsInstrumented.${n}.tests.run) {
+          "nix-util-tests" = { };
+          "nix-store-tests" = { };
+          "nix-fetchers-tests" = { };
+          "nix-expr-tests" = { };
+          "nix-flake-tests" = { };
+        })
+        // {
+          inherit (nixComponentsInstrumented) nix-functional-tests;
+        };
+
+      coverageProfileDrvs = lib.mapAttrs (
+        n: v:
+        v.overrideAttrs (
+          finalAttrs: prevAttrs: {
+            outputs = (prevAttrs.outputs or [ "out" ]) ++ [ "profraw" ];
+            env = {
+              LLVM_PROFILE_FILE = "${placeholder "profraw"}/%m";
+            };
+          }
+        )
+      ) componentsTestsToProfile;
+
+      coverageProfiles = lib.mapAttrsToList (n: v: lib.getOutput "profraw" v) coverageProfileDrvs;
+
+      mergedProfdata =
+        pkgs.runCommand "merged-profdata"
+          {
+            __structuredAttrs = true;
+            nativeBuildInputs = [ pkgs.llvmPackages.libllvm ];
+            inherit coverageProfiles;
+          }
+          ''
+            rawProfiles=()
+            for dir in "''\${coverageProfiles[@]}"; do
+              rawProfiles+=($dir/*)
+            done
+            llvm-profdata merge -sparse -output $out "''\${rawProfiles[@]}"
+          '';
+
+      coverageReports =
+        let
+          nixComponentDrvs = lib.filter (lib.isDerivation) (lib.attrValues nixComponentsInstrumented);
+        in
+        pkgs.runCommand "code-coverage-report"
+          {
+            nativeBuildInputs = [
+              pkgs.llvmPackages.libllvm
+              pkgs.jq
+            ];
+            __structuredAttrs = true;
+            nixComponents = nixComponentDrvs;
+          }
+          ''
+            # ${toString (lib.map (v: v.src) nixComponentDrvs)}
+
+            binaryFiles=()
+            for dir in "''\${nixComponents[@]}"; do
+              readarray -t filesInDir < <(find "$dir" -type f -executable)
+              binaryFiles+=("''\${filesInDir[@]}")
+            done
+
+            arguments=$(concatStringsSep " -object " binaryFiles)
+            llvm-cov show $arguments -instr-profile ${mergedProfdata} -output-dir $out -format=html
+
+            {
+              echo "# Code coverage summary (generated via \`llvm-cov\`):"
+              echo
+              echo '```'
+              llvm-cov report $arguments -instr-profile ${mergedProfdata} -format=text -use-color=false
+              echo '```'
+              echo
+            } >> $out/index.txt
+
+            llvm-cov export $arguments -instr-profile ${mergedProfdata} -format=text > $out/coverage.json
+
+            mkdir -p $out/nix-support
+
+            coverageTotals=$(jq ".data[0].totals" $out/coverage.json)
+
+            # Mostly inline from pkgs/build-support/setup-hooks/make-coverage-analysis-report.sh [1],
+            # which we can't use here, because we rely on LLVM's infra for source code coverage collection.
+            # [1]: https://github.com/NixOS/nixpkgs/blob/67bb48c4c8e327417d6d5aa7e538244b209e852b/pkgs/build-support/setup-hooks/make-coverage-analysis-report.sh#L16
+            declare -A metricsArray=(["lineCoverage"]="lines" ["functionCoverage"]="functions" ["branchCoverage"]="branches")
+
+            for metricName in "''\${!metricsArray[@]}"; do
+              key="''\${metricsArray[$metricName]}"
+              metric=$(echo "$coverageTotals" | jq ".$key.percent * 10 | round / 10")
+              echo "$metricName $metric %" >> $out/nix-support/hydra-metrics
+            done
+
+            echo "report coverage $out" >> $out/nix-support/hydra-build-products
+          '';
+    in
+    assert withCoverage;
+    assert stdenv.cc.isClang;
+    {
+      inherit coverageProfileDrvs mergedProfdata coverageReports;
+    };
+}
diff --git a/scripts/prepare-installer-for-github-actions b/ci/gha/tests/prepare-installer-for-github-actions
similarity index 100%
rename from scripts/prepare-installer-for-github-actions
rename to ci/gha/tests/prepare-installer-for-github-actions
diff --git a/ci/gha/tests/wrapper.nix b/ci/gha/tests/wrapper.nix
new file mode 100644
index 000000000..dc280ebbb
--- /dev/null
+++ b/ci/gha/tests/wrapper.nix
@@ -0,0 +1,16 @@
+{
+  nixFlake ? builtins.getFlake ("git+file://" + toString ../../..),
+  system ? builtins.currentSystem,
+  pkgs ? nixFlake.inputs.nixpkgs.legacyPackages.${system},
+  stdenv ? "stdenv",
+  componentTestsPrefix ? "",
+  withInstrumentation ? false,
+}@args:
+import ./. (
+  args
+  // {
+    getStdenv = p: p.${stdenv};
+    withSanitizers = withInstrumentation;
+    withCoverage = withInstrumentation;
+  }
+)
diff --git a/doc/manual/meson.build b/doc/manual/meson.build
index 6fe2374a7..2e372dedd 100644
--- a/doc/manual/meson.build
+++ b/doc/manual/meson.build
@@ -1,4 +1,5 @@
-project('nix-manual',
+project(
+  'nix-manual',
   version : files('.version'),
   meson_version : '>= 1.1',
   license : 'LGPL-2.1-or-later',
@@ -8,43 +9,45 @@ nix = find_program('nix', native : true)
 
 mdbook = find_program('mdbook', native : true)
 bash = find_program('bash', native : true)
+rsync = find_program('rsync', required : true, native : true)
 
 pymod = import('python')
 python = pymod.find_installation('python3')
 
 nix_env_for_docs = {
-  'HOME': '/dummy',
-  'NIX_CONF_DIR': '/dummy',
-  'NIX_SSL_CERT_FILE': '/dummy/no-ca-bundle.crt',
-  'NIX_STATE_DIR': '/dummy',
-  'NIX_CONFIG': 'cores = 0',
+  'HOME' : '/dummy',
+  'NIX_CONF_DIR' : '/dummy',
+  'NIX_SSL_CERT_FILE' : '/dummy/no-ca-bundle.crt',
+  'NIX_STATE_DIR' : '/dummy',
+  'NIX_CONFIG' : 'cores = 0',
 }
 
-nix_for_docs = [nix, '--experimental-features', 'nix-command']
+nix_for_docs = [ nix, '--experimental-features', 'nix-command' ]
 nix_eval_for_docs_common = nix_for_docs + [
   'eval',
-  '-I', 'nix=' + meson.current_source_dir(),
+  '-I',
+  'nix=' + meson.current_source_dir(),
   '--store', 'dummy://',
   '--impure',
 ]
 nix_eval_for_docs = nix_eval_for_docs_common + '--raw'
 
 conf_file_json = custom_target(
-  command : nix_for_docs + ['config', 'show', '--json'],
+  command : nix_for_docs + [ 'config', 'show', '--json' ],
   capture : true,
   output : 'conf-file.json',
   env : nix_env_for_docs,
 )
 
 language_json = custom_target(
-  command: [nix, '__dump-language'],
+  command : [ nix, '__dump-language' ],
   output : 'language.json',
   capture : true,
   env : nix_env_for_docs,
 )
 
 nix3_cli_json = custom_target(
-  command : [nix, '__dump-cli'],
+  command : [ nix, '__dump-cli' ],
   capture : true,
   output : 'nix.json',
   env : nix_env_for_docs,
@@ -78,13 +81,14 @@ manual = custom_target(
   'manual',
   command : [
     bash,
-    '-euo', 'pipefail',
+    '-euo',
+    'pipefail',
     '-c',
     '''
         @0@ @INPUT0@ @CURRENT_SOURCE_DIR@ > @DEPFILE@
         @0@ @INPUT1@ summary @2@ < @CURRENT_SOURCE_DIR@/source/SUMMARY.md.in > @2@/source/SUMMARY.md
         sed -e 's|@version@|@3@|g' < @INPUT2@ > @2@/book.toml
-        rsync -r --include='*.md' @CURRENT_SOURCE_DIR@/ @2@/
+        @4@ -r --include='*.md' @CURRENT_SOURCE_DIR@/ @2@/
         (cd @2@; RUST_LOG=warn @1@ build -d @2@ 3>&2 2>&1 1>&3) | { grep -Fv "because fragment resolution isn't implemented" || :; } 3>&2 2>&1 1>&3
         rm -rf @2@/manual
         mv @2@/html @2@/manual
@@ -94,6 +98,7 @@ manual = custom_target(
       mdbook.full_path(),
       meson.current_build_dir(),
       meson.project_version(),
+      rsync.full_path(),
     ),
   ],
   input : [
@@ -118,8 +123,8 @@ manual = custom_target(
   ],
   depfile : 'manual.d',
   env : {
-    'RUST_LOG': 'info',
-    'MDBOOK_SUBSTITUTE_SEARCH': meson.current_build_dir() / 'source',
+    'RUST_LOG' : 'info',
+    'MDBOOK_SUBSTITUTE_SEARCH' : meson.current_build_dir() / 'source',
   },
 )
 manual_html = manual[0]
@@ -131,7 +136,8 @@ install_subdir(
 )
 
 nix_nested_manpages = [
-  [ 'nix-env',
+  [
+    'nix-env',
     [
       'delete-generations',
       'install',
@@ -146,7 +152,8 @@ nix_nested_manpages = [
       'upgrade',
     ],
   ],
-  [ 'nix-store',
+  [
+    'nix-store',
     [
       'add-fixed',
       'add',
diff --git a/doc/manual/package.nix b/doc/manual/package.nix
index af6d46a2a..69b7c0e49 100644
--- a/doc/manual/package.nix
+++ b/doc/manual/package.nix
@@ -46,24 +46,23 @@ mkMesonDerivation (finalAttrs: {
   ];
 
   # Hack for sake of the dev shell
-  passthru.externalNativeBuildInputs =
-    [
-      meson
-      ninja
-      (lib.getBin lowdown-unsandboxed)
-      mdbook
-      mdbook-linkcheck
-      jq
-      python3
-      rsync
-      changelog-d
-    ]
-    ++ lib.optionals (!officialRelease) [
-      # When not an official release, we likely have changelog entries that have
-      # yet to be rendered.
-      # When released, these are rendered into a committed file to save a dependency.
-      changelog-d
-    ];
+  passthru.externalNativeBuildInputs = [
+    meson
+    ninja
+    (lib.getBin lowdown-unsandboxed)
+    mdbook
+    mdbook-linkcheck
+    jq
+    python3
+    rsync
+    changelog-d
+  ]
+  ++ lib.optionals (!officialRelease) [
+    # When not an official release, we likely have changelog entries that have
+    # yet to be rendered.
+    # When released, these are rendered into a committed file to save a dependency.
+    changelog-d
+  ];
 
   nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
     nix-cli
diff --git a/doc/manual/rl-next/dropped-compat.md b/doc/manual/rl-next/dropped-compat.md
new file mode 100644
index 000000000..d6cc7704a
--- /dev/null
+++ b/doc/manual/rl-next/dropped-compat.md
@@ -0,0 +1,6 @@
+---
+synopsis: "Removed support for daemons and clients older than Nix 2.0"
+prs: [13951]
+---
+
+We have dropped support in the daemon worker protocol for daemons and clients that don't speak at least version 18 of the protocol. This first Nix release that supports this version is Nix 2.0, released in February 2018.
diff --git a/doc/manual/rl-next/shorter-build-dir-names.md b/doc/manual/rl-next/shorter-build-dir-names.md
new file mode 100644
index 000000000..e87fa5d04
--- /dev/null
+++ b/doc/manual/rl-next/shorter-build-dir-names.md
@@ -0,0 +1,6 @@
+---
+synopsis: "Temporary build directories no longer include derivation names"
+prs: [13839]
+---
+
+Temporary build directories created during derivation builds no longer include the derivation name in their path to avoid build failures when the derivation name is too long. This change ensures predictable prefix lengths for build directories under `/nix/var/nix/builds`.
\ No newline at end of file
diff --git a/doc/manual/source/SUMMARY.md.in b/doc/manual/source/SUMMARY.md.in
index bfb921567..8fed98c2c 100644
--- a/doc/manual/source/SUMMARY.md.in
+++ b/doc/manual/source/SUMMARY.md.in
@@ -128,6 +128,7 @@
 - [Development](development/index.md)
   - [Building](development/building.md)
   - [Testing](development/testing.md)
+  - [Benchmarking](development/benchmarking.md)
   - [Debugging](development/debugging.md)
   - [Documentation](development/documentation.md)
   - [CLI guideline](development/cli-guideline.md)
@@ -137,6 +138,7 @@
   - [Contributing](development/contributing.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
+  - [Release 2.31 (2025-08-21)](release-notes/rl-2.31.md)
   - [Release 2.30 (2025-07-07)](release-notes/rl-2.30.md)
   - [Release 2.29 (2025-05-14)](release-notes/rl-2.29.md)
   - [Release 2.28 (2025-04-02)](release-notes/rl-2.28.md)
diff --git a/doc/manual/source/command-ref/env-common.md b/doc/manual/source/command-ref/env-common.md
index ee3995111..e0fd2b00e 100644
--- a/doc/manual/source/command-ref/env-common.md
+++ b/doc/manual/source/command-ref/env-common.md
@@ -75,7 +75,7 @@ Most Nix commands interpret the following environment variables:
 - <span id="env-NIX_CONF_DIR">[`NIX_CONF_DIR`](#env-NIX_CONF_DIR)</span>
 
   Overrides the location of the system Nix configuration directory
-  (default `prefix/etc/nix`).
+  (default `sysconfdir/nix`, i.e. `/etc/nix` on most systems).
 
 - <span id="env-NIX_CONFIG">[`NIX_CONFIG`](#env-NIX_CONFIG)</span>
 
diff --git a/doc/manual/source/command-ref/meson.build b/doc/manual/source/command-ref/meson.build
index 2976f69ff..92998dec1 100644
--- a/doc/manual/source/command-ref/meson.build
+++ b/doc/manual/source/command-ref/meson.build
@@ -1,13 +1,12 @@
 xp_features_json = custom_target(
-  command : [nix, '__dump-xp-features'],
+  command : [ nix, '__dump-xp-features' ],
   capture : true,
   output : 'xp-features.json',
 )
 
 experimental_features_shortlist_md = custom_target(
   command : nix_eval_for_docs + [
-    '--expr',
-    'import @INPUT0@ (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
+    '--expr', 'import @INPUT0@ (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
   ],
   input : [
     '../../generate-xp-features-shortlist.nix',
@@ -19,14 +18,8 @@ experimental_features_shortlist_md = custom_target(
 )
 
 nix3_cli_files = custom_target(
-  command : [
-    python.full_path(),
-    '@INPUT0@',
-    '@OUTPUT@',
-    '--'
-  ] + nix_eval_for_docs + [
-    '--expr',
-    'import @INPUT1@ true (builtins.readFile ./@INPUT2@)',
+  command : [ python.full_path(), '@INPUT0@', '@OUTPUT@', '--' ] + nix_eval_for_docs + [
+    '--expr', 'import @INPUT1@ true (builtins.readFile ./@INPUT2@)',
   ],
   input : [
     '../../remove_before_wrapper.py',
@@ -40,8 +33,7 @@ nix3_cli_files = custom_target(
 conf_file_md_body = custom_target(
   command : [
     nix_eval_for_docs,
-    '--expr',
-    'import @INPUT0@ { prefix = "conf"; } (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
+    '--expr', 'import @INPUT0@ { prefix = "conf"; } (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
   ],
   capture : true,
   input : [
diff --git a/doc/manual/source/development/benchmarking.md b/doc/manual/source/development/benchmarking.md
new file mode 100644
index 000000000..74eadd9c2
--- /dev/null
+++ b/doc/manual/source/development/benchmarking.md
@@ -0,0 +1,187 @@
+# Running Benchmarks
+
+This guide explains how to build and run performance benchmarks in the Nix codebase.
+
+## Overview
+
+Nix uses the [Google Benchmark](https://github.com/google/benchmark) framework for performance testing. Benchmarks help measure and track the performance of critical operations like derivation parsing.
+
+## Building Benchmarks
+
+Benchmarks are disabled by default and must be explicitly enabled during the build configuration. For accurate results, use a debug-optimized release build.
+
+### Development Environment Setup
+
+First, enter the development shell which includes the necessary dependencies:
+
+```bash
+nix develop .#native-ccacheStdenv
+```
+
+### Configure Build with Benchmarks
+
+From the project root, configure the build with benchmarks enabled and optimization:
+
+```bash
+cd build
+meson configure -Dbenchmarks=true -Dbuildtype=debugoptimized
+```
+
+The `debugoptimized` build type provides:
+- Compiler optimizations for realistic performance measurements
+- Debug symbols for profiling and analysis
+- Balance between performance and debuggability
+
+### Build the Benchmarks
+
+Build the project including benchmarks:
+
+```bash
+ninja
+```
+
+This will create benchmark executables in the build directory. Currently available:
+- `build/src/libstore-tests/nix-store-benchmarks` - Store-related performance benchmarks
+
+Additional benchmark executables will be created as more benchmarks are added to the codebase.
+
+## Running Benchmarks
+
+### Basic Usage
+
+Run benchmark executables directly. For example, to run store benchmarks:
+
+```bash
+./build/src/libstore-tests/nix-store-benchmarks
+```
+
+As more benchmark executables are added, run them similarly from their respective build directories.
+
+### Filtering Benchmarks
+
+Run specific benchmarks using regex patterns:
+
+```bash
+# Run only derivation parser benchmarks
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_filter="derivation.*"
+
+# Run only benchmarks for hello.drv
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_filter=".*hello.*"
+```
+
+### Output Formats
+
+Generate benchmark results in different formats:
+
+```bash
+# JSON output
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_format=json > results.json
+
+# CSV output
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_format=csv > results.csv
+```
+
+### Advanced Options
+
+```bash
+# Run benchmarks multiple times for better statistics
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_repetitions=10
+
+# Set minimum benchmark time (useful for micro-benchmarks)
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_min_time=2
+
+# Compare against baseline
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_baseline=baseline.json
+
+# Display time in custom units
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_time_unit=ms
+```
+
+## Writing New Benchmarks
+
+To add new benchmarks:
+
+1. Create a new `.cc` file in the appropriate `*-tests` directory
+2. Include the benchmark header:
+   ```cpp
+   #include <benchmark/benchmark.h>
+   ```
+
+3. Write benchmark functions:
+   ```cpp
+   static void BM_YourBenchmark(benchmark::State & state)
+   {
+       // Setup code here
+
+       for (auto _ : state) {
+           // Code to benchmark
+       }
+   }
+   BENCHMARK(BM_YourBenchmark);
+   ```
+
+4. Add the file to the corresponding `meson.build`:
+   ```meson
+   benchmarks_sources = files(
+       'your-benchmark.cc',
+       # existing benchmarks...
+   )
+   ```
+
+## Profiling with Benchmarks
+
+For deeper performance analysis, combine benchmarks with profiling tools:
+
+```bash
+# Using Linux perf
+perf record ./build/src/libstore-tests/nix-store-benchmarks
+perf report
+```
+
+### Using Valgrind Callgrind
+
+Valgrind's callgrind tool provides detailed profiling information that can be visualized with kcachegrind:
+
+```bash
+# Profile with callgrind
+valgrind --tool=callgrind ./build/src/libstore-tests/nix-store-benchmarks
+
+# Visualize the results with kcachegrind
+kcachegrind callgrind.out.*
+```
+
+This provides:
+- Function call graphs
+- Instruction-level profiling
+- Source code annotation
+- Interactive visualization of performance bottlenecks
+
+## Continuous Performance Testing
+
+```bash
+# Save baseline results
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_format=json > baseline.json
+
+# Compare against baseline in CI
+./build/src/libstore-tests/nix-store-benchmarks --benchmark_baseline=baseline.json
+```
+
+## Troubleshooting
+
+### Benchmarks not building
+
+Ensure benchmarks are enabled:
+```bash
+meson configure build | grep benchmarks
+# Should show: benchmarks true
+```
+
+### Inconsistent results
+
+- Ensure your system is not under heavy load
+- Disable CPU frequency scaling for consistent results
+- Run benchmarks multiple times with `--benchmark_repetitions`
+
+## See Also
+
+- [Google Benchmark documentation](https://github.com/google/benchmark/blob/main/docs/user_guide.md)
diff --git a/doc/manual/source/development/building.md b/doc/manual/source/development/building.md
index 167463837..a07232a5f 100644
--- a/doc/manual/source/development/building.md
+++ b/doc/manual/source/development/building.md
@@ -34,7 +34,7 @@ $ nix-shell --attr devShells.x86_64-linux.native-clangStdenvPackages
 To build Nix itself in this shell:
 
 ```console
-[nix-shell]$ mesonFlags+=" --prefix=$(pwd)/outputs/out"
+[nix-shell]$ out="$(pwd)/outputs/out" dev=$out debug=$out mesonFlags+=" --prefix=${out}"
 [nix-shell]$ dontAddPrefix=1 configurePhase
 [nix-shell]$ buildPhase
 ```
@@ -215,14 +215,18 @@ nix build .#nix-everything-x86_64-w64-mingw32
 
 For historic reasons and backward-compatibility, some CPU and OS identifiers are translated as follows:
 
-| `config.guess`             | Nix                 |
-|----------------------------|---------------------|
-| `amd64`                    | `x86_64`            |
-| `i*86`                     | `i686`              |
-| `arm6`                     | `arm6l`             |
-| `arm7`                     | `arm7l`             |
-| `linux-gnu*`               | `linux`             |
-| `linux-musl*`              | `linux`             |
+| `host_machine.cpu_family()` | `host_machine.endian()` | Nix                 |
+|-----------------------------|-------------------------|---------------------|
+| `x86`                       |                         | `i686`              |
+| `arm`                       |                         | `host_machine.cpu()`|
+| `ppc`                       | `little`                | `powerpcle`         |
+| `ppc64`                     | `little`                | `powerpc64le`       |
+| `ppc`                       | `big`                   | `powerpc`           |
+| `ppc64`                     | `big`                   | `powerpc64`         |
+| `mips`                      | `little`                | `mipsel`            |
+| `mips64`                    | `little`                | `mips64el`          |
+| `mips`                      | `big`                   | `mips`              |
+| `mips64`                    | `big`                   | `mips64`            |
 
 ## Compilation environments
 
diff --git a/doc/manual/source/development/meson.build b/doc/manual/source/development/meson.build
index 5ffbfe394..4831cf8f0 100644
--- a/doc/manual/source/development/meson.build
+++ b/doc/manual/source/development/meson.build
@@ -1,7 +1,6 @@
 experimental_feature_descriptions_md = custom_target(
   command : nix_eval_for_docs + [
-    '--expr',
-    'import @INPUT0@ (builtins.fromJSON (builtins.readFile @INPUT1@))',
+    '--expr', 'import @INPUT0@ (builtins.fromJSON (builtins.readFile @INPUT1@))',
   ],
   input : [
     '../../generate-xp-features.nix',
diff --git a/doc/manual/source/installation/prerequisites-source.md b/doc/manual/source/installation/prerequisites-source.md
index c346a0a4b..057fd4443 100644
--- a/doc/manual/source/installation/prerequisites-source.md
+++ b/doc/manual/source/installation/prerequisites-source.md
@@ -10,7 +10,7 @@
   - Bash Shell. The `./configure` script relies on bashisms, so Bash is
     required.
 
-  - A version of GCC or Clang that supports C++20.
+  - A version of GCC or Clang that supports C++23.
 
   - `pkg-config` to locate dependencies. If your distribution does not
     provide it, you can get it from
diff --git a/doc/manual/source/installation/uninstall.md b/doc/manual/source/installation/uninstall.md
index 8d45da6bb..69d59847b 100644
--- a/doc/manual/source/installation/uninstall.md
+++ b/doc/manual/source/installation/uninstall.md
@@ -41,6 +41,38 @@ There may also be references to Nix in
 
 which you may remove.
 
+### FreeBSD
+
+1. Stop and remove the Nix daemon service:
+
+   ```console
+   sudo service nix-daemon stop
+   sudo rm -f /usr/local/etc/rc.d/nix-daemon
+   sudo sysrc -x nix_daemon_enable
+   ```
+
+2. Remove files created by Nix:
+
+   ```console
+   sudo rm -rf /etc/nix /usr/local/etc/profile.d/nix.sh /nix ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
+   ```
+
+3. Remove build users and their group:
+
+   ```console
+   for i in $(seq 1 32); do
+     sudo pw userdel nixbld$i
+   done
+   sudo pw groupdel nixbld
+   ```
+
+4. There may also be references to Nix in:
+   - `/usr/local/etc/bashrc`
+   - `/usr/local/etc/zshrc`
+   - Shell configuration files in users' home directories
+
+   which you may remove.
+
 ### macOS
 
 > **Updating to macOS 15 Sequoia**
diff --git a/doc/manual/source/language/advanced-attributes.md b/doc/manual/source/language/advanced-attributes.md
index 34c3b636b..c9d64f060 100644
--- a/doc/manual/source/language/advanced-attributes.md
+++ b/doc/manual/source/language/advanced-attributes.md
@@ -160,7 +160,6 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
 ## Other output modifications
 
   - [`unsafeDiscardReferences`]{#adv-attr-unsafeDiscardReferences}\
-
     When using [structured attributes](#adv-attr-structuredAttrs), the
     attribute `unsafeDiscardReferences` is an attribute set with a boolean value for each output name.
     If set to `true`, it disables scanning the output for runtime dependencies.
@@ -195,7 +194,6 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
     [`builder`]: ./derivations.md#attr-builder
 
 - [`requiredSystemFeatures`]{#adv-attr-requiredSystemFeatures}\
-
   If a derivation has the `requiredSystemFeatures` attribute, then Nix will only build it on a machine that has the corresponding features set in its [`system-features` configuration](@docroot@/command-ref/conf-file.md#conf-system-features).
 
   For example, setting
diff --git a/doc/manual/source/language/meson.build b/doc/manual/source/language/meson.build
index 97469e2f3..ed4995bfb 100644
--- a/doc/manual/source/language/meson.build
+++ b/doc/manual/source/language/meson.build
@@ -1,19 +1,13 @@
 builtins_md = custom_target(
-  command : [
-    python.full_path(),
-    '@INPUT0@',
-    '@OUTPUT@',
-    '--'
-  ] + nix_eval_for_docs + [
-    '--expr',
-    '(builtins.readFile @INPUT3@) + import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)) + (builtins.readFile @INPUT4@)',
+  command : [ python.full_path(), '@INPUT0@', '@OUTPUT@', '--' ] + nix_eval_for_docs + [
+    '--expr', '(builtins.readFile @INPUT3@) + import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)) + (builtins.readFile @INPUT4@)',
   ],
   input : [
     '../../remove_before_wrapper.py',
     '../../generate-builtins.nix',
     language_json,
     'builtins-prefix.md',
-    'builtins-suffix.md'
+    'builtins-suffix.md',
   ],
   output : 'builtins.md',
   env : nix_env_for_docs,
diff --git a/doc/manual/source/meson.build b/doc/manual/source/meson.build
index 098a29897..949d26526 100644
--- a/doc/manual/source/meson.build
+++ b/doc/manual/source/meson.build
@@ -1,7 +1,8 @@
 summary_rl_next = custom_target(
   command : [
     bash,
-    '-euo', 'pipefail',
+    '-euo',
+    'pipefail',
     '-c',
     '''
       if [ -e "@INPUT@" ]; then
@@ -12,6 +13,6 @@ summary_rl_next = custom_target(
   input : [
     rl_next_generated,
   ],
-  capture: true,
+  capture : true,
   output : 'SUMMARY-rl-next.md',
 )
diff --git a/doc/manual/source/package-management/garbage-collector-roots.md b/doc/manual/source/package-management/garbage-collector-roots.md
index 30c5b7f8d..925a33162 100644
--- a/doc/manual/source/package-management/garbage-collector-roots.md
+++ b/doc/manual/source/package-management/garbage-collector-roots.md
@@ -12,7 +12,7 @@ $ ln -s /nix/store/d718ef...-foo /nix/var/nix/gcroots/bar
 That is, after this command, the garbage collector will not remove
 `/nix/store/d718ef...-foo` or any of its dependencies.
 
-Subdirectories of `prefix/nix/var/nix/gcroots` are also searched for
-symlinks. Symlinks to non-store paths are followed and searched for
-roots, but symlinks to non-store paths *inside* the paths reached in
-that way are not followed to prevent infinite recursion.
+Subdirectories of `prefix/nix/var/nix/gcroots` are searched
+recursively. Symlinks to store paths count as roots. Symlinks to
+non-store paths are ignored, unless the non-store path is itself a
+symlink to a store path.
\ No newline at end of file
diff --git a/doc/manual/source/protocols/nix-archive.md b/doc/manual/source/protocols/nix-archive.md
index 640b527f1..02a8dd464 100644
--- a/doc/manual/source/protocols/nix-archive.md
+++ b/doc/manual/source/protocols/nix-archive.md
@@ -24,7 +24,7 @@ nar-obj-inner
   | str("type"), str("directory") directory
   ;
 
-regular = [ str("executable"), str("") ], str("contents"), str(contents);
+regular = [ str("executable") ], str("contents"), str(contents);
 
 symlink = str("target"), str(target);
 
diff --git a/doc/manual/source/release-notes/rl-2.31.md b/doc/manual/source/release-notes/rl-2.31.md
new file mode 100644
index 000000000..8b9d44c83
--- /dev/null
+++ b/doc/manual/source/release-notes/rl-2.31.md
@@ -0,0 +1,96 @@
+# Release 2.31.0 (2025-08-21)
+
+- `build-cores = 0` now auto-detects CPU cores [#13402](https://github.com/NixOS/nix/pull/13402)
+
+  When `build-cores` is set to `0`, Nix now automatically detects the number of available CPU cores and passes this value via `NIX_BUILD_CORES`, instead of passing `0` directly. This matches the behavior when `build-cores` is unset. This prevents the builder from having to detect the number of cores.
+
+- Fix Git LFS SSH issues [#13337](https://github.com/NixOS/nix/issues/13337) [#13743](https://github.com/NixOS/nix/pull/13743)
+
+  Fixed some outstanding issues with Git LFS and SSH.
+
+  * Added support for `NIX_SSHOPTS`.
+  * Properly use the parsed port from URL.
+  * Better use of the response of `git-lfs-authenticate` to determine API endpoint when the API is not exposed on port 443.
+
+- Add support for `user@address:port` syntax in store URIs [#7044](https://github.com/NixOS/nix/issues/7044) [#3425](https://github.com/NixOS/nix/pull/3425)
+
+  It's now possible to specify the port used for SSH stores directly in the store URL in accordance with [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986). Previously the only way to specify custom ports was via `ssh_config` or the `NIX_SSHOPTS` environment variable, because Nix incorrectly passed the port number together with the host name to the SSH executable.
+
+  This change affects [store references](@docroot@/store/types/index.md#store-url-format) passed via the `--store` and similar flags in CLI as well as in the configuration for [remote builders](@docroot@/command-ref/conf-file.md#conf-builders). For example, the following store URIs now work:
+
+  - `ssh://127.0.0.1:2222`
+  - `ssh://[b573:6a48:e224:840b:6007:6275:f8f7:ebf3]:22`
+  - `ssh-ng://[b573:6a48:e224:840b:6007:6275:f8f7:ebf3]:22`
+
+- Represent IPv6 RFC4007 ZoneId literals in conformance with RFC6874 [#13445](https://github.com/NixOS/nix/pull/13445)
+
+  Prior versions of Nix since [#4646](https://github.com/NixOS/nix/pull/4646) accepted [IPv6 scoped addresses](https://datatracker.ietf.org/doc/html/rfc4007) in URIs like [store references](@docroot@/store/types/index.md#store-url-format) in the textual representation with a literal percent character: `[fe80::1%18]`. This was ambiguous, because the the percent literal `%` is reserved by [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986), since it's used to indicate percent encoding. Nix now requires that the percent `%` symbol is percent-encoded as `%25`. This implements [RFC6874](https://datatracker.ietf.org/doc/html/rfc6874), which defines the representation of zone identifiers in URIs. The example from above now has to be specified as `[fe80::1%2518]`.
+
+- Use WAL mode for SQLite cache databases [#13800](https://github.com/NixOS/nix/pull/13800)
+
+  Previously, Nix used SQLite's "truncate" mode for caches. However, this could cause a Nix process to block if another process was updating the cache. This was a problem for the flake evaluation cache in particular, since it uses long-running transactions. Thus, concurrent Nix commands operating on the same flake could be blocked for an unbounded amount of time. WAL mode avoids this problem.
+
+  This change required updating the versions of the SQLite caches. For instance, `eval-cache-v5.sqlite` is now `eval-cache-v6.sqlite`.
+
+- Enable parallel marking in bdwgc [#13708](https://github.com/NixOS/nix/pull/13708)
+
+  Previously marking was done by only one thread, which takes a long time if the heap gets big. Enabling parallel marking speeds up evaluation a lot, for example (on a Ryzen 9 5900X 12-Core):
+
+  * `nix search nixpkgs` from 24.3s to 18.9s.
+  * Evaluating the `NixOS/nix/2.21.2` flake regression test from 86.1s to 71.2s.
+
+- New command `nix flake prefetch-inputs` [#13565](https://github.com/NixOS/nix/pull/13565)
+
+  This command fetches all inputs of a flake in parallel. This can be a lot faster than the serialized on-demand fetching during regular flake evaluation. The downside is that it may fetch inputs that aren't normally used.
+
+- Add `warn-short-path-literals` setting [#13489](https://github.com/NixOS/nix/pull/13489)
+
+  This setting, when enabled, causes Nix to emit warnings when encountering relative path literals that don't start with `.` or `/`, for instance suggesting that `foo/bar` should be rewritten to `./foo/bar`.
+
+- When updating a lock, respect the input's lock file [#13437](https://github.com/NixOS/nix/pull/13437)
+
+  For example, if a flake has a lock for `a` and `a/b`, and we change the flakeref for `a`, previously Nix would fetch the latest version of `b` rather than using the lock for `b` from `a`.
+
+- Implement support for Git hashing with SHA-256 [#13543](https://github.com/NixOS/nix/pull/13543)
+
+  The experimental support for [Git-hashing](@docroot@/development/experimental-features.md#xp-feature-git-hashing) store objects now also includes support for SHA-256, not just SHA-1, in line with upstream Git.
+
+## Contributors
+
+This release was made possible by the following 34 contributors:
+
+- John Soo [**(@jsoo1)**](https://github.com/jsoo1)
+- Alan Urmancheev [**(@alurm)**](https://github.com/alurm)
+- Manse [**(@PedroManse)**](https://github.com/PedroManse)
+- Pol Dellaiera [**(@drupol)**](https://github.com/drupol)
+- DavHau [**(@DavHau)**](https://github.com/DavHau)
+- Leandro Emmanuel Reina Kiperman [**(@kip93)**](https://github.com/kip93)
+- h0nIg [**(@h0nIg)**](https://github.com/h0nIg)
+- Philip Taron [**(@philiptaron)**](https://github.com/philiptaron)
+- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
+- Connor Baker [**(@ConnorBaker)**](https://github.com/ConnorBaker)
+- kenji [**(@a-kenji)**](https://github.com/a-kenji)
+- Oleksandr Knyshuk [**(@k1gen)**](https://github.com/k1gen)
+- Maciej Krüger [**(@mkg20001)**](https://github.com/mkg20001)
+- Justin Bailey [**(@jgbailey-well)**](https://github.com/jgbailey-well)
+- Emily [**(@emilazy)**](https://github.com/emilazy)
+- Volker Diels-Grabsch [**(@vog)**](https://github.com/vog)
+- gustavderdrache [**(@gustavderdrache)**](https://github.com/gustavderdrache)
+- Elliot Cameron [**(@de11n)**](https://github.com/de11n)
+- Alexander V. Nikolaev [**(@avnik)**](https://github.com/avnik)
+- tomberek [**(@tomberek)**](https://github.com/tomberek)
+- Matthew Kenigsberg [**(@mkenigs)**](https://github.com/mkenigs)
+- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
+- Cosima Neidahl [**(@OPNA2608)**](https://github.com/OPNA2608)
+- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
+- m4dc4p [**(@m4dc4p)**](https://github.com/m4dc4p)
+- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
+- Jason Yundt [**(@Jayman2000)**](https://github.com/Jayman2000)
+- Jens Petersen [**(@juhp)**](https://github.com/juhp)
+- the-sun-will-rise-tomorrow [**(@the-sun-will-rise-tomorrow)**](https://github.com/the-sun-will-rise-tomorrow)
+- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
+- AGawas [**(@aln730)**](https://github.com/aln730)
+- Robert Hensing [**(@roberth)**](https://github.com/roberth)
+- Dmitry Bogatov [**(@KAction)**](https://github.com/KAction)
+- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
+- Philipp Otterbein
diff --git a/doc/manual/source/release-notes/rl-2.8.md b/doc/manual/source/release-notes/rl-2.8.md
index 9778e8c3a..686445208 100644
--- a/doc/manual/source/release-notes/rl-2.8.md
+++ b/doc/manual/source/release-notes/rl-2.8.md
@@ -48,6 +48,6 @@
 
 * `nix run` is now stricter in what it accepts: members of the `apps`
   flake output are now required to be apps (as defined in [the
-  manual](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-run.html#apps)),
+  manual](https://nix.dev/manual/nix/stable/command-ref/new-cli/nix3-run.html#apps)),
   and members of `packages` or `legacyPackages` must be derivations
   (not apps).
diff --git a/doc/manual/source/store/derivation/index.md b/doc/manual/source/store/derivation/index.md
index 1687ad8c0..0e12b4d5e 100644
--- a/doc/manual/source/store/derivation/index.md
+++ b/doc/manual/source/store/derivation/index.md
@@ -9,7 +9,7 @@ This is where Nix distinguishes itself.
 
 ## Store Derivation {#store-derivation}
 
-A derivation is a specification for running an executable on precisely defined input to produce on more [store objects][store object].
+A derivation is a specification for running an executable on precisely defined input to produce one or more [store objects][store object].
 These store objects are known as the derivation's *outputs*.
 
 Derivations are *built*, in which case the process is spawned according to the spec, and when it exits, required to leave behind files which will (after post-processing) become the outputs of the derivation.
diff --git a/doc/manual/source/store/meson.build b/doc/manual/source/store/meson.build
index e3006020d..ec4659ebc 100644
--- a/doc/manual/source/store/meson.build
+++ b/doc/manual/source/store/meson.build
@@ -1,12 +1,6 @@
 types_dir = custom_target(
-  command : [
-    python.full_path(),
-    '@INPUT0@',
-    '@OUTPUT@',
-    '--'
-  ] + nix_eval_for_docs + [
-    '--expr',
-    'import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)).stores',
+  command : [ python.full_path(), '@INPUT0@', '@OUTPUT@', '--' ] + nix_eval_for_docs + [
+    '--expr', 'import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)).stores',
   ],
   input : [
     '../../remove_before_wrapper.py',
diff --git a/doc/manual/source/store/store-object.md b/doc/manual/source/store/store-object.md
index 10c2384fa..71ec772fb 100644
--- a/doc/manual/source/store/store-object.md
+++ b/doc/manual/source/store/store-object.md
@@ -20,7 +20,8 @@ The graph of references excluding self-references thus forms a [directed acyclic
 
 [directed acyclic graph]: @docroot@/glossary.md#gloss-directed-acyclic-graph
 
-We can take the [transitive closure] of the references graph, which any pair of store objects have an edge not if there is a single reference from the first to the second, but a path of one or more references from the first to the second.
+We can take the [transitive closure] of the references graph, in which any pair of store objects have an edge if a *path* of one or more references exists from the first to the second object.
+(A single reference always forms a path which is one reference long, but longer paths may connect objects which have no direct reference between them.)
 The *requisites* of a store object are all store objects reachable by paths of references which start with given store object's references.
 
 [transitive closure]: https://en.wikipedia.org/wiki/Transitive_closure
diff --git a/docker.nix b/docker.nix
index c6e8e478e..9dbc34d61 100644
--- a/docker.nix
+++ b/docker.nix
@@ -1,10 +1,10 @@
 {
   # Core dependencies
-  pkgs,
-  lib,
-  dockerTools,
-  runCommand,
-  buildPackages,
+  pkgs ? import <nixpkgs> { },
+  lib ? pkgs.lib,
+  dockerTools ? pkgs.dockerTools,
+  runCommand ? pkgs.runCommand,
+  buildPackages ? pkgs.buildPackages,
   # Image configuration
   name ? "nix",
   tag ? "latest",
@@ -28,24 +28,24 @@
   },
   Cmd ? [ (lib.getExe bashInteractive) ],
   # Default Packages
-  nix,
-  bashInteractive,
-  coreutils-full,
-  gnutar,
-  gzip,
-  gnugrep,
-  which,
-  curl,
-  less,
-  wget,
-  man,
-  cacert,
-  findutils,
-  iana-etc,
-  gitMinimal,
-  openssh,
+  nix ? pkgs.nix,
+  bashInteractive ? pkgs.bashInteractive,
+  coreutils-full ? pkgs.coreutils-full,
+  gnutar ? pkgs.gnutar,
+  gzip ? pkgs.gzip,
+  gnugrep ? pkgs.gnugrep,
+  which ? pkgs.which,
+  curl ? pkgs.curl,
+  less ? pkgs.less,
+  wget ? pkgs.wget,
+  man ? pkgs.man,
+  cacert ? pkgs.cacert,
+  findutils ? pkgs.findutils,
+  iana-etc ? pkgs.iana-etc,
+  gitMinimal ? pkgs.gitMinimal,
+  openssh ? pkgs.openssh,
   # Other dependencies
-  shadow,
+  shadow ? pkgs.shadow,
 }:
 let
   defaultPkgs = [
@@ -65,62 +65,61 @@ let
     iana-etc
     gitMinimal
     openssh
-  ] ++ extraPkgs;
+  ]
+  ++ extraPkgs;
 
-  users =
-    {
+  users = {
 
-      root = {
-        uid = 0;
-        shell = lib.getExe bashInteractive;
-        home = "/root";
-        gid = 0;
-        groups = [ "root" ];
-        description = "System administrator";
-      };
-
-      nobody = {
-        uid = 65534;
-        shell = lib.getExe' shadow "nologin";
-        home = "/var/empty";
-        gid = 65534;
-        groups = [ "nobody" ];
-        description = "Unprivileged account (don't use!)";
-      };
-
-    }
-    // lib.optionalAttrs (uid != 0) {
-      "${uname}" = {
-        uid = uid;
-        shell = lib.getExe bashInteractive;
-        home = "/home/${uname}";
-        gid = gid;
-        groups = [ "${gname}" ];
-        description = "Nix user";
-      };
-    }
-    // lib.listToAttrs (
-      map (n: {
-        name = "nixbld${toString n}";
-        value = {
-          uid = 30000 + n;
-          gid = 30000;
-          groups = [ "nixbld" ];
-          description = "Nix build user ${toString n}";
-        };
-      }) (lib.lists.range 1 32)
-    );
-
-  groups =
-    {
-      root.gid = 0;
-      nixbld.gid = 30000;
-      nobody.gid = 65534;
-    }
-    // lib.optionalAttrs (gid != 0) {
-      "${gname}".gid = gid;
+    root = {
+      uid = 0;
+      shell = lib.getExe bashInteractive;
+      home = "/root";
+      gid = 0;
+      groups = [ "root" ];
+      description = "System administrator";
     };
 
+    nobody = {
+      uid = 65534;
+      shell = lib.getExe' shadow "nologin";
+      home = "/var/empty";
+      gid = 65534;
+      groups = [ "nobody" ];
+      description = "Unprivileged account (don't use!)";
+    };
+
+  }
+  // lib.optionalAttrs (uid != 0) {
+    "${uname}" = {
+      uid = uid;
+      shell = lib.getExe bashInteractive;
+      home = "/home/${uname}";
+      gid = gid;
+      groups = [ "${gname}" ];
+      description = "Nix user";
+    };
+  }
+  // lib.listToAttrs (
+    map (n: {
+      name = "nixbld${toString n}";
+      value = {
+        uid = 30000 + n;
+        gid = 30000;
+        groups = [ "nixbld" ];
+        description = "Nix build user ${toString n}";
+      };
+    }) (lib.lists.range 1 32)
+  );
+
+  groups = {
+    root.gid = 0;
+    nixbld.gid = 30000;
+    nobody.gid = 65534;
+  }
+  // lib.optionalAttrs (gid != 0) {
+    "${gname}".gid = gid;
+  };
+
   userToPasswd = (
     k:
     {
@@ -184,11 +183,14 @@ let
       } " = ";
     };
 
-  nixConfContents = toConf {
-    sandbox = false;
-    build-users-group = "nixbld";
-    trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
-  };
+  nixConfContents = toConf (
+    {
+      sandbox = false;
+      build-users-group = "nixbld";
+      trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
+    }
+    // nixConf
+  );
 
   userHome = if uid == 0 then "/root" else "/home/${uname}";
 
@@ -279,7 +281,10 @@ let
 
           # may get replaced by pkgs.dockerTools.caCertificates
           mkdir -p $out/etc/ssl/certs
+          # Old NixOS compatibility.
           ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
+          # NixOS canonical location
+          ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-certificates.crt
 
           cat $passwdContentsPath > $out/etc/passwd
           echo "" >> $out/etc/passwd
@@ -308,6 +313,7 @@ let
           # see doc/manual/source/command-ref/files/profiles.md
           ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
           ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
+          ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile
 
           # see doc/manual/source/command-ref/files/channels.md
           ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
diff --git a/flake.lock b/flake.lock
index 3075eabc2..cc2b2f27e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -63,16 +63,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747179050,
-        "narHash": "sha256-qhFMmDkeJX9KJwr5H32f1r7Prs7XbQWtO0h3V0a0rFY=",
+        "lastModified": 1756178832,
+        "narHash": "sha256-O2CIn7HjZwEGqBrwu9EU76zlmA5dbmna7jL1XUmAId8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "adaa24fbf46737f3f1b5497bf64bae750f82942e",
+        "rev": "d98ce345cdab58477ca61855540999c86577d19d",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.05-small",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 69bd2a21a..fd623c807 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,7 @@
 {
   description = "The purely functional package manager";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small";
 
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
@@ -131,31 +131,107 @@
         }
       );
 
-      overlayFor =
-        getStdenv: final: prev:
+      /**
+        Produce the `nixComponents` and `nixDependencies` package sets (scopes) for
+        a given `pkgs` and `getStdenv`.
+      */
+      packageSetsFor =
         let
-          stdenv = getStdenv final;
+          /**
+            Removes a prefix from the attribute names of a set of splices.
+            This is a completely uninteresting and exists for compatibility only.
+
+            Example:
+            ```nix
+            renameSplicesFrom "pkgs" { pkgsBuildBuild = ...; ... }
+            => { buildBuild = ...; ... }
+            ```
+          */
+          renameSplicesFrom = prefix: x: {
+            buildBuild = x."${prefix}BuildBuild";
+            buildHost = x."${prefix}BuildHost";
+            buildTarget = x."${prefix}BuildTarget";
+            hostHost = x."${prefix}HostHost";
+            hostTarget = x."${prefix}HostTarget";
+            targetTarget = x."${prefix}TargetTarget";
+          };
+
+          /**
+            Adds a prefix to the attribute names of a set of splices.
+            This is a completely uninteresting and exists for compatibility only.
+
+            Example:
+            ```nix
+            renameSplicesTo "self" { buildBuild = ...; ... }
+            => { selfBuildBuild = ...; ... }
+            ```
+          */
+          renameSplicesTo = prefix: x: {
+            "${prefix}BuildBuild" = x.buildBuild;
+            "${prefix}BuildHost" = x.buildHost;
+            "${prefix}BuildTarget" = x.buildTarget;
+            "${prefix}HostHost" = x.hostHost;
+            "${prefix}HostTarget" = x.hostTarget;
+            "${prefix}TargetTarget" = x.targetTarget;
+          };
+
+          /**
+            Takes a function `f` and returns a function that applies `f` pointwise to each splice.
+
+            Example:
+            ```nix
+            mapSplices (x: x * 10) { buildBuild = 1; buildHost = 2; ... }
+            => { buildBuild = 10; buildHost = 20; ... }
+            ```
+          */
+          mapSplices =
+            f:
+            {
+              buildBuild,
+              buildHost,
+              buildTarget,
+              hostHost,
+              hostTarget,
+              targetTarget,
+            }:
+            {
+              buildBuild = f buildBuild;
+              buildHost = f buildHost;
+              buildTarget = f buildTarget;
+              hostHost = f hostHost;
+              hostTarget = f hostTarget;
+              targetTarget = f targetTarget;
+            };
+
         in
-        {
-          nixStable = prev.nix;
+        args@{
+          pkgs,
+          getStdenv ? pkgs: pkgs.stdenv,
+        }:
+        let
+          nixComponentsSplices = mapSplices (
+            pkgs': (packageSetsFor (args // { pkgs = pkgs'; })).nixComponents
+          ) (renameSplicesFrom "pkgs" pkgs);
+          nixDependenciesSplices = mapSplices (
+            pkgs': (packageSetsFor (args // { pkgs = pkgs'; })).nixDependencies
+          ) (renameSplicesFrom "pkgs" pkgs);
 
           # A new scope, so that we can use `callPackage` to inject our own interdependencies
           # without "polluting" the top level "`pkgs`" attrset.
           # This also has the benefit of providing us with a distinct set of packages
           # we can iterate over.
-          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
-          nixComponents2 =
+          nixComponents =
             lib.makeScopeWithSplicing'
               {
-                inherit (final) splicePackages;
-                inherit (final.nixDependencies2) newScope;
+                inherit (pkgs) splicePackages;
+                inherit (nixDependencies) newScope;
               }
               {
-                otherSplices = final.generateSplicesForMkScope "nixComponents2";
+                otherSplices = renameSplicesTo "self" nixComponentsSplices;
                 f = import ./packaging/components.nix {
-                  inherit (final) lib;
+                  inherit (pkgs) lib;
                   inherit officialRelease;
-                  pkgs = final;
+                  inherit pkgs;
                   src = self;
                   maintainers = [ ];
                 };
@@ -163,29 +239,71 @@
 
           # The dependencies are in their own scope, so that they don't have to be
           # in Nixpkgs top level `pkgs` or `nixComponents2`.
-          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
-          nixDependencies2 =
+          nixDependencies =
             lib.makeScopeWithSplicing'
               {
-                inherit (final) splicePackages;
-                inherit (final) newScope; # layered directly on pkgs, unlike nixComponents2 above
+                inherit (pkgs) splicePackages;
+                inherit (pkgs) newScope; # layered directly on pkgs, unlike nixComponents2 above
               }
               {
-                otherSplices = final.generateSplicesForMkScope "nixDependencies2";
+                otherSplices = renameSplicesTo "self" nixDependenciesSplices;
                 f = import ./packaging/dependencies.nix {
-                  inherit inputs stdenv;
-                  pkgs = final;
+                  inherit inputs pkgs;
+                  stdenv = getStdenv pkgs;
                 };
               };
 
+          # If the package set is largely empty, we should(?) return empty sets
+          # This is what most package sets in Nixpkgs do. Otherwise, we get
+          # an error message that indicates that some stdenv attribute is missing,
+          # and indeed it will be missing, as seemingly `pkgsTargetTarget` is
+          # very incomplete.
+          fixup = lib.mapAttrs (k: v: if !(pkgs ? nix) then { } else v);
+        in
+        fixup {
+          inherit nixDependencies;
+          inherit nixComponents;
+        };
+
+      overlayFor =
+        getStdenv: final: prev:
+        let
+          packageSets = packageSetsFor {
+            inherit getStdenv;
+            pkgs = final;
+          };
+        in
+        {
+          nixStable = prev.nix;
+
+          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
+          nixComponents2 = packageSets.nixComponents;
+
+          # The dependencies are in their own scope, so that they don't have to be
+          # in Nixpkgs top level `pkgs` or `nixComponents2`.
+          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
+          nixDependencies2 = packageSets.nixDependencies;
+
           nix = final.nixComponents2.nix-cli;
         };
 
     in
     {
-      # A Nixpkgs overlay that overrides the 'nix' and
-      # 'nix-perl-bindings' packages.
-      overlays.default = overlayFor (p: p.stdenv);
+      overlays.internal = overlayFor (p: p.stdenv);
+
+      /**
+        A Nixpkgs overlay that sets `nix` to something like `packages.<system>.nix-everything`,
+        except dependencies aren't taken from (flake) `nix.inputs.nixpkgs`, but from the Nixpkgs packages
+        where the overlay is used.
+      */
+      overlays.default =
+        final: prev:
+        let
+          packageSets = packageSetsFor { pkgs = final; };
+        in
+        {
+          nix = packageSets.nixComponents.nix-everything;
+        };
 
       hydraJobs = import ./packaging/hydra.nix {
         inherit
@@ -202,43 +320,11 @@
 
       checks = forAllSystems (
         system:
-        {
-          installerScriptForGHA = self.hydraJobs.installerScriptForGHA.${system};
-          installTests = self.hydraJobs.installTests.${system};
-          nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
-          rl-next =
-            let
-              pkgs = nixpkgsFor.${system}.native;
-            in
-            pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
-              LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${./doc/manual/rl-next} >$out
-            '';
-          repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
-
-          /**
-            Checks for our packaging expressions.
-            This shouldn't build anything significant; just check that things
-            (including derivations) are _set up_ correctly.
-          */
-          packaging-overriding =
-            let
-              pkgs = nixpkgsFor.${system}.native;
-              nix = self.packages.${system}.nix;
-            in
-            assert (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src.patches == [ pkgs.emptyFile ];
-            if pkgs.stdenv.buildPlatform.isDarwin then
-              lib.warn "packaging-overriding check currently disabled because of a permissions issue on macOS" pkgs.emptyFile
-            else
-              # If this fails, something might be wrong with how we've wired the scope,
-              # or something could be broken in Nixpkgs.
-              pkgs.testers.testEqualContents {
-                assertion = "trivial patch does not change source contents";
-                expected = "${./.}";
-                actual =
-                  # Same for all components; nix-util is an arbitrary pick
-                  (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src;
-              };
-        }
+        (import ./ci/gha/tests {
+          inherit system;
+          pkgs = nixpkgsFor.${system}.native;
+          nixFlake = self;
+        }).topLevel
         // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
           dockerImage = self.hydraJobs.dockerImage.${system};
         }
@@ -251,58 +337,20 @@
         # Add "passthru" tests
         //
           flatMapAttrs
+            {
+              "" = {
+                pkgs = nixpkgsFor.${system}.native;
+              };
+            }
             (
-              {
-                # Run all tests with UBSAN enabled. Running both with ubsan and
-                # without doesn't seem to have much immediate benefit for doubling
-                # the GHA CI workaround.
-                #
-                # TODO: Work toward enabling "address,undefined" if it seems feasible.
-                # This would maybe require dropping Boost coroutines and ignoring intentional
-                # memory leaks with detect_leaks=0.
-                "" = rec {
-                  nixpkgs = nixpkgsFor.${system}.native;
-                  nixComponents = nixpkgs.nixComponents2.overrideScope (
-                    nixCompFinal: nixCompPrev: {
-                      mesonComponentOverrides = _finalAttrs: prevAttrs: {
-                        mesonFlags =
-                          (prevAttrs.mesonFlags or [ ])
-                          # TODO: Macos builds instrumented with ubsan take very long
-                          # to run functional tests.
-                          ++ lib.optionals (!nixpkgs.stdenv.hostPlatform.isDarwin) [
-                            (lib.mesonOption "b_sanitize" "undefined")
-                          ];
-                      };
-                    }
-                  );
-                };
-              }
-              // lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.hostPlatform.isDarwin) {
-                # TODO: enable static builds for darwin, blocked on:
-                #       https://github.com/NixOS/nixpkgs/issues/320448
-                # TODO: disabled to speed up GHA CI.
-                # "static-" = {
-                #   nixpkgs = nixpkgsFor.${system}.native.pkgsStatic;
-                # };
-              }
-            )
-            (
-              nixpkgsPrefix:
-              {
-                nixpkgs,
-                nixComponents ? nixpkgs.nixComponents2,
-              }:
-              flatMapAttrs nixComponents (
-                pkgName: pkg:
-                flatMapAttrs pkg.tests or { } (
-                  testName: test: {
-                    "${nixpkgsPrefix}${pkgName}-${testName}" = test;
-                  }
-                )
-              )
-              // lib.optionalAttrs (nixpkgs.stdenv.hostPlatform == nixpkgs.stdenv.buildPlatform) {
-                "${nixpkgsPrefix}nix-functional-tests" = nixComponents.nix-functional-tests;
-              }
+              nixpkgsPrefix: args:
+              (import ./ci/gha/tests (
+                args
+                // {
+                  nixFlake = self;
+                  componentTestsPrefix = nixpkgsPrefix;
+                }
+              )).componentTests
             )
         // devFlake.checks.${system} or { }
       );
@@ -465,5 +513,53 @@
             default = self.devShells.${system}.native;
           }
         );
+
+      lib = {
+        /**
+          Creates a package set for a given Nixpkgs instance and stdenv.
+
+          # Inputs
+
+          - `pkgs`: The Nixpkgs instance to use.
+
+          - `getStdenv`: _Optional_ A function that takes a package set and returns the stdenv to use.
+            This needs to be a function in order to support cross compilation - the `pkgs` passed to `getStdenv` can be `pkgsBuildHost` or any other variation needed.
+
+          # Outputs
+
+          The return value is a fresh Nixpkgs scope containing all the packages that are defined in the Nix repository,
+          as well as some internals and parameters, which may be subject to change.
+
+          # Example
+
+          ```console
+          nix repl> :lf NixOS/nix
+          nix-repl> ps = lib.makeComponents { pkgs = import inputs.nixpkgs { crossSystem = "riscv64-linux"; }; }
+          nix-repl> ps
+          {
+            appendPatches = «lambda appendPatches @ ...»;
+            callPackage = «lambda callPackageWith @ ...»;
+            overrideAllMesonComponents = «lambda overrideSource @ ...»;
+            overrideSource = «lambda overrideSource @ ...»;
+            # ...
+            nix-everything
+            # ...
+            nix-store
+            nix-store-c
+            # ...
+          }
+          ```
+        */
+        makeComponents =
+          {
+            pkgs,
+            getStdenv ? pkgs: pkgs.stdenv,
+          }:
+
+          let
+            packageSets = packageSetsFor { inherit getStdenv pkgs; };
+          in
+          packageSets.nixComponents;
+      };
     };
 }
diff --git a/maintainers/README.md b/maintainers/README.md
index 6553cd048..722a920b7 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -46,7 +46,7 @@ The team meets twice a week (times are denoted in the [Europe/Amsterdam](https:/
        - mark it as draft if it is blocked on the contributor
        - escalate it back to the team by moving it to To discuss, and leaving a comment as to why the issue needs to be discussed again.
 
-- Work meeting: Mondays 14:00-16:00 Europe/Amsterdam see [calendar](https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com).
+- Work meeting: Mondays 18:00-20:00 Europe/Amsterdam; see [calendar](https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com).
 
   1. Code review on pull requests from [In review](#in-review).
   2. Other chores and tasks.
diff --git a/maintainers/data/release-credits-email-to-handle.json b/maintainers/data/release-credits-email-to-handle.json
index 48e8685e6..ea37afb90 100644
--- a/maintainers/data/release-credits-email-to-handle.json
+++ b/maintainers/data/release-credits-email-to-handle.json
@@ -185,5 +185,23 @@
     "gwenn.lebihan7@gmail.com": "gwennlbh",
     "hey@ewen.works": "gwennlbh",
     "matt@sturgeon.me.uk": "MattSturgeon",
-    "pbsds@hotmail.com": "pbsds"
+    "pbsds@hotmail.com": "pbsds",
+    "sergei@zimmerman.foo": "xokdvium",
+    "v@njh.eu": "vog",
+    "pedro.manse@dmk3.com.br": "PedroManse",
+    "arnavgawas707@gmail.com": "aln730",
+    "mkg20001@gmail.com": "mkg20001",
+    "avn@avnik.info": "avnik",
+    "olk@disr.it": "k1gen",
+    "108410815+alurm@users.noreply.github.com": "alurm",
+    "kaction.cc@gmail.com": "KAction",
+    "juhpetersen@gmail.com": "juhp",
+    "opna2608@protonmail.com": "OPNA2608",
+    "jgbailey@gmail.com": "m4dc4p",
+    "justin.bailey@well.co": "jgbailey-well",
+    "130508846+de11n@users.noreply.github.com": "de11n",
+    "ConnorBaker01@Gmail.com": "ConnorBaker",
+    "jsoo1@asu.edu": "jsoo1",
+    "hsngrmpf+github@gmail.com": "DavHau",
+    "matthew@floxdev.com": "mkenigs"
 }
\ No newline at end of file
diff --git a/maintainers/data/release-credits-handle-to-name.json b/maintainers/data/release-credits-handle-to-name.json
index a6352c44b..e2510548d 100644
--- a/maintainers/data/release-credits-handle-to-name.json
+++ b/maintainers/data/release-credits-handle-to-name.json
@@ -162,5 +162,20 @@
     "pbsds": "Peder Bergebakken Sundt",
     "egorkonovalov": "Egor Konovalov",
     "jayeshv": "jayeshv",
-    "vcunat": "Vladim\u00edr \u010cun\u00e1t"
+    "vcunat": "Vladim\u00edr \u010cun\u00e1t",
+    "mkenigs": "Matthew Kenigsberg",
+    "alurm": "Alan Urmancheev",
+    "jgbailey-well": "Justin Bailey",
+    "k1gen": "Oleksandr Knyshuk",
+    "juhp": "Jens Petersen",
+    "de11n": "Elliot Cameron",
+    "jsoo1": "John Soo",
+    "m4dc4p": null,
+    "PedroManse": "Manse",
+    "OPNA2608": "Cosima Neidahl",
+    "mkg20001": "Maciej Kr\u00fcger",
+    "avnik": "Alexander V. Nikolaev",
+    "DavHau": null,
+    "aln730": "AGawas",
+    "vog": "Volker Diels-Grabsch"
 }
\ No newline at end of file
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 1058d6334..4815313dd 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -37,118 +37,29 @@
               fi
             ''}";
           };
-          meson-format = {
-            enable = true;
-            files = "(meson.build|meson.options)$";
-            entry = "${pkgs.writeScript "format-meson" ''
-              #!${pkgs.runtimeShell}
-              for file in "$@"; do
-                ${lib.getExe pkgs.meson} format -ic ${../meson.format} "$file"
-              done
-            ''}";
-            excludes = [
-              # We haven't applied formatting to these files yet
-              ''^doc/manual/meson.build$''
-              ''^doc/manual/source/command-ref/meson.build$''
-              ''^doc/manual/source/development/meson.build$''
-              ''^doc/manual/source/language/meson.build$''
-              ''^doc/manual/source/meson.build$''
-              ''^doc/manual/source/release-notes/meson.build$''
-              ''^doc/manual/source/store/meson.build$''
-              ''^misc/bash/meson.build$''
-              ''^misc/fish/meson.build$''
-              ''^misc/launchd/meson.build$''
-              ''^misc/meson.build$''
-              ''^misc/systemd/meson.build$''
-              ''^misc/zsh/meson.build$''
-              ''^nix-meson-build-support/$''
-              ''^nix-meson-build-support/big-objs/meson.build$''
-              ''^nix-meson-build-support/common/meson.build$''
-              ''^nix-meson-build-support/deps-lists/meson.build$''
-              ''^nix-meson-build-support/export/meson.build$''
-              ''^nix-meson-build-support/export-all-symbols/meson.build$''
-              ''^nix-meson-build-support/generate-header/meson.build$''
-              ''^nix-meson-build-support/libatomic/meson.build$''
-              ''^nix-meson-build-support/subprojects/meson.build$''
-              ''^scripts/meson.build$''
-              ''^src/external-api-docs/meson.build$''
-              ''^src/internal-api-docs/meson.build$''
-              ''^src/libcmd/include/nix/cmd/meson.build$''
-              ''^src/libcmd/meson.build$''
-              ''^src/libcmd/nix-meson-build-support$''
-              ''^src/libexpr/include/nix/expr/meson.build$''
-              ''^src/libexpr/meson.build$''
-              ''^src/libexpr/nix-meson-build-support$''
-              ''^src/libexpr-c/meson.build$''
-              ''^src/libexpr-c/nix-meson-build-support$''
-              ''^src/libexpr-test-support/meson.build$''
-              ''^src/libexpr-test-support/nix-meson-build-support$''
-              ''^src/libexpr-tests/meson.build$''
-              ''^src/libexpr-tests/nix-meson-build-support$''
-              ''^src/libfetchers/include/nix/fetchers/meson.build$''
-              ''^src/libfetchers/meson.build$''
-              ''^src/libfetchers/nix-meson-build-support$''
-              ''^src/libfetchers-c/meson.build$''
-              ''^src/libfetchers-c/nix-meson-build-support$''
-              ''^src/libfetchers-tests/meson.build$''
-              ''^src/libfetchers-tests/nix-meson-build-support$''
-              ''^src/libflake/include/nix/flake/meson.build$''
-              ''^src/libflake/meson.build$''
-              ''^src/libflake/nix-meson-build-support$''
-              ''^src/libflake-c/meson.build$''
-              ''^src/libflake-c/nix-meson-build-support$''
-              ''^src/libflake-tests/meson.build$''
-              ''^src/libflake-tests/nix-meson-build-support$''
-              ''^src/libmain/include/nix/main/meson.build$''
-              ''^src/libmain/meson.build$''
-              ''^src/libmain/nix-meson-build-support$''
-              ''^src/libmain-c/meson.build$''
-              ''^src/libmain-c/nix-meson-build-support$''
-              ''^src/libstore/include/nix/store/meson.build$''
-              ''^src/libstore/meson.build$''
-              ''^src/libstore/nix-meson-build-support$''
-              ''^src/libstore/unix/include/nix/store/meson.build$''
-              ''^src/libstore/unix/meson.build$''
-              ''^src/libstore/windows/meson.build$''
-              ''^src/libstore-c/meson.build$''
-              ''^src/libstore-c/nix-meson-build-support$''
-              ''^src/libstore-test-support/include/nix/store/tests/meson.build$''
-              ''^src/libstore-test-support/meson.build$''
-              ''^src/libstore-test-support/nix-meson-build-support$''
-              ''^src/libstore-tests/meson.build$''
-              ''^src/libstore-tests/nix-meson-build-support$''
-              ''^src/libutil/meson.build$''
-              ''^src/libutil/nix-meson-build-support$''
-              ''^src/libutil/unix/include/nix/util/meson.build$''
-              ''^src/libutil/unix/meson.build$''
-              ''^src/libutil/windows/meson.build$''
-              ''^src/libutil-c/meson.build$''
-              ''^src/libutil-c/nix-meson-build-support$''
-              ''^src/libutil-test-support/include/nix/util/tests/meson.build$''
-              ''^src/libutil-test-support/meson.build$''
-              ''^src/libutil-test-support/nix-meson-build-support$''
-              ''^src/libutil-tests/meson.build$''
-              ''^src/libutil-tests/nix-meson-build-support$''
-              ''^src/nix/meson.build$''
-              ''^src/nix/nix-meson-build-support$''
-              ''^src/perl/lib/Nix/meson.build$''
-              ''^src/perl/meson.build$''
-              ''^tests/functional/ca/meson.build$''
-              ''^tests/functional/common/meson.build$''
-              ''^tests/functional/dyn-drv/meson.build$''
-              ''^tests/functional/flakes/meson.build$''
-              ''^tests/functional/git-hashing/meson.build$''
-              ''^tests/functional/local-overlay-store/meson.build$''
-              ''^tests/functional/meson.build$''
-              ''^src/libcmd/meson.options$''
-              ''^src/libexpr/meson.options$''
-              ''^src/libstore/meson.options$''
-              ''^src/libutil/meson.options$''
-              ''^src/libutil-c/meson.options$''
-              ''^src/nix/meson.options$''
-              ''^src/perl/meson.options$''
-            ];
-          };
+          meson-format =
+            let
+              meson = pkgs.meson.overrideAttrs {
+                doCheck = false;
+                doInstallCheck = false;
+                patches = [
+                  (pkgs.fetchpatch {
+                    url = "https://github.com/mesonbuild/meson/commit/38d29b4dd19698d5cad7b599add2a69b243fd88a.patch";
+                    hash = "sha256-PgPBvGtCISKn1qQQhzBW5XfknUe91i5XGGBcaUK4yeE=";
+                  })
+                ];
+              };
+            in
+            {
+              enable = true;
+              files = "(meson.build|meson.options)$";
+              entry = "${pkgs.writeScript "format-meson" ''
+                #!${pkgs.runtimeShell}
+                for file in "$@"; do
+                  ${lib.getExe meson} format -ic ${../meson.format} "$file"
+                done
+              ''}";
+            };
           nixfmt-rfc-style = {
             enable = true;
             excludes = [
@@ -189,467 +100,6 @@
               # Don't format vendored code
               ''^doc/manual/redirects\.js$''
               ''^doc/manual/theme/highlight\.js$''
-
-              # We haven't applied formatting to these files yet
-              ''^doc/manual/redirects\.js$''
-              ''^doc/manual/theme/highlight\.js$''
-              ''^src/build-remote/build-remote\.cc$''
-              ''^src/libcmd/built-path\.cc$''
-              ''^src/libcmd/include/nix/cmd/built-path\.hh$''
-              ''^src/libcmd/common-eval-args\.cc$''
-              ''^src/libcmd/include/nix/cmd/common-eval-args\.hh$''
-              ''^src/libcmd/editor-for\.cc$''
-              ''^src/libcmd/installable-attr-path\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-attr-path\.hh$''
-              ''^src/libcmd/installable-derived-path\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-derived-path\.hh$''
-              ''^src/libcmd/installable-flake\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-flake\.hh$''
-              ''^src/libcmd/installable-value\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-value\.hh$''
-              ''^src/libcmd/installables\.cc$''
-              ''^src/libcmd/include/nix/cmd/installables\.hh$''
-              ''^src/libcmd/include/nix/cmd/legacy\.hh$''
-              ''^src/libcmd/markdown\.cc$''
-              ''^src/libcmd/misc-store-flags\.cc$''
-              ''^src/libcmd/repl-interacter\.cc$''
-              ''^src/libcmd/include/nix/cmd/repl-interacter\.hh$''
-              ''^src/libcmd/repl\.cc$''
-              ''^src/libcmd/include/nix/cmd/repl\.hh$''
-              ''^src/libexpr-c/nix_api_expr\.cc$''
-              ''^src/libexpr-c/nix_api_external\.cc$''
-              ''^src/libexpr/attr-path\.cc$''
-              ''^src/libexpr/include/nix/expr/attr-path\.hh$''
-              ''^src/libexpr/attr-set\.cc$''
-              ''^src/libexpr/include/nix/expr/attr-set\.hh$''
-              ''^src/libexpr/eval-cache\.cc$''
-              ''^src/libexpr/include/nix/expr/eval-cache\.hh$''
-              ''^src/libexpr/eval-error\.cc$''
-              ''^src/libexpr/include/nix/expr/eval-inline\.hh$''
-              ''^src/libexpr/eval-settings\.cc$''
-              ''^src/libexpr/include/nix/expr/eval-settings\.hh$''
-              ''^src/libexpr/eval\.cc$''
-              ''^src/libexpr/include/nix/expr/eval\.hh$''
-              ''^src/libexpr/function-trace\.cc$''
-              ''^src/libexpr/include/nix/expr/gc-small-vector\.hh$''
-              ''^src/libexpr/get-drvs\.cc$''
-              ''^src/libexpr/include/nix/expr/get-drvs\.hh$''
-              ''^src/libexpr/json-to-value\.cc$''
-              ''^src/libexpr/nixexpr\.cc$''
-              ''^src/libexpr/include/nix/expr/nixexpr\.hh$''
-              ''^src/libexpr/include/nix/expr/parser-state\.hh$''
-              ''^src/libexpr/primops\.cc$''
-              ''^src/libexpr/include/nix/expr/primops\.hh$''
-              ''^src/libexpr/primops/context\.cc$''
-              ''^src/libexpr/primops/fetchClosure\.cc$''
-              ''^src/libexpr/primops/fetchMercurial\.cc$''
-              ''^src/libexpr/primops/fetchTree\.cc$''
-              ''^src/libexpr/primops/fromTOML\.cc$''
-              ''^src/libexpr/print-ambiguous\.cc$''
-              ''^src/libexpr/include/nix/expr/print-ambiguous\.hh$''
-              ''^src/libexpr/include/nix/expr/print-options\.hh$''
-              ''^src/libexpr/print\.cc$''
-              ''^src/libexpr/include/nix/expr/print\.hh$''
-              ''^src/libexpr/search-path\.cc$''
-              ''^src/libexpr/include/nix/expr/symbol-table\.hh$''
-              ''^src/libexpr/value-to-json\.cc$''
-              ''^src/libexpr/include/nix/expr/value-to-json\.hh$''
-              ''^src/libexpr/value-to-xml\.cc$''
-              ''^src/libexpr/include/nix/expr/value-to-xml\.hh$''
-              ''^src/libexpr/value/context\.cc$''
-              ''^src/libexpr/include/nix/expr/value/context\.hh$''
-              ''^src/libfetchers/attrs\.cc$''
-              ''^src/libfetchers/cache\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/cache\.hh$''
-              ''^src/libfetchers/fetch-settings\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/fetch-settings\.hh$''
-              ''^src/libfetchers/fetch-to-store\.cc$''
-              ''^src/libfetchers/fetchers\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/fetchers\.hh$''
-              ''^src/libfetchers/filtering-source-accessor\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/filtering-source-accessor\.hh$''
-              ''^src/libfetchers/fs-source-accessor\.cc$''
-              ''^src/libfetchers/include/nix/fs-source-accessor\.hh$''
-              ''^src/libfetchers/git-utils\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/git-utils\.hh$''
-              ''^src/libfetchers/github\.cc$''
-              ''^src/libfetchers/indirect\.cc$''
-              ''^src/libfetchers/memory-source-accessor\.cc$''
-              ''^src/libfetchers/path\.cc$''
-              ''^src/libfetchers/registry\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/registry\.hh$''
-              ''^src/libfetchers/tarball\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/tarball\.hh$''
-              ''^src/libfetchers/git\.cc$''
-              ''^src/libfetchers/mercurial\.cc$''
-              ''^src/libflake/config\.cc$''
-              ''^src/libflake/flake\.cc$''
-              ''^src/libflake/include/nix/flake/flake\.hh$''
-              ''^src/libflake/flakeref\.cc$''
-              ''^src/libflake/include/nix/flake/flakeref\.hh$''
-              ''^src/libflake/lockfile\.cc$''
-              ''^src/libflake/include/nix/flake/lockfile\.hh$''
-              ''^src/libflake/url-name\.cc$''
-              ''^src/libmain/common-args\.cc$''
-              ''^src/libmain/include/nix/main/common-args\.hh$''
-              ''^src/libmain/loggers\.cc$''
-              ''^src/libmain/include/nix/main/loggers\.hh$''
-              ''^src/libmain/progress-bar\.cc$''
-              ''^src/libmain/shared\.cc$''
-              ''^src/libmain/include/nix/main/shared\.hh$''
-              ''^src/libmain/unix/stack\.cc$''
-              ''^src/libstore/binary-cache-store\.cc$''
-              ''^src/libstore/include/nix/store/binary-cache-store\.hh$''
-              ''^src/libstore/include/nix/store/build-result\.hh$''
-              ''^src/libstore/include/nix/store/builtins\.hh$''
-              ''^src/libstore/builtins/buildenv\.cc$''
-              ''^src/libstore/include/nix/store/builtins/buildenv\.hh$''
-              ''^src/libstore/include/nix/store/common-protocol-impl\.hh$''
-              ''^src/libstore/common-protocol\.cc$''
-              ''^src/libstore/include/nix/store/common-protocol\.hh$''
-              ''^src/libstore/include/nix/store/common-ssh-store-config\.hh$''
-              ''^src/libstore/content-address\.cc$''
-              ''^src/libstore/include/nix/store/content-address\.hh$''
-              ''^src/libstore/daemon\.cc$''
-              ''^src/libstore/include/nix/store/daemon\.hh$''
-              ''^src/libstore/derivations\.cc$''
-              ''^src/libstore/include/nix/store/derivations\.hh$''
-              ''^src/libstore/derived-path-map\.cc$''
-              ''^src/libstore/include/nix/store/derived-path-map\.hh$''
-              ''^src/libstore/derived-path\.cc$''
-              ''^src/libstore/include/nix/store/derived-path\.hh$''
-              ''^src/libstore/downstream-placeholder\.cc$''
-              ''^src/libstore/include/nix/store/downstream-placeholder\.hh$''
-              ''^src/libstore/dummy-store\.cc$''
-              ''^src/libstore/export-import\.cc$''
-              ''^src/libstore/filetransfer\.cc$''
-              ''^src/libstore/include/nix/store/filetransfer\.hh$''
-              ''^src/libstore/include/nix/store/gc-store\.hh$''
-              ''^src/libstore/globals\.cc$''
-              ''^src/libstore/include/nix/store/globals\.hh$''
-              ''^src/libstore/http-binary-cache-store\.cc$''
-              ''^src/libstore/legacy-ssh-store\.cc$''
-              ''^src/libstore/include/nix/store/legacy-ssh-store\.hh$''
-              ''^src/libstore/include/nix/store/length-prefixed-protocol-helper\.hh$''
-              ''^src/libstore/linux/personality\.cc$''
-              ''^src/libstore/linux/include/nix/store/personality\.hh$''
-              ''^src/libstore/local-binary-cache-store\.cc$''
-              ''^src/libstore/local-fs-store\.cc$''
-              ''^src/libstore/include/nix/store/local-fs-store\.hh$''
-              ''^src/libstore/log-store\.cc$''
-              ''^src/libstore/include/nix/store/log-store\.hh$''
-              ''^src/libstore/machines\.cc$''
-              ''^src/libstore/include/nix/store/machines\.hh$''
-              ''^src/libstore/make-content-addressed\.cc$''
-              ''^src/libstore/include/nix/store/make-content-addressed\.hh$''
-              ''^src/libstore/misc\.cc$''
-              ''^src/libstore/names\.cc$''
-              ''^src/libstore/include/nix/store/names\.hh$''
-              ''^src/libstore/nar-accessor\.cc$''
-              ''^src/libstore/include/nix/store/nar-accessor\.hh$''
-              ''^src/libstore/nar-info-disk-cache\.cc$''
-              ''^src/libstore/include/nix/store/nar-info-disk-cache\.hh$''
-              ''^src/libstore/nar-info\.cc$''
-              ''^src/libstore/include/nix/store/nar-info\.hh$''
-              ''^src/libstore/outputs-spec\.cc$''
-              ''^src/libstore/include/nix/store/outputs-spec\.hh$''
-              ''^src/libstore/parsed-derivations\.cc$''
-              ''^src/libstore/path-info\.cc$''
-              ''^src/libstore/include/nix/store/path-info\.hh$''
-              ''^src/libstore/path-references\.cc$''
-              ''^src/libstore/include/nix/store/path-regex\.hh$''
-              ''^src/libstore/path-with-outputs\.cc$''
-              ''^src/libstore/path\.cc$''
-              ''^src/libstore/include/nix/store/path\.hh$''
-              ''^src/libstore/pathlocks\.cc$''
-              ''^src/libstore/include/nix/store/pathlocks\.hh$''
-              ''^src/libstore/profiles\.cc$''
-              ''^src/libstore/include/nix/store/profiles\.hh$''
-              ''^src/libstore/realisation\.cc$''
-              ''^src/libstore/include/nix/store/realisation\.hh$''
-              ''^src/libstore/remote-fs-accessor\.cc$''
-              ''^src/libstore/include/nix/store/remote-fs-accessor\.hh$''
-              ''^src/libstore/include/nix/store/remote-store-connection\.hh$''
-              ''^src/libstore/remote-store\.cc$''
-              ''^src/libstore/include/nix/store/remote-store\.hh$''
-              ''^src/libstore/s3-binary-cache-store\.cc$''
-              ''^src/libstore/include/nix/store/s3\.hh$''
-              ''^src/libstore/serve-protocol-impl\.cc$''
-              ''^src/libstore/include/nix/store/serve-protocol-impl\.hh$''
-              ''^src/libstore/serve-protocol\.cc$''
-              ''^src/libstore/include/nix/store/serve-protocol\.hh$''
-              ''^src/libstore/sqlite\.cc$''
-              ''^src/libstore/include/nix/store/sqlite\.hh$''
-              ''^src/libstore/ssh-store\.cc$''
-              ''^src/libstore/ssh\.cc$''
-              ''^src/libstore/include/nix/store/ssh\.hh$''
-              ''^src/libstore/store-api\.cc$''
-              ''^src/libstore/include/nix/store/store-api\.hh$''
-              ''^src/libstore/include/nix/store/store-dir-config\.hh$''
-              ''^src/libstore/build/derivation-building-goal\.cc$''
-              ''^src/libstore/include/nix/store/build/derivation-building-goal\.hh$''
-              ''^src/libstore/build/derivation-goal\.cc$''
-              ''^src/libstore/include/nix/store/build/derivation-goal\.hh$''
-              ''^src/libstore/build/drv-output-substitution-goal\.cc$''
-              ''^src/libstore/include/nix/store/build/drv-output-substitution-goal\.hh$''
-              ''^src/libstore/build/entry-points\.cc$''
-              ''^src/libstore/build/goal\.cc$''
-              ''^src/libstore/include/nix/store/build/goal\.hh$''
-              ''^src/libstore/unix/build/hook-instance\.cc$''
-              ''^src/libstore/unix/build/derivation-builder\.cc$''
-              ''^src/libstore/unix/include/nix/store/build/derivation-builder\.hh$''
-              ''^src/libstore/build/substitution-goal\.cc$''
-              ''^src/libstore/include/nix/store/build/substitution-goal\.hh$''
-              ''^src/libstore/build/worker\.cc$''
-              ''^src/libstore/include/nix/store/build/worker\.hh$''
-              ''^src/libstore/builtins/fetchurl\.cc$''
-              ''^src/libstore/builtins/unpack-channel\.cc$''
-              ''^src/libstore/gc\.cc$''
-              ''^src/libstore/local-overlay-store\.cc$''
-              ''^src/libstore/include/nix/store/local-overlay-store\.hh$''
-              ''^src/libstore/local-store\.cc$''
-              ''^src/libstore/include/nix/store/local-store\.hh$''
-              ''^src/libstore/unix/user-lock\.cc$''
-              ''^src/libstore/unix/include/nix/store/user-lock\.hh$''
-              ''^src/libstore/optimise-store\.cc$''
-              ''^src/libstore/unix/pathlocks\.cc$''
-              ''^src/libstore/posix-fs-canonicalise\.cc$''
-              ''^src/libstore/include/nix/store/posix-fs-canonicalise\.hh$''
-              ''^src/libstore/uds-remote-store\.cc$''
-              ''^src/libstore/include/nix/store/uds-remote-store\.hh$''
-              ''^src/libstore/windows/build\.cc$''
-              ''^src/libstore/include/nix/store/worker-protocol-impl\.hh$''
-              ''^src/libstore/worker-protocol\.cc$''
-              ''^src/libstore/include/nix/store/worker-protocol\.hh$''
-              ''^src/libutil-c/nix_api_util_internal\.h$''
-              ''^src/libutil/archive\.cc$''
-              ''^src/libutil/include/nix/util/archive\.hh$''
-              ''^src/libutil/args\.cc$''
-              ''^src/libutil/include/nix/util/args\.hh$''
-              ''^src/libutil/include/nix/util/args/root\.hh$''
-              ''^src/libutil/include/nix/util/callback\.hh$''
-              ''^src/libutil/canon-path\.cc$''
-              ''^src/libutil/include/nix/util/canon-path\.hh$''
-              ''^src/libutil/include/nix/util/chunked-vector\.hh$''
-              ''^src/libutil/include/nix/util/closure\.hh$''
-              ''^src/libutil/include/nix/util/comparator\.hh$''
-              ''^src/libutil/compute-levels\.cc$''
-              ''^src/libutil/include/nix/util/config-impl\.hh$''
-              ''^src/libutil/configuration\.cc$''
-              ''^src/libutil/include/nix/util/configuration\.hh$''
-              ''^src/libutil/current-process\.cc$''
-              ''^src/libutil/include/nix/util/current-process\.hh$''
-              ''^src/libutil/english\.cc$''
-              ''^src/libutil/include/nix/util/english\.hh$''
-              ''^src/libutil/error\.cc$''
-              ''^src/libutil/include/nix/util/error\.hh$''
-              ''^src/libutil/include/nix/util/exit\.hh$''
-              ''^src/libutil/experimental-features\.cc$''
-              ''^src/libutil/include/nix/util/experimental-features\.hh$''
-              ''^src/libutil/file-content-address\.cc$''
-              ''^src/libutil/include/nix/util/file-content-address\.hh$''
-              ''^src/libutil/file-descriptor\.cc$''
-              ''^src/libutil/include/nix/util/file-descriptor\.hh$''
-              ''^src/libutil/include/nix/util/file-path-impl\.hh$''
-              ''^src/libutil/include/nix/util/file-path\.hh$''
-              ''^src/libutil/file-system\.cc$''
-              ''^src/libutil/include/nix/util/file-system\.hh$''
-              ''^src/libutil/include/nix/util/finally\.hh$''
-              ''^src/libutil/include/nix/util/fmt\.hh$''
-              ''^src/libutil/fs-sink\.cc$''
-              ''^src/libutil/include/nix/util/fs-sink\.hh$''
-              ''^src/libutil/git\.cc$''
-              ''^src/libutil/include/nix/util/git\.hh$''
-              ''^src/libutil/hash\.cc$''
-              ''^src/libutil/include/nix/util/hash\.hh$''
-              ''^src/libutil/hilite\.cc$''
-              ''^src/libutil/include/nix/util/hilite\.hh$''
-              ''^src/libutil/source-accessor\.hh$''
-              ''^src/libutil/include/nix/util/json-impls\.hh$''
-              ''^src/libutil/json-utils\.cc$''
-              ''^src/libutil/include/nix/util/json-utils\.hh$''
-              ''^src/libutil/linux/cgroup\.cc$''
-              ''^src/libutil/linux/linux-namespaces\.cc$''
-              ''^src/libutil/logging\.cc$''
-              ''^src/libutil/include/nix/util/logging\.hh$''
-              ''^src/libutil/memory-source-accessor\.cc$''
-              ''^src/libutil/include/nix/util/memory-source-accessor\.hh$''
-              ''^src/libutil/include/nix/util/pool\.hh$''
-              ''^src/libutil/position\.cc$''
-              ''^src/libutil/include/nix/util/position\.hh$''
-              ''^src/libutil/posix-source-accessor\.cc$''
-              ''^src/libutil/include/nix/util/posix-source-accessor\.hh$''
-              ''^src/libutil/include/nix/util/processes\.hh$''
-              ''^src/libutil/include/nix/util/ref\.hh$''
-              ''^src/libutil/references\.cc$''
-              ''^src/libutil/include/nix/util/references\.hh$''
-              ''^src/libutil/regex-combinators\.hh$''
-              ''^src/libutil/serialise\.cc$''
-              ''^src/libutil/include/nix/util/serialise\.hh$''
-              ''^src/libutil/include/nix/util/signals\.hh$''
-              ''^src/libutil/signature/local-keys\.cc$''
-              ''^src/libutil/include/nix/util/signature/local-keys\.hh$''
-              ''^src/libutil/signature/signer\.cc$''
-              ''^src/libutil/include/nix/util/signature/signer\.hh$''
-              ''^src/libutil/source-accessor\.cc$''
-              ''^src/libutil/include/nix/util/source-accessor\.hh$''
-              ''^src/libutil/source-path\.cc$''
-              ''^src/libutil/include/nix/util/source-path\.hh$''
-              ''^src/libutil/include/nix/util/split\.hh$''
-              ''^src/libutil/suggestions\.cc$''
-              ''^src/libutil/include/nix/util/suggestions\.hh$''
-              ''^src/libutil/include/nix/util/sync\.hh$''
-              ''^src/libutil/terminal\.cc$''
-              ''^src/libutil/include/nix/util/terminal\.hh$''
-              ''^src/libutil/thread-pool\.cc$''
-              ''^src/libutil/include/nix/util/thread-pool\.hh$''
-              ''^src/libutil/include/nix/util/topo-sort\.hh$''
-              ''^src/libutil/include/nix/util/types\.hh$''
-              ''^src/libutil/unix/file-descriptor\.cc$''
-              ''^src/libutil/unix/file-path\.cc$''
-              ''^src/libutil/unix/processes\.cc$''
-              ''^src/libutil/unix/include/nix/util/signals-impl\.hh$''
-              ''^src/libutil/unix/signals\.cc$''
-              ''^src/libutil/unix-domain-socket\.cc$''
-              ''^src/libutil/unix/users\.cc$''
-              ''^src/libutil/include/nix/util/url-parts\.hh$''
-              ''^src/libutil/url\.cc$''
-              ''^src/libutil/include/nix/util/url\.hh$''
-              ''^src/libutil/users\.cc$''
-              ''^src/libutil/include/nix/util/users\.hh$''
-              ''^src/libutil/util\.cc$''
-              ''^src/libutil/include/nix/util/util\.hh$''
-              ''^src/libutil/include/nix/util/variant-wrapper\.hh$''
-              ''^src/libutil/widecharwidth/widechar_width\.h$'' # vendored source
-              ''^src/libutil/windows/file-descriptor\.cc$''
-              ''^src/libutil/windows/file-path\.cc$''
-              ''^src/libutil/windows/processes\.cc$''
-              ''^src/libutil/windows/users\.cc$''
-              ''^src/libutil/windows/windows-error\.cc$''
-              ''^src/libutil/windows/include/nix/util/windows-error\.hh$''
-              ''^src/libutil/xml-writer\.cc$''
-              ''^src/libutil/include/nix/util/xml-writer\.hh$''
-              ''^src/nix-build/nix-build\.cc$''
-              ''^src/nix-channel/nix-channel\.cc$''
-              ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
-              ''^src/nix-env/buildenv.nix$''
-              ''^src/nix-env/nix-env\.cc$''
-              ''^src/nix-env/user-env\.cc$''
-              ''^src/nix-env/user-env\.hh$''
-              ''^src/nix-instantiate/nix-instantiate\.cc$''
-              ''^src/nix-store/dotgraph\.cc$''
-              ''^src/nix-store/graphml\.cc$''
-              ''^src/nix-store/nix-store\.cc$''
-              ''^src/nix/add-to-store\.cc$''
-              ''^src/nix/app\.cc$''
-              ''^src/nix/build\.cc$''
-              ''^src/nix/bundle\.cc$''
-              ''^src/nix/cat\.cc$''
-              ''^src/nix/config-check\.cc$''
-              ''^src/nix/config\.cc$''
-              ''^src/nix/copy\.cc$''
-              ''^src/nix/derivation-add\.cc$''
-              ''^src/nix/derivation-show\.cc$''
-              ''^src/nix/derivation\.cc$''
-              ''^src/nix/develop\.cc$''
-              ''^src/nix/diff-closures\.cc$''
-              ''^src/nix/dump-path\.cc$''
-              ''^src/nix/edit\.cc$''
-              ''^src/nix/eval\.cc$''
-              ''^src/nix/flake\.cc$''
-              ''^src/nix/fmt\.cc$''
-              ''^src/nix/hash\.cc$''
-              ''^src/nix/log\.cc$''
-              ''^src/nix/ls\.cc$''
-              ''^src/nix/main\.cc$''
-              ''^src/nix/make-content-addressed\.cc$''
-              ''^src/nix/nar\.cc$''
-              ''^src/nix/optimise-store\.cc$''
-              ''^src/nix/path-from-hash-part\.cc$''
-              ''^src/nix/path-info\.cc$''
-              ''^src/nix/prefetch\.cc$''
-              ''^src/nix/profile\.cc$''
-              ''^src/nix/realisation\.cc$''
-              ''^src/nix/registry\.cc$''
-              ''^src/nix/repl\.cc$''
-              ''^src/nix/run\.cc$''
-              ''^src/nix/run\.hh$''
-              ''^src/nix/search\.cc$''
-              ''^src/nix/sigs\.cc$''
-              ''^src/nix/store-copy-log\.cc$''
-              ''^src/nix/store-delete\.cc$''
-              ''^src/nix/store-gc\.cc$''
-              ''^src/nix/store-info\.cc$''
-              ''^src/nix/store-repair\.cc$''
-              ''^src/nix/store\.cc$''
-              ''^src/nix/unix/daemon\.cc$''
-              ''^src/nix/upgrade-nix\.cc$''
-              ''^src/nix/verify\.cc$''
-              ''^src/nix/why-depends\.cc$''
-
-              ''^tests/functional/plugins/plugintest\.cc''
-              ''^tests/functional/test-libstoreconsumer/main\.cc''
-              ''^tests/nixos/ca-fd-leak/sender\.c''
-              ''^tests/nixos/ca-fd-leak/smuggler\.c''
-              ''^tests/nixos/user-sandboxing/attacker\.c''
-              ''^src/libexpr-test-support/include/nix/expr/tests/libexpr\.hh''
-              ''^src/libexpr-test-support/tests/value/context\.cc''
-              ''^src/libexpr-test-support/include/nix/expr/tests/value/context\.hh''
-              ''^src/libexpr-tests/derived-path\.cc''
-              ''^src/libexpr-tests/error_traces\.cc''
-              ''^src/libexpr-tests/eval\.cc''
-              ''^src/libexpr-tests/json\.cc''
-              ''^src/libexpr-tests/main\.cc''
-              ''^src/libexpr-tests/primops\.cc''
-              ''^src/libexpr-tests/search-path\.cc''
-              ''^src/libexpr-tests/trivial\.cc''
-              ''^src/libexpr-tests/value/context\.cc''
-              ''^src/libexpr-tests/value/print\.cc''
-              ''^src/libfetchers-tests/public-key\.cc''
-              ''^src/libflake-tests/flakeref\.cc''
-              ''^src/libflake-tests/url-name\.cc''
-              ''^src/libstore-test-support/tests/derived-path\.cc''
-              ''^src/libstore-test-support/include/nix/store/tests/derived-path\.hh''
-              ''^src/libstore-test-support/include/nix/store/tests/nix_api_store\.hh''
-              ''^src/libstore-test-support/tests/outputs-spec\.cc''
-              ''^src/libstore-test-support/include/nix/store/tests/outputs-spec\.hh''
-              ''^src/libstore-test-support/path\.cc''
-              ''^src/libstore-test-support/include/nix/store/tests/path\.hh''
-              ''^src/libstore-test-support/include/nix/store/tests/protocol\.hh''
-              ''^src/libstore-tests/common-protocol\.cc''
-              ''^src/libstore-tests/content-address\.cc''
-              ''^src/libstore-tests/derivation\.cc''
-              ''^src/libstore-tests/derived-path\.cc''
-              ''^src/libstore-tests/downstream-placeholder\.cc''
-              ''^src/libstore-tests/machines\.cc''
-              ''^src/libstore-tests/nar-info-disk-cache\.cc''
-              ''^src/libstore-tests/nar-info\.cc''
-              ''^src/libstore-tests/outputs-spec\.cc''
-              ''^src/libstore-tests/path-info\.cc''
-              ''^src/libstore-tests/path\.cc''
-              ''^src/libstore-tests/serve-protocol\.cc''
-              ''^src/libstore-tests/worker-protocol\.cc''
-              ''^src/libutil-test-support/include/nix/util/tests/characterization\.hh''
-              ''^src/libutil-test-support/hash\.cc''
-              ''^src/libutil-test-support/include/nix/util/tests/hash\.hh''
-              ''^src/libutil-tests/args\.cc''
-              ''^src/libutil-tests/canon-path\.cc''
-              ''^src/libutil-tests/chunked-vector\.cc''
-              ''^src/libutil-tests/closure\.cc''
-              ''^src/libutil-tests/compression\.cc''
-              ''^src/libutil-tests/config\.cc''
-              ''^src/libutil-tests/file-content-address\.cc''
-              ''^src/libutil-tests/git\.cc''
-              ''^src/libutil-tests/hash\.cc''
-              ''^src/libutil-tests/hilite\.cc''
-              ''^src/libutil-tests/json-utils\.cc''
-              ''^src/libutil-tests/logging\.cc''
-              ''^src/libutil-tests/lru-cache\.cc''
-              ''^src/libutil-tests/pool\.cc''
-              ''^src/libutil-tests/references\.cc''
-              ''^src/libutil-tests/suggestions\.cc''
-              ''^src/libutil-tests/url\.cc''
-              ''^src/libutil-tests/xml-writer\.cc''
             ];
           };
           shellcheck = {
@@ -723,8 +173,6 @@
               ''^tests/functional/gc-concurrent\.sh$''
               ''^tests/functional/gc-concurrent2\.builder\.sh$''
               ''^tests/functional/gc-non-blocking\.sh$''
-              ''^tests/functional/git-hashing/common\.sh$''
-              ''^tests/functional/git-hashing/simple\.sh$''
               ''^tests/functional/hash-convert\.sh$''
               ''^tests/functional/impure-derivations\.sh$''
               ''^tests/functional/impure-eval\.sh$''
@@ -800,7 +248,6 @@
               ''^tests/functional/user-envs\.builder\.sh$''
               ''^tests/functional/user-envs\.sh$''
               ''^tests/functional/why-depends\.sh$''
-              ''^src/libutil-tests/data/git/check-data\.sh$''
             ];
           };
         };
diff --git a/maintainers/format.sh b/maintainers/format.sh
index a2a6d8b41..b2902e6dc 100755
--- a/maintainers/format.sh
+++ b/maintainers/format.sh
@@ -1,11 +1,16 @@
 #!/usr/bin/env bash
 
 if ! type -p pre-commit &>/dev/null; then
-  echo "format.sh: pre-commit not found. Please use \`nix develop\`.";
+  echo "format.sh: pre-commit not found. Please use \`nix develop -c ./maintainers/format.sh\`.";
   exit 1;
 fi;
 if test -z "$_NIX_PRE_COMMIT_HOOKS_CONFIG"; then
-  echo "format.sh: _NIX_PRE_COMMIT_HOOKS_CONFIG not set. Please use \`nix develop\`.";
+  echo "format.sh: _NIX_PRE_COMMIT_HOOKS_CONFIG not set. Please use \`nix develop -c ./maintainers/format.sh\`.";
   exit 1;
 fi;
-pre-commit run --config "$_NIX_PRE_COMMIT_HOOKS_CONFIG" --all-files
+
+while ! pre-commit run --config "$_NIX_PRE_COMMIT_HOOKS_CONFIG" --all-files; do
+    if [ "${1:-}" != "--until-stable" ]; then
+        exit 1
+    fi
+done
diff --git a/maintainers/onboarding.md b/maintainers/onboarding.md
index d7491db16..311cc64e6 100644
--- a/maintainers/onboarding.md
+++ b/maintainers/onboarding.md
@@ -3,5 +3,9 @@
 
 - https://github.com/NixOS/nixos-homepage/
 - https://github.com/orgs/NixOS/teams/nix-team
-- Matrix room
+- Matrix rooms
+  - [private] Nix maintainer team
+  - Nix ∪ Lix devs (also private)
+  - any open security issues if present and needed
+
 - Team member should subscribe to notifications for the [Nix development category on Discourse](https://discourse.nixos.org/c/dev/nix/50)
diff --git a/maintainers/release-notes-todo b/maintainers/release-notes-todo
new file mode 100755
index 000000000..7cadc2a79
--- /dev/null
+++ b/maintainers/release-notes-todo
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+# debug:
+# set -x
+
+START_REF="${1}"
+END_REF="${2:-upstream/master}"
+
+# Get the merge base
+MERGE_BASE=$(git merge-base "$START_REF" "$END_REF")
+unset START_REF
+
+# Get date range
+START_DATE=$(git show -s --format=%cI "$MERGE_BASE")
+END_DATE=$(git show -s --format=%cI "$END_REF")
+
+echo "Checking PRs merged between $START_DATE and $END_DATE" >&2
+
+# Get all commits between merge base and HEAD
+COMMITS=$(git rev-list "$MERGE_BASE..$END_REF")
+
+# Convert to set for fast lookup
+declare -A commit_set
+for commit in $COMMITS; do
+    commit_set["$commit"]=1
+done
+
+# Get the current changelog
+LOG_DONE="$(changelog-d doc/manual/rl-next)"
+is_done(){
+    local nr="$1"
+    echo "$LOG_DONE" | grep -E "^- .*/pull/$nr)"
+}
+
+# Query merged PRs in date range
+gh pr list \
+    --repo NixOS/nix \
+    --state merged \
+    --limit 1000 \
+    --json number,title,author,mergeCommit \
+    --search "merged:$START_DATE..$END_DATE" | \
+jq -r '.[] | [.number, .mergeCommit.oid, .title, .author.login] | @tsv' | \
+while IFS=$'\t' read -r pr_num merge_commit _title author; do
+    # Check if this PR's merge commit is in our branch
+    if [[ -n "${commit_set[$merge_commit]:-}" ]]; then
+        # Full detail, not suitable for comment due to mass ping and duplicate title
+        # echo "- #$pr_num $_title (@$author)"
+        echo "- #$pr_num ($author)"
+        if is_done "$pr_num"
+        then
+            echo "  - [x] has note"
+        else
+            echo "  - [ ] has note"
+        fi
+        echo "  - [ ] skip"
+    fi
+done
diff --git a/maintainers/release-process.md b/maintainers/release-process.md
index f2c61302b..790618b7f 100644
--- a/maintainers/release-process.md
+++ b/maintainers/release-process.md
@@ -24,11 +24,18 @@ release:
 * In a checkout of the Nix repo, make sure you're on `master` and run
   `git pull`.
 
+* Compile a release notes to-do list by running
+
+  ```console
+  $ ./maintainers/release-notes-todo PREV_RELEASE HEAD
+  ```
+
 * Compile the release notes by running
 
   ```console
   $ export VERSION=X.YY
   $ git checkout -b release-notes
+  $ export GITHUB_TOKEN=...
   $ ./maintainers/release-notes
   ```
 
@@ -39,10 +46,6 @@ release:
 * Proof-read / edit / rearrange the release notes if needed. Breaking changes
   and highlights should go to the top.
 
-* Run `maintainers/release-credits` to make sure the credits script works
-  and produces a sensible output. Some emails might not automatically map to
-  a GitHub handle.
-
 * Push.
 
   ```console
@@ -130,6 +133,8 @@ release:
 
   Commit and push this to the maintenance branch.
 
+* Create a backport label.
+
 * Bump the version of `master`:
 
   ```console
@@ -137,6 +142,7 @@ release:
   $ git pull
   $ NEW_VERSION=2.13.0
   $ echo $NEW_VERSION > .version
+  $ ... edit .mergify.yml to add the previous version ...
   $ git checkout -b bump-$NEW_VERSION
   $ git commit -a -m 'Bump version'
   $ git push --set-upstream origin bump-$NEW_VERSION
@@ -144,10 +150,6 @@ release:
 
   Make a pull request and auto-merge it.
 
-* Create a backport label.
-
-* Add the new backport label to `.mergify.yml`.
-
 * Post an [announcement on Discourse](https://discourse.nixos.org/c/announcements/8), including the contents of
   `rl-$VERSION.md`.
 
diff --git a/meson.build b/meson.build
index 4a3a517fb..5dcf98717 100644
--- a/meson.build
+++ b/meson.build
@@ -8,7 +8,6 @@ project(
   subproject_dir : 'src',
   default_options : [
     'localstatedir=/nix/var',
-    # hack for trailing newline
   ],
   meson_version : '>= 1.1',
 )
@@ -29,7 +28,7 @@ subproject('nix')
 if get_option('doc-gen')
   subproject('internal-api-docs')
   subproject('external-api-docs')
-  if not meson.is_cross_build()
+  if meson.can_run_host_binaries()
     subproject('nix-manual')
   endif
 endif
diff --git a/meson.options b/meson.options
index 30670902e..d2c9fa40c 100644
--- a/meson.options
+++ b/meson.options
@@ -20,3 +20,10 @@ option(
   value : true,
   description : 'Build language bindings (e.g. Perl)',
 )
+
+option(
+  'benchmarks',
+  type : 'boolean',
+  value : false,
+  description : 'Build benchmarks (requires gbenchmark)',
+)
diff --git a/misc/freebsd/meson.build b/misc/freebsd/meson.build
new file mode 100644
index 000000000..d94149883
--- /dev/null
+++ b/misc/freebsd/meson.build
@@ -0,0 +1,10 @@
+configure_file(
+  input : 'nix-daemon.in',
+  output : 'nix-daemon',
+  install : true,
+  install_dir : get_option('prefix') / 'etc/rc.d',
+  install_mode : 'rwxr-xr-x',
+  configuration : {
+    'bindir' : bindir,
+  },
+)
diff --git a/misc/freebsd/nix-daemon.in b/misc/freebsd/nix-daemon.in
new file mode 100644
index 000000000..9eb269850
--- /dev/null
+++ b/misc/freebsd/nix-daemon.in
@@ -0,0 +1,49 @@
+#!/bin/sh
+#
+# PROVIDE: nix_daemon
+# REQUIRE: DAEMON
+# KEYWORD: shutdown
+#
+# Add the following lines to /etc/rc.conf to enable nix-daemon:
+#
+# nix_daemon_enable="YES"
+#
+
+# shellcheck source=/dev/null
+. /etc/rc.subr
+
+name="nix_daemon"
+# shellcheck disable=SC2034
+rcvar="nix_daemon_enable"
+
+load_rc_config $name
+
+: "${nix_daemon_enable:=NO}"
+
+command="@bindir@/nix-daemon"
+command_args=""
+pidfile="/var/run/nix-daemon.pid"
+
+# shellcheck disable=SC2034
+start_cmd="${name}_start"
+# shellcheck disable=SC2034
+stop_cmd="${name}_stop"
+
+nix_daemon_start() {
+    echo "Starting ${name}."
+    # command_args is intentionally unquoted to allow multiple arguments
+    # shellcheck disable=SC2086
+    /usr/sbin/daemon -c -f -p "${pidfile}" "${command}" ${command_args}
+}
+
+nix_daemon_stop() {
+    if [ -f "${pidfile}" ]; then
+        echo "Stopping ${name}."
+        kill -TERM "$(cat "${pidfile}")"
+        rm -f "${pidfile}"
+    else
+        echo "${name} is not running."
+    fi
+}
+
+run_rc_command "$1"
\ No newline at end of file
diff --git a/misc/launchd/meson.build b/misc/launchd/meson.build
index 5168131d1..53a57b65b 100644
--- a/misc/launchd/meson.build
+++ b/misc/launchd/meson.build
@@ -9,5 +9,5 @@ configure_file(
     # 'storedir' : store_dir,
     # 'localstatedir' : localstatedir,
     # 'bindir' : bindir,
-  },
+},
 )
diff --git a/misc/meson.build b/misc/meson.build
index 82f2b0c65..fc2bca07f 100644
--- a/misc/meson.build
+++ b/misc/meson.build
@@ -9,3 +9,7 @@ endif
 if host_machine.system() == 'darwin'
   subdir('launchd')
 endif
+
+if host_machine.system() == 'freebsd'
+  subdir('freebsd')
+endif
diff --git a/nix-meson-build-support/big-objs/meson.build b/nix-meson-build-support/big-objs/meson.build
index 7e422abd8..f8dd8d1a3 100644
--- a/nix-meson-build-support/big-objs/meson.build
+++ b/nix-meson-build-support/big-objs/meson.build
@@ -2,5 +2,5 @@ if host_machine.system() == 'windows'
   # libexpr's primops creates a large object
   # Without the following flag, we'll get errors when cross-compiling to mingw32:
   # Fatal error: can't write 66 bytes to section .text of src/libexpr/libnixexpr.dll.p/primops.cc.obj: 'file too big'
-  add_project_arguments([ '-Wa,-mbig-obj' ], language: 'cpp')
+  add_project_arguments([ '-Wa,-mbig-obj' ], language : 'cpp')
 endif
diff --git a/nix-meson-build-support/common/meson.build b/nix-meson-build-support/common/meson.build
index b9140256a..fd686f140 100644
--- a/nix-meson-build-support/common/meson.build
+++ b/nix-meson-build-support/common/meson.build
@@ -18,3 +18,25 @@ add_project_arguments(
   '-Wno-deprecated-declarations',
   language : 'cpp',
 )
+
+# GCC doesn't benefit much from precompiled headers.
+do_pch = cxx.get_id() == 'clang'
+
+# This is a clang-only option for improving build times.
+# It forces the instantiation of templates in the PCH itself and
+# not every translation unit it's included in.
+# It's available starting from clang 11, which is old enough to not
+# bother checking the version.
+# This feature helps in particular with the expensive nlohmann::json template
+# instantiations in libutil and libstore.
+if cxx.get_id() == 'clang'
+  add_project_arguments('-fpch-instantiate-templates', language : 'cpp')
+endif
+
+# Clang gets grumpy about missing libasan symbols if -shared-libasan is not
+# passed when building shared libs, at least on Linux
+if cxx.get_id() == 'clang' and ('address' in get_option('b_sanitize') or 'undefined' in get_option(
+  'b_sanitize',
+))
+  add_project_link_arguments('-shared-libasan', language : 'cpp')
+endif
diff --git a/nix-meson-build-support/default-system-cpu/meson.build b/nix-meson-build-support/default-system-cpu/meson.build
new file mode 100644
index 000000000..f63b07975
--- /dev/null
+++ b/nix-meson-build-support/default-system-cpu/meson.build
@@ -0,0 +1,19 @@
+# This attempts to translate meson cpu_family and cpu_name specified via
+# --cross-file [1] into a nix *system double*. Nixpkgs mostly respects ([2]) the
+# conventions outlined in [1].
+#
+# [1]: https://mesonbuild.com/Reference-tables.html#cpu-families
+# [2]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/lib/meson.nix
+
+nix_system_cpu = {'ppc64' : 'powerpc64', 'ppc' : 'powerpc', 'x86' : 'i686'}.get(
+  host_machine.cpu_family(),
+  host_machine.cpu_family(),
+)
+
+if (host_machine.cpu_family() in [ 'ppc64', 'ppc' ]) and host_machine.endian() == 'little'
+  nix_system_cpu += 'le'
+elif host_machine.cpu_family() in [ 'mips64', 'mips' ] and host_machine.endian() == 'little'
+  nix_system_cpu += 'el'
+elif host_machine.cpu_family() == 'arm'
+  nix_system_cpu = host_machine.cpu()
+endif
diff --git a/nix-meson-build-support/deps-lists/meson.build b/nix-meson-build-support/deps-lists/meson.build
index 237eac545..b4609c176 100644
--- a/nix-meson-build-support/deps-lists/meson.build
+++ b/nix-meson-build-support/deps-lists/meson.build
@@ -6,7 +6,7 @@
 # *interface*.
 #
 # See `man pkg-config` for some details.
-deps_private = [ ]
+deps_private = []
 
 # These are public dependencies with pkg-config files. Public is the
 # opposite of private: these dependencies are used in installed header
@@ -23,14 +23,14 @@ deps_private = [ ]
 # N.B. For distributions that care about "ABI" stability and not just
 # "API" stability, the private dependencies also matter as they can
 # potentially affect the public ABI.
-deps_public = [ ]
+deps_public = []
 
 # These are subproject deps (type == "internal"). They are other
 # packages in `/src` in this repo. The private vs public distinction is
 # the same as above.
-deps_private_subproject = [ ]
-deps_public_subproject = [ ]
+deps_private_subproject = []
+deps_public_subproject = []
 
 # These are dependencencies without pkg-config files. Ideally they are
 # just private, but they may also be public (e.g. boost).
-deps_other = [ ]
+deps_other = []
diff --git a/nix-meson-build-support/export-all-symbols/meson.build b/nix-meson-build-support/export-all-symbols/meson.build
index d7c086749..6a562e80d 100644
--- a/nix-meson-build-support/export-all-symbols/meson.build
+++ b/nix-meson-build-support/export-all-symbols/meson.build
@@ -5,7 +5,7 @@ if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
   # and not detail with this yet.
   #
   # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
+  linker_export_flags = [ '-Wl,--export-all-symbols' ]
 else
   linker_export_flags = []
 endif
diff --git a/nix-meson-build-support/export/meson.build b/nix-meson-build-support/export/meson.build
index 950bd9544..62a27bd48 100644
--- a/nix-meson-build-support/export/meson.build
+++ b/nix-meson-build-support/export/meson.build
@@ -1,12 +1,12 @@
 requires_private = []
 foreach dep : deps_private_subproject
-  requires_private  += dep.name()
+  requires_private += dep.name()
 endforeach
 requires_private += deps_private
 
-requires_public  = []
+requires_public = []
 foreach dep : deps_public_subproject
-  requires_public  += dep.name()
+  requires_public += dep.name()
 endforeach
 requires_public += deps_public
 
@@ -14,7 +14,7 @@ extra_pkg_config_variables = get_variable('extra_pkg_config_variables', {})
 
 extra_cflags = []
 if not meson.project_name().endswith('-c')
-    extra_cflags += ['-std=c++2a']
+  extra_cflags += [ '-std=c++23' ]
 endif
 
 import('pkgconfig').generate(
@@ -29,10 +29,13 @@ import('pkgconfig').generate(
   variables : extra_pkg_config_variables,
 )
 
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-  variables : extra_pkg_config_variables,
-))
+meson.override_dependency(
+  meson.project_name(),
+  declare_dependency(
+    include_directories : include_dirs,
+    link_with : this_library,
+    compile_args : [ '-std=c++23' ],
+    dependencies : deps_public_subproject + deps_public,
+    variables : extra_pkg_config_variables,
+  ),
+)
diff --git a/nix-meson-build-support/generate-header/meson.build b/nix-meson-build-support/generate-header/meson.build
index dfbe1375f..a6523bc9f 100644
--- a/nix-meson-build-support/generate-header/meson.build
+++ b/nix-meson-build-support/generate-header/meson.build
@@ -1,7 +1,12 @@
-bash = find_program('bash', native: true)
+bash = find_program('bash', native : true)
 
 gen_header = generator(
   bash,
-  arguments : [ '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
+  arguments : [
+    '-c',
+    '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"',
+    '_ignored_argv0',
+    '@OUTPUT@',
+  ],
   output : '@PLAINNAME@.gen.hh',
 )
diff --git a/nix-meson-build-support/libatomic/meson.build b/nix-meson-build-support/libatomic/meson.build
index d16d23817..1c014bee7 100644
--- a/nix-meson-build-support/libatomic/meson.build
+++ b/nix-meson-build-support/libatomic/meson.build
@@ -3,6 +3,6 @@
 # This is needed for std::atomic on some platforms
 # We did not manage to test this reliably on all platforms, so we hardcode
 # it for now.
-if host_machine.cpu_family() == 'arm'
+if host_machine.cpu_family() in [ 'arm', 'ppc' ]
   deps_other += cxx.find_library('atomic')
 endif
diff --git a/packaging/binary-tarball.nix b/packaging/binary-tarball.nix
index 2050384b0..86aae0ac5 100644
--- a/packaging/binary-tarball.nix
+++ b/packaging/binary-tarball.nix
@@ -37,6 +37,9 @@ runCommand "nix-binary-tarball-${version}" env ''
   substitute ${../scripts/install-systemd-multi-user.sh} $TMPDIR/install-systemd-multi-user.sh \
     --subst-var-by nix ${nix} \
     --subst-var-by cacert ${cacert}
+  substitute ${../scripts/install-freebsd-multi-user.sh} $TMPDIR/install-freebsd-multi-user.sh \
+    --subst-var-by nix ${nix} \
+    --subst-var-by cacert ${cacert}
   substitute ${../scripts/install-multi-user.sh} $TMPDIR/install-multi-user \
     --subst-var-by nix ${nix} \
     --subst-var-by cacert ${cacert}
@@ -48,6 +51,7 @@ runCommand "nix-binary-tarball-${version}" env ''
     shellcheck $TMPDIR/create-darwin-volume.sh
     shellcheck $TMPDIR/install-darwin-multi-user.sh
     shellcheck $TMPDIR/install-systemd-multi-user.sh
+    shellcheck $TMPDIR/install-freebsd-multi-user.sh
 
     # SC1091: Don't panic about not being able to source
     #         /etc/profile
@@ -64,6 +68,7 @@ runCommand "nix-binary-tarball-${version}" env ''
   chmod +x $TMPDIR/create-darwin-volume.sh
   chmod +x $TMPDIR/install-darwin-multi-user.sh
   chmod +x $TMPDIR/install-systemd-multi-user.sh
+  chmod +x $TMPDIR/install-freebsd-multi-user.sh
   chmod +x $TMPDIR/install-multi-user
   dir=nix-${version}-${system}
   fn=$out/$dir.tar.xz
@@ -82,6 +87,7 @@ runCommand "nix-binary-tarball-${version}" env ''
     $TMPDIR/create-darwin-volume.sh \
     $TMPDIR/install-darwin-multi-user.sh \
     $TMPDIR/install-systemd-multi-user.sh \
+    $TMPDIR/install-freebsd-multi-user.sh \
     $TMPDIR/install-multi-user \
     $TMPDIR/reginfo \
     $(cat ${installerClosureInfo}/store-paths)
diff --git a/packaging/components.nix b/packaging/components.nix
index b40bd45b0..b5fad4043 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -54,12 +54,12 @@ let
     preConfigure =
       prevAttrs.preConfigure or ""
       +
-        # Update the repo-global .version file.
-        # Symlink ./.version points there, but by default only workDir is writable.
-        ''
-          chmod u+w ./.version
-          echo ${finalAttrs.version} > ./.version
-        '';
+      # Update the repo-global .version file.
+      # Symlink ./.version points there, but by default only workDir is writable.
+      ''
+        chmod u+w ./.version
+        echo ${finalAttrs.version} > ./.version
+      '';
   };
 
   localSourceLayer =
@@ -148,7 +148,8 @@ let
     nativeBuildInputs = [
       meson
       ninja
-    ] ++ prevAttrs.nativeBuildInputs or [ ];
+    ]
+    ++ prevAttrs.nativeBuildInputs or [ ];
     mesonCheckFlags = prevAttrs.mesonCheckFlags or [ ] ++ [
       "--print-errorlogs"
     ];
@@ -365,18 +366,33 @@ in
 
   nix-cmd = callPackage ../src/libcmd/package.nix { };
 
+  /**
+    The Nix command line interface. Note that this does not include its tests, whereas `nix-everything` does.
+  */
   nix-cli = callPackage ../src/nix/package.nix { version = fineVersion; };
 
   nix-functional-tests = callPackage ../tests/functional/package.nix {
     version = fineVersion;
   };
 
+  /**
+    The manual as would be published on https://nix.dev/reference/nix-manual
+  */
   nix-manual = callPackage ../doc/manual/package.nix { version = fineVersion; };
+  /**
+    Doxygen pages for C++ code
+  */
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { version = fineVersion; };
+  /**
+    Doxygen pages for the public C API
+  */
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { version = fineVersion; };
 
   nix-perl-bindings = callPackage ../src/perl/package.nix { };
 
+  /**
+    Combined package that has the CLI, libraries, and (assuming non-cross, no overrides) it requires that all tests succeed.
+  */
   nix-everything = callPackage ../packaging/everything.nix { } // {
     # Note: no `passthru.overrideAllMesonComponents` etc
     #       This would propagate into `nix.overrideAttrs f`, but then discard
diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index 7ce3bf125..981c1aa48 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -10,27 +10,8 @@
   stdenv,
 }:
 
-let
-  prevStdenv = stdenv;
-in
-
 let
   inherit (pkgs) lib;
-
-  stdenv = if prevStdenv.isDarwin && prevStdenv.isx86_64 then darwinStdenv else prevStdenv;
-
-  # Fix the following error with the default x86_64-darwin SDK:
-  #
-  #     error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
-  #
-  # Despite the use of the 10.13 deployment target here, the aligned
-  # allocation function Clang uses with this setting actually works
-  # all the way back to 10.6.
-  # NOTE: this is not just a version constraint, but a request to make Darwin
-  #       provide this version level of support. Removing this minimum version
-  #       request will regress the above error.
-  darwinStdenv = pkgs.overrideSDK prevStdenv { darwinMinVersion = "10.13"; };
-
 in
 scope: {
   inherit stdenv;
@@ -50,8 +31,40 @@ scope: {
         requiredSystemFeatures = [ ];
       };
 
-  boehmgc = pkgs.boehmgc.override {
-    enableLargeConfig = true;
+  boehmgc =
+    (pkgs.boehmgc.override {
+      enableLargeConfig = true;
+    }).overrideAttrs
+      (attrs: {
+        # Increase the initial mark stack size to avoid stack
+        # overflows, since these inhibit parallel marking (see
+        # GC_mark_some()). To check whether the mark stack is too
+        # small, run Nix with GC_PRINT_STATS=1 and look for messages
+        # such as `Mark stack overflow`, `No room to copy back mark
+        # stack`, and `Grew mark stack to ... frames`.
+        NIX_CFLAGS_COMPILE = "-DINITIAL_MARK_STACK_SIZE=1048576";
+      });
+
+  lowdown = pkgs.lowdown.overrideAttrs (prevAttrs: rec {
+    version = "2.0.2";
+    src = pkgs.fetchurl {
+      url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
+      hash = "sha512-cfzhuF4EnGmLJf5EGSIbWqJItY3npbRSALm+GarZ7SMU7Hr1xw0gtBFMpOdi5PBar4TgtvbnG4oRPh+COINGlA==";
+    };
+    nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ pkgs.buildPackages.bmake ];
+    postInstall =
+      lib.replaceStrings [ "lowdown.so.1" "lowdown.1.dylib" ] [ "lowdown.so.2" "lowdown.2.dylib" ]
+        prevAttrs.postInstall;
+  });
+
+  toml11 = pkgs.toml11.overrideAttrs rec {
+    version = "4.4.0";
+    src = pkgs.fetchFromGitHub {
+      owner = "ToruNiina";
+      repo = "toml11";
+      tag = "v${version}";
+      hash = "sha256-sgWKYxNT22nw376ttGsTdg0AMzOwp8QH3E8mx0BZJTQ=";
+    };
   };
 
   # TODO Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
@@ -62,6 +75,7 @@ scope: {
         "--with-context"
         "--with-coroutine"
         "--with-iostreams"
+        "--with-url"
       ];
       enableIcu = false;
     }).overrideAttrs
diff --git a/packaging/dev-shell.nix b/packaging/dev-shell.nix
index 8d3fa3852..949f79752 100644
--- a/packaging/dev-shell.nix
+++ b/packaging/dev-shell.nix
@@ -71,17 +71,16 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
     # We use this shell with the local checkout, not unpackPhase.
     src = null;
 
-    env =
-      {
-        # For `make format`, to work without installing pre-commit
-        _NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
-          modular.pre-commit.settings.rawConfig
-        }";
-      }
-      // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        CC_LD = "mold";
-        CXX_LD = "mold";
-      };
+    env = {
+      # For `make format`, to work without installing pre-commit
+      _NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
+        modular.pre-commit.settings.rawConfig
+      }";
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      CC_LD = "mold";
+      CXX_LD = "mold";
+    };
 
     mesonFlags =
       map (transformFlag "libutil") (ignoreCrossFile pkgs.nixComponents2.nix-util.mesonFlags)
@@ -113,27 +112,31 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
       ) pkgs.buildPackages.mesonEmulatorHook
       ++ [
         pkgs.buildPackages.cmake
+        pkgs.buildPackages.gnused
         pkgs.buildPackages.shellcheck
         pkgs.buildPackages.changelog-d
         modular.pre-commit.settings.package
         (pkgs.writeScriptBin "pre-commit-hooks-install" modular.pre-commit.settings.installationScript)
         pkgs.buildPackages.nixfmt-rfc-style
+        pkgs.buildPackages.gdb
       ]
       ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
         lib.hiPrio pkgs.buildPackages.clang-tools
       )
       ++ lib.optional stdenv.hostPlatform.isLinux pkgs.buildPackages.mold-wrapped;
 
-    buildInputs =
-      attrs.buildInputs or [ ]
-      ++ pkgs.nixComponents2.nix-util.buildInputs
-      ++ pkgs.nixComponents2.nix-store.buildInputs
-      ++ pkgs.nixComponents2.nix-store-tests.externalBuildInputs
-      ++ pkgs.nixComponents2.nix-fetchers.buildInputs
-      ++ pkgs.nixComponents2.nix-expr.buildInputs
-      ++ pkgs.nixComponents2.nix-expr.externalPropagatedBuildInputs
-      ++ pkgs.nixComponents2.nix-cmd.buildInputs
-      ++ lib.optionals havePerl pkgs.nixComponents2.nix-perl-bindings.externalBuildInputs
-      ++ lib.optional havePerl pkgs.perl;
+    buildInputs = [
+      pkgs.gbenchmark
+    ]
+    ++ attrs.buildInputs or [ ]
+    ++ pkgs.nixComponents2.nix-util.buildInputs
+    ++ pkgs.nixComponents2.nix-store.buildInputs
+    ++ pkgs.nixComponents2.nix-store-tests.externalBuildInputs
+    ++ pkgs.nixComponents2.nix-fetchers.buildInputs
+    ++ pkgs.nixComponents2.nix-expr.buildInputs
+    ++ pkgs.nixComponents2.nix-expr.externalPropagatedBuildInputs
+    ++ pkgs.nixComponents2.nix-cmd.buildInputs
+    ++ lib.optionals havePerl pkgs.nixComponents2.nix-perl-bindings.externalBuildInputs
+    ++ lib.optional havePerl pkgs.perl;
   }
 )
diff --git a/packaging/everything.nix b/packaging/everything.nix
index 5bf57f95a..f6bdad490 100644
--- a/packaging/everything.nix
+++ b/packaging/everything.nix
@@ -47,25 +47,25 @@
 }:
 
 let
-  libs =
-    {
-      inherit
-        nix-util
-        nix-util-c
-        nix-store
-        nix-store-c
-        nix-fetchers
-        nix-fetchers-c
-        nix-expr
-        nix-expr-c
-        nix-flake
-        nix-flake-c
-        nix-main
-        nix-main-c
-        nix-cmd
-        ;
-    }
-    // lib.optionalAttrs
+  libs = {
+    inherit
+      nix-util
+      nix-util-c
+      nix-store
+      nix-store-c
+      nix-fetchers
+      nix-fetchers-c
+      nix-expr
+      nix-expr-c
+      nix-flake
+      nix-flake-c
+      nix-main
+      nix-main-c
+      nix-cmd
+      ;
+  }
+  //
+    lib.optionalAttrs
       (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
       {
         # Currently fails in static build
@@ -127,20 +127,19 @@ stdenv.mkDerivation (finalAttrs: {
   */
   dontFixup = true;
 
-  checkInputs =
-    [
-      # Make sure the unit tests have passed
-      nix-util-tests.tests.run
-      nix-store-tests.tests.run
-      nix-expr-tests.tests.run
-      nix-fetchers-tests.tests.run
-      nix-flake-tests.tests.run
+  checkInputs = [
+    # Make sure the unit tests have passed
+    nix-util-tests.tests.run
+    nix-store-tests.tests.run
+    nix-expr-tests.tests.run
+    nix-fetchers-tests.tests.run
+    nix-flake-tests.tests.run
 
-      # Make sure the functional tests have passed
-      nix-functional-tests
-    ]
-    ++ lib.optionals
-      (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+    # Make sure the functional tests have passed
+    nix-functional-tests
+  ]
+  ++
+    lib.optionals (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
       [
         # Perl currently fails in static build
         # TODO: Split out tests into a separate derivation?
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 27c09d9c9..9f9749bde 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -223,10 +223,17 @@ in
   dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
 
   # # Line coverage analysis.
-  # coverage = nixpkgsFor.x86_64-linux.native.nix.override {
-  #   pname = "nix-coverage";
-  #   withCoverageChecks = true;
-  # };
+  coverage =
+    (import ./../ci/gha/tests rec {
+      withCoverage = true;
+      pkgs = nixpkgsFor.x86_64-linux.nativeForStdenv.clangStdenv;
+      nixComponents = pkgs.nixComponents2;
+      nixFlake = null;
+      getStdenv = p: p.clangStdenv;
+    }).codeCoverage.coverageReports.overrideAttrs
+      {
+        name = "nix-coverage"; # For historical consistency
+      };
 
   # Nix's manual
   manual = nixpkgsFor.x86_64-linux.native.nixComponents2.nix-manual;
@@ -240,7 +247,9 @@ in
   # System tests.
   tests =
     import ../tests/nixos {
-      inherit lib nixpkgs nixpkgsFor;
+      inherit lib nixpkgs;
+      pkgs = nixpkgsFor.x86_64-linux.native;
+      nixComponents = nixpkgsFor.x86_64-linux.native.nixComponents2;
       inherit (self.inputs) nixpkgs-23-11;
     }
     // {
diff --git a/scripts/install-freebsd-multi-user.sh b/scripts/install-freebsd-multi-user.sh
new file mode 100644
index 000000000..0d8b85ec4
--- /dev/null
+++ b/scripts/install-freebsd-multi-user.sh
@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+
+set -eu
+set -o pipefail
+
+# System specific settings
+# FreeBSD typically uses UIDs from 1001+ for regular users,
+# so we'll use a range that's unlikely to conflict
+export NIX_FIRST_BUILD_UID="${NIX_FIRST_BUILD_UID:-30001}"
+export NIX_BUILD_GROUP_ID="${NIX_BUILD_GROUP_ID:-30000}"
+export NIX_BUILD_USER_NAME_TEMPLATE="nixbld%d"
+
+# FreeBSD service paths
+readonly SERVICE_SRC=/etc/rc.d/nix-daemon
+readonly SERVICE_DEST=/usr/local/etc/rc.d/nix-daemon
+
+poly_cure_artifacts() {
+    :
+}
+
+poly_service_installed_check() {
+    if [ -f "$SERVICE_DEST" ]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
+poly_service_uninstall_directions() {
+    cat <<EOF
+$1. Delete the rc.d service
+
+  sudo service nix-daemon stop
+  sudo rm -f $SERVICE_DEST
+  sudo sysrc -x nix_daemon_enable
+
+EOF
+}
+
+poly_service_setup_note() {
+    cat <<EOF
+ - link the nix-daemon rc.d service to $SERVICE_DEST
+
+EOF
+}
+
+poly_extra_try_me_commands() {
+    cat <<EOF
+  $ sudo service nix-daemon start
+EOF
+}
+
+poly_configure_nix_daemon_service() {
+    task "Setting up the nix-daemon rc.d service"
+
+    # Ensure the rc.d directory exists
+    _sudo "to create the rc.d directory" \
+          mkdir -p /usr/local/etc/rc.d
+
+    # Link the pre-installed rc.d script
+    _sudo "to set up the nix-daemon service" \
+          ln -sfn "/nix/var/nix/profiles/default$SERVICE_SRC" "$SERVICE_DEST"
+
+    _sudo "to enable the nix-daemon service" \
+          sysrc nix_daemon_enable=YES
+
+    _sudo "to start the nix-daemon" \
+          service nix-daemon start
+}
+
+poly_group_exists() {
+    pw group show "$1" > /dev/null 2>&1
+}
+
+poly_group_id_get() {
+    pw group show "$1" | cut -d: -f3
+}
+
+poly_create_build_group() {
+    _sudo "Create the Nix build group, $NIX_BUILD_GROUP_NAME" \
+          pw groupadd -n "$NIX_BUILD_GROUP_NAME" -g "$NIX_BUILD_GROUP_ID" >&2
+}
+
+poly_user_exists() {
+    pw user show "$1" > /dev/null 2>&1
+}
+
+poly_user_id_get() {
+    pw user show "$1" | cut -d: -f3
+}
+
+poly_user_hidden_get() {
+    # FreeBSD doesn't have a concept of hidden users like macOS
+    echo "0"
+}
+
+poly_user_hidden_set() {
+    # No-op on FreeBSD
+    true
+}
+
+poly_user_home_get() {
+    pw user show "$1" | cut -d: -f9
+}
+
+poly_user_home_set() {
+    _sudo "in order to give $1 a safe home directory" \
+          pw usermod -n "$1" -d "$2"
+}
+
+poly_user_note_get() {
+    pw user show "$1" | cut -d: -f8
+}
+
+poly_user_note_set() {
+    _sudo "in order to give $1 a useful comment" \
+          pw usermod -n "$1" -c "$2"
+}
+
+poly_user_shell_get() {
+    pw user show "$1" | cut -d: -f10
+}
+
+poly_user_shell_set() {
+    _sudo "in order to prevent $1 from logging in" \
+          pw usermod -n "$1" -s "$2"
+}
+
+poly_user_in_group_check() {
+    groups "$1" 2>/dev/null | grep -q "\<$2\>"
+}
+
+poly_user_in_group_set() {
+    _sudo "Add $1 to the $2 group" \
+          pw groupmod -n "$2" -m "$1"
+}
+
+poly_user_primary_group_get() {
+    pw user show "$1" | cut -d: -f4
+}
+
+poly_user_primary_group_set() {
+    _sudo "to let the nix daemon use this user for builds" \
+          pw usermod -n "$1" -g "$2"
+}
+
+poly_create_build_user() {
+    username=$1
+    uid=$2
+    builder_num=$3
+
+    _sudo "Creating the Nix build user, $username" \
+          pw useradd \
+          -n "$username" \
+          -u "$uid" \
+          -g "$NIX_BUILD_GROUP_NAME" \
+          -G "$NIX_BUILD_GROUP_NAME" \
+          -d /var/empty \
+          -s /sbin/nologin \
+          -c "Nix build user $builder_num"
+}
+
+poly_prepare_to_install() {
+    # FreeBSD-specific preparation steps
+    :
+}
+
+poly_configure_default_profile_targets() {
+    # FreeBSD-specific profile locations
+    # FreeBSD uses /usr/local/etc for third-party shell configurations
+    # Include both profile (for login shells) and bashrc (for interactive shells)
+    echo "/usr/local/etc/profile /usr/local/etc/bashrc /usr/local/etc/profile.d/nix.sh /usr/local/etc/zshrc"
+}
diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index f051ccc46..477eb1fd6 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -33,7 +33,8 @@ readonly NIX_BUILD_GROUP_NAME="nixbld"
 readonly NIX_ROOT="/nix"
 readonly NIX_EXTRA_CONF=${NIX_EXTRA_CONF:-}
 
-readonly PROFILE_TARGETS=("/etc/bashrc" "/etc/profile.d/nix.sh" "/etc/zshrc" "/etc/bash.bashrc" "/etc/zsh/zshrc")
+# PROFILE_TARGETS will be set later after OS-specific scripts are loaded
+PROFILE_TARGETS=()
 readonly PROFILE_BACKUP_SUFFIX=".backup-before-nix"
 readonly PROFILE_NIX_FILE="$NIX_ROOT/var/nix/profiles/default/etc/profile.d/nix-daemon.sh"
 
@@ -99,6 +100,14 @@ is_os_darwin() {
     fi
 }
 
+is_os_freebsd() {
+    if [ "$(uname -s)" = "FreeBSD" ]; then
+        return 0
+    else
+        return 1
+    fi
+}
+
 contact_us() {
     echo "You can open an issue at"
     echo "https://github.com/NixOS/nix/issues/new?labels=installer&template=installer.md"
@@ -498,6 +507,10 @@ You have aborted the installation.
 EOF
         fi
     fi
+
+    if is_os_freebsd; then
+        ok "Detected FreeBSD, will set up rc.d service for nix-daemon"
+    fi
 }
 
 setup_report() {
@@ -834,8 +847,13 @@ install_from_extracted_nix() {
     (
         cd "$EXTRACTED_NIX_PATH"
 
-        _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
-              cp -RPp ./store/* "$NIX_ROOT/store/"
+        if is_os_darwin || is_os_freebsd; then
+            _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
+                  cp -RPp ./store/* "$NIX_ROOT/store/"
+        else
+            _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
+                  cp -RP --preserve=ownership,timestamps ./store/* "$NIX_ROOT/store/"
+        fi
 
         _sudo "to make the new store non-writable at $NIX_ROOT/store" \
               chmod -R ugo-w "$NIX_ROOT/store/"
@@ -984,11 +1002,22 @@ main() {
         # shellcheck source=./install-systemd-multi-user.sh
         . "$EXTRACTED_NIX_PATH/install-systemd-multi-user.sh" # most of this works on non-systemd distros also
         check_required_system_specific_settings "install-systemd-multi-user.sh"
+    elif is_os_freebsd; then
+        # shellcheck source=./install-freebsd-multi-user.sh
+        . "$EXTRACTED_NIX_PATH/install-freebsd-multi-user.sh"
+        check_required_system_specific_settings "install-freebsd-multi-user.sh"
     else
         failure "Sorry, I don't know what to do on $(uname)"
     fi
 
 
+    # Set profile targets after OS-specific scripts are loaded
+    if command -v poly_configure_default_profile_targets > /dev/null 2>&1; then
+        PROFILE_TARGETS=($(poly_configure_default_profile_targets))
+    else
+        PROFILE_TARGETS=("/etc/bashrc" "/etc/profile.d/nix.sh" "/etc/zshrc" "/etc/bash.bashrc" "/etc/zsh/zshrc")
+    fi
+
     welcome_to_nix
 
     if ! is_root; then
diff --git a/scripts/install-nix-from-tarball.sh b/scripts/install-nix-from-tarball.sh
index 8d127a9c5..fd00460ec 100644
--- a/scripts/install-nix-from-tarball.sh
+++ b/scripts/install-nix-from-tarball.sh
@@ -26,8 +26,10 @@ if [ -z "$HOME" ]; then
     exit 1
 fi
 
+OS="$(uname -s)"
+
 # macOS support for 10.12.6 or higher
-if [ "$(uname -s)" = "Darwin" ]; then
+if [ "$OS" = "Darwin" ]; then
     IFS='.' read -r macos_major macos_minor macos_patch << EOF
 $(sw_vers -productVersion)
 EOF
@@ -39,11 +41,11 @@ EOF
 fi
 
 # Determine if we could use the multi-user installer or not
-if [ "$(uname -s)" = "Linux" ]; then
-    echo "Note: a multi-user installation is possible. See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation" >&2
+if [ "$OS" = "Linux" ] || [ "$OS" = "FreeBSD" ]; then
+    echo "Note: a multi-user installation is possible. See https://nix.dev/manual/nix/stable/installation/installing-binary.html#multi-user-installation" >&2
 fi
 
-case "$(uname -s)" in
+case "$OS" in
     "Darwin")
         INSTALL_MODE=daemon;;
     *)
@@ -60,7 +62,7 @@ while [ $# -gt 0 ]; do
             ACTION=install
             ;;
         --no-daemon)
-            if [ "$(uname -s)" = "Darwin" ]; then
+            if [ "$OS" = "Darwin" ]; then
                 printf '\e[1;31mError: --no-daemon installs are no-longer supported on Darwin/macOS!\e[0m\n' >&2
                 exit 1
             fi
@@ -96,7 +98,7 @@ while [ $# -gt 0 ]; do
                 echo "              providing multi-user support and better isolation for local builds."
                 echo "              Both for security and reproducibility, this method is recommended if"
                 echo "              supported on your platform."
-                echo "              See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation"
+                echo "              See https://nix.dev/manual/nix/stable/installation/installing-binary.html#multi-user-installation"
                 echo ""
                 echo " --no-daemon: Simple, single-user installation that does not require root and is"
                 echo "              trivial to uninstall."
@@ -123,6 +125,13 @@ while [ $# -gt 0 ]; do
 done
 
 if [ "$INSTALL_MODE" = "daemon" ]; then
+    # Check for bash on systems that don't have it by default
+    if [ "$OS" = "FreeBSD" ] && ! command -v bash >/dev/null 2>&1; then
+        printf '\e[1;31mError: bash is required for multi-user installation but was not found.\e[0m\n' >&2
+        printf 'Please install bash first:\n' >&2
+        printf '  pkg install bash\n' >&2
+        exit 1
+    fi
     printf '\e[1;31mSwitching to the Multi-user Installer\e[0m\n'
     exec "$self/install-multi-user" $ACTION
     exit 0
@@ -144,7 +153,7 @@ if ! [ -e "$dest" ]; then
 fi
 
 if ! [ -w "$dest" ]; then
-    echo "$0: directory $dest exists, but is not writable by you. This could indicate that another user has already performed a single-user installation of Nix on this system. If you wish to enable multi-user support see https://nixos.org/manual/nix/stable/installation/multi-user.html. If you wish to continue with a single-user install for $USER please run 'chown -R $USER $dest' as root." >&2
+    echo "$0: directory $dest exists, but is not writable by you. This could indicate that another user has already performed a single-user installation of Nix on this system. If you wish to enable multi-user support see https://nix.dev/manual/nix/stable/installation/multi-user.html. If you wish to continue with a single-user install for $USER please run 'chown -R $USER $dest' as root." >&2
     exit 1
 fi
 
@@ -167,7 +176,11 @@ for i in $(cd "$self/store" >/dev/null && echo ./*); do
         rm -rf "$i_tmp"
     fi
     if ! [ -e "$dest/store/$i" ]; then
-        cp -RPp "$self/store/$i" "$i_tmp"
+        if [ "$OS" = "Darwin" ] || [ "$OS" = "FreeBSD" ]; then
+            cp -RPp "$self/store/$i" "$i_tmp"
+        else
+            cp -RP --preserve=ownership,timestamps "$self/store/$i" "$i_tmp"
+        fi
         chmod -R a-w "$i_tmp"
         chmod +w "$i_tmp"
         mv "$i_tmp" "$dest/store/$i"
diff --git a/scripts/meson.build b/scripts/meson.build
index 777da42b1..bbcf3ef56 100644
--- a/scripts/meson.build
+++ b/scripts/meson.build
@@ -2,19 +2,19 @@ configure_file(
   input : 'nix-profile.sh.in',
   output : 'nix-profile.sh',
   configuration : {
-    'localstatedir': localstatedir,
-  }
+    'localstatedir' : localstatedir,
+  },
 )
 
 foreach rc : [ '.sh', '.fish', '-daemon.sh', '-daemon.fish' ]
   configure_file(
-    input : 'nix-profile' + rc  + '.in',
+    input : 'nix-profile' + rc + '.in',
     output : 'nix' + rc,
     install : true,
     install_dir : get_option('profile-dir'),
     install_mode : 'rw-r--r--',
     configuration : {
-      'localstatedir': localstatedir,
+      'localstatedir' : localstatedir,
     },
   )
 endforeach
diff --git a/scripts/serve-installer-for-github-actions b/scripts/serve-installer-for-github-actions
deleted file mode 100755
index 2efd2aa32..000000000
--- a/scripts/serve-installer-for-github-actions
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-if [[ ! -d out ]]; then
-  echo "run prepare-installer-for-github-actions first"
-  exit 1
-fi
-cd out
-PORT=${PORT:-8126}
-nohup python -m http.server "$PORT" >/dev/null 2>&1 &
-pid=$!
-
-while ! curl -s "http://localhost:$PORT"; do
-  sleep 1
-  if ! kill -0 $pid; then
-    echo "Failed to start http server"
-    exit 1
-  fi
-done
-
-echo 'To install nix, run the following command:'
-echo "sh <(curl http://localhost:$PORT/install) --tarball-url-prefix http://localhost:$PORT"
diff --git a/src/external-api-docs/meson.build b/src/external-api-docs/meson.build
index 62474ffe4..cba6f646b 100644
--- a/src/external-api-docs/meson.build
+++ b/src/external-api-docs/meson.build
@@ -1,4 +1,5 @@
-project('nix-external-api-docs',
+project(
+  'nix-external-api-docs',
   version : files('.version'),
   meson_version : '>= 1.1',
   license : 'LGPL-2.1-or-later',
@@ -10,7 +11,7 @@ doxygen_cfg = configure_file(
   input : 'doxygen.cfg.in',
   output : 'doxygen.cfg',
   configuration : {
-    'PROJECT_NUMBER': meson.project_version(),
+    'PROJECT_NUMBER' : meson.project_version(),
     'OUTPUT_DIRECTORY' : meson.current_build_dir(),
     'src' : fs.parent(fs.parent(meson.project_source_root())),
   },
@@ -20,7 +21,7 @@ doxygen = find_program('doxygen', native : true, required : true)
 
 custom_target(
   'external-api-docs',
-  command : [ doxygen , doxygen_cfg ],
+  command : [ doxygen, doxygen_cfg ],
   input : [
     doxygen_cfg,
   ],
diff --git a/src/internal-api-docs/doxygen.cfg.in b/src/internal-api-docs/doxygen.cfg.in
index 950497ca3..2769edd9f 100644
--- a/src/internal-api-docs/doxygen.cfg.in
+++ b/src/internal-api-docs/doxygen.cfg.in
@@ -57,9 +57,7 @@ INPUT                  = \
   @src@/libutil/args \
   @src@/libutil-tests \
   @src@/libutil-test-support/tests \
-  @src@/nix \
-  @src@/nix-env \
-  @src@/nix-store
+  @src@/nix
 
 # If the MACRO_EXPANSION tag is set to YES, doxygen will expand all macro names
 # in the source code. If set to NO, only conditional compilation will be
diff --git a/src/internal-api-docs/meson.build b/src/internal-api-docs/meson.build
index c0426621e..daab4c93c 100644
--- a/src/internal-api-docs/meson.build
+++ b/src/internal-api-docs/meson.build
@@ -1,4 +1,5 @@
-project('nix-internal-api-docs',
+project(
+  'nix-internal-api-docs',
   version : files('.version'),
   meson_version : '>= 1.1',
   license : 'LGPL-2.1-or-later',
@@ -10,7 +11,7 @@ doxygen_cfg = configure_file(
   input : 'doxygen.cfg.in',
   output : 'doxygen.cfg',
   configuration : {
-    'PROJECT_NUMBER': meson.project_version(),
+    'PROJECT_NUMBER' : meson.project_version(),
     'OUTPUT_DIRECTORY' : meson.current_build_dir(),
     'BUILD_ROOT' : meson.build_root(),
     'src' : fs.parent(fs.parent(meson.project_source_root())) / 'src',
@@ -21,7 +22,7 @@ doxygen = find_program('doxygen', native : true, required : true)
 
 custom_target(
   'internal-api-docs',
-  command : [ doxygen , doxygen_cfg ],
+  command : [ doxygen, doxygen_cfg ],
   input : [
     doxygen_cfg,
   ],
diff --git a/src/libcmd/built-path.cc b/src/libcmd/built-path.cc
index 1238f9422..80d97dc3e 100644
--- a/src/libcmd/built-path.cc
+++ b/src/libcmd/built-path.cc
@@ -10,23 +10,13 @@
 namespace nix {
 
 // Custom implementation to avoid `ref` ptr equality
-GENERATE_CMP_EXT(
-    ,
-    std::strong_ordering,
-    SingleBuiltPathBuilt,
-    *me->drvPath,
-    me->output);
+GENERATE_CMP_EXT(, std::strong_ordering, SingleBuiltPathBuilt, *me->drvPath, me->output);
 
 // Custom implementation to avoid `ref` ptr equality
 
 // TODO no `GENERATE_CMP_EXT` because no `std::set::operator<=>` on
 // Darwin, per header.
-GENERATE_EQUAL(
-    ,
-    BuiltPathBuilt ::,
-    BuiltPathBuilt,
-    *me->drvPath,
-    me->outputs);
+GENERATE_EQUAL(, BuiltPathBuilt ::, BuiltPathBuilt, *me->drvPath, me->outputs);
 
 StorePath SingleBuiltPath::outPath() const
 {
@@ -34,8 +24,8 @@ StorePath SingleBuiltPath::outPath() const
         overloaded{
             [](const SingleBuiltPath::Opaque & p) { return p.path; },
             [](const SingleBuiltPath::Built & b) { return b.output.second; },
-        }, raw()
-    );
+        },
+        raw());
 }
 
 StorePathSet BuiltPath::outPaths() const
@@ -49,13 +39,13 @@ StorePathSet BuiltPath::outPaths() const
                     res.insert(path);
                 return res;
             },
-        }, raw()
-    );
+        },
+        raw());
 }
 
 SingleDerivedPath::Built SingleBuiltPath::Built::discardOutputPath() const
 {
-    return SingleDerivedPath::Built {
+    return SingleDerivedPath::Built{
         .drvPath = make_ref<SingleDerivedPath>(drvPath->discardOutputPath()),
         .output = output.first,
     };
@@ -65,14 +55,10 @@ SingleDerivedPath SingleBuiltPath::discardOutputPath() const
 {
     return std::visit(
         overloaded{
-            [](const SingleBuiltPath::Opaque & p) -> SingleDerivedPath {
-                return p;
-            },
-            [](const SingleBuiltPath::Built & b) -> SingleDerivedPath {
-                return b.discardOutputPath();
-            },
-        }, raw()
-    );
+            [](const SingleBuiltPath::Opaque & p) -> SingleDerivedPath { return p; },
+            [](const SingleBuiltPath::Built & b) -> SingleDerivedPath { return b.discardOutputPath(); },
+        },
+        raw());
 }
 
 nlohmann::json BuiltPath::Built::toJSON(const StoreDirConfig & store) const
@@ -97,16 +83,12 @@ nlohmann::json SingleBuiltPath::Built::toJSON(const StoreDirConfig & store) cons
 
 nlohmann::json SingleBuiltPath::toJSON(const StoreDirConfig & store) const
 {
-    return std::visit([&](const auto & buildable) {
-        return buildable.toJSON(store);
-    }, raw());
+    return std::visit([&](const auto & buildable) { return buildable.toJSON(store); }, raw());
 }
 
 nlohmann::json BuiltPath::toJSON(const StoreDirConfig & store) const
 {
-    return std::visit([&](const auto & buildable) {
-        return buildable.toJSON(store);
-    }, raw());
+    return std::visit([&](const auto & buildable) { return buildable.toJSON(store); }, raw());
 }
 
 RealisedPath::Set BuiltPath::toRealisedPaths(Store & store) const
@@ -116,20 +98,18 @@ RealisedPath::Set BuiltPath::toRealisedPaths(Store & store) const
         overloaded{
             [&](const BuiltPath::Opaque & p) { res.insert(p.path); },
             [&](const BuiltPath::Built & p) {
-                auto drvHashes =
-                    staticOutputHashes(store, store.readDerivation(p.drvPath->outPath()));
-                for (auto& [outputName, outputPath] : p.outputs) {
-                    if (experimentalFeatureSettings.isEnabled(
-                                Xp::CaDerivations)) {
+                auto drvHashes = staticOutputHashes(store, store.readDerivation(p.drvPath->outPath()));
+                for (auto & [outputName, outputPath] : p.outputs) {
+                    if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
                         auto drvOutput = get(drvHashes, outputName);
                         if (!drvOutput)
                             throw Error(
                                 "the derivation '%s' has unrealised output '%s' (derived-path.cc/toRealisedPaths)",
-                                store.printStorePath(p.drvPath->outPath()), outputName);
-                        auto thisRealisation = store.queryRealisation(
-                            DrvOutput{*drvOutput, outputName});
-                        assert(thisRealisation);  // We’ve built it, so we must
-                                                  // have the realisation
+                                store.printStorePath(p.drvPath->outPath()),
+                                outputName);
+                        auto thisRealisation = store.queryRealisation(DrvOutput{*drvOutput, outputName});
+                        assert(thisRealisation); // We’ve built it, so we must
+                                                 // have the realisation
                         res.insert(*thisRealisation);
                     } else {
                         res.insert(outputPath);
@@ -141,4 +121,4 @@ RealisedPath::Set BuiltPath::toRealisedPaths(Store & store) const
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/command-installable-value.cc b/src/libcmd/command-installable-value.cc
index 0884f17e9..34e161b4b 100644
--- a/src/libcmd/command-installable-value.cc
+++ b/src/libcmd/command-installable-value.cc
@@ -8,4 +8,4 @@ void InstallableValueCommand::run(ref<Store> store, ref<Installable> installable
     run(store, installableValue);
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index 31f64fd5a..6b6bbe345 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -402,4 +402,4 @@ void MixOutLinkBase::createOutLinksMaybe(const std::vector<BuiltPathWithResult>
             createOutLinks(outLink, toBuiltPaths(buildables), *store2);
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index d275beb12..f7e086c16 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -15,15 +15,15 @@
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/cmd/compatibility-settings.hh"
 #include "nix/expr/eval-settings.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
-
 fetchers::Settings fetchSettings;
 
 static GlobalConfig::Register rFetchSettings(&fetchSettings);
 
-EvalSettings evalSettings {
+EvalSettings evalSettings{
     settings.readOnlyMode,
     {
         {
@@ -31,7 +31,7 @@ EvalSettings evalSettings {
             [](EvalState & state, std::string_view rest) {
                 experimentalFeatureSettings.require(Xp::Flakes);
                 // FIXME `parseFlakeRef` should take a `std::string_view`.
-                auto flakeRef = parseFlakeRef(fetchSettings, std::string { rest }, {}, true, false);
+                auto flakeRef = parseFlakeRef(fetchSettings, std::string{rest}, {}, true, false);
                 debug("fetching flake search path element '%s''", rest);
                 auto [accessor, lockedRef] = flakeRef.resolve(state.store).lazyFetch(state.store);
                 auto storePath = nix::fetchToStore(
@@ -49,17 +49,14 @@ EvalSettings evalSettings {
 
 static GlobalConfig::Register rEvalSettings(&evalSettings);
 
-
 flake::Settings flakeSettings;
 
 static GlobalConfig::Register rFlakeSettings(&flakeSettings);
 
-
-CompatibilitySettings compatibilitySettings {};
+CompatibilitySettings compatibilitySettings{};
 
 static GlobalConfig::Register rCompatibilitySettings(&compatibilitySettings);
 
-
 MixEvalArgs::MixEvalArgs()
 {
     addFlag({
@@ -67,7 +64,9 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the value *expr* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "expr"},
-        .handler = {[&](std::string name, std::string expr) { autoArgs.insert_or_assign(name, AutoArg{AutoArgExpr{expr}}); }},
+        .handler = {[&](std::string name, std::string expr) {
+            autoArgs.insert_or_assign(name, AutoArg{AutoArgExpr{expr}});
+        }},
     });
 
     addFlag({
@@ -75,7 +74,9 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the string *string* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "string"},
-        .handler = {[&](std::string name, std::string s) { autoArgs.insert_or_assign(name, AutoArg{AutoArgString{s}}); }},
+        .handler = {[&](std::string name, std::string s) {
+            autoArgs.insert_or_assign(name, AutoArg{AutoArgString{s}});
+        }},
     });
 
     addFlag({
@@ -83,7 +84,9 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the contents of file *path* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "path"},
-        .handler = {[&](std::string name, std::string path) { autoArgs.insert_or_assign(name, AutoArg{AutoArgFile{path}}); }},
+        .handler = {[&](std::string name, std::string path) {
+            autoArgs.insert_or_assign(name, AutoArg{AutoArgFile{path}});
+        }},
         .completer = completePath,
     });
 
@@ -107,18 +110,14 @@ MixEvalArgs::MixEvalArgs()
   )",
         .category = category,
         .labels = {"path"},
-        .handler = {[&](std::string s) {
-            lookupPath.elements.emplace_back(LookupPath::Elem::parse(s));
-        }},
+        .handler = {[&](std::string s) { lookupPath.elements.emplace_back(LookupPath::Elem::parse(s)); }},
     });
 
     addFlag({
         .longName = "impure",
         .description = "Allow access to mutable paths and repositories.",
         .category = category,
-        .handler = {[&]() {
-            evalSettings.pureEval = false;
-        }},
+        .handler = {[&]() { evalSettings.pureEval = false; }},
     });
 
     addFlag({
@@ -130,7 +129,8 @@ MixEvalArgs::MixEvalArgs()
             auto from = parseFlakeRef(fetchSettings, _from, std::filesystem::current_path().string());
             auto to = parseFlakeRef(fetchSettings, _to, std::filesystem::current_path().string());
             fetchers::Attrs extraAttrs;
-            if (to.subdir != "") extraAttrs["dir"] = to.subdir;
+            if (to.subdir != "")
+                extraAttrs["dir"] = to.subdir;
             fetchers::overrideRegistry(from.input, to.input, extraAttrs);
         }},
         .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
@@ -141,7 +141,7 @@ MixEvalArgs::MixEvalArgs()
     addFlag({
         .longName = "eval-store",
         .description =
-          R"(
+            R"(
             The [URL of the Nix store](@docroot@/store/types/index.md#store-url-format)
             to use for evaluation, i.e. to store derivations (`.drv` files) and inputs referenced by them.
           )",
@@ -156,20 +156,21 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
     auto res = state.buildBindings(autoArgs.size());
     for (auto & [name, arg] : autoArgs) {
         auto v = state.allocValue();
-        std::visit(overloaded {
-            [&](const AutoArgExpr & arg) {
-                state.mkThunk_(*v, state.parseExprFromString(arg.expr, compatibilitySettings.nixShellShebangArgumentsRelativeToScript ? state.rootPath(absPath(getCommandBaseDir())) : state.rootPath(".")));
-            },
-            [&](const AutoArgString & arg) {
-                v->mkString(arg.s);
-            },
-            [&](const AutoArgFile & arg) {
-                v->mkString(readFile(arg.path.string()));
-            },
-            [&](const AutoArgStdin & arg) {
-                v->mkString(readFile(STDIN_FILENO));
-            }
-        }, arg);
+        std::visit(
+            overloaded{
+                [&](const AutoArgExpr & arg) {
+                    state.mkThunk_(
+                        *v,
+                        state.parseExprFromString(
+                            arg.expr,
+                            compatibilitySettings.nixShellShebangArgumentsRelativeToScript
+                                ? state.rootPath(absPath(getCommandBaseDir()))
+                                : state.rootPath(".")));
+                },
+                [&](const AutoArgString & arg) { v->mkString(arg.s); },
+                [&](const AutoArgFile & arg) { v->mkString(readFile(arg.path.string())); },
+                [&](const AutoArgStdin & arg) { v->mkString(readFile(STDIN_FILENO)); }},
+            arg);
         res.insert(state.symbols.create(name), v);
     }
     return res.finish();
@@ -178,15 +179,8 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
 SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * baseDir)
 {
     if (EvalSettings::isPseudoUrl(s)) {
-        auto accessor = fetchers::downloadTarball(
-            state.store,
-            state.fetchSettings,
-            EvalSettings::resolvePseudoUrl(s));
-        auto storePath = fetchToStore(
-            state.fetchSettings,
-            *state.store,
-            SourcePath(accessor),
-            FetchMode::Copy);
+        auto accessor = fetchers::downloadTarball(state.store, state.fetchSettings, EvalSettings::resolvePseudoUrl(s));
+        auto storePath = fetchToStore(state.fetchSettings, *state.store, SourcePath(accessor), FetchMode::Copy);
         return state.storePath(storePath);
     }
 
@@ -195,11 +189,7 @@ SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * bas
         auto flakeRef = parseFlakeRef(fetchSettings, std::string(s.substr(6)), {}, true, false);
         auto [accessor, lockedRef] = flakeRef.resolve(state.store).lazyFetch(state.store);
         auto storePath = nix::fetchToStore(
-            state.fetchSettings,
-            *state.store,
-            SourcePath(accessor),
-            FetchMode::Copy,
-            lockedRef.input.getName());
+            state.fetchSettings, *state.store, SourcePath(accessor), FetchMode::Copy, lockedRef.input.getName());
         state.allowPath(storePath);
         return state.storePath(storePath);
     }
@@ -213,4 +203,4 @@ SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * bas
         return state.rootPath(baseDir ? absPath(s, *baseDir) : absPath(s));
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/editor-for.cc b/src/libcmd/editor-for.cc
index a5d635859..95fdf95ad 100644
--- a/src/libcmd/editor-for.cc
+++ b/src/libcmd/editor-for.cc
@@ -11,14 +11,12 @@ Strings editorFor(const SourcePath & file, uint32_t line)
         throw Error("cannot open '%s' in an editor because it has no physical path", file);
     auto editor = getEnv("EDITOR").value_or("cat");
     auto args = tokenizeString<Strings>(editor);
-    if (line > 0 && (
-        editor.find("emacs") != std::string::npos ||
-        editor.find("nano") != std::string::npos ||
-        editor.find("vim") != std::string::npos ||
-        editor.find("kak") != std::string::npos))
+    if (line > 0
+        && (editor.find("emacs") != std::string::npos || editor.find("nano") != std::string::npos
+            || editor.find("vim") != std::string::npos || editor.find("kak") != std::string::npos))
         args.push_back(fmt("+%d", line));
     args.push_back(path->string());
     return args;
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/built-path.hh b/src/libcmd/include/nix/cmd/built-path.hh
index c885876a7..d41529e5a 100644
--- a/src/libcmd/include/nix/cmd/built-path.hh
+++ b/src/libcmd/include/nix/cmd/built-path.hh
@@ -8,7 +8,8 @@ namespace nix {
 
 struct SingleBuiltPath;
 
-struct SingleBuiltPathBuilt {
+struct SingleBuiltPathBuilt
+{
     ref<SingleBuiltPath> drvPath;
     std::pair<std::string, StorePath> output;
 
@@ -18,26 +19,25 @@ struct SingleBuiltPathBuilt {
     static SingleBuiltPathBuilt parse(const StoreDirConfig & store, std::string_view, std::string_view);
     nlohmann::json toJSON(const StoreDirConfig & store) const;
 
-    bool operator ==(const SingleBuiltPathBuilt &) const noexcept;
-    std::strong_ordering operator <=>(const SingleBuiltPathBuilt &) const noexcept;
+    bool operator==(const SingleBuiltPathBuilt &) const noexcept;
+    std::strong_ordering operator<=>(const SingleBuiltPathBuilt &) const noexcept;
 };
 
-using _SingleBuiltPathRaw = std::variant<
-    DerivedPathOpaque,
-    SingleBuiltPathBuilt
->;
+using _SingleBuiltPathRaw = std::variant<DerivedPathOpaque, SingleBuiltPathBuilt>;
 
-struct SingleBuiltPath : _SingleBuiltPathRaw {
+struct SingleBuiltPath : _SingleBuiltPathRaw
+{
     using Raw = _SingleBuiltPathRaw;
     using Raw::Raw;
 
     using Opaque = DerivedPathOpaque;
     using Built = SingleBuiltPathBuilt;
 
-    bool operator == (const SingleBuiltPath &) const = default;
-    auto operator <=> (const SingleBuiltPath &) const = default;
+    bool operator==(const SingleBuiltPath &) const = default;
+    auto operator<=>(const SingleBuiltPath &) const = default;
 
-    inline const Raw & raw() const {
+    inline const Raw & raw() const
+    {
         return static_cast<const Raw &>(*this);
     }
 
@@ -51,7 +51,7 @@ struct SingleBuiltPath : _SingleBuiltPathRaw {
 
 static inline ref<SingleBuiltPath> staticDrv(StorePath drvPath)
 {
-    return make_ref<SingleBuiltPath>(SingleBuiltPath::Opaque { drvPath });
+    return make_ref<SingleBuiltPath>(SingleBuiltPath::Opaque{drvPath});
 }
 
 /**
@@ -59,40 +59,41 @@ static inline ref<SingleBuiltPath> staticDrv(StorePath drvPath)
  *
  * See 'BuiltPath' for more an explanation.
  */
-struct BuiltPathBuilt {
+struct BuiltPathBuilt
+{
     ref<SingleBuiltPath> drvPath;
     std::map<std::string, StorePath> outputs;
 
-    bool operator == (const BuiltPathBuilt &) const noexcept;
+    bool operator==(const BuiltPathBuilt &) const noexcept;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //std::strong_ordering operator <=> (const BuiltPathBuilt &) const noexcept;
+    // std::strong_ordering operator <=> (const BuiltPathBuilt &) const noexcept;
 
     std::string to_string(const StoreDirConfig & store) const;
     static BuiltPathBuilt parse(const StoreDirConfig & store, std::string_view, std::string_view);
     nlohmann::json toJSON(const StoreDirConfig & store) const;
 };
 
-using _BuiltPathRaw = std::variant<
-    DerivedPath::Opaque,
-    BuiltPathBuilt
->;
+using _BuiltPathRaw = std::variant<DerivedPath::Opaque, BuiltPathBuilt>;
 
 /**
  * A built path. Similar to a DerivedPath, but enriched with the corresponding
  * output path(s).
  */
-struct BuiltPath : _BuiltPathRaw {
+struct BuiltPath : _BuiltPathRaw
+{
     using Raw = _BuiltPathRaw;
     using Raw::Raw;
 
     using Opaque = DerivedPathOpaque;
     using Built = BuiltPathBuilt;
 
-    bool operator == (const BuiltPath &) const = default;
-    // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=> (const BuiltPath &) const = default;
+    bool operator==(const BuiltPath &) const = default;
 
-    inline const Raw & raw() const {
+    // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
+    // auto operator <=> (const BuiltPath &) const = default;
+
+    inline const Raw & raw() const
+    {
         return static_cast<const Raw &>(*this);
     }
 
@@ -104,4 +105,4 @@ struct BuiltPath : _BuiltPathRaw {
 
 typedef std::vector<BuiltPath> BuiltPaths;
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/command-installable-value.hh b/src/libcmd/include/nix/cmd/command-installable-value.hh
index b171d9f73..beb77be64 100644
--- a/src/libcmd/include/nix/cmd/command-installable-value.hh
+++ b/src/libcmd/include/nix/cmd/command-installable-value.hh
@@ -20,4 +20,4 @@ struct InstallableValueCommand : InstallableCommand
     void run(ref<Store> store, ref<Installable> installable) override;
 };
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/common-eval-args.hh b/src/libcmd/include/nix/cmd/common-eval-args.hh
index 88ede1ed7..62518ba0e 100644
--- a/src/libcmd/include/nix/cmd/common-eval-args.hh
+++ b/src/libcmd/include/nix/cmd/common-eval-args.hh
@@ -13,13 +13,17 @@ namespace nix {
 
 class Store;
 
-namespace fetchers { struct Settings; }
+namespace fetchers {
+struct Settings;
+}
 
 class EvalState;
 struct CompatibilitySettings;
 class Bindings;
 
-namespace flake { struct Settings; }
+namespace flake {
+struct Settings;
+}
 
 /**
  * @todo Get rid of global settings variables
@@ -54,10 +58,23 @@ struct MixEvalArgs : virtual Args, virtual MixRepair
     std::optional<std::string> evalStoreUrl;
 
 private:
-    struct AutoArgExpr { std::string expr; };
-    struct AutoArgString { std::string s; };
-    struct AutoArgFile { std::filesystem::path path; };
-    struct AutoArgStdin { };
+    struct AutoArgExpr
+    {
+        std::string expr;
+    };
+
+    struct AutoArgString
+    {
+        std::string s;
+    };
+
+    struct AutoArgFile
+    {
+        std::filesystem::path path;
+    };
+
+    struct AutoArgStdin
+    {};
 
     using AutoArg = std::variant<AutoArgExpr, AutoArgString, AutoArgFile, AutoArgStdin>;
 
@@ -65,8 +82,8 @@ private:
 };
 
 /**
- * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ * @param baseDir Optional [base directory](https://nix.dev/manual/nix/development/glossary#gloss-base-directory)
  */
 SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * baseDir = nullptr);
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/compatibility-settings.hh b/src/libcmd/include/nix/cmd/compatibility-settings.hh
index c7061a0a1..7c34ae17a 100644
--- a/src/libcmd/include/nix/cmd/compatibility-settings.hh
+++ b/src/libcmd/include/nix/cmd/compatibility-settings.hh
@@ -33,4 +33,4 @@ struct CompatibilitySettings : public Config
     )"};
 };
 
-};
+}; // namespace nix
diff --git a/src/libcmd/include/nix/cmd/editor-for.hh b/src/libcmd/include/nix/cmd/editor-for.hh
index 11414e823..3fb8a072e 100644
--- a/src/libcmd/include/nix/cmd/editor-for.hh
+++ b/src/libcmd/include/nix/cmd/editor-for.hh
@@ -12,4 +12,4 @@ namespace nix {
  */
 Strings editorFor(const SourcePath & file, uint32_t line);
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/installable-attr-path.hh b/src/libcmd/include/nix/cmd/installable-attr-path.hh
index 5a0dc993c..474bb358e 100644
--- a/src/libcmd/include/nix/cmd/installable-attr-path.hh
+++ b/src/libcmd/include/nix/cmd/installable-attr-path.hh
@@ -39,7 +39,10 @@ class InstallableAttrPath : public InstallableValue
         const std::string & attrPath,
         ExtendedOutputsSpec extendedOutputsSpec);
 
-    std::string what() const override { return attrPath; };
+    std::string what() const override
+    {
+        return attrPath;
+    };
 
     std::pair<Value *, PosIdx> toValue(EvalState & state) override;
 
@@ -55,4 +58,4 @@ public:
         ExtendedOutputsSpec extendedOutputsSpec);
 };
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/installable-derived-path.hh b/src/libcmd/include/nix/cmd/installable-derived-path.hh
index daa6ba868..f255f2bba 100644
--- a/src/libcmd/include/nix/cmd/installable-derived-path.hh
+++ b/src/libcmd/include/nix/cmd/installable-derived-path.hh
@@ -11,8 +11,10 @@ struct InstallableDerivedPath : Installable
     DerivedPath derivedPath;
 
     InstallableDerivedPath(ref<Store> store, DerivedPath && derivedPath)
-        : store(store), derivedPath(std::move(derivedPath))
-    { }
+        : store(store)
+        , derivedPath(std::move(derivedPath))
+    {
+    }
 
     std::string what() const override;
 
@@ -20,10 +22,8 @@ struct InstallableDerivedPath : Installable
 
     std::optional<StorePath> getStorePath() override;
 
-    static InstallableDerivedPath parse(
-        ref<Store> store,
-        std::string_view prefix,
-        ExtendedOutputsSpec extendedOutputsSpec);
+    static InstallableDerivedPath
+    parse(ref<Store> store, std::string_view prefix, ExtendedOutputsSpec extendedOutputsSpec);
 };
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/installable-flake.hh b/src/libcmd/include/nix/cmd/installable-flake.hh
index 8699031b5..935ea8779 100644
--- a/src/libcmd/include/nix/cmd/installable-flake.hh
+++ b/src/libcmd/include/nix/cmd/installable-flake.hh
@@ -18,7 +18,8 @@ struct ExtraPathInfoFlake : ExtraPathInfoValue
     /**
      * Extra struct to get around C++ designated initializer limitations
      */
-    struct Flake {
+    struct Flake
+    {
         FlakeRef originalRef;
         FlakeRef lockedRef;
     };
@@ -26,8 +27,10 @@ struct ExtraPathInfoFlake : ExtraPathInfoValue
     Flake flake;
 
     ExtraPathInfoFlake(Value && v, Flake && f)
-        : ExtraPathInfoValue(std::move(v)), flake(std::move(f))
-    { }
+        : ExtraPathInfoValue(std::move(v))
+        , flake(std::move(f))
+    {
+    }
 };
 
 struct InstallableFlake : InstallableValue
@@ -49,7 +52,10 @@ struct InstallableFlake : InstallableValue
         Strings prefixes,
         const flake::LockFlags & lockFlags);
 
-    std::string what() const override { return flakeRef.to_string() + "#" + *attrPaths.begin(); }
+    std::string what() const override
+    {
+        return flakeRef.to_string() + "#" + *attrPaths.begin();
+    }
 
     std::vector<std::string> getActualAttrPaths();
 
@@ -61,8 +67,7 @@ struct InstallableFlake : InstallableValue
      * Get a cursor to every attrpath in getActualAttrPaths() that
      * exists. However if none exists, throw an exception.
      */
-    std::vector<ref<eval_cache::AttrCursor>>
-    getCursors(EvalState & state) override;
+    std::vector<ref<eval_cache::AttrCursor>> getCursors(EvalState & state) override;
 
     std::shared_ptr<flake::LockedFlake> getLockedFlake() const;
 
@@ -79,11 +84,9 @@ struct InstallableFlake : InstallableValue
  */
 static inline FlakeRef defaultNixpkgsFlakeRef()
 {
-    return FlakeRef::fromAttrs(fetchSettings, {{"type","indirect"}, {"id", "nixpkgs"}});
+    return FlakeRef::fromAttrs(fetchSettings, {{"type", "indirect"}, {"id", "nixpkgs"}});
 }
 
-ref<eval_cache::EvalCache> openEvalCache(
-    EvalState & state,
-    std::shared_ptr<flake::LockedFlake> lockedFlake);
+ref<eval_cache::EvalCache> openEvalCache(EvalState & state, std::shared_ptr<flake::LockedFlake> lockedFlake);
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/installable-value.hh b/src/libcmd/include/nix/cmd/installable-value.hh
index e65c199a5..3521a4154 100644
--- a/src/libcmd/include/nix/cmd/installable-value.hh
+++ b/src/libcmd/include/nix/cmd/installable-value.hh
@@ -9,7 +9,10 @@ namespace nix {
 struct PackageInfo;
 struct SourceExprCommand;
 
-namespace eval_cache { class EvalCache; class AttrCursor; }
+namespace eval_cache {
+class EvalCache;
+class AttrCursor;
+} // namespace eval_cache
 
 struct App
 {
@@ -37,7 +40,8 @@ struct ExtraPathInfoValue : ExtraPathInfo
     /**
      * Extra struct to get around C++ designated initializer limitations
      */
-    struct Value {
+    struct Value
+    {
         /**
          * An optional priority for use with "build envs". See Package
          */
@@ -61,7 +65,8 @@ struct ExtraPathInfoValue : ExtraPathInfo
 
     ExtraPathInfoValue(Value && v)
         : value(std::move(v))
-    { }
+    {
+    }
 
     virtual ~ExtraPathInfoValue() = default;
 };
@@ -74,9 +79,12 @@ struct InstallableValue : Installable
 {
     ref<EvalState> state;
 
-    InstallableValue(ref<EvalState> state) : state(state) {}
+    InstallableValue(ref<EvalState> state)
+        : state(state)
+    {
+    }
 
-    virtual ~InstallableValue() { }
+    virtual ~InstallableValue() {}
 
     virtual std::pair<Value *, PosIdx> toValue(EvalState & state) = 0;
 
@@ -85,15 +93,13 @@ struct InstallableValue : Installable
      * However if none exists, throw exception instead of returning
      * empty vector.
      */
-    virtual std::vector<ref<eval_cache::AttrCursor>>
-    getCursors(EvalState & state);
+    virtual std::vector<ref<eval_cache::AttrCursor>> getCursors(EvalState & state);
 
     /**
      * Get the first and most preferred cursor this Installable could
      * refer to, or throw an exception if none exists.
      */
-    virtual ref<eval_cache::AttrCursor>
-    getCursor(EvalState & state);
+    virtual ref<eval_cache::AttrCursor> getCursor(EvalState & state);
 
     UnresolvedApp toApp(EvalState & state);
 
@@ -116,7 +122,8 @@ protected:
      * @result A derived path (with empty info, for now) if the value
      * matched the above criteria.
      */
-    std::optional<DerivedPathWithInfo> trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx);
+    std::optional<DerivedPathWithInfo>
+    trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx);
 };
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/installables.hh b/src/libcmd/include/nix/cmd/installables.hh
index 84941278a..530334e03 100644
--- a/src/libcmd/include/nix/cmd/installables.hh
+++ b/src/libcmd/include/nix/cmd/installables.hh
@@ -112,7 +112,7 @@ typedef std::vector<ref<Installable>> Installables;
  */
 struct Installable
 {
-    virtual ~Installable() { }
+    virtual ~Installable() {}
 
     /**
      * What Installable is this?
@@ -168,37 +168,19 @@ struct Installable
         BuildMode bMode = bmNormal);
 
     static std::set<StorePath> toStorePathSet(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        const Installables & installables);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables);
 
     static std::vector<StorePath> toStorePaths(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        const Installables & installables);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables);
 
     static StorePath toStorePath(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        ref<Installable> installable);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, ref<Installable> installable);
 
-    static std::set<StorePath> toDerivations(
-        ref<Store> store,
-        const Installables & installables,
-        bool useDeriver = false);
+    static std::set<StorePath>
+    toDerivations(ref<Store> store, const Installables & installables, bool useDeriver = false);
 
     static BuiltPaths toBuiltPaths(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        const Installables & installables);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables);
 };
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/legacy.hh b/src/libcmd/include/nix/cmd/legacy.hh
index 0c375a7d2..546057184 100644
--- a/src/libcmd/include/nix/cmd/legacy.hh
+++ b/src/libcmd/include/nix/cmd/legacy.hh
@@ -7,13 +7,14 @@
 
 namespace nix {
 
-typedef std::function<void(int, char * *)> MainFunction;
+typedef std::function<void(int, char **)> MainFunction;
 
 struct RegisterLegacyCommand
 {
     typedef std::map<std::string, MainFunction> Commands;
 
-    static Commands & commands() {
+    static Commands & commands()
+    {
         static Commands commands;
         return commands;
     }
@@ -24,4 +25,4 @@ struct RegisterLegacyCommand
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/markdown.hh b/src/libcmd/include/nix/cmd/markdown.hh
index 66db1736c..95a59c2aa 100644
--- a/src/libcmd/include/nix/cmd/markdown.hh
+++ b/src/libcmd/include/nix/cmd/markdown.hh
@@ -14,4 +14,4 @@ namespace nix {
  */
 std::string renderMarkdownToTerminal(std::string_view markdown);
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/meson.build b/src/libcmd/include/nix/cmd/meson.build
index 368edb28e..119d0814b 100644
--- a/src/libcmd/include/nix/cmd/meson.build
+++ b/src/libcmd/include/nix/cmd/meson.build
@@ -1,6 +1,6 @@
 # Public headers directory
 
-include_dirs = [include_directories('../..')]
+include_dirs = [ include_directories('../..') ]
 
 headers = files(
   'built-path.hh',
diff --git a/src/libcmd/include/nix/cmd/misc-store-flags.hh b/src/libcmd/include/nix/cmd/misc-store-flags.hh
index c9467ad8e..27e139076 100644
--- a/src/libcmd/include/nix/cmd/misc-store-flags.hh
+++ b/src/libcmd/include/nix/cmd/misc-store-flags.hh
@@ -4,18 +4,22 @@
 namespace nix::flag {
 
 Args::Flag hashAlgo(std::string && longName, HashAlgorithm * ha);
+
 static inline Args::Flag hashAlgo(HashAlgorithm * ha)
 {
     return hashAlgo("hash-algo", ha);
 }
+
 Args::Flag hashAlgoOpt(std::string && longName, std::optional<HashAlgorithm> * oha);
 Args::Flag hashFormatWithDefault(std::string && longName, HashFormat * hf);
 Args::Flag hashFormatOpt(std::string && longName, std::optional<HashFormat> * ohf);
+
 static inline Args::Flag hashAlgoOpt(std::optional<HashAlgorithm> * oha)
 {
     return hashAlgoOpt("hash-algo", oha);
 }
+
 Args::Flag fileIngestionMethod(FileIngestionMethod * method);
 Args::Flag contentAddressMethod(ContentAddressMethod * method);
 
-}
+} // namespace nix::flag
diff --git a/src/libcmd/include/nix/cmd/network-proxy.hh b/src/libcmd/include/nix/cmd/network-proxy.hh
index 255597a61..f51b7dadb 100644
--- a/src/libcmd/include/nix/cmd/network-proxy.hh
+++ b/src/libcmd/include/nix/cmd/network-proxy.hh
@@ -19,4 +19,4 @@ extern const StringSet networkProxyVariables;
  */
 bool haveNetworkProxyConnection();
 
-}
+} // namespace nix
diff --git a/src/libcmd/include/nix/cmd/repl-interacter.hh b/src/libcmd/include/nix/cmd/repl-interacter.hh
index eb58563b2..89e854ad9 100644
--- a/src/libcmd/include/nix/cmd/repl-interacter.hh
+++ b/src/libcmd/include/nix/cmd/repl-interacter.hh
@@ -11,10 +11,11 @@ namespace nix {
 namespace detail {
 /** Provides the completion hooks for the repl, without exposing its complete
  * internals. */
-struct ReplCompleterMixin {
+struct ReplCompleterMixin
+{
     virtual StringSet completePrefix(const std::string & prefix) = 0;
 };
-};
+}; // namespace detail
 
 enum class ReplPromptType {
     ReplPrompt,
@@ -29,7 +30,7 @@ public:
     virtual Guard init(detail::ReplCompleterMixin * repl) = 0;
     /** Returns a boolean of whether the interacter got EOF */
     virtual bool getLine(std::string & input, ReplPromptType promptType) = 0;
-    virtual ~ReplInteracter(){};
+    virtual ~ReplInteracter() {};
 };
 
 class ReadlineLikeInteracter : public virtual ReplInteracter
@@ -40,9 +41,10 @@ public:
         : historyFile(historyFile)
     {
     }
+
     virtual Guard init(detail::ReplCompleterMixin * repl) override;
     virtual bool getLine(std::string & input, ReplPromptType promptType) override;
     virtual ~ReadlineLikeInteracter() override;
 };
 
-};
+}; // namespace nix
diff --git a/src/libcmd/include/nix/cmd/repl.hh b/src/libcmd/include/nix/cmd/repl.hh
index 83e39727f..a2c905f86 100644
--- a/src/libcmd/include/nix/cmd/repl.hh
+++ b/src/libcmd/include/nix/cmd/repl.hh
@@ -12,12 +12,12 @@ struct AbstractNixRepl
 
     AbstractNixRepl(ref<EvalState> state)
         : state(state)
-    { }
+    {
+    }
 
-    virtual ~AbstractNixRepl()
-    { }
+    virtual ~AbstractNixRepl() {}
 
-    typedef std::vector<std::pair<Value*,std::string>> AnnotatedValues;
+    typedef std::vector<std::pair<Value *, std::string>> AnnotatedValues;
 
     using RunNix = void(Path program, const Strings & args, const std::optional<std::string> & input);
 
@@ -33,13 +33,11 @@ struct AbstractNixRepl
         std::function<AnnotatedValues()> getValues,
         RunNix * runNix = nullptr);
 
-    static ReplExitStatus runSimple(
-        ref<EvalState> evalState,
-        const ValMap & extraEnv);
+    static ReplExitStatus runSimple(ref<EvalState> evalState, const ValMap & extraEnv);
 
     virtual void initEnv() = 0;
 
     virtual ReplExitStatus mainLoop() = 0;
 };
 
-}
+} // namespace nix
diff --git a/src/libcmd/installable-attr-path.cc b/src/libcmd/installable-attr-path.cc
index 7783b4f40..28c3db3fc 100644
--- a/src/libcmd/installable-attr-path.cc
+++ b/src/libcmd/installable-attr-path.cc
@@ -35,7 +35,8 @@ InstallableAttrPath::InstallableAttrPath(
     , v(allocRootValue(v))
     , attrPath(attrPath)
     , extendedOutputsSpec(std::move(extendedOutputsSpec))
-{ }
+{
+}
 
 std::pair<Value *, PosIdx> InstallableAttrPath::toValue(EvalState & state)
 {
@@ -48,12 +49,9 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
 {
     auto [v, pos] = toValue(*state);
 
-    if (std::optional derivedPathWithInfo = trySinglePathToDerivedPaths(
-        *v,
-        pos,
-        fmt("while evaluating the attribute '%s'", attrPath)))
-    {
-        return { *derivedPathWithInfo };
+    if (std::optional derivedPathWithInfo =
+            trySinglePathToDerivedPaths(*v, pos, fmt("while evaluating the attribute '%s'", attrPath))) {
+        return {*derivedPathWithInfo};
     }
 
     Bindings & autoArgs = *cmd.getAutoArgs(*state);
@@ -70,19 +68,19 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
         if (!drvPath)
             throw Error("'%s' is not a derivation", what());
 
-        auto newOutputs = std::visit(overloaded {
-            [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
-                StringSet outputsToInstall;
-                for (auto & output : packageInfo.queryOutputs(false, true))
-                    outputsToInstall.insert(output.first);
-                if (outputsToInstall.empty())
-                    outputsToInstall.insert("out");
-                return OutputsSpec::Names { std::move(outputsToInstall) };
+        auto newOutputs = std::visit(
+            overloaded{
+                [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
+                    StringSet outputsToInstall;
+                    for (auto & output : packageInfo.queryOutputs(false, true))
+                        outputsToInstall.insert(output.first);
+                    if (outputsToInstall.empty())
+                        outputsToInstall.insert("out");
+                    return OutputsSpec::Names{std::move(outputsToInstall)};
+                },
+                [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec { return e; },
             },
-            [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec {
-                return e;
-            },
-        }, extendedOutputsSpec.raw);
+            extendedOutputsSpec.raw);
 
         auto [iter, didInsert] = byDrvPath.emplace(*drvPath, newOutputs);
 
@@ -93,11 +91,12 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
     DerivedPathsWithInfo res;
     for (auto & [drvPath, outputs] : byDrvPath)
         res.push_back({
-            .path = DerivedPath::Built {
-                .drvPath = makeConstantStorePathRef(drvPath),
-                .outputs = outputs,
-            },
-            .info = make_ref<ExtraPathInfoValue>(ExtraPathInfoValue::Value {
+            .path =
+                DerivedPath::Built{
+                    .drvPath = makeConstantStorePathRef(drvPath),
+                    .outputs = outputs,
+                },
+            .info = make_ref<ExtraPathInfoValue>(ExtraPathInfoValue::Value{
                 .extendedOutputsSpec = outputs,
                 /* FIXME: reconsider backwards compatibility above
                    so we can fill in this info. */
@@ -115,10 +114,12 @@ InstallableAttrPath InstallableAttrPath::parse(
     ExtendedOutputsSpec extendedOutputsSpec)
 {
     return {
-        state, cmd, v,
-        prefix == "." ? "" : std::string { prefix },
+        state,
+        cmd,
+        v,
+        prefix == "." ? "" : std::string{prefix},
         std::move(extendedOutputsSpec),
     };
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/installable-derived-path.cc b/src/libcmd/installable-derived-path.cc
index 5a92f81c7..929c663d1 100644
--- a/src/libcmd/installable-derived-path.cc
+++ b/src/libcmd/installable-derived-path.cc
@@ -21,35 +21,35 @@ std::optional<StorePath> InstallableDerivedPath::getStorePath()
     return derivedPath.getBaseStorePath();
 }
 
-InstallableDerivedPath InstallableDerivedPath::parse(
-    ref<Store> store,
-    std::string_view prefix,
-    ExtendedOutputsSpec extendedOutputsSpec)
+InstallableDerivedPath
+InstallableDerivedPath::parse(ref<Store> store, std::string_view prefix, ExtendedOutputsSpec extendedOutputsSpec)
 {
-    auto derivedPath = std::visit(overloaded {
-        // If the user did not use ^, we treat the output more
-        // liberally: we accept a symlink chain or an actual
-        // store path.
-        [&](const ExtendedOutputsSpec::Default &) -> DerivedPath {
-            auto storePath = store->followLinksToStorePath(prefix);
-            return DerivedPath::Opaque {
-                .path = std::move(storePath),
-            };
+    auto derivedPath = std::visit(
+        overloaded{
+            // If the user did not use ^, we treat the output more
+            // liberally: we accept a symlink chain or an actual
+            // store path.
+            [&](const ExtendedOutputsSpec::Default &) -> DerivedPath {
+                auto storePath = store->followLinksToStorePath(prefix);
+                return DerivedPath::Opaque{
+                    .path = std::move(storePath),
+                };
+            },
+            // If the user did use ^, we just do exactly what is written.
+            [&](const ExtendedOutputsSpec::Explicit & outputSpec) -> DerivedPath {
+                auto drv = make_ref<SingleDerivedPath>(SingleDerivedPath::parse(*store, prefix));
+                drvRequireExperiment(*drv);
+                return DerivedPath::Built{
+                    .drvPath = std::move(drv),
+                    .outputs = outputSpec,
+                };
+            },
         },
-        // If the user did use ^, we just do exactly what is written.
-        [&](const ExtendedOutputsSpec::Explicit & outputSpec) -> DerivedPath {
-            auto drv = make_ref<SingleDerivedPath>(SingleDerivedPath::parse(*store, prefix));
-            drvRequireExperiment(*drv);
-            return DerivedPath::Built {
-                .drvPath = std::move(drv),
-                .outputs = outputSpec,
-            };
-        },
-    }, extendedOutputsSpec.raw);
-    return InstallableDerivedPath {
+        extendedOutputsSpec.raw);
+    return InstallableDerivedPath{
         store,
         std::move(derivedPath),
     };
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/installable-flake.cc b/src/libcmd/installable-flake.cc
index 85a4188a7..5431100d3 100644
--- a/src/libcmd/installable-flake.cc
+++ b/src/libcmd/installable-flake.cc
@@ -28,8 +28,8 @@ namespace nix {
 std::vector<std::string> InstallableFlake::getActualAttrPaths()
 {
     std::vector<std::string> res;
-    if (attrPaths.size() == 1 && attrPaths.front().starts_with(".")){
-        attrPaths.front().erase(0,1);
+    if (attrPaths.size() == 1 && attrPaths.front().starts_with(".")) {
+        attrPaths.front().erase(0, 1);
         res.push_back(attrPaths.front());
         return res;
     }
@@ -47,8 +47,11 @@ static std::string showAttrPaths(const std::vector<std::string> & paths)
 {
     std::string s;
     for (const auto & [n, i] : enumerate(paths)) {
-        if (n > 0) s += n + 1 == paths.size() ? " or " : ", ";
-        s += '\''; s += i; s += '\'';
+        if (n > 0)
+            s += n + 1 == paths.size() ? " or " : ", ";
+        s += '\'';
+        s += i;
+        s += '\'';
     }
     return s;
 }
@@ -62,12 +65,12 @@ InstallableFlake::InstallableFlake(
     Strings attrPaths,
     Strings prefixes,
     const flake::LockFlags & lockFlags)
-    : InstallableValue(state),
-      flakeRef(flakeRef),
-      attrPaths(fragment == "" ? attrPaths : Strings{(std::string) fragment}),
-      prefixes(fragment == "" ? Strings{} : prefixes),
-      extendedOutputsSpec(std::move(extendedOutputsSpec)),
-      lockFlags(lockFlags)
+    : InstallableValue(state)
+    , flakeRef(flakeRef)
+    , attrPaths(fragment == "" ? attrPaths : Strings{(std::string) fragment})
+    , prefixes(fragment == "" ? Strings{} : prefixes)
+    , extendedOutputsSpec(std::move(extendedOutputsSpec))
+    , lockFlags(lockFlags)
 {
     if (cmd && cmd->getAutoArgs(*state)->size())
         throw UsageError("'--arg' and '--argstr' are incompatible with flakes");
@@ -87,18 +90,14 @@ DerivedPathsWithInfo InstallableFlake::toDerivedPaths()
         auto v = attr->forceValue();
 
         if (std::optional derivedPathWithInfo = trySinglePathToDerivedPaths(
-            v,
-            noPos,
-            fmt("while evaluating the flake output attribute '%s'", attrPath)))
-        {
-            return { *derivedPathWithInfo };
+                v, noPos, fmt("while evaluating the flake output attribute '%s'", attrPath))) {
+            return {*derivedPathWithInfo};
         } else {
             throw Error(
                 "expected flake output attribute '%s' to be a derivation or path but found %s: %s",
                 attrPath,
                 showType(v),
-                ValuePrinter(*this->state, v, errorPrintOptions)
-            );
+                ValuePrinter(*this->state, v, errorPrintOptions));
         }
     }
 
@@ -106,46 +105,47 @@ DerivedPathsWithInfo InstallableFlake::toDerivedPaths()
 
     std::optional<NixInt::Inner> priority;
 
-    if (attr->maybeGetAttr(state->sOutputSpecified)) {
-    } else if (auto aMeta = attr->maybeGetAttr(state->sMeta)) {
+    if (attr->maybeGetAttr(state->s.outputSpecified)) {
+    } else if (auto aMeta = attr->maybeGetAttr(state->s.meta)) {
         if (auto aPriority = aMeta->maybeGetAttr("priority"))
             priority = aPriority->getInt().value;
     }
 
     return {{
-        .path = DerivedPath::Built {
-            .drvPath = makeConstantStorePathRef(std::move(drvPath)),
-            .outputs = std::visit(overloaded {
-                [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
-                    StringSet outputsToInstall;
-                    if (auto aOutputSpecified = attr->maybeGetAttr(state->sOutputSpecified)) {
-                        if (aOutputSpecified->getBool()) {
-                            if (auto aOutputName = attr->maybeGetAttr("outputName"))
-                                outputsToInstall = { aOutputName->getString() };
-                        }
-                    } else if (auto aMeta = attr->maybeGetAttr(state->sMeta)) {
-                        if (auto aOutputsToInstall = aMeta->maybeGetAttr("outputsToInstall"))
-                            for (auto & s : aOutputsToInstall->getListOfStrings())
-                                outputsToInstall.insert(s);
-                    }
+        .path =
+            DerivedPath::Built{
+                .drvPath = makeConstantStorePathRef(std::move(drvPath)),
+                .outputs = std::visit(
+                    overloaded{
+                        [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
+                            StringSet outputsToInstall;
+                            if (auto aOutputSpecified = attr->maybeGetAttr(state->s.outputSpecified)) {
+                                if (aOutputSpecified->getBool()) {
+                                    if (auto aOutputName = attr->maybeGetAttr("outputName"))
+                                        outputsToInstall = {aOutputName->getString()};
+                                }
+                            } else if (auto aMeta = attr->maybeGetAttr(state->s.meta)) {
+                                if (auto aOutputsToInstall = aMeta->maybeGetAttr("outputsToInstall"))
+                                    for (auto & s : aOutputsToInstall->getListOfStrings())
+                                        outputsToInstall.insert(s);
+                            }
 
-                    if (outputsToInstall.empty())
-                        outputsToInstall.insert("out");
+                            if (outputsToInstall.empty())
+                                outputsToInstall.insert("out");
 
-                    return OutputsSpec::Names { std::move(outputsToInstall) };
-                },
-                [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec {
-                    return e;
-                },
-            }, extendedOutputsSpec.raw),
-        },
+                            return OutputsSpec::Names{std::move(outputsToInstall)};
+                        },
+                        [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec { return e; },
+                    },
+                    extendedOutputsSpec.raw),
+            },
         .info = make_ref<ExtraPathInfoFlake>(
-            ExtraPathInfoValue::Value {
+            ExtraPathInfoValue::Value{
                 .priority = priority,
                 .attrPath = attrPath,
                 .extendedOutputsSpec = extendedOutputsSpec,
             },
-            ExtraPathInfoFlake::Flake {
+            ExtraPathInfoFlake::Flake{
                 .originalRef = flakeRef,
                 .lockedRef = getLockedFlake()->flake.lockedRef,
             }),
@@ -157,8 +157,7 @@ std::pair<Value *, PosIdx> InstallableFlake::toValue(EvalState & state)
     return {&getCursor(state)->forceValue(), noPos};
 }
 
-std::vector<ref<eval_cache::AttrCursor>>
-InstallableFlake::getCursors(EvalState & state)
+std::vector<ref<eval_cache::AttrCursor>> InstallableFlake::getCursors(EvalState & state)
 {
     auto evalCache = openEvalCache(state, getLockedFlake());
 
@@ -181,11 +180,7 @@ InstallableFlake::getCursors(EvalState & state)
     }
 
     if (res.size() == 0)
-        throw Error(
-            suggestions,
-            "flake '%s' does not provide attribute %s",
-            flakeRef,
-            showAttrPaths(attrPaths));
+        throw Error(suggestions, "flake '%s' does not provide attribute %s", flakeRef, showAttrPaths(attrPaths));
 
     return res;
 }
@@ -196,8 +191,8 @@ std::shared_ptr<flake::LockedFlake> InstallableFlake::getLockedFlake() const
         flake::LockFlags lockFlagsApplyConfig = lockFlags;
         // FIXME why this side effect?
         lockFlagsApplyConfig.applyNixConfig = true;
-        _lockedFlake = std::make_shared<flake::LockedFlake>(lockFlake(
-            flakeSettings, *state, flakeRef, lockFlagsApplyConfig));
+        _lockedFlake =
+            std::make_shared<flake::LockedFlake>(lockFlake(flakeSettings, *state, flakeRef, lockFlagsApplyConfig));
     }
     return _lockedFlake;
 }
@@ -216,4 +211,4 @@ FlakeRef InstallableFlake::nixpkgsFlakeRef() const
     return defaultNixpkgsFlakeRef();
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/installable-value.cc b/src/libcmd/installable-value.cc
index e92496347..3a167af3d 100644
--- a/src/libcmd/installable-value.cc
+++ b/src/libcmd/installable-value.cc
@@ -4,17 +4,14 @@
 
 namespace nix {
 
-std::vector<ref<eval_cache::AttrCursor>>
-InstallableValue::getCursors(EvalState & state)
+std::vector<ref<eval_cache::AttrCursor>> InstallableValue::getCursors(EvalState & state)
 {
     auto evalCache =
-        std::make_shared<nix::eval_cache::EvalCache>(std::nullopt, state,
-            [&]() { return toValue(state).first; });
+        std::make_shared<nix::eval_cache::EvalCache>(std::nullopt, state, [&]() { return toValue(state).first; });
     return {evalCache->getRoot()};
 }
 
-ref<eval_cache::AttrCursor>
-InstallableValue::getCursor(EvalState & state)
+ref<eval_cache::AttrCursor> InstallableValue::getCursor(EvalState & state)
 {
     /* Although getCursors should return at least one element, in case it doesn't,
        bound check to avoid an undefined behavior for vector[0] */
@@ -39,30 +36,32 @@ ref<InstallableValue> InstallableValue::require(ref<Installable> installable)
     auto castedInstallable = installable.dynamic_pointer_cast<InstallableValue>();
     if (!castedInstallable)
         throw nonValueInstallable(*installable);
-    return ref { castedInstallable };
+    return ref{castedInstallable};
 }
 
-std::optional<DerivedPathWithInfo> InstallableValue::trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx)
+std::optional<DerivedPathWithInfo>
+InstallableValue::trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     if (v.type() == nPath) {
         auto storePath = fetchToStore(state->fetchSettings, *state->store, v.path(), FetchMode::Copy);
         return {{
-            .path = DerivedPath::Opaque {
-                .path = std::move(storePath),
-            },
+            .path =
+                DerivedPath::Opaque{
+                    .path = std::move(storePath),
+                },
             .info = make_ref<ExtraPathInfo>(),
         }};
     }
 
     else if (v.type() == nString) {
         return {{
-            .path = DerivedPath::fromSingle(
-                state->coerceToSingleDerivedPath(pos, v, errorCtx)),
+            .path = DerivedPath::fromSingle(state->coerceToSingleDerivedPath(pos, v, errorCtx)),
             .info = make_ref<ExtraPathInfo>(),
         }};
     }
 
-    else return std::nullopt;
+    else
+        return std::nullopt;
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 49ffd82e1..96ff06ad3 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -61,7 +61,8 @@ MixFlakeOptions::MixFlakeOptions()
         .category = category,
         .handler = {[&]() {
             lockFlags.recreateLockFile = true;
-            warn("'--recreate-lock-file' is deprecated and will be removed in a future version; use 'nix flake update' instead.");
+            warn(
+                "'--recreate-lock-file' is deprecated and will be removed in a future version; use 'nix flake update' instead.");
         }},
     });
 
@@ -158,9 +159,7 @@ MixFlakeOptions::MixFlakeOptions()
         .description = "Write the given lock file instead of `flake.lock` within the top-level flake.",
         .category = category,
         .labels = {"flake-lock-path"},
-        .handler = {[&](std::string lockFilePath) {
-            lockFlags.outputLockFilePath = lockFilePath;
-        }},
+        .handler = {[&](std::string lockFilePath) { lockFlags.outputLockFilePath = lockFilePath; }},
         .completer = completePath,
     });
 
@@ -175,14 +174,20 @@ MixFlakeOptions::MixFlakeOptions()
                 flakeSettings,
                 *evalState,
                 parseFlakeRef(fetchSettings, flakeRef, absPath(getCommandBaseDir())),
-                { .writeLockFile = false });
+                {.writeLockFile = false});
             for (auto & [inputName, input] : flake.lockFile.root->inputs) {
                 auto input2 = flake.lockFile.findInput({inputName}); // resolve 'follows' nodes
                 if (auto input3 = std::dynamic_pointer_cast<const flake::LockedNode>(input2)) {
+                    fetchers::Attrs extraAttrs;
+
+                    if (!input3->lockedRef.subdir.empty()) {
+                        extraAttrs["dir"] = input3->lockedRef.subdir;
+                    }
+
                     overrideRegistry(
-                        fetchers::Input::fromAttrs(fetchSettings, {{"type","indirect"}, {"id", inputName}}),
+                        fetchers::Input::fromAttrs(fetchSettings, {{"type", "indirect"}, {"id", inputName}}),
                         input3->lockedRef.input,
-                        {});
+                        extraAttrs);
                 }
             }
         }},
@@ -209,7 +214,8 @@ SourceExprCommand::SourceExprCommand()
 
     addFlag({
         .longName = "expr",
-        .description = "Interpret [*installables*](@docroot@/command-ref/new-cli/nix.md#installables) as attribute paths relative to the Nix expression *expr*.",
+        .description =
+            "Interpret [*installables*](@docroot@/command-ref/new-cli/nix.md#installables) as attribute paths relative to the Nix expression *expr*.",
         .category = installablesCategory,
         .labels = {"expr"},
         .handler = {&expr},
@@ -220,32 +226,26 @@ MixReadOnlyOption::MixReadOnlyOption()
 {
     addFlag({
         .longName = "read-only",
-        .description =
-            "Do not instantiate each evaluated derivation. "
-            "This improves performance, but can cause errors when accessing "
-            "store paths of derivations during evaluation.",
+        .description = "Do not instantiate each evaluated derivation. "
+                       "This improves performance, but can cause errors when accessing "
+                       "store paths of derivations during evaluation.",
         .handler = {&settings.readOnlyMode, true},
     });
 }
 
 Strings SourceExprCommand::getDefaultFlakeAttrPaths()
 {
-    return {
-        "packages." + settings.thisSystem.get() + ".default",
-        "defaultPackage." + settings.thisSystem.get()
-    };
+    return {"packages." + settings.thisSystem.get() + ".default", "defaultPackage." + settings.thisSystem.get()};
 }
 
 Strings SourceExprCommand::getDefaultFlakeAttrPathPrefixes()
 {
-    return {
-        // As a convenience, look for the attribute in
-        // 'outputs.packages'.
-        "packages." + settings.thisSystem.get() + ".",
-        // As a temporary hack until Nixpkgs is properly converted
-        // to provide a clean 'packages' set, look in 'legacyPackages'.
-        "legacyPackages." + settings.thisSystem.get() + "."
-    };
+    return {// As a convenience, look for the attribute in
+            // 'outputs.packages'.
+            "packages." + settings.thisSystem.get() + ".",
+            // As a temporary hack until Nixpkgs is properly converted
+            // to provide a clean 'packages' set, look in 'legacyPackages'.
+            "legacyPackages." + settings.thisSystem.get() + "."};
 }
 
 Args::CompleterClosure SourceExprCommand::getCompleteInstallable()
@@ -263,10 +263,7 @@ void SourceExprCommand::completeInstallable(AddCompletions & completions, std::s
 
             evalSettings.pureEval = false;
             auto state = getEvalState();
-            auto e =
-                state->parseExprFromFile(
-                    resolveExprPath(
-                        lookupFileArg(*state, *file)));
+            auto e = state->parseExprFromFile(resolveExprPath(lookupFileArg(*state, *file)));
 
             Value root;
             state->eval(e, root);
@@ -285,7 +282,7 @@ void SourceExprCommand::completeInstallable(AddCompletions & completions, std::s
             }
 
             auto [v, pos] = findAlongAttrPath(*state, prefix_, *autoArgs, root);
-            Value &v1(*v);
+            Value & v1(*v);
             state->forceValue(v1, pos);
             Value v2;
             state->autoCallFunction(*autoArgs, v1, v2);
@@ -310,7 +307,7 @@ void SourceExprCommand::completeInstallable(AddCompletions & completions, std::s
                 getDefaultFlakeAttrPaths(),
                 prefix);
         }
-    } catch (EvalError&) {
+    } catch (EvalError &) {
         // Don't want eval errors to mess-up with the completion engine, so let's just swallow them
     }
 }
@@ -334,22 +331,23 @@ void completeFlakeRefWithFragment(
 
             auto fragment = prefix.substr(hash + 1);
             std::string prefixRoot = "";
-            if (fragment.starts_with(".")){
+            if (fragment.starts_with(".")) {
                 fragment = fragment.substr(1);
                 prefixRoot = ".";
             }
             auto flakeRefS = std::string(prefix.substr(0, hash));
 
             // TODO: ideally this would use the command base directory instead of assuming ".".
-            auto flakeRef = parseFlakeRef(fetchSettings, expandTilde(flakeRefS), std::filesystem::current_path().string());
+            auto flakeRef =
+                parseFlakeRef(fetchSettings, expandTilde(flakeRefS), std::filesystem::current_path().string());
 
-            auto evalCache = openEvalCache(*evalState,
-                std::make_shared<flake::LockedFlake>(lockFlake(
-                    flakeSettings, *evalState, flakeRef, lockFlags)));
+            auto evalCache = openEvalCache(
+                *evalState,
+                std::make_shared<flake::LockedFlake>(lockFlake(flakeSettings, *evalState, flakeRef, lockFlags)));
 
             auto root = evalCache->getRoot();
 
-            if (prefixRoot == "."){
+            if (prefixRoot == ".") {
                 attrPathPrefixes.clear();
             }
             /* Complete 'fragment' relative to all the
@@ -369,7 +367,8 @@ void completeFlakeRefWithFragment(
                 }
 
                 auto attr = root->findAlongAttrPath(attrPath);
-                if (!attr) continue;
+                if (!attr)
+                    continue;
 
                 for (auto & attr2 : (*attr)->getAttrs()) {
                     if (hasPrefix(evalState->symbols[attr2], lastAttr)) {
@@ -377,7 +376,9 @@ void completeFlakeRefWithFragment(
                         /* Strip the attrpath prefix. */
                         attrPath2.erase(attrPath2.begin(), attrPath2.begin() + attrPathPrefix.size());
                         // FIXME: handle names with dots
-                        completions.add(flakeRefS + "#" + prefixRoot + concatStringsSep(".", evalState->symbols.resolve(attrPath2)));
+                        completions.add(
+                            flakeRefS + "#" + prefixRoot
+                            + concatStringsSep(".", evalState->symbols.resolve(attrPath2)));
                     }
                 }
             }
@@ -387,7 +388,8 @@ void completeFlakeRefWithFragment(
             if (fragment.empty()) {
                 for (auto & attrPath : defaultFlakeAttrPaths) {
                     auto attr = root->findAlongAttrPath(parseAttrPath(*evalState, attrPath));
-                    if (!attr) continue;
+                    if (!attr)
+                        continue;
                     completions.add(flakeRefS + "#" + prefixRoot);
                 }
             }
@@ -427,14 +429,12 @@ DerivedPathWithInfo Installable::toDerivedPath()
 {
     auto buildables = toDerivedPaths();
     if (buildables.size() != 1)
-        throw Error("installable '%s' evaluates to %d derivations, where only one is expected", what(), buildables.size());
+        throw Error(
+            "installable '%s' evaluates to %d derivations, where only one is expected", what(), buildables.size());
     return std::move(buildables[0]);
 }
 
-static StorePath getDeriver(
-    ref<Store> store,
-    const Installable & i,
-    const StorePath & drvPath)
+static StorePath getDeriver(ref<Store> store, const Installable & i, const StorePath & drvPath)
 {
     auto derivers = store->queryValidDerivers(drvPath);
     if (derivers.empty())
@@ -443,35 +443,35 @@ static StorePath getDeriver(
     return *derivers.begin();
 }
 
-ref<eval_cache::EvalCache> openEvalCache(
-    EvalState & state,
-    std::shared_ptr<flake::LockedFlake> lockedFlake)
+ref<eval_cache::EvalCache> openEvalCache(EvalState & state, std::shared_ptr<flake::LockedFlake> lockedFlake)
 {
     auto fingerprint = evalSettings.useEvalCache && evalSettings.pureEval
-        ? lockedFlake->getFingerprint(state.store, state.fetchSettings)
-        : std::nullopt;
-    auto rootLoader = [&state, lockedFlake]()
-        {
-            /* For testing whether the evaluation cache is
-               complete. */
-            if (getEnv("NIX_ALLOW_EVAL").value_or("1") == "0")
-                throw Error("not everything is cached, but evaluation is not allowed");
+                           ? lockedFlake->getFingerprint(state.store, state.fetchSettings)
+                           : std::nullopt;
+    auto rootLoader = [&state, lockedFlake]() {
+        /* For testing whether the evaluation cache is
+           complete. */
+        if (getEnv("NIX_ALLOW_EVAL").value_or("1") == "0")
+            throw Error("not everything is cached, but evaluation is not allowed");
 
-            auto vFlake = state.allocValue();
-            flake::callFlake(state, *lockedFlake, *vFlake);
+        auto vFlake = state.allocValue();
+        flake::callFlake(state, *lockedFlake, *vFlake);
 
-            state.forceAttrs(*vFlake, noPos, "while parsing cached flake data");
+        state.forceAttrs(*vFlake, noPos, "while parsing cached flake data");
 
-            auto aOutputs = vFlake->attrs()->get(state.symbols.create("outputs"));
-            assert(aOutputs);
+        auto aOutputs = vFlake->attrs()->get(state.symbols.create("outputs"));
+        assert(aOutputs);
 
-            return aOutputs->value;
-        };
+        return aOutputs->value;
+    };
 
     if (fingerprint) {
         auto search = state.evalCaches.find(fingerprint.value());
         if (search == state.evalCaches.end()) {
-            search = state.evalCaches.emplace(fingerprint.value(), make_ref<nix::eval_cache::EvalCache>(fingerprint, state, rootLoader)).first;
+            search =
+                state.evalCaches
+                    .emplace(fingerprint.value(), make_ref<nix::eval_cache::EvalCache>(fingerprint, state, rootLoader))
+                    .first;
         }
         return search->second;
     } else {
@@ -479,8 +479,7 @@ ref<eval_cache::EvalCache> openEvalCache(
     }
 }
 
-Installables SourceExprCommand::parseInstallables(
-    ref<Store> store, std::vector<std::string> ss)
+Installables SourceExprCommand::parseInstallables(ref<Store> store, std::vector<std::string> ss)
 {
     Installables result;
 
@@ -501,12 +500,10 @@ Installables SourceExprCommand::parseInstallables(
         if (file == "-") {
             auto e = state->parseStdin();
             state->eval(e, *vFile);
-        }
-        else if (file) {
+        } else if (file) {
             auto dir = absPath(getCommandBaseDir());
             state->evalFile(lookupFileArg(*state, *file, &dir), *vFile);
-        }
-        else {
+        } else {
             Path dir = absPath(getCommandBaseDir());
             auto e = state->parseExprFromString(*expr, state->rootPath(dir));
             state->eval(e, *vFile);
@@ -515,9 +512,8 @@ Installables SourceExprCommand::parseInstallables(
         for (auto & s : ss) {
             auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse(s);
             result.push_back(
-                make_ref<InstallableAttrPath>(
-                    InstallableAttrPath::parse(
-                        state, *this, vFile, std::move(prefix), std::move(extendedOutputsSpec))));
+                make_ref<InstallableAttrPath>(InstallableAttrPath::parse(
+                    state, *this, vFile, std::move(prefix), std::move(extendedOutputsSpec))));
         }
 
     } else {
@@ -532,8 +528,9 @@ Installables SourceExprCommand::parseInstallables(
 
             if (prefix.find('/') != std::string::npos) {
                 try {
-                    result.push_back(make_ref<InstallableDerivedPath>(
-                        InstallableDerivedPath::parse(store, prefix, extendedOutputsSpec.raw)));
+                    result.push_back(
+                        make_ref<InstallableDerivedPath>(
+                            InstallableDerivedPath::parse(store, prefix, extendedOutputsSpec.raw)));
                     continue;
                 } catch (BadStorePath &) {
                 } catch (...) {
@@ -543,9 +540,10 @@ Installables SourceExprCommand::parseInstallables(
             }
 
             try {
-                auto [flakeRef, fragment] = parseFlakeRefWithFragment(
-                    fetchSettings, std::string { prefix }, absPath(getCommandBaseDir()));
-                result.push_back(make_ref<InstallableFlake>(
+                auto [flakeRef, fragment] =
+                    parseFlakeRefWithFragment(fetchSettings, std::string{prefix}, absPath(getCommandBaseDir()));
+                result.push_back(
+                    make_ref<InstallableFlake>(
                         this,
                         getEvalState(),
                         std::move(flakeRef),
@@ -566,8 +564,7 @@ Installables SourceExprCommand::parseInstallables(
     return result;
 }
 
-ref<Installable> SourceExprCommand::parseInstallable(
-    ref<Store> store, const std::string & installable)
+ref<Installable> SourceExprCommand::parseInstallable(ref<Store> store, const std::string & installable)
 {
     auto installables = parseInstallables(store, {installable});
     assert(installables.size() == 1);
@@ -578,20 +575,18 @@ static SingleBuiltPath getBuiltPath(ref<Store> evalStore, ref<Store> store, cons
 {
     return std::visit(
         overloaded{
-            [&](const SingleDerivedPath::Opaque & bo) -> SingleBuiltPath {
-                return SingleBuiltPath::Opaque { bo.path };
-            },
+            [&](const SingleDerivedPath::Opaque & bo) -> SingleBuiltPath { return SingleBuiltPath::Opaque{bo.path}; },
             [&](const SingleDerivedPath::Built & bfd) -> SingleBuiltPath {
                 auto drvPath = getBuiltPath(evalStore, store, *bfd.drvPath);
                 // Resolving this instead of `bfd` will yield the same result, but avoid duplicative work.
-                SingleDerivedPath::Built truncatedBfd {
+                SingleDerivedPath::Built truncatedBfd{
                     .drvPath = makeConstantStorePathRef(drvPath.outPath()),
                     .output = bfd.output,
                 };
                 auto outputPath = resolveDerivedPath(*store, truncatedBfd, &*evalStore);
-                return SingleBuiltPath::Built {
+                return SingleBuiltPath::Built{
                     .drvPath = make_ref<SingleBuiltPath>(std::move(drvPath)),
-                    .output = { bfd.output, outputPath },
+                    .output = {bfd.output, outputPath},
                 };
             },
         },
@@ -599,11 +594,7 @@ static SingleBuiltPath getBuiltPath(ref<Store> evalStore, ref<Store> store, cons
 }
 
 std::vector<BuiltPathWithResult> Installable::build(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    const Installables & installables,
-    BuildMode bMode)
+    ref<Store> evalStore, ref<Store> store, Realise mode, const Installables & installables, BuildMode bMode)
 {
     std::vector<BuiltPathWithResult> res;
     for (auto & [_, builtPathWithResult] : build2(evalStore, store, mode, installables, bMode))
@@ -611,9 +602,7 @@ std::vector<BuiltPathWithResult> Installable::build(
     return res;
 }
 
-static void throwBuildErrors(
-    std::vector<KeyedBuildResult> & buildResults,
-    const Store & store)
+static void throwBuildErrors(std::vector<KeyedBuildResult> & buildResults, const Store & store)
 {
     std::vector<KeyedBuildResult> failed;
     for (auto & buildResult : buildResults) {
@@ -630,10 +619,11 @@ static void throwBuildErrors(
             StringSet failedPaths;
             for (; failedResult != failed.end(); failedResult++) {
                 if (!failedResult->errorMsg.empty()) {
-                    logError(ErrorInfo{
-                        .level = lvlError,
-                        .msg = failedResult->errorMsg,
-                    });
+                    logError(
+                        ErrorInfo{
+                            .level = lvlError,
+                            .msg = failedResult->errorMsg,
+                        });
                 }
                 failedPaths.insert(failedResult->path.to_string(store));
             }
@@ -643,11 +633,7 @@ static void throwBuildErrors(
 }
 
 std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build2(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    const Installables & installables,
-    BuildMode bMode)
+    ref<Store> evalStore, ref<Store> store, Realise mode, const Installables & installables, BuildMode bMode)
 {
     if (mode == Realise::Nothing)
         settings.readOnlyMode = true;
@@ -678,22 +664,25 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
 
         for (auto & path : pathsToBuild) {
             for (auto & aux : backmap[path]) {
-                std::visit(overloaded {
-                    [&](const DerivedPath::Built & bfd) {
-                        auto outputs = resolveDerivedPath(*store, bfd, &*evalStore);
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Built {
-                                .drvPath = make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
-                                .outputs = outputs,
-                             },
-                            .info = aux.info}});
+                std::visit(
+                    overloaded{
+                        [&](const DerivedPath::Built & bfd) {
+                            auto outputs = resolveDerivedPath(*store, bfd, &*evalStore);
+                            res.push_back(
+                                {aux.installable,
+                                 {.path =
+                                      BuiltPath::Built{
+                                          .drvPath =
+                                              make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
+                                          .outputs = outputs,
+                                      },
+                                  .info = aux.info}});
+                        },
+                        [&](const DerivedPath::Opaque & bo) {
+                            res.push_back({aux.installable, {.path = BuiltPath::Opaque{bo.path}, .info = aux.info}});
+                        },
                     },
-                    [&](const DerivedPath::Opaque & bo) {
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Opaque { bo.path },
-                            .info = aux.info}});
-                    },
-                }, path.raw());
+                    path.raw());
             }
         }
 
@@ -707,26 +696,30 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
         throwBuildErrors(buildResults, *store);
         for (auto & buildResult : buildResults) {
             for (auto & aux : backmap[buildResult.path]) {
-                std::visit(overloaded {
-                    [&](const DerivedPath::Built & bfd) {
-                        std::map<std::string, StorePath> outputs;
-                        for (auto & [outputName, realisation] : buildResult.builtOutputs)
-                            outputs.emplace(outputName, realisation.outPath);
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Built {
-                                .drvPath = make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
-                                .outputs = outputs,
-                            },
-                            .info = aux.info,
-                            .result = buildResult}});
+                std::visit(
+                    overloaded{
+                        [&](const DerivedPath::Built & bfd) {
+                            std::map<std::string, StorePath> outputs;
+                            for (auto & [outputName, realisation] : buildResult.builtOutputs)
+                                outputs.emplace(outputName, realisation.outPath);
+                            res.push_back(
+                                {aux.installable,
+                                 {.path =
+                                      BuiltPath::Built{
+                                          .drvPath =
+                                              make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
+                                          .outputs = outputs,
+                                      },
+                                  .info = aux.info,
+                                  .result = buildResult}});
+                        },
+                        [&](const DerivedPath::Opaque & bo) {
+                            res.push_back(
+                                {aux.installable,
+                                 {.path = BuiltPath::Opaque{bo.path}, .info = aux.info, .result = buildResult}});
+                        },
                     },
-                    [&](const DerivedPath::Opaque & bo) {
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Opaque { bo.path },
-                            .info = aux.info,
-                            .result = buildResult}});
-                    },
-                }, buildResult.path.raw());
+                    buildResult.path.raw());
             }
         }
 
@@ -741,11 +734,7 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
 }
 
 BuiltPaths Installable::toBuiltPaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    const Installables & installables)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables)
 {
     if (operateOn == OperateOn::Output) {
         BuiltPaths res;
@@ -764,10 +753,7 @@ BuiltPaths Installable::toBuiltPaths(
 }
 
 StorePathSet Installable::toStorePathSet(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode, OperateOn operateOn,
-    const Installables & installables)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables)
 {
     StorePathSet outPaths;
     for (auto & path : toBuiltPaths(evalStore, store, mode, operateOn, installables)) {
@@ -778,10 +764,7 @@ StorePathSet Installable::toStorePathSet(
 }
 
 StorePaths Installable::toStorePaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode, OperateOn operateOn,
-    const Installables & installables)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables)
 {
     StorePaths outPaths;
     for (auto & path : toBuiltPaths(evalStore, store, mode, operateOn, installables)) {
@@ -792,10 +775,7 @@ StorePaths Installable::toStorePaths(
 }
 
 StorePath Installable::toStorePath(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode, OperateOn operateOn,
-    ref<Installable> installable)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, ref<Installable> installable)
 {
     auto paths = toStorePathSet(evalStore, store, mode, operateOn, {installable});
 
@@ -805,28 +785,23 @@ StorePath Installable::toStorePath(
     return *paths.begin();
 }
 
-StorePathSet Installable::toDerivations(
-    ref<Store> store,
-    const Installables & installables,
-    bool useDeriver)
+StorePathSet Installable::toDerivations(ref<Store> store, const Installables & installables, bool useDeriver)
 {
     StorePathSet drvPaths;
 
     for (const auto & i : installables)
         for (const auto & b : i->toDerivedPaths())
-            std::visit(overloaded {
-                [&](const DerivedPath::Opaque & bo) {
-                    drvPaths.insert(
-                        bo.path.isDerivation()
-                            ? bo.path
-                        : useDeriver
-                            ? getDeriver(store, *i, bo.path)
-                        : throw Error("argument '%s' did not evaluate to a derivation", i->what()));
+            std::visit(
+                overloaded{
+                    [&](const DerivedPath::Opaque & bo) {
+                        drvPaths.insert(
+                            bo.path.isDerivation() ? bo.path
+                            : useDeriver           ? getDeriver(store, *i, bo.path)
+                                         : throw Error("argument '%s' did not evaluate to a derivation", i->what()));
+                    },
+                    [&](const DerivedPath::Built & bfd) { drvPaths.insert(resolveDerivedPath(*store, *bfd.drvPath)); },
                 },
-                [&](const DerivedPath::Built & bfd) {
-                    drvPaths.insert(resolveDerivedPath(*store, *bfd.drvPath));
-                },
-            }, b.path.raw());
+                b.path.raw());
 
     return drvPaths;
 }
@@ -861,10 +836,7 @@ std::vector<FlakeRef> RawInstallablesCommand::getFlakeRefsForCompletion()
     std::vector<FlakeRef> res;
     res.reserve(rawInstallables.size());
     for (const auto & i : rawInstallables)
-        res.push_back(parseFlakeRefWithFragment(
-            fetchSettings,
-            expandTilde(i),
-            absPath(getCommandBaseDir())).first);
+        res.push_back(parseFlakeRefWithFragment(fetchSettings, expandTilde(i), absPath(getCommandBaseDir())).first);
     return res;
 }
 
@@ -883,12 +855,7 @@ void RawInstallablesCommand::run(ref<Store> store)
 
 std::vector<FlakeRef> InstallableCommand::getFlakeRefsForCompletion()
 {
-    return {
-        parseFlakeRefWithFragment(
-            fetchSettings,
-            expandTilde(_installable),
-            absPath(getCommandBaseDir())).first
-    };
+    return {parseFlakeRefWithFragment(fetchSettings, expandTilde(_installable), absPath(getCommandBaseDir())).first};
 }
 
 void InstallablesCommand::run(ref<Store> store, std::vector<std::string> && rawInstallables)
@@ -928,4 +895,4 @@ BuiltPaths toBuiltPaths(const std::vector<BuiltPathWithResult> & builtPathsWithR
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/markdown.cc b/src/libcmd/markdown.cc
index 41da73c7a..c3341da73 100644
--- a/src/libcmd/markdown.cc
+++ b/src/libcmd/markdown.cc
@@ -18,29 +18,36 @@ static std::string doRenderMarkdownToTerminal(std::string_view markdown)
 {
     int windowWidth = getWindowSize().second;
 
-#if HAVE_LOWDOWN_1_4
-    struct lowdown_opts_term opts_term {
+#  if HAVE_LOWDOWN_1_4
+    struct lowdown_opts_term opts_term{
         .cols = (size_t) std::max(windowWidth - 5, 60),
         .hmargin = 0,
         .vmargin = 0,
     };
-#endif
-    struct lowdown_opts opts
-    {
+#  endif
+    struct lowdown_opts opts{
         .type = LOWDOWN_TERM,
-#if HAVE_LOWDOWN_1_4
+#  if HAVE_LOWDOWN_1_4
         .term = opts_term,
-#endif
+#  endif
         .maxdepth = 20,
-#if !HAVE_LOWDOWN_1_4
+#  if !HAVE_LOWDOWN_1_4
         .cols = (size_t) std::max(windowWidth - 5, 60),
         .hmargin = 0,
         .vmargin = 0,
-#endif
+#  endif
         .feat = LOWDOWN_COMMONMARK | LOWDOWN_FENCED | LOWDOWN_DEFLIST | LOWDOWN_TABLES,
-        .oflags = LOWDOWN_TERM_NOLINK,
+        .oflags =
+#  if HAVE_LOWDOWN_1_4
+            LOWDOWN_TERM_NORELLINK // To render full links while skipping relative ones
+#  else
+            LOWDOWN_TERM_NOLINK
+#  endif
     };
 
+    if (!isTTY())
+        opts.oflags |= LOWDOWN_TERM_NOANSI;
+
     auto doc = lowdown_doc_new(&opts);
     if (!doc)
         throw Error("cannot allocate Markdown document");
@@ -66,7 +73,7 @@ static std::string doRenderMarkdownToTerminal(std::string_view markdown)
     if (!rndr_res)
         throw Error("allocation error while rendering Markdown");
 
-    return filterANSIEscapes(std::string(buf->data, buf->size), !isTTY());
+    return std::string(buf->data, buf->size);
 }
 
 std::string renderMarkdownToTerminal(std::string_view markdown)
diff --git a/src/libcmd/meson.build b/src/libcmd/meson.build
index 216d4df9c..24e075246 100644
--- a/src/libcmd/meson.build
+++ b/src/libcmd/meson.build
@@ -1,7 +1,9 @@
-project('nix-cmd', 'cpp',
+project(
+  'nix-cmd',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -16,8 +18,7 @@ subdir('nix-meson-build-support/deps-lists')
 
 configdata = configuration_data()
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
@@ -31,11 +32,18 @@ subdir('nix-meson-build-support/subprojects')
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
 
-lowdown = dependency('lowdown', version : '>= 0.9.0', required : get_option('markdown'))
+lowdown = dependency(
+  'lowdown',
+  version : '>= 0.9.0',
+  required : get_option('markdown'),
+)
 deps_private += lowdown
 configdata.set('HAVE_LOWDOWN', lowdown.found().to_int())
 # The API changed slightly around terminal initialization.
-configdata.set('HAVE_LOWDOWN_1_4', lowdown.version().version_compare('>= 1.4.0').to_int())
+configdata.set(
+  'HAVE_LOWDOWN_1_4',
+  lowdown.version().version_compare('>= 1.4.0').to_int(),
+)
 
 readline_flavor = get_option('readline-flavor')
 if readline_flavor == 'editline'
@@ -50,7 +58,7 @@ endif
 configdata.set(
   'USE_READLINE',
   (readline_flavor == 'readline').to_int(),
-  description: 'Use readline instead of editline',
+  description : 'Use readline instead of editline',
 )
 
 config_priv_h = configure_file(
@@ -89,9 +97,10 @@ this_library = library(
   config_priv_h,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 install_headers(headers, subdir : 'nix/cmd', preserve_path : true)
diff --git a/src/libcmd/meson.options b/src/libcmd/meson.options
index 79ae4fa55..31178d82f 100644
--- a/src/libcmd/meson.options
+++ b/src/libcmd/meson.options
@@ -2,14 +2,14 @@
 
 option(
   'markdown',
-  type: 'feature',
-  description: 'Enable Markdown rendering in the Nix binary (requires lowdown)',
+  type : 'feature',
+  description : 'Enable Markdown rendering in the Nix binary (requires lowdown)',
 )
 
 option(
   'readline-flavor',
   type : 'combo',
-  choices : ['editline', 'readline'],
+  choices : [ 'editline', 'readline' ],
   value : 'editline',
   description : 'Which library to use for nice line editing with the Nix language REPL',
 )
diff --git a/src/libcmd/misc-store-flags.cc b/src/libcmd/misc-store-flags.cc
index a57ad35ff..fd2211813 100644
--- a/src/libcmd/misc-store-flags.cc
+++ b/src/libcmd/misc-store-flags.cc
@@ -1,7 +1,6 @@
 #include "nix/cmd/misc-store-flags.hh"
 
-namespace nix::flag
-{
+namespace nix::flag {
 
 static void hashFormatCompleter(AddCompletions & completions, size_t index, std::string_view prefix)
 {
@@ -15,27 +14,23 @@ static void hashFormatCompleter(AddCompletions & completions, size_t index, std:
 Args::Flag hashFormatWithDefault(std::string && longName, HashFormat * hf)
 {
     assert(*hf == nix::HashFormat::SRI);
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash format (`base16`, `nix32`, `base64`, `sri`). Default: `sri`.",
-            .labels = {"hash-format"},
-            .handler = {[hf](std::string s) {
-                *hf = parseHashFormat(s);
-            }},
-            .completer = hashFormatCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description = "Hash format (`base16`, `nix32`, `base64`, `sri`). Default: `sri`.",
+        .labels = {"hash-format"},
+        .handler = {[hf](std::string s) { *hf = parseHashFormat(s); }},
+        .completer = hashFormatCompleter,
     };
 }
 
 Args::Flag hashFormatOpt(std::string && longName, std::optional<HashFormat> * ohf)
 {
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash format (`base16`, `nix32`, `base64`, `sri`).",
-            .labels = {"hash-format"},
-            .handler = {[ohf](std::string s) {
-                *ohf = std::optional<HashFormat>{parseHashFormat(s)};
-            }},
-            .completer = hashFormatCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description = "Hash format (`base16`, `nix32`, `base64`, `sri`).",
+        .labels = {"hash-format"},
+        .handler = {[ohf](std::string s) { *ohf = std::optional<HashFormat>{parseHashFormat(s)}; }},
+        .completer = hashFormatCompleter,
     };
 }
 
@@ -48,34 +43,31 @@ static void hashAlgoCompleter(AddCompletions & completions, size_t index, std::s
 
 Args::Flag hashAlgo(std::string && longName, HashAlgorithm * ha)
 {
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`).",
-            .labels = {"hash-algo"},
-            .handler = {[ha](std::string s) {
-                *ha = parseHashAlgo(s);
-            }},
-            .completer = hashAlgoCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description = "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`).",
+        .labels = {"hash-algo"},
+        .handler = {[ha](std::string s) { *ha = parseHashAlgo(s); }},
+        .completer = hashAlgoCompleter,
     };
 }
 
 Args::Flag hashAlgoOpt(std::string && longName, std::optional<HashAlgorithm> * oha)
 {
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`). Can be omitted for SRI hashes.",
-            .labels = {"hash-algo"},
-            .handler = {[oha](std::string s) {
-                *oha = std::optional<HashAlgorithm>{parseHashAlgo(s)};
-            }},
-            .completer = hashAlgoCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description =
+            "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`). Can be omitted for SRI hashes.",
+        .labels = {"hash-algo"},
+        .handler = {[oha](std::string s) { *oha = std::optional<HashAlgorithm>{parseHashAlgo(s)}; }},
+        .completer = hashAlgoCompleter,
     };
 }
 
 Args::Flag fileIngestionMethod(FileIngestionMethod * method)
 {
-    return Args::Flag {
-        .longName  = "mode",
+    return Args::Flag{
+        .longName = "mode",
         // FIXME indentation carefully made for context, this is messed up.
         .description = R"(
     How to compute the hash of the input.
@@ -92,16 +84,14 @@ Args::Flag fileIngestionMethod(FileIngestionMethod * method)
       it to the hash function.
         )",
         .labels = {"file-ingestion-method"},
-        .handler = {[method](std::string s) {
-            *method = parseFileIngestionMethod(s);
-        }},
+        .handler = {[method](std::string s) { *method = parseFileIngestionMethod(s); }},
     };
 }
 
 Args::Flag contentAddressMethod(ContentAddressMethod * method)
 {
-    return Args::Flag {
-        .longName  = "mode",
+    return Args::Flag{
+        .longName = "mode",
         // FIXME indentation carefully made for context, this is messed up.
         .description = R"(
     How to compute the content-address of the store object.
@@ -126,10 +116,8 @@ Args::Flag contentAddressMethod(ContentAddressMethod * method)
       for regular usage prefer `nar` and `flat`.
         )",
         .labels = {"content-address-method"},
-        .handler = {[method](std::string s) {
-            *method = ContentAddressMethod::parse(s);
-        }},
+        .handler = {[method](std::string s) { *method = ContentAddressMethod::parse(s); }},
     };
 }
 
-}
+} // namespace nix::flag
diff --git a/src/libcmd/network-proxy.cc b/src/libcmd/network-proxy.cc
index a4a89685c..6c9f2b073 100644
--- a/src/libcmd/network-proxy.cc
+++ b/src/libcmd/network-proxy.cc
@@ -47,4 +47,4 @@ bool haveNetworkProxyConnection()
     return false;
 }
 
-}
+} // namespace nix
diff --git a/src/libcmd/package.nix b/src/libcmd/package.nix
index be5054f64..c382f0e57 100644
--- a/src/libcmd/package.nix
+++ b/src/libcmd/package.nix
@@ -53,7 +53,8 @@ mkMesonLibrary (finalAttrs: {
 
   buildInputs = [
     ({ inherit editline readline; }.${readlineFlavor})
-  ] ++ lib.optional enableMarkdown lowdown;
+  ]
+  ++ lib.optional enableMarkdown lowdown;
 
   propagatedBuildInputs = [
     nix-util
diff --git a/src/libcmd/pch/precompiled-headers.hh b/src/libcmd/pch/precompiled-headers.hh
new file mode 100644
index 000000000..6f9947e9b
--- /dev/null
+++ b/src/libcmd/pch/precompiled-headers.hh
@@ -0,0 +1,4 @@
+#include "nix/cmd/installables.hh"
+#include "nix/expr/eval.hh"
+#include "nix/util/util.hh"
+#include "nix/flake/flake.hh"
diff --git a/src/libcmd/repl-interacter.cc b/src/libcmd/repl-interacter.cc
index 4de335dd5..c9b435675 100644
--- a/src/libcmd/repl-interacter.cc
+++ b/src/libcmd/repl-interacter.cc
@@ -5,8 +5,8 @@
 #include <signal.h>
 
 #if USE_READLINE
-#include <readline/history.h>
-#include <readline/readline.h>
+#  include <readline/history.h>
+#  include <readline/readline.h>
 #else
 // editline < 1.15.2 don't wrap their API for C++ usage
 // (added in https://github.com/troglobit/editline/commit/91398ceb3427b730995357e9d120539fb9bb7461).
@@ -14,7 +14,7 @@
 // For compatibility with these versions, we wrap the API here
 // (wrapping multiple times on newer versions is no problem).
 extern "C" {
-#include <editline.h>
+#  include <editline.h>
 }
 #endif
 
@@ -35,7 +35,7 @@ void sigintHandler(int signo)
 {
     g_signal_received = signo;
 }
-};
+}; // namespace
 
 static detail::ReplCompleterMixin * curRepl; // ugly
 
@@ -185,8 +185,7 @@ bool ReadlineLikeInteracter::getLine(std::string & input, ReplPromptType promptT
     // editline doesn't echo the input to the output when non-interactive, unlike readline
     // this results in a different behavior when running tests. The echoing is
     // quite useful for reading the test output, so we add it here.
-    if (auto e = getEnv("_NIX_TEST_REPL_ECHO"); s && e && *e == "1")
-    {
+    if (auto e = getEnv("_NIX_TEST_REPL_ECHO"); s && e && *e == "1") {
 #if !USE_READLINE
         // This is probably not right for multi-line input, but we don't use that
         // in the characterisation tests, so it's fine.
@@ -207,4 +206,4 @@ ReadlineLikeInteracter::~ReadlineLikeInteracter()
     write_history(historyFile.c_str());
 }
 
-};
+}; // namespace nix
diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 8170bd579..01d786deb 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -54,10 +54,7 @@ enum class ProcessLineResult {
     PromptAgain,
 };
 
-struct NixRepl
-    : AbstractNixRepl
-    , detail::ReplCompleterMixin
-    , gc
+struct NixRepl : AbstractNixRepl, detail::ReplCompleterMixin, gc
 {
     size_t debugTraceIndex;
 
@@ -80,8 +77,12 @@ struct NixRepl
 
     std::unique_ptr<ReplInteracter> interacter;
 
-    NixRepl(const LookupPath & lookupPath, nix::ref<Store> store,ref<EvalState> state,
-            std::function<AnnotatedValues()> getValues, RunNix * runNix);
+    NixRepl(
+        const LookupPath & lookupPath,
+        nix::ref<Store> store,
+        ref<EvalState> state,
+        std::function<AnnotatedValues()> getValues,
+        RunNix * runNix);
     virtual ~NixRepl() = default;
 
     ReplExitStatus mainLoop() override;
@@ -103,20 +104,22 @@ struct NixRepl
     void evalString(std::string s, Value & v);
     void loadDebugTraceEnv(DebugTrace & dt);
 
-    void printValue(std::ostream & str,
-                              Value & v,
-                              unsigned int maxDepth = std::numeric_limits<unsigned int>::max())
+    void printValue(std::ostream & str, Value & v, unsigned int maxDepth = std::numeric_limits<unsigned int>::max())
     {
         // Hide the progress bar during printing because it might interfere
         auto suspension = logger->suspend();
-        ::nix::printValue(*state, str, v, PrintOptions {
-            .ansiColors = true,
-            .force = true,
-            .derivationPaths = true,
-            .maxDepth = maxDepth,
-            .prettyIndent = 2,
-            .errors = ErrorPrintBehavior::ThrowTopLevel,
-        });
+        ::nix::printValue(
+            *state,
+            str,
+            v,
+            PrintOptions{
+                .ansiColors = true,
+                .force = true,
+                .derivationPaths = true,
+                .maxDepth = maxDepth,
+                .prettyIndent = 2,
+                .errors = ErrorPrintBehavior::ThrowTopLevel,
+            });
     }
 };
 
@@ -124,13 +127,17 @@ std::string removeWhitespace(std::string s)
 {
     s = chomp(s);
     size_t n = s.find_first_not_of(" \n\r\t");
-    if (n != std::string::npos) s = std::string(s, n);
+    if (n != std::string::npos)
+        s = std::string(s, n);
     return s;
 }
 
-
-NixRepl::NixRepl(const LookupPath & lookupPath, nix::ref<Store> store, ref<EvalState> state,
-            std::function<NixRepl::AnnotatedValues()> getValues, RunNix * runNix)
+NixRepl::NixRepl(
+    const LookupPath & lookupPath,
+    nix::ref<Store> store,
+    ref<EvalState> state,
+    std::function<NixRepl::AnnotatedValues()> getValues,
+    RunNix * runNix)
     : AbstractNixRepl(state)
     , debugTraceIndex(0)
     , getValues(getValues)
@@ -188,7 +195,8 @@ ReplExitStatus NixRepl::mainLoop()
             auto suspension = logger->suspend();
             // When continuing input from previous lines, don't print a prompt, just align to the same
             // number of chars as the prompt.
-            if (!interacter->getLine(input, input.empty() ? ReplPromptType::ReplPrompt : ReplPromptType::ContinuationPrompt)) {
+            if (!interacter->getLine(
+                    input, input.empty() ? ReplPromptType::ReplPrompt : ReplPromptType::ContinuationPrompt)) {
                 // Ctrl-D should exit the debugger.
                 state->debugStop = false;
                 logger->cout("");
@@ -200,14 +208,14 @@ ReplExitStatus NixRepl::mainLoop()
         }
         try {
             switch (processLine(input)) {
-                case ProcessLineResult::Quit:
-                    return ReplExitStatus::QuitAll;
-                case ProcessLineResult::Continue:
-                    return ReplExitStatus::Continue;
-                case ProcessLineResult::PromptAgain:
-                    break;
-                default:
-                    unreachable();
+            case ProcessLineResult::Quit:
+                return ReplExitStatus::QuitAll;
+            case ProcessLineResult::Continue:
+                return ReplExitStatus::Continue;
+            case ProcessLineResult::PromptAgain:
+                break;
+            default:
+                unreachable();
             }
         } catch (IncompleteReplExpr &) {
             continue;
@@ -256,7 +264,8 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
         /* This is a variable name; look it up in the current scope. */
         StringSet::iterator i = varNames.lower_bound(cur);
         while (i != varNames.end()) {
-            if (i->substr(0, cur.size()) != cur) break;
+            if (i->substr(0, cur.size()) != cur)
+                break;
             completions.insert(prev + *i);
             i++;
         }
@@ -275,11 +284,15 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
             Expr * e = parseString(expr);
             Value v;
             e->eval(*state, *env, v);
-            state->forceAttrs(v, noPos, "while evaluating an attrset for the purpose of completion (this error should not be displayed; file an issue?)");
+            state->forceAttrs(
+                v,
+                noPos,
+                "while evaluating an attrset for the purpose of completion (this error should not be displayed; file an issue?)");
 
             for (auto & i : *v.attrs()) {
                 std::string_view name = state->symbols[i.name];
-                if (name.substr(0, cur2.size()) != cur2) continue;
+                if (name.substr(0, cur2.size()) != cur2)
+                    continue;
                 completions.insert(concatStrings(prev, expr, ".", name));
             }
 
@@ -297,24 +310,23 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
     return completions;
 }
 
-
 // FIXME: DRY and match or use the parser
 static bool isVarName(std::string_view s)
 {
-    if (s.size() == 0) return false;
+    if (s.size() == 0)
+        return false;
     char c = s[0];
-    if ((c >= '0' && c <= '9') || c == '-' || c == '\'') return false;
+    if ((c >= '0' && c <= '9') || c == '-' || c == '\'')
+        return false;
     for (auto & i : s)
-        if (!((i >= 'a' && i <= 'z') ||
-              (i >= 'A' && i <= 'Z') ||
-              (i >= '0' && i <= '9') ||
-              i == '_' || i == '-' || i == '\''))
+        if (!((i >= 'a' && i <= 'z') || (i >= 'A' && i <= 'Z') || (i >= '0' && i <= '9') || i == '_' || i == '-'
+              || i == '\''))
             return false;
     return true;
 }
 
-
-StorePath NixRepl::getDerivationPath(Value & v) {
+StorePath NixRepl::getDerivationPath(Value & v)
+{
     auto packageInfo = getDerivation(*state, v, false);
     if (!packageInfo)
         throw Error("expression does not evaluate to a derivation, so I can't build it");
@@ -353,53 +365,50 @@ ProcessLineResult NixRepl::processLine(std::string line)
     if (line[0] == ':') {
         size_t p = line.find_first_of(" \n\r\t");
         command = line.substr(0, p);
-        if (p != std::string::npos) arg = removeWhitespace(line.substr(p));
+        if (p != std::string::npos)
+            arg = removeWhitespace(line.substr(p));
     } else {
         arg = line;
     }
 
     if (command == ":?" || command == ":help") {
         // FIXME: convert to Markdown, include in the 'nix repl' manpage.
-        std::cout
-             << "The following commands are available:\n"
-             << "\n"
-             << "  <expr>                       Evaluate and print expression\n"
-             << "  <x> = <expr>                 Bind expression to variable\n"
-             << "  :a, :add <expr>              Add attributes from resulting set to scope\n"
-             << "  :b <expr>                    Build a derivation\n"
-             << "  :bl <expr>                   Build a derivation, creating GC roots in the\n"
-             << "                               working directory\n"
-             << "  :e, :edit <expr>             Open package or function in $EDITOR\n"
-             << "  :i <expr>                    Build derivation, then install result into\n"
-             << "                               current profile\n"
-             << "  :l, :load <path>             Load Nix expression and add it to scope\n"
-             << "  :lf, :load-flake <ref>       Load Nix flake and add it to scope\n"
-             << "  :ll, :last-loaded            Show most recently loaded variables added to scope\n"
-             << "  :p, :print <expr>            Evaluate and print expression recursively\n"
-             << "                               Strings are printed directly, without escaping.\n"
-             << "  :q, :quit                    Exit nix-repl\n"
-             << "  :r, :reload                  Reload all files\n"
-             << "  :sh <expr>                   Build dependencies of derivation, then start\n"
-             << "                               nix-shell\n"
-             << "  :t <expr>                    Describe result of evaluation\n"
-             << "  :u <expr>                    Build derivation, then start nix-shell\n"
-             << "  :doc <expr>                  Show documentation of a builtin function\n"
-             << "  :log <expr>                  Show logs for a derivation\n"
-             << "  :te, :trace-enable [bool]    Enable, disable or toggle showing traces for\n"
-             << "                               errors\n"
-             << "  :?, :help                    Brings up this help menu\n"
-             ;
+        std::cout << "The following commands are available:\n"
+                  << "\n"
+                  << "  <expr>                       Evaluate and print expression\n"
+                  << "  <x> = <expr>                 Bind expression to variable\n"
+                  << "  :a, :add <expr>              Add attributes from resulting set to scope\n"
+                  << "  :b <expr>                    Build a derivation\n"
+                  << "  :bl <expr>                   Build a derivation, creating GC roots in the\n"
+                  << "                               working directory\n"
+                  << "  :e, :edit <expr>             Open package or function in $EDITOR\n"
+                  << "  :i <expr>                    Build derivation, then install result into\n"
+                  << "                               current profile\n"
+                  << "  :l, :load <path>             Load Nix expression and add it to scope\n"
+                  << "  :lf, :load-flake <ref>       Load Nix flake and add it to scope\n"
+                  << "  :ll, :last-loaded            Show most recently loaded variables added to scope\n"
+                  << "  :p, :print <expr>            Evaluate and print expression recursively\n"
+                  << "                               Strings are printed directly, without escaping.\n"
+                  << "  :q, :quit                    Exit nix-repl\n"
+                  << "  :r, :reload                  Reload all files\n"
+                  << "  :sh <expr>                   Build dependencies of derivation, then start\n"
+                  << "                               nix-shell\n"
+                  << "  :t <expr>                    Describe result of evaluation\n"
+                  << "  :u <expr>                    Build derivation, then start nix-shell\n"
+                  << "  :doc <expr>                  Show documentation of a builtin function\n"
+                  << "  :log <expr>                  Show logs for a derivation\n"
+                  << "  :te, :trace-enable [bool]    Enable, disable or toggle showing traces for\n"
+                  << "                               errors\n"
+                  << "  :?, :help                    Brings up this help menu\n";
         if (state->debugRepl) {
-             std::cout
-             << "\n"
-             << "        Debug mode commands\n"
-             << "  :env             Show env stack\n"
-             << "  :bt, :backtrace  Show trace stack\n"
-             << "  :st              Show current trace\n"
-             << "  :st <idx>        Change to another trace in the stack\n"
-             << "  :c, :continue    Go until end of program, exception, or builtins.break\n"
-             << "  :s, :step        Go one step\n"
-             ;
+            std::cout << "\n"
+                      << "        Debug mode commands\n"
+                      << "  :env             Show env stack\n"
+                      << "  :bt, :backtrace  Show trace stack\n"
+                      << "  :st              Show current trace\n"
+                      << "  :st <idx>        Change to another trace in the stack\n"
+                      << "  :c, :continue    Go until end of program, exception, or builtins.break\n"
+                      << "  :s, :step        Go one step\n";
         }
 
     }
@@ -424,17 +433,18 @@ ProcessLineResult NixRepl::processLine(std::string line)
         try {
             // change the DebugTrace index.
             debugTraceIndex = stoi(arg);
-        } catch (...) { }
+        } catch (...) {
+        }
 
         for (const auto & [idx, i] : enumerate(state->debugTraces)) {
-             if (idx == debugTraceIndex) {
-                 std::cout << "\n" << ANSI_BLUE << idx << ANSI_NORMAL << ": ";
-                 showDebugTrace(std::cout, state->positions, i);
-                 std::cout << std::endl;
-                 printEnvBindings(*state, i.expr, i.env);
-                 loadDebugTraceEnv(i);
-                 break;
-             }
+            if (idx == debugTraceIndex) {
+                std::cout << "\n" << ANSI_BLUE << idx << ANSI_NORMAL << ": ";
+                showDebugTrace(std::cout, state->positions, i);
+                std::cout << std::endl;
+                printEnvBindings(*state, i.expr, i.env);
+                loadDebugTraceEnv(i);
+                break;
+            }
         }
     }
 
@@ -478,7 +488,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
         Value v;
         evalString(arg, v);
 
-        const auto [path, line] = [&] () -> std::pair<SourcePath, uint32_t> {
+        const auto [path, line] = [&]() -> std::pair<SourcePath, uint32_t> {
             if (v.type() == nPath || v.type() == nString) {
                 NixStringContext context;
                 auto path = state->coerceToPath(noPos, v, context, "while evaluating the filename to edit");
@@ -502,7 +512,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
         // runProgram redirects stdout to a StringSink,
         // using runProgram2 to allow editors to display their UI
-        runProgram2(RunOptions { .program = editor, .lookupPath = true, .args = args , .isInteractive = true });
+        runProgram2(RunOptions{.program = editor, .lookupPath = true, .args = args, .isInteractive = true});
 
         // Reload right after exiting the editor
         state->resetFileCache();
@@ -533,9 +543,9 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
         if (command == ":b" || command == ":bl") {
             state->store->buildPaths({
-                DerivedPath::Built {
+                DerivedPath::Built{
                     .drvPath = makeConstantStorePathRef(drvPath),
-                    .outputs = OutputsSpec::All { },
+                    .outputs = OutputsSpec::All{},
                 },
             });
             auto drv = state->store->readDerivation(drvPath);
@@ -554,9 +564,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
             runNix("nix-env", {"-i", drvPathRaw});
         } else if (command == ":log") {
             settings.readOnlyMode = true;
-            Finally roModeReset([&]() {
-                settings.readOnlyMode = false;
-            });
+            Finally roModeReset([&]() { settings.readOnlyMode = false; });
             auto subs = getDefaultSubstituters();
 
             subs.push_front(state->store);
@@ -566,20 +574,22 @@ ProcessLineResult NixRepl::processLine(std::string line)
             for (auto & sub : subs) {
                 auto * logSubP = dynamic_cast<LogStore *>(&*sub);
                 if (!logSubP) {
-                    printInfo("Skipped '%s' which does not support retrieving build logs", sub->getUri());
+                    printInfo(
+                        "Skipped '%s' which does not support retrieving build logs", sub->config.getHumanReadableURI());
                     continue;
                 }
                 auto & logSub = *logSubP;
 
                 auto log = logSub.getBuildLog(drvPath);
                 if (log) {
-                    printInfo("got build log for '%s' from '%s'", drvPathRaw, logSub.getUri());
+                    printInfo("got build log for '%s' from '%s'", drvPathRaw, logSub.config.getHumanReadableURI());
                     logger->writeToStdout(*log);
                     foundLog = true;
                     break;
                 }
             }
-            if (!foundLog) throw Error("build log of '%s' is not available", drvPathRaw);
+            if (!foundLog)
+                throw Error("build log of '%s' is not available", drvPathRaw);
         } else {
             runNix("nix-shell", {drvPathRaw});
         }
@@ -642,9 +652,8 @@ ProcessLineResult NixRepl::processLine(std::string line)
                 for (auto & arg : args)
                     arg = "*" + arg + "*";
 
-                markdown +=
-                    "**Synopsis:** `builtins." + (std::string) (*doc->name) + "` "
-                    + concatStringsSep(" ", args) + "\n\n";
+                markdown += "**Synopsis:** `builtins." + (std::string) (*doc->name) + "` " + concatStringsSep(" ", args)
+                            + "\n\n";
             }
 
             markdown += stripIndentation(doc->doc);
@@ -685,11 +694,8 @@ ProcessLineResult NixRepl::processLine(std::string line)
     else {
         size_t p = line.find('=');
         std::string name;
-        if (p != std::string::npos &&
-            p < line.size() &&
-            line[p + 1] != '=' &&
-            isVarName(name = removeWhitespace(line.substr(0, p))))
-        {
+        if (p != std::string::npos && p < line.size() && line[p + 1] != '='
+            && isVarName(name = removeWhitespace(line.substr(0, p)))) {
             Expr * e = parseString(line.substr(p + 1));
             Value & v(*state->allocValue());
             v.mkThunk(env, e);
@@ -737,9 +743,13 @@ void NixRepl::loadFlake(const std::string & flakeRefS)
 
     Value v;
 
-    flake::callFlake(*state,
-        flake::lockFlake(flakeSettings, *state, flakeRef,
-            flake::LockFlags {
+    flake::callFlake(
+        *state,
+        flake::lockFlake(
+            flakeSettings,
+            *state,
+            flakeRef,
+            flake::LockFlags{
                 .updateLockFile = false,
                 .useRegistries = !evalSettings.pureEval,
                 .allowUnlocked = !evalSettings.pureEval,
@@ -748,7 +758,6 @@ void NixRepl::loadFlake(const std::string & flakeRefS)
     addAttrsToScope(v);
 }
 
-
 void NixRepl::initEnv()
 {
     env = &state->allocEnv(envSize);
@@ -771,7 +780,6 @@ void NixRepl::showLastLoaded()
     }
 }
 
-
 void NixRepl::reloadFilesAndFlakes()
 {
     initEnv();
@@ -780,7 +788,6 @@ void NixRepl::reloadFilesAndFlakes()
     loadFlakes();
 }
 
-
 void NixRepl::loadFiles()
 {
     Strings old = loadedFiles;
@@ -797,7 +804,6 @@ void NixRepl::loadFiles()
     }
 }
 
-
 void NixRepl::loadFlakes()
 {
     Strings old = loadedFlakes;
@@ -809,10 +815,12 @@ void NixRepl::loadFlakes()
     }
 }
 
-
 void NixRepl::addAttrsToScope(Value & attrs)
 {
-    state->forceAttrs(attrs, [&]() { return attrs.determinePos(noPos); }, "while evaluating an attribute set to be merged in the global scope");
+    state->forceAttrs(
+        attrs,
+        [&]() { return attrs.determinePos(noPos); },
+        "while evaluating an attribute set to be merged in the global scope");
     if (displ + attrs.attrs()->size() >= envSize)
         throw Error("environment full; cannot add more variables");
 
@@ -847,7 +855,6 @@ void NixRepl::addAttrsToScope(Value & attrs)
         notice("... and %1% more; view with :ll", attrs.attrs()->size() - max_print);
 }
 
-
 void NixRepl::addVarToScope(const Symbol name, Value & v)
 {
     if (displ >= envSize)
@@ -860,13 +867,11 @@ void NixRepl::addVarToScope(const Symbol name, Value & v)
     varNames.emplace(state->symbols[name]);
 }
 
-
 Expr * NixRepl::parseString(std::string s)
 {
     return state->parseExprFromString(std::move(s), state->rootPath("."), staticEnv);
 }
 
-
 void NixRepl::evalString(std::string s, Value & v)
 {
     Expr * e;
@@ -884,46 +889,40 @@ void NixRepl::evalString(std::string s, Value & v)
     state->forceValue(v, v.determinePos(noPos));
 }
 
-
 void NixRepl::runNix(Path program, const Strings & args, const std::optional<std::string> & input)
 {
     if (runNixPtr)
         (*runNixPtr)(program, args, input);
     else
-        throw Error("Cannot run '%s' because no method of calling the Nix CLI was provided. This is a configuration problem pertaining to how this program was built. See Nix 2.25 release notes", program);
+        throw Error(
+            "Cannot run '%s' because no method of calling the Nix CLI was provided. This is a configuration problem pertaining to how this program was built. See Nix 2.25 release notes",
+            program);
 }
 
-
 std::unique_ptr<AbstractNixRepl> AbstractNixRepl::create(
-   const LookupPath & lookupPath, nix::ref<Store> store, ref<EvalState> state,
-   std::function<AnnotatedValues()> getValues, RunNix * runNix)
+    const LookupPath & lookupPath,
+    nix::ref<Store> store,
+    ref<EvalState> state,
+    std::function<AnnotatedValues()> getValues,
+    RunNix * runNix)
 {
-    return std::make_unique<NixRepl>(
-        lookupPath,
-        std::move(store),
-        state,
-        getValues,
-        runNix
-    );
+    return std::make_unique<NixRepl>(lookupPath, std::move(store), state, getValues, runNix);
 }
 
-
-ReplExitStatus AbstractNixRepl::runSimple(
-    ref<EvalState> evalState,
-    const ValMap & extraEnv)
+ReplExitStatus AbstractNixRepl::runSimple(ref<EvalState> evalState, const ValMap & extraEnv)
 {
-    auto getValues = [&]()->NixRepl::AnnotatedValues{
+    auto getValues = [&]() -> NixRepl::AnnotatedValues {
         NixRepl::AnnotatedValues values;
         return values;
     };
     LookupPath lookupPath = {};
+    // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDelete)
     auto repl = std::make_unique<NixRepl>(
-            lookupPath,
-            openStore(),
-            evalState,
-            getValues,
-            /*runNix=*/nullptr
-        );
+        lookupPath,
+        openStore(),
+        evalState,
+        getValues,
+        /*runNix=*/nullptr);
 
     repl->initEnv();
 
@@ -934,4 +933,4 @@ ReplExitStatus AbstractNixRepl::runSimple(
     return repl->mainLoop();
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index ed4582e40..7c014d61d 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -1,7 +1,9 @@
-project('nix-expr-c', 'cpp',
+project(
+  'nix-expr-c',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -33,7 +35,7 @@ sources = files(
   'nix_api_value.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 headers = files(
   'nix_api_expr.h',
@@ -50,7 +52,7 @@ this_library = library(
   sources,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index efaebf0e7..46e08b5f7 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -16,7 +16,7 @@
 #include "nix_api_util_internal.h"
 
 #if NIX_USE_BOEHMGC
-#  include <mutex>
+#  include <boost/unordered/concurrent_flat_map.hpp>
 #endif
 
 /**
@@ -31,17 +31,17 @@
  * @param init Function that takes a T* and returns the initializer for T
  * @return Pointer to allocated and initialized object
  */
-template <typename T, typename F>
+template<typename T, typename F>
 static T * unsafe_new_with_self(F && init)
 {
     // Allocate
-    void * p = ::operator new(
-        sizeof(T),
-        static_cast<std::align_val_t>(alignof(T)));
+    void * p = ::operator new(sizeof(T), static_cast<std::align_val_t>(alignof(T)));
     // Initialize with placement new
     return new (p) T(init(static_cast<T *>(p)));
 }
 
+extern "C" {
+
 nix_err nix_libexpr_init(nix_c_context * context)
 {
     if (context)
@@ -86,12 +86,13 @@ nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, n
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_value_call_multi(nix_c_context * context, EvalState * state, nix_value * fn, size_t nargs, nix_value ** args, nix_value * value)
+nix_err nix_value_call_multi(
+    nix_c_context * context, EvalState * state, nix_value * fn, size_t nargs, nix_value ** args, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        state->state.callFunction(fn->value, {(nix::Value * *) args, nargs}, value->value, nix::noPos);
+        state->state.callFunction(fn->value, {(nix::Value **) args, nargs}, value->value, nix::noPos);
         state->state.forceValue(value->value, nix::noPos);
     }
     NIXC_CATCH_ERRS
@@ -152,7 +153,8 @@ nix_err nix_eval_state_builder_load(nix_c_context * context, nix_eval_state_buil
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_eval_state_builder_set_lookup_path(nix_c_context * context, nix_eval_state_builder * builder, const char ** lookupPath_c)
+nix_err nix_eval_state_builder_set_lookup_path(
+    nix_c_context * context, nix_eval_state_builder * builder, const char ** lookupPath_c)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -175,11 +177,7 @@ EvalState * nix_eval_state_build(nix_c_context * context, nix_eval_state_builder
             return EvalState{
                 .fetchSettings = std::move(builder->fetchSettings),
                 .settings = std::move(builder->settings),
-                .state = nix::EvalState(
-                    builder->lookupPath,
-                    builder->store,
-                    self->fetchSettings,
-                    self->settings),
+                .state = nix::EvalState(builder->lookupPath, builder->store, self->fetchSettings, self->settings),
             };
         });
     }
@@ -195,11 +193,10 @@ EvalState * nix_state_create(nix_c_context * context, const char ** lookupPath_c
     if (nix_eval_state_builder_load(context, builder) != NIX_OK)
         return nullptr;
 
-    if (nix_eval_state_builder_set_lookup_path(context, builder, lookupPath_c)
-            != NIX_OK)
+    if (nix_eval_state_builder_set_lookup_path(context, builder, lookupPath_c) != NIX_OK)
         return nullptr;
 
-    auto *state = nix_eval_state_build(context, builder);
+    auto * state = nix_eval_state_build(context, builder);
     nix_eval_state_builder_free(builder);
     return state;
 }
@@ -210,28 +207,20 @@ void nix_state_free(EvalState * state)
 }
 
 #if NIX_USE_BOEHMGC
-std::unordered_map<
+boost::concurrent_flat_map<
     const void *,
     unsigned int,
     std::hash<const void *>,
     std::equal_to<const void *>,
     traceable_allocator<std::pair<const void * const, unsigned int>>>
-    nix_refcounts;
-
-std::mutex nix_refcount_lock;
+    nix_refcounts{};
 
 nix_err nix_gc_incref(nix_c_context * context, const void * p)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        std::scoped_lock lock(nix_refcount_lock);
-        auto f = nix_refcounts.find(p);
-        if (f != nix_refcounts.end()) {
-            f->second++;
-        } else {
-            nix_refcounts[p] = 1;
-        }
+        nix_refcounts.insert_or_visit({p, 1}, [](auto & kv) { kv.second++; });
     }
     NIXC_CATCH_ERRS
 }
@@ -242,12 +231,12 @@ nix_err nix_gc_decref(nix_c_context * context, const void * p)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        std::scoped_lock lock(nix_refcount_lock);
-        auto f = nix_refcounts.find(p);
-        if (f != nix_refcounts.end()) {
-            if (--f->second == 0)
-                nix_refcounts.erase(f);
-        } else
+        bool fail = true;
+        nix_refcounts.erase_if(p, [&](auto & kv) {
+            fail = false;
+            return !--kv.second;
+        });
+        if (fail)
             throw std::runtime_error("nix_gc_decref: object was not referenced");
     }
     NIXC_CATCH_ERRS
@@ -265,20 +254,23 @@ nix_err nix_gc_incref(nix_c_context * context, const void *)
         context->last_err_code = NIX_OK;
     return NIX_OK;
 }
+
 nix_err nix_gc_decref(nix_c_context * context, const void *)
 {
     if (context)
         context->last_err_code = NIX_OK;
     return NIX_OK;
 }
+
 void nix_gc_now() {}
 #endif
 
-nix_err nix_value_incref(nix_c_context * context, nix_value *x)
+nix_err nix_value_incref(nix_c_context * context, nix_value * x)
 {
     return nix_gc_incref(context, (const void *) x);
 }
-nix_err nix_value_decref(nix_c_context * context, nix_value *x)
+
+nix_err nix_value_decref(nix_c_context * context, nix_value * x)
 {
     return nix_gc_decref(context, (const void *) x);
 }
@@ -289,3 +281,5 @@ void nix_gc_register_finalizer(void * obj, void * cd, void (*finalizer)(void * o
     GC_REGISTER_FINALIZER(obj, finalizer, cd, 0, 0);
 #endif
 }
+
+} // extern "C"
diff --git a/src/libexpr-c/nix_api_expr_internal.h b/src/libexpr-c/nix_api_expr_internal.h
index a26595cec..3aa1d9932 100644
--- a/src/libexpr-c/nix_api_expr_internal.h
+++ b/src/libexpr-c/nix_api_expr_internal.h
@@ -8,6 +8,8 @@
 #include "nix_api_value.h"
 #include "nix/expr/search-path.hh"
 
+extern "C" {
+
 struct nix_eval_state_builder
 {
     nix::ref<nix::Store> store;
@@ -61,4 +63,6 @@ struct nix_realised_string
     std::vector<StorePath> storePaths;
 };
 
+} // extern "C"
+
 #endif // NIX_API_EXPR_INTERNAL_H
diff --git a/src/libexpr-c/nix_api_external.cc b/src/libexpr-c/nix_api_external.cc
index 04d2e52b5..ff2950448 100644
--- a/src/libexpr-c/nix_api_external.cc
+++ b/src/libexpr-c/nix_api_external.cc
@@ -14,6 +14,8 @@
 
 #include <nlohmann/json.hpp>
 
+extern "C" {
+
 void nix_set_string_return(nix_string_return * str, const char * c)
 {
     str->str = c;
@@ -40,6 +42,8 @@ nix_err nix_external_add_string_context(nix_c_context * context, nix_string_cont
     NIXC_CATCH_ERRS
 }
 
+} // extern "C"
+
 class NixCExternalValue : public nix::ExternalValueBase
 {
     NixCExternalValueDesc & desc;
@@ -48,11 +52,13 @@ class NixCExternalValue : public nix::ExternalValueBase
 public:
     NixCExternalValue(NixCExternalValueDesc & desc, void * v)
         : desc(desc)
-        , v(v){};
+        , v(v) {};
+
     void * get_ptr()
     {
         return v;
     }
+
     /**
      * Print out the value
      */
@@ -155,13 +161,21 @@ public:
         }
         nix_string_context ctx{context};
         desc.printValueAsXML(
-            v, (EvalState *) &state, strict, location, &doc, &ctx, &drvsSeen,
+            v,
+            (EvalState *) &state,
+            strict,
+            location,
+            &doc,
+            &ctx,
+            &drvsSeen,
             *reinterpret_cast<const uint32_t *>(&pos));
     }
 
-    virtual ~NixCExternalValue() override{};
+    virtual ~NixCExternalValue() override {};
 };
 
+extern "C" {
+
 ExternalValue * nix_create_external_value(nix_c_context * context, NixCExternalValueDesc * desc, void * v)
 {
     if (context)
@@ -190,3 +204,5 @@ void * nix_get_external_value_content(nix_c_context * context, ExternalValue * b
     }
     NIXC_CATCH_ERRS_NULL
 }
+
+} // extern "C"
diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index fb90e2872..093daf2f8 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -111,6 +111,8 @@ static void nix_c_primop_wrapper(
     v = vTmp;
 }
 
+extern "C" {
+
 PrimOp * nix_alloc_primop(
     nix_c_context * context,
     PrimOpFun fun,
@@ -592,7 +594,7 @@ nix_err nix_bindings_builder_insert(nix_c_context * context, BindingsBuilder * b
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
-        nix::Symbol s = bb->builder.state.symbols.create(name);
+        nix::Symbol s = bb->builder.state.get().symbols.create(name);
         bb->builder.insert(s, &v);
     }
     NIXC_CATCH_ERRS
@@ -651,3 +653,5 @@ const StorePath * nix_realised_string_get_store_path(nix_realised_string * s, si
 {
     return &s->storePaths[i];
 }
+
+} // extern "C"
diff --git a/src/libexpr-test-support/include/nix/expr/tests/libexpr.hh b/src/libexpr-test-support/include/nix/expr/tests/libexpr.hh
index 48c96ae2c..4cf985e15 100644
--- a/src/libexpr-test-support/include/nix/expr/tests/libexpr.hh
+++ b/src/libexpr-test-support/include/nix/expr/tests/libexpr.hh
@@ -16,141 +16,159 @@
 #include "nix/store/tests/libstore.hh"
 
 namespace nix {
-    class LibExprTest : public LibStoreTest {
-        public:
-            static void SetUpTestSuite() {
-                LibStoreTest::SetUpTestSuite();
-                initGC();
-            }
-
-        protected:
-            LibExprTest()
-                : LibStoreTest()
-                , state({}, store, fetchSettings, evalSettings, nullptr)
-            {
-                evalSettings.nixPath = {};
-            }
-            Value eval(std::string input, bool forceValue = true) {
-                Value v;
-                Expr * e = state.parseExprFromString(input, state.rootPath(CanonPath::root));
-                assert(e);
-                state.eval(e, v);
-                if (forceValue)
-                    state.forceValue(v, noPos);
-                return v;
-            }
-
-            Value * maybeThunk(std::string input, bool forceValue = true) {
-                Expr * e = state.parseExprFromString(input, state.rootPath(CanonPath::root));
-                assert(e);
-                return e->maybeThunk(state, state.baseEnv);
-            }
-
-            Symbol createSymbol(const char * value) {
-                return state.symbols.create(value);
-            }
-
-            bool readOnlyMode = true;
-            fetchers::Settings fetchSettings{};
-            EvalSettings evalSettings{readOnlyMode};
-            EvalState state;
-    };
-
-    MATCHER(IsListType, "") {
-        return arg != nList;
+class LibExprTest : public LibStoreTest
+{
+public:
+    static void SetUpTestSuite()
+    {
+        LibStoreTest::SetUpTestSuite();
+        initGC();
     }
 
-    MATCHER(IsList, "") {
-        return arg.type() == nList;
+protected:
+    LibExprTest()
+        : LibStoreTest()
+        , state({}, store, fetchSettings, evalSettings, nullptr)
+    {
+        evalSettings.nixPath = {};
     }
 
-    MATCHER(IsString, "") {
-        return arg.type() == nString;
+    Value eval(std::string input, bool forceValue = true)
+    {
+        Value v;
+        Expr * e = state.parseExprFromString(input, state.rootPath(CanonPath::root));
+        assert(e);
+        state.eval(e, v);
+        if (forceValue)
+            state.forceValue(v, noPos);
+        return v;
     }
 
-    MATCHER(IsNull, "") {
-        return arg.type() == nNull;
+    Value * maybeThunk(std::string input, bool forceValue = true)
+    {
+        Expr * e = state.parseExprFromString(input, state.rootPath(CanonPath::root));
+        assert(e);
+        return e->maybeThunk(state, state.baseEnv);
     }
 
-    MATCHER(IsThunk, "") {
-        return arg.type() == nThunk;
+    Symbol createSymbol(const char * value)
+    {
+        return state.symbols.create(value);
     }
 
-    MATCHER(IsAttrs, "") {
-        return arg.type() == nAttrs;
-    }
+    bool readOnlyMode = true;
+    fetchers::Settings fetchSettings{};
+    EvalSettings evalSettings{readOnlyMode};
+    EvalState state;
+};
 
-    MATCHER_P(IsStringEq, s, fmt("The string is equal to \"%1%\"", s)) {
-        if (arg.type() != nString) {
+MATCHER(IsListType, "")
+{
+    return arg != nList;
+}
+
+MATCHER(IsList, "")
+{
+    return arg.type() == nList;
+}
+
+MATCHER(IsString, "")
+{
+    return arg.type() == nString;
+}
+
+MATCHER(IsNull, "")
+{
+    return arg.type() == nNull;
+}
+
+MATCHER(IsThunk, "")
+{
+    return arg.type() == nThunk;
+}
+
+MATCHER(IsAttrs, "")
+{
+    return arg.type() == nAttrs;
+}
+
+MATCHER_P(IsStringEq, s, fmt("The string is equal to \"%1%\"", s))
+{
+    if (arg.type() != nString) {
+        return false;
+    }
+    return std::string_view(arg.c_str()) == s;
+}
+
+MATCHER_P(IsIntEq, v, fmt("The string is equal to \"%1%\"", v))
+{
+    if (arg.type() != nInt) {
+        return false;
+    }
+    return arg.integer().value == v;
+}
+
+MATCHER_P(IsFloatEq, v, fmt("The float is equal to \"%1%\"", v))
+{
+    if (arg.type() != nFloat) {
+        return false;
+    }
+    return arg.fpoint() == v;
+}
+
+MATCHER(IsTrue, "")
+{
+    if (arg.type() != nBool) {
+        return false;
+    }
+    return arg.boolean() == true;
+}
+
+MATCHER(IsFalse, "")
+{
+    if (arg.type() != nBool) {
+        return false;
+    }
+    return arg.boolean() == false;
+}
+
+MATCHER_P(IsPathEq, p, fmt("Is a path equal to \"%1%\"", p))
+{
+    if (arg.type() != nPath) {
+        *result_listener << "Expected a path got " << arg.type();
+        return false;
+    } else {
+        auto path = arg.path();
+        if (path.path != CanonPath(p)) {
+            *result_listener << "Expected a path that equals \"" << p << "\" but got: " << path.path;
             return false;
         }
-        return std::string_view(arg.c_str()) == s;
     }
+    return true;
+}
 
-    MATCHER_P(IsIntEq, v, fmt("The string is equal to \"%1%\"", v)) {
-        if (arg.type() != nInt) {
-            return false;
-        }
-        return arg.integer().value == v;
+MATCHER_P(IsListOfSize, n, fmt("Is a list of size [%1%]", n))
+{
+    if (arg.type() != nList) {
+        *result_listener << "Expected list got " << arg.type();
+        return false;
+    } else if (arg.listSize() != (size_t) n) {
+        *result_listener << "Expected as list of size " << n << " got " << arg.listSize();
+        return false;
     }
+    return true;
+}
 
-    MATCHER_P(IsFloatEq, v, fmt("The float is equal to \"%1%\"", v)) {
-        if (arg.type() != nFloat) {
-            return false;
-        }
-        return arg.fpoint() == v;
+MATCHER_P(IsAttrsOfSize, n, fmt("Is a set of size [%1%]", n))
+{
+    if (arg.type() != nAttrs) {
+        *result_listener << "Expected set got " << arg.type();
+        return false;
+    } else if (arg.attrs()->size() != (size_t) n) {
+        *result_listener << "Expected a set with " << n << " attributes but got " << arg.attrs()->size();
+        return false;
     }
-
-    MATCHER(IsTrue, "") {
-        if (arg.type() != nBool) {
-            return false;
-        }
-        return arg.boolean() == true;
-    }
-
-    MATCHER(IsFalse, "") {
-        if (arg.type() != nBool) {
-            return false;
-        }
-        return arg.boolean() == false;
-    }
-
-    MATCHER_P(IsPathEq, p, fmt("Is a path equal to \"%1%\"", p)) {
-        if (arg.type() != nPath) {
-            *result_listener << "Expected a path got " << arg.type();
-            return false;
-        } else {
-            auto path = arg.path();
-            if (path.path != CanonPath(p)) {
-                *result_listener << "Expected a path that equals \"" << p << "\" but got: " << path.path;
-                return false;
-            }
-        }
-        return true;
-    }
-
-
-    MATCHER_P(IsListOfSize, n, fmt("Is a list of size [%1%]", n)) {
-        if (arg.type() != nList) {
-            *result_listener << "Expected list got " << arg.type();
-            return false;
-        } else if (arg.listSize() != (size_t)n) {
-            *result_listener << "Expected as list of size " << n << " got " << arg.listSize();
-            return false;
-        }
-        return true;
-    }
-
-    MATCHER_P(IsAttrsOfSize, n, fmt("Is a set of size [%1%]", n)) {
-        if (arg.type() != nAttrs) {
-            *result_listener << "Expected set got " << arg.type();
-            return false;
-        } else if (arg.attrs()->size() != (size_t) n) {
-            *result_listener << "Expected a set with " << n << " attributes but got " << arg.attrs()->size();
-            return false;
-        }
-        return true;
-    }
-
+    return true;
+}
 
 } /* namespace nix */
diff --git a/src/libexpr-test-support/include/nix/expr/tests/meson.build b/src/libexpr-test-support/include/nix/expr/tests/meson.build
index 84ec401ab..6575d11c8 100644
--- a/src/libexpr-test-support/include/nix/expr/tests/meson.build
+++ b/src/libexpr-test-support/include/nix/expr/tests/meson.build
@@ -6,5 +6,4 @@ headers = files(
   'libexpr.hh',
   'nix_api_expr.hh',
   'value/context.hh',
-  # hack for trailing newline
 )
diff --git a/src/libexpr-test-support/include/nix/expr/tests/nix_api_expr.hh b/src/libexpr-test-support/include/nix/expr/tests/nix_api_expr.hh
index 3e5aec313..376761d76 100644
--- a/src/libexpr-test-support/include/nix/expr/tests/nix_api_expr.hh
+++ b/src/libexpr-test-support/include/nix/expr/tests/nix_api_expr.hh
@@ -18,6 +18,7 @@ protected:
         state = nix_state_create(nullptr, nullptr, store);
         value = nix_alloc_value(nullptr, state);
     }
+
     ~nix_api_expr_test()
     {
         nix_gc_decref(nullptr, value);
@@ -28,4 +29,4 @@ protected:
     nix_value * value;
 };
 
-}
+} // namespace nixC
diff --git a/src/libexpr-test-support/include/nix/expr/tests/value/context.hh b/src/libexpr-test-support/include/nix/expr/tests/value/context.hh
index a6a851d3a..68a0b8dea 100644
--- a/src/libexpr-test-support/include/nix/expr/tests/value/context.hh
+++ b/src/libexpr-test-support/include/nix/expr/tests/value/context.hh
@@ -9,23 +9,27 @@ namespace rc {
 using namespace nix;
 
 template<>
-struct Arbitrary<NixStringContextElem::Opaque> {
+struct Arbitrary<NixStringContextElem::Opaque>
+{
     static Gen<NixStringContextElem::Opaque> arbitrary();
 };
 
 template<>
-struct Arbitrary<NixStringContextElem::Built> {
+struct Arbitrary<NixStringContextElem::Built>
+{
     static Gen<NixStringContextElem::Built> arbitrary();
 };
 
 template<>
-struct Arbitrary<NixStringContextElem::DrvDeep> {
+struct Arbitrary<NixStringContextElem::DrvDeep>
+{
     static Gen<NixStringContextElem::DrvDeep> arbitrary();
 };
 
 template<>
-struct Arbitrary<NixStringContextElem> {
+struct Arbitrary<NixStringContextElem>
+{
     static Gen<NixStringContextElem> arbitrary();
 };
 
-}
+} // namespace rc
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index b97f94362..d762eb85e 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -1,7 +1,9 @@
-project('nix-expr-test-support', 'cpp',
+project(
+  'nix-expr-test-support',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -14,8 +16,7 @@ cxx = meson.get_compiler('cpp')
 
 subdir('nix-meson-build-support/deps-lists')
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-test-support'),
@@ -47,7 +48,7 @@ this_library = library(
   include_directories : include_dirs,
   # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
   #       is available. See also ../libutil/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libexpr-test-support/tests/value/context.cc b/src/libexpr-test-support/tests/value/context.cc
index 51ff1b2ae..d6036601a 100644
--- a/src/libexpr-test-support/tests/value/context.cc
+++ b/src/libexpr-test-support/tests/value/context.cc
@@ -1,3 +1,4 @@
+#include <exception> // Needed by rapidcheck on Darwin
 #include <rapidcheck.h>
 
 #include "nix/store/tests/path.hh"
@@ -36,4 +37,4 @@ Gen<NixStringContextElem> Arbitrary<NixStringContextElem>::arbitrary()
         });
 }
 
-}
+} // namespace rc
diff --git a/src/libexpr-tests/derived-path.cc b/src/libexpr-tests/derived-path.cc
index 9cc5d5371..e9f9fcd07 100644
--- a/src/libexpr-tests/derived-path.cc
+++ b/src/libexpr-tests/derived-path.cc
@@ -1,5 +1,6 @@
 #include <nlohmann/json.hpp>
 #include <gtest/gtest.h>
+#include <exception> // Needed by rapidcheck on Darwin
 #include <rapidcheck/gtest.h>
 
 #include "nix/store/tests/derived-path.hh"
@@ -8,36 +9,30 @@
 namespace nix {
 
 // Testing of trivial expressions
-class DerivedPathExpressionTest : public LibExprTest {};
+class DerivedPathExpressionTest : public LibExprTest
+{};
 
 // FIXME: `RC_GTEST_FIXTURE_PROP` isn't calling `SetUpTestSuite` because it is
 // no a real fixture.
 //
 // See https://github.com/emil-e/rapidcheck/blob/master/doc/gtest.md#rc_gtest_fixture_propfixture-name-args
-TEST_F(DerivedPathExpressionTest, force_init)
-{
-}
+TEST_F(DerivedPathExpressionTest, force_init) {}
 
 #ifndef COVERAGE
 
-RC_GTEST_FIXTURE_PROP(
-    DerivedPathExpressionTest,
-    prop_opaque_path_round_trip,
-    (const SingleDerivedPath::Opaque & o))
+RC_GTEST_FIXTURE_PROP(DerivedPathExpressionTest, prop_opaque_path_round_trip, (const SingleDerivedPath::Opaque & o))
 {
     auto * v = state.allocValue();
     state.mkStorePathString(o.path, *v);
     auto d = state.coerceToSingleDerivedPath(noPos, *v, "");
-    RC_ASSERT(SingleDerivedPath { o } == d);
+    RC_ASSERT(SingleDerivedPath{o} == d);
 }
 
 // TODO use DerivedPath::Built for parameter once it supports a single output
 // path only.
 
 RC_GTEST_FIXTURE_PROP(
-    DerivedPathExpressionTest,
-    prop_derived_path_built_placeholder_round_trip,
-    (const SingleDerivedPath::Built & b))
+    DerivedPathExpressionTest, prop_derived_path_built_placeholder_round_trip, (const SingleDerivedPath::Built & b))
 {
     /**
      * We set these in tests rather than the regular globals so we don't have
@@ -49,7 +44,7 @@ RC_GTEST_FIXTURE_PROP(
     auto * v = state.allocValue();
     state.mkOutputString(*v, b, std::nullopt, mockXpSettings);
     auto [d, _] = state.coerceToSingleDerivedPathUnchecked(noPos, *v, "", mockXpSettings);
-    RC_ASSERT(SingleDerivedPath { b } == d);
+    RC_ASSERT(SingleDerivedPath{b} == d);
 }
 
 RC_GTEST_FIXTURE_PROP(
@@ -63,7 +58,7 @@ RC_GTEST_FIXTURE_PROP(
     auto * v = state.allocValue();
     state.mkOutputString(*v, b, outPath, mockXpSettings);
     auto [d, _] = state.coerceToSingleDerivedPathUnchecked(noPos, *v, "", mockXpSettings);
-    RC_ASSERT(SingleDerivedPath { b } == d);
+    RC_ASSERT(SingleDerivedPath{b} == d);
 }
 
 #endif
diff --git a/src/libexpr-tests/error_traces.cc b/src/libexpr-tests/error_traces.cc
index 32e49efe6..7e7b5eb84 100644
--- a/src/libexpr-tests/error_traces.cc
+++ b/src/libexpr-tests/error_traces.cc
@@ -5,1374 +5,1358 @@
 
 namespace nix {
 
-    using namespace testing;
+using namespace testing;
 
-    // Testing eval of PrimOp's
-    class ErrorTraceTest : public LibExprTest { };
+// Testing eval of PrimOp's
+class ErrorTraceTest : public LibExprTest
+{};
 
-    TEST_F(ErrorTraceTest, TraceBuilder) {
-        ASSERT_THROW(
-            state.error<EvalError>("puppy").debugThrow(),
-            EvalError
-        );
+TEST_F(ErrorTraceTest, TraceBuilder)
+{
+    ASSERT_THROW(state.error<EvalError>("puppy").debugThrow(), EvalError);
 
-        ASSERT_THROW(
-            state.error<EvalError>("puppy").withTrace(noPos, "doggy").debugThrow(),
-            EvalError
-        );
+    ASSERT_THROW(state.error<EvalError>("puppy").withTrace(noPos, "doggy").debugThrow(), EvalError);
 
-        ASSERT_THROW(
+    ASSERT_THROW(
+        try {
             try {
-                try {
-                    state.error<EvalError>("puppy").withTrace(noPos, "doggy").debugThrow();
-                } catch (Error & e) {
-                    e.addTrace(state.positions[noPos], "beans");
-                    throw;
-                }
-            } catch (BaseError & e) {
-                ASSERT_EQ(PrintToString(e.info().msg),
-                          PrintToString(HintFmt("puppy")));
-                auto trace = e.info().traces.rbegin();
-                ASSERT_EQ(e.info().traces.size(), 2u);
-                ASSERT_EQ(PrintToString(trace->hint),
-                          PrintToString(HintFmt("doggy")));
-                trace++;
-                ASSERT_EQ(PrintToString(trace->hint),
-                          PrintToString(HintFmt("beans")));
+                state.error<EvalError>("puppy").withTrace(noPos, "doggy").debugThrow();
+            } catch (Error & e) {
+                e.addTrace(state.positions[noPos], "beans");
                 throw;
             }
-            , EvalError
-        );
-    }
-
-    TEST_F(ErrorTraceTest, NestedThrows) {
-        try {
-            state.error<EvalError>("puppy").withTrace(noPos, "doggy").debugThrow();
         } catch (BaseError & e) {
-            try {
-                state.error<EvalError>("beans").debugThrow();
-            } catch (Error & e2) {
-                e.addTrace(state.positions[noPos], "beans2");
-                //e2.addTrace(state.positions[noPos], "Something", "");
-                ASSERT_TRUE(e.info().traces.size() == 2u);
-                ASSERT_TRUE(e2.info().traces.size() == 0u);
-                ASSERT_FALSE(&e.info() == &e2.info());
-            }
+            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(HintFmt("puppy")));
+            auto trace = e.info().traces.rbegin();
+            ASSERT_EQ(e.info().traces.size(), 2u);
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("doggy")));
+            trace++;
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("beans")));
+            throw;
+        },
+        EvalError);
+}
+
+TEST_F(ErrorTraceTest, NestedThrows)
+{
+    try {
+        state.error<EvalError>("puppy").withTrace(noPos, "doggy").debugThrow();
+    } catch (BaseError & e) {
+        try {
+            state.error<EvalError>("beans").debugThrow();
+        } catch (Error & e2) {
+            e.addTrace(state.positions[noPos], "beans2");
+            // e2.addTrace(state.positions[noPos], "Something", "");
+            ASSERT_TRUE(e.info().traces.size() == 2u);
+            ASSERT_TRUE(e2.info().traces.size() == 0u);
+            ASSERT_FALSE(&e.info() == &e2.info());
         }
     }
+}
 
-#define ASSERT_TRACE1(args, type, message)                                  \
-        ASSERT_THROW(                                                       \
-            std::string expr(args);                                         \
-            std::string name = expr.substr(0, expr.find(" "));              \
-            try {                                                           \
-                Value v = eval("builtins." args);                           \
-                state.forceValueDeep(v);                                    \
-            } catch (BaseError & e) {                                       \
-                ASSERT_EQ(PrintToString(e.info().msg),                      \
-                          PrintToString(message));                          \
-                ASSERT_EQ(e.info().traces.size(), 1u) << "while testing " args << std::endl << e.what(); \
-                auto trace = e.info().traces.rbegin();                      \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-                throw;                                                      \
-            }                                                               \
-            , type                                                          \
-        )
+#define ASSERT_TRACE1(args, type, message)                                                                         \
+    ASSERT_THROW(                                                                                                  \
+        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
+            Value v = eval("builtins." args);                                                                      \
+            state.forceValueDeep(v);                                                                               \
+        } catch (BaseError & e) {                                                                                  \
+            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
+            ASSERT_EQ(e.info().traces.size(), 1u) << "while testing " args << std::endl << e.what();               \
+            auto trace = e.info().traces.rbegin();                                                                 \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
+            throw;                                                                                                 \
+        },                                                                                                         \
+                                                                                   type)
 
-#define ASSERT_TRACE2(args, type, message, context)                         \
-        ASSERT_THROW(                                                       \
-            std::string expr(args);                                         \
-            std::string name = expr.substr(0, expr.find(" "));              \
-            try {                                                           \
-                Value v = eval("builtins." args);                           \
-                state.forceValueDeep(v);                                    \
-            } catch (BaseError & e) {                                       \
-                ASSERT_EQ(PrintToString(e.info().msg),                      \
-                          PrintToString(message));                          \
-                ASSERT_EQ(e.info().traces.size(), 2u) << "while testing " args << std::endl << e.what(); \
-                auto trace = e.info().traces.rbegin();                      \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(context));                          \
-                ++trace;                                                    \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-                throw;                                                      \
-            }                                                               \
-            , type                                                          \
-        )
+#define ASSERT_TRACE2(args, type, message, context)                                                                \
+    ASSERT_THROW(                                                                                                  \
+        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
+            Value v = eval("builtins." args);                                                                      \
+            state.forceValueDeep(v);                                                                               \
+        } catch (BaseError & e) {                                                                                  \
+            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
+            ASSERT_EQ(e.info().traces.size(), 2u) << "while testing " args << std::endl << e.what();               \
+            auto trace = e.info().traces.rbegin();                                                                 \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context));                                         \
+            ++trace;                                                                                               \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
+            throw;                                                                                                 \
+        },                                                                                                         \
+                                                                                   type)
 
-#define ASSERT_TRACE3(args, type, message, context1, context2)              \
-        ASSERT_THROW(                                                       \
-            std::string expr(args);                                         \
-            std::string name = expr.substr(0, expr.find(" "));              \
-            try {                                                           \
-                Value v = eval("builtins." args);                           \
-                state.forceValueDeep(v);                                    \
-            } catch (BaseError & e) {                                       \
-                ASSERT_EQ(PrintToString(e.info().msg),                      \
-                          PrintToString(message));                          \
-                ASSERT_EQ(e.info().traces.size(), 3u) << "while testing " args << std::endl << e.what(); \
-                auto trace = e.info().traces.rbegin();                      \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(context1));                         \
-                ++trace;                                                    \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(context2));                         \
-                ++trace;                                                    \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-                throw;                                                      \
-            }                                                               \
-            , type                                                          \
-        )
+#define ASSERT_TRACE3(args, type, message, context1, context2)                                                     \
+    ASSERT_THROW(                                                                                                  \
+        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
+            Value v = eval("builtins." args);                                                                      \
+            state.forceValueDeep(v);                                                                               \
+        } catch (BaseError & e) {                                                                                  \
+            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
+            ASSERT_EQ(e.info().traces.size(), 3u) << "while testing " args << std::endl << e.what();               \
+            auto trace = e.info().traces.rbegin();                                                                 \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context1));                                        \
+            ++trace;                                                                                               \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context2));                                        \
+            ++trace;                                                                                               \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
+            throw;                                                                                                 \
+        },                                                                                                         \
+                                                                                   type)
 
-#define ASSERT_TRACE4(args, type, message, context1, context2, context3)    \
-        ASSERT_THROW(                                                       \
-            std::string expr(args);                                         \
-            std::string name = expr.substr(0, expr.find(" "));              \
-            try {                                                           \
-                Value v = eval("builtins." args);                           \
-                state.forceValueDeep(v);                                    \
-            } catch (BaseError & e) {                                       \
-                ASSERT_EQ(PrintToString(e.info().msg),                      \
-                          PrintToString(message));                          \
-                ASSERT_EQ(e.info().traces.size(), 4u) << "while testing " args << std::endl << e.what(); \
-                auto trace = e.info().traces.rbegin();                      \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(context1));                         \
-                ++trace;                                                    \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(context2));                         \
-                ++trace;                                                    \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(context3));                         \
-                ++trace;                                                    \
-                ASSERT_EQ(PrintToString(trace->hint),                       \
-                          PrintToString(HintFmt("while calling the '%s' builtin", name))); \
-                throw;                                                      \
-            }                                                               \
-            , type                                                          \
-        )
+#define ASSERT_TRACE4(args, type, message, context1, context2, context3)                                           \
+    ASSERT_THROW(                                                                                                  \
+        std::string expr(args); std::string name = expr.substr(0, expr.find(" ")); try {                           \
+            Value v = eval("builtins." args);                                                                      \
+            state.forceValueDeep(v);                                                                               \
+        } catch (BaseError & e) {                                                                                  \
+            ASSERT_EQ(PrintToString(e.info().msg), PrintToString(message));                                        \
+            ASSERT_EQ(e.info().traces.size(), 4u) << "while testing " args << std::endl << e.what();               \
+            auto trace = e.info().traces.rbegin();                                                                 \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context1));                                        \
+            ++trace;                                                                                               \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context2));                                        \
+            ++trace;                                                                                               \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(context3));                                        \
+            ++trace;                                                                                               \
+            ASSERT_EQ(PrintToString(trace->hint), PrintToString(HintFmt("while calling the '%s' builtin", name))); \
+            throw;                                                                                                 \
+        },                                                                                                         \
+                                                                                   type)
 
 // We assume that expr starts with "builtins.derivationStrict { name =",
 // otherwise the name attribute position (1, 29) would be invalid.
-#define DERIVATION_TRACE_HINTFMT(name)                                      \
-        HintFmt("while evaluating derivation '%s'\n"                        \
-                "  whose name attribute is located at %s",                  \
-                name, Pos(1, 29, Pos::String{.source = make_ref<std::string>(expr)}))
+#define DERIVATION_TRACE_HINTFMT(name)             \
+    HintFmt(                                       \
+        "while evaluating derivation '%s'\n"       \
+        "  whose name attribute is located at %s", \
+        name,                                      \
+        Pos(1, 29, Pos::String{.source = make_ref<std::string>(expr)}))
 
 // To keep things simple, we also assume that derivation name is "foo".
-#define ASSERT_DERIVATION_TRACE1(args, type, message)                       \
-        ASSERT_TRACE2(args, type, message, DERIVATION_TRACE_HINTFMT("foo"))
-#define ASSERT_DERIVATION_TRACE2(args, type, message, context)              \
-        ASSERT_TRACE3(args, type, message, context, DERIVATION_TRACE_HINTFMT("foo"))
-#define ASSERT_DERIVATION_TRACE3(args, type, message, context1, context2)   \
-        ASSERT_TRACE4(args, type, message, context1, context2, DERIVATION_TRACE_HINTFMT("foo"))
-
-    TEST_F(ErrorTraceTest, genericClosure) {
-        ASSERT_TRACE2("genericClosure 1",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.genericClosure"));
-
-        ASSERT_TRACE2("genericClosure {}",
-                      TypeError,
-                      HintFmt("attribute '%s' missing", "startSet"),
-                      HintFmt("in the attrset passed as argument to builtins.genericClosure"));
-
-        ASSERT_TRACE2("genericClosure { startSet = 1; }",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the 'startSet' attribute passed as argument to builtins.genericClosure"));
-
-        ASSERT_TRACE2("genericClosure { startSet = [{ key = 1;}]; operator = true; }",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-                      HintFmt("while evaluating the 'operator' attribute passed as argument to builtins.genericClosure"));
-
-        ASSERT_TRACE2("genericClosure { startSet = [{ key = 1;}]; operator = item: true; }",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the `operator` passed to builtins.genericClosure"));
-
-        ASSERT_TRACE2("genericClosure { startSet = [{ key = 1;}]; operator = item: [ true ]; }",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-                      HintFmt("while evaluating one of the elements generated by (or initially passed to) builtins.genericClosure"));
-
-        ASSERT_TRACE2("genericClosure { startSet = [{ key = 1;}]; operator = item: [ {} ]; }",
-                      TypeError,
-                      HintFmt("attribute '%s' missing", "key"),
-                      HintFmt("in one of the attrsets generated by (or initially passed to) builtins.genericClosure"));
-
-        ASSERT_TRACE2("genericClosure { startSet = [{ key = 1;}]; operator = item: [{ key = ''a''; }]; }",
-                      EvalError,
-                      HintFmt("cannot compare %s with %s", "a string", "an integer"),
-                      HintFmt("while comparing the `key` attributes of two genericClosure elements"));
-
-        ASSERT_TRACE2("genericClosure { startSet = [ true ]; operator = item: [{ key = ''a''; }]; }",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-                      HintFmt("while evaluating one of the elements generated by (or initially passed to) builtins.genericClosure"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, replaceStrings) {
-        ASSERT_TRACE2("replaceStrings 0 0 {}",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "0" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.replaceStrings"));
-
-        ASSERT_TRACE2("replaceStrings [] 0 {}",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "0" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.replaceStrings"));
-
-        ASSERT_TRACE1("replaceStrings [ 0 ] [] {}",
-                      EvalError,
-                      HintFmt("'from' and 'to' arguments passed to builtins.replaceStrings have different lengths"));
-
-        ASSERT_TRACE2("replaceStrings [ 1 ] [ \"new\" ] {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating one of the strings to replace passed to builtins.replaceStrings"));
-
-        ASSERT_TRACE2("replaceStrings [ \"oo\" ] [ true ] \"foo\"",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-                      HintFmt("while evaluating one of the replacement strings passed to builtins.replaceStrings"));
-
-        ASSERT_TRACE2("replaceStrings [ \"old\" ] [ \"new\" ] {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the third argument passed to builtins.replaceStrings"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, scopedImport) {
-    }
-
-
-    TEST_F(ErrorTraceTest, import) {
-    }
-
-
-    TEST_F(ErrorTraceTest, typeOf) {
-    }
-
-
-    TEST_F(ErrorTraceTest, isNull) {
-    }
-
-
-    TEST_F(ErrorTraceTest, isFunction) {
-    }
-
-
-    TEST_F(ErrorTraceTest, isInt) {
-    }
-
-
-    TEST_F(ErrorTraceTest, isFloat) {
-    }
-
-
-    TEST_F(ErrorTraceTest, isString) {
-    }
-
-
-    TEST_F(ErrorTraceTest, isBool) {
-    }
-
-
-    TEST_F(ErrorTraceTest, isPath) {
-    }
-
-
-    TEST_F(ErrorTraceTest, break) {
-    }
-
-
-    TEST_F(ErrorTraceTest, abort) {
-    }
-
-
-    TEST_F(ErrorTraceTest, throw) {
-    }
-
-
-    TEST_F(ErrorTraceTest, addErrorContext) {
-    }
-
-
-    TEST_F(ErrorTraceTest, ceil) {
-        ASSERT_TRACE2("ceil \"foo\"",
-                      TypeError,
-                      HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.ceil"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, floor) {
-        ASSERT_TRACE2("floor \"foo\"",
-                      TypeError,
-                      HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.floor"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, tryEval) {
-    }
-
-
-    TEST_F(ErrorTraceTest, getEnv) {
-        ASSERT_TRACE2("getEnv [ ]",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.getEnv"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, seq) {
-    }
-
-
-    TEST_F(ErrorTraceTest, deepSeq) {
-    }
-
-
-    TEST_F(ErrorTraceTest, trace) {
-    }
-
-
-    TEST_F(ErrorTraceTest, placeholder) {
-        ASSERT_TRACE2("placeholder []",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.placeholder"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, toPath) {
-        ASSERT_TRACE2("toPath []",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.toPath"));
-
-        ASSERT_TRACE2("toPath \"foo\"",
-                      EvalError,
-                      HintFmt("string '%s' doesn't represent an absolute path", "foo"),
-                      HintFmt("while evaluating the first argument passed to builtins.toPath"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, storePath) {
-        ASSERT_TRACE2("storePath true",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to 'builtins.storePath'"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, pathExists) {
-        ASSERT_TRACE2("pathExists []",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while realising the context of a path"));
-
-        ASSERT_TRACE2("pathExists \"zorglub\"",
-                      EvalError,
-                      HintFmt("string '%s' doesn't represent an absolute path", "zorglub"),
-                      HintFmt("while realising the context of a path"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, baseNameOf) {
-        ASSERT_TRACE2("baseNameOf []",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.baseNameOf"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, dirOf) {
-    }
-
-
-    TEST_F(ErrorTraceTest, readFile) {
-    }
-
-
-    TEST_F(ErrorTraceTest, findFile) {
-    }
-
-
-    TEST_F(ErrorTraceTest, hashFile) {
-    }
-
-
-    TEST_F(ErrorTraceTest, readDir) {
-    }
-
-
-    TEST_F(ErrorTraceTest, toXML) {
-    }
-
-
-    TEST_F(ErrorTraceTest, toJSON) {
-    }
-
-
-    TEST_F(ErrorTraceTest, fromJSON) {
-    }
-
-
-    TEST_F(ErrorTraceTest, toFile) {
-    }
-
-
-    TEST_F(ErrorTraceTest, filterSource) {
-        ASSERT_TRACE2("filterSource [] []",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'"));
-
-        ASSERT_TRACE2("filterSource [] \"foo\"",
-                      EvalError,
-                      HintFmt("string '%s' doesn't represent an absolute path", "foo"),
-                      HintFmt("while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'"));
-
-        ASSERT_TRACE2("filterSource [] ./.",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.filterSource"));
-
-        // Unsupported by store "dummy"
-
-        // ASSERT_TRACE2("filterSource (_: 1) ./.",
-        //               TypeError,
-        //               HintFmt("attempt to call something which is not a function but %s", "an integer"),
-        //               HintFmt("while adding path '/home/layus/projects/nix'"));
-
-        // ASSERT_TRACE2("filterSource (_: _: 1) ./.",
-        //               TypeError,
-        //               HintFmt("expected a Boolean but found %s: %s", "an integer", "1"),
-        //               HintFmt("while evaluating the return value of the path filter function"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, path) {
-    }
-
-
-    TEST_F(ErrorTraceTest, attrNames) {
-        ASSERT_TRACE2("attrNames []",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the argument passed to builtins.attrNames"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, attrValues) {
-        ASSERT_TRACE2("attrValues []",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the argument passed to builtins.attrValues"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, getAttr) {
-        ASSERT_TRACE2("getAttr [] []",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.getAttr"));
-
-        ASSERT_TRACE2("getAttr \"foo\" []",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the second argument passed to builtins.getAttr"));
-
-        ASSERT_TRACE2("getAttr \"foo\" {}",
-                      TypeError,
-                      HintFmt("attribute '%s' missing", "foo"),
-                      HintFmt("in the attribute set under consideration"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, unsafeGetAttrPos) {
-    }
-
-
-    TEST_F(ErrorTraceTest, hasAttr) {
-        ASSERT_TRACE2("hasAttr [] []",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.hasAttr"));
-
-        ASSERT_TRACE2("hasAttr \"foo\" []",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the second argument passed to builtins.hasAttr"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, isAttrs) {
-    }
-
-
-    TEST_F(ErrorTraceTest, removeAttrs) {
-        ASSERT_TRACE2("removeAttrs \"\" \"\"",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
-
-        ASSERT_TRACE2("removeAttrs \"\" [ 1 ]",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
-
-        ASSERT_TRACE2("removeAttrs \"\" [ \"1\" ]",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, listToAttrs) {
-        ASSERT_TRACE2("listToAttrs 1",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the argument passed to builtins.listToAttrs"));
-
-        ASSERT_TRACE2("listToAttrs [ 1 ]",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating an element of the list passed to builtins.listToAttrs"));
-
-        ASSERT_TRACE2("listToAttrs [ {} ]",
-                      TypeError,
-                      HintFmt("attribute '%s' missing", "name"),
-                      HintFmt("in a {name=...; value=...;} pair"));
-
-        ASSERT_TRACE2("listToAttrs [ { name = 1; } ]",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the `name` attribute of an element of the list passed to builtins.listToAttrs"));
-
-        ASSERT_TRACE2("listToAttrs [ { name = \"foo\"; } ]",
-                      TypeError,
-                      HintFmt("attribute '%s' missing", "value"),
-                      HintFmt("in a {name=...; value=...;} pair"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, intersectAttrs) {
-        ASSERT_TRACE2("intersectAttrs [] []",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.intersectAttrs"));
-
-        ASSERT_TRACE2("intersectAttrs {} []",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the second argument passed to builtins.intersectAttrs"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, catAttrs) {
-        ASSERT_TRACE2("catAttrs [] {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.catAttrs"));
-
-        ASSERT_TRACE2("catAttrs \"foo\" {}",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the second argument passed to builtins.catAttrs"));
-
-        ASSERT_TRACE2("catAttrs \"foo\" [ 1 ]",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating an element in the list passed as second argument to builtins.catAttrs"));
-
-        ASSERT_TRACE2("catAttrs \"foo\" [ { foo = 1; } 1 { bar = 5;} ]",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating an element in the list passed as second argument to builtins.catAttrs"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, functionArgs) {
-        ASSERT_TRACE1("functionArgs {}",
-                      TypeError,
-                      HintFmt("'functionArgs' requires a function"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, mapAttrs) {
-        ASSERT_TRACE2("mapAttrs [] []",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the second argument passed to builtins.mapAttrs"));
-
-        // XXX: deferred
-        // ASSERT_TRACE2("mapAttrs \"\" { foo.bar = 1; }",
-        //               TypeError,
-        //               HintFmt("attempt to call something which is not a function but %s", "a string"),
-        //               HintFmt("while evaluating the attribute 'foo'"));
-
-        // ASSERT_TRACE2("mapAttrs (x: x + \"1\") { foo.bar = 1; }",
-        //               TypeError,
-        //               HintFmt("attempt to call something which is not a function but %s", "a string"),
-        //               HintFmt("while evaluating the attribute 'foo'"));
-
-        // ASSERT_TRACE2("mapAttrs (x: y: x + 1) { foo.bar = 1; }",
-        //               TypeError,
-        //               HintFmt("cannot coerce %s to a string", "an integer"),
-        //               HintFmt("while evaluating a path segment"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, zipAttrsWith) {
-        ASSERT_TRACE2("zipAttrsWith [] [ 1 ]",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "a list", Uncolored("[ ]")),
-                      HintFmt("while evaluating the first argument passed to builtins.zipAttrsWith"));
-
-        ASSERT_TRACE2("zipAttrsWith (_: 1) [ 1 ]",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating a value of the list passed as second argument to builtins.zipAttrsWith"));
-
-        // XXX: How to properly tell that the function takes two arguments ?
-        // The same question also applies to sort, and maybe others.
-        // Due to laziness, we only create a thunk, and it fails later on.
-        // ASSERT_TRACE2("zipAttrsWith (_: 1) [ { foo = 1; } ]",
-        //               TypeError,
-        //               HintFmt("attempt to call something which is not a function but %s", "an integer"),
-        //               HintFmt("while evaluating the attribute 'foo'"));
-
-        // XXX: Also deferred deeply
-        // ASSERT_TRACE2("zipAttrsWith (a: b: a + b) [ { foo = 1; } { foo = 2; } ]",
-        //               TypeError,
-        //               HintFmt("cannot coerce %s to a string", "a list"),
-        //               HintFmt("while evaluating a path segment"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, isList) {
-    }
-
-
-    TEST_F(ErrorTraceTest, elemAt) {
-        ASSERT_TRACE2("elemAt \"foo\" (-1)",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to 'builtins.elemAt'"));
-
-        ASSERT_TRACE1("elemAt [] (-1)",
-                      Error,
-                      HintFmt("'builtins.elemAt' called with index %d on a list of size %d", -1, 0));
-
-        ASSERT_TRACE1("elemAt [\"foo\"] 3",
-                      Error,
-                      HintFmt("'builtins.elemAt' called with index %d on a list of size %d", 3, 1));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, head) {
-        ASSERT_TRACE2("head 1",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to 'builtins.head'"));
-
-        ASSERT_TRACE1("head []",
-                      Error,
-                      HintFmt("'builtins.head' called on an empty list"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, tail) {
-        ASSERT_TRACE2("tail 1",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to 'builtins.tail'"));
-
-        ASSERT_TRACE1("tail []",
-                      Error,
-                      HintFmt("'builtins.tail' called on an empty list"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, map) {
-        ASSERT_TRACE2("map 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.map"));
-
-        ASSERT_TRACE2("map 1 [ 1 ]",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.map"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, filter) {
-        ASSERT_TRACE2("filter 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.filter"));
-
-        ASSERT_TRACE2("filter 1 [ \"foo\" ]",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.filter"));
-
-        ASSERT_TRACE2("filter (_: 5) [ \"foo\" ]",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "5" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the filtering function passed to builtins.filter"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, elem) {
-        ASSERT_TRACE2("elem 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.elem"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, concatLists) {
-        ASSERT_TRACE2("concatLists 1",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.concatLists"));
-
-        ASSERT_TRACE2("concatLists [ 1 ]",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating a value of the list passed to builtins.concatLists"));
-
-        ASSERT_TRACE2("concatLists [ [1] \"foo\" ]",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating a value of the list passed to builtins.concatLists"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, length) {
-        ASSERT_TRACE2("length 1",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.length"));
-
-        ASSERT_TRACE2("length \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.length"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, foldlPrime) {
-        ASSERT_TRACE2("foldl' 1 \"foo\" true",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.foldlStrict"));
-
-        ASSERT_TRACE2("foldl' (_: 1) \"foo\" true",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
-                      HintFmt("while evaluating the third argument passed to builtins.foldlStrict"));
-
-        ASSERT_TRACE1("foldl' (_: 1) \"foo\" [ true ]",
-                      TypeError,
-                      HintFmt("attempt to call something which is not a function but %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)));
-
-        ASSERT_TRACE2("foldl' (a: b: a && b) \"foo\" [ true ]",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("in the left operand of the AND (&&) operator"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, any) {
-        ASSERT_TRACE2("any 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.any"));
-
-        ASSERT_TRACE2("any (_: 1) \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.any"));
-
-        ASSERT_TRACE2("any (_: 1) [ \"foo\" ]",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the function passed to builtins.any"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, all) {
-        ASSERT_TRACE2("all 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.all"));
-
-        ASSERT_TRACE2("all (_: 1) \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.all"));
-
-        ASSERT_TRACE2("all (_: 1) [ \"foo\" ]",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the function passed to builtins.all"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, genList) {
-        ASSERT_TRACE2("genList 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.genList"));
-
-        ASSERT_TRACE2("genList 1 2",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.genList"));
-
-        // XXX: deferred
-        // ASSERT_TRACE2("genList (x: x + \"foo\") 2 #TODO",
-        //               TypeError,
-        //               HintFmt("cannot add %s to an integer", "a string"),
-        //               HintFmt("while evaluating anonymous lambda"));
-
-        ASSERT_TRACE1("genList false (-3)",
-                      EvalError,
-                      HintFmt("cannot create list of size %d", -3));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, sort) {
-        ASSERT_TRACE2("sort 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.sort"));
-
-        ASSERT_TRACE2("sort 1 [ \"foo\" ]",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.sort"));
-
-        ASSERT_TRACE1("sort (_: 1) [ \"foo\" \"bar\" ]",
-                      TypeError,
-                      HintFmt("attempt to call something which is not a function but %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)));
-
-        ASSERT_TRACE2("sort (_: _: 1) [ \"foo\" \"bar\" ]",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the sorting function passed to builtins.sort"));
-
-        // XXX: Trace too deep, need better asserts
-        // ASSERT_TRACE1("sort (a: b: a <= b) [ \"foo\" {} ] # TODO",
-        //               TypeError,
-        //               HintFmt("cannot compare %s with %s", "a string", "a set"));
-
-        // ASSERT_TRACE1("sort (a: b: a <= b) [ {} {} ] # TODO",
-        //               TypeError,
-        //               HintFmt("cannot compare %s with %s; values of that type are incomparable", "a set", "a set"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, partition) {
-        ASSERT_TRACE2("partition 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.partition"));
-
-        ASSERT_TRACE2("partition (_: 1) \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.partition"));
-
-        ASSERT_TRACE2("partition (_: 1) [ \"foo\" ]",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the partition function passed to builtins.partition"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, groupBy) {
-        ASSERT_TRACE2("groupBy 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.groupBy"));
-
-        ASSERT_TRACE2("groupBy (_: 1) \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.groupBy"));
-
-        ASSERT_TRACE2("groupBy (x: x) [ \"foo\" \"bar\" 1 ]",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the grouping function passed to builtins.groupBy"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, concatMap) {
-        ASSERT_TRACE2("concatMap 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.concatMap"));
-
-        ASSERT_TRACE2("concatMap (x: 1) \"foo\"",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.concatMap"));
-
-        ASSERT_TRACE2("concatMap (x: 1) [ \"foo\" ] # TODO",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the function passed to builtins.concatMap"));
-
-        ASSERT_TRACE2("concatMap (x: \"foo\") [ 1 2 ] # TODO",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the return value of the function passed to builtins.concatMap"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, add) {
-        ASSERT_TRACE2("add \"foo\" 1",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument of the addition"));
-
-        ASSERT_TRACE2("add 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument of the addition"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, sub) {
-        ASSERT_TRACE2("sub \"foo\" 1",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument of the subtraction"));
-
-        ASSERT_TRACE2("sub 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument of the subtraction"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, mul) {
-        ASSERT_TRACE2("mul \"foo\" 1",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument of the multiplication"));
-
-        ASSERT_TRACE2("mul 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument of the multiplication"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, div) {
-        ASSERT_TRACE2("div \"foo\" 1 # TODO: an integer was expected -> a number",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first operand of the division"));
-
-        ASSERT_TRACE2("div 1 \"foo\"",
-                      TypeError,
-                      HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second operand of the division"));
-
-        ASSERT_TRACE1("div \"foo\" 0",
-                      EvalError,
-                      HintFmt("division by zero"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, bitAnd) {
-        ASSERT_TRACE2("bitAnd 1.1 2",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.bitAnd"));
-
-        ASSERT_TRACE2("bitAnd 1 2.2",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.bitAnd"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, bitOr) {
-        ASSERT_TRACE2("bitOr 1.1 2",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.bitOr"));
-
-        ASSERT_TRACE2("bitOr 1 2.2",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.bitOr"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, bitXor) {
-        ASSERT_TRACE2("bitXor 1.1 2",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.bitXor"));
-
-        ASSERT_TRACE2("bitXor 1 2.2",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument passed to builtins.bitXor"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, lessThan) {
-        ASSERT_TRACE1("lessThan 1 \"foo\"",
-                      EvalError,
-                      HintFmt("cannot compare %s with %s", "an integer", "a string"));
-
-        ASSERT_TRACE1("lessThan {} {}",
-                      EvalError,
-                      HintFmt("cannot compare %s with %s; values of that type are incomparable", "a set", "a set"));
-
-        ASSERT_TRACE2("lessThan [ 1 2 ] [ \"foo\" ]",
-                      EvalError,
-                      HintFmt("cannot compare %s with %s", "an integer", "a string"),
-                      HintFmt("while comparing two list elements"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, toString) {
-        ASSERT_TRACE2("toString { a = 1; }",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ a = " ANSI_CYAN "1" ANSI_NORMAL "; }")),
-                      HintFmt("while evaluating the first argument passed to builtins.toString"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, substring) {
-        ASSERT_TRACE2("substring {} \"foo\" true",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the first argument (the start offset) passed to builtins.substring"));
-
-        ASSERT_TRACE2("substring 3 \"foo\" true",
-                      TypeError,
-                      HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
-                      HintFmt("while evaluating the second argument (the substring length) passed to builtins.substring"));
-
-        ASSERT_TRACE2("substring 0 3 {}",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the third argument (the string) passed to builtins.substring"));
-
-        ASSERT_TRACE1("substring (-3) 3 \"sometext\"",
-                      EvalError,
-                      HintFmt("negative start position in 'substring'"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, stringLength) {
-        ASSERT_TRACE2("stringLength {} # TODO: context is missing ???",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the argument passed to builtins.stringLength"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, hashString) {
-        ASSERT_TRACE2("hashString 1 {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.hashString"));
-
-        ASSERT_TRACE1("hashString \"foo\" \"content\"",
-                      UsageError,
-                      HintFmt("unknown hash algorithm '%s', expect 'blake3', 'md5', 'sha1', 'sha256', or 'sha512'", "foo"));
-
-        ASSERT_TRACE2("hashString \"sha256\" {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the second argument passed to builtins.hashString"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, match) {
-        ASSERT_TRACE2("match 1 {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.match"));
-
-        ASSERT_TRACE2("match \"foo\" {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the second argument passed to builtins.match"));
-
-        ASSERT_TRACE1("match \"(.*\" \"\"",
-                      EvalError,
-                      HintFmt("invalid regular expression '%s'", "(.*"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, split) {
-        ASSERT_TRACE2("split 1 {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.split"));
-
-        ASSERT_TRACE2("split \"foo\" {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the second argument passed to builtins.split"));
-
-        ASSERT_TRACE1("split \"f(o*o\" \"1foo2\"",
-                      EvalError,
-                      HintFmt("invalid regular expression '%s'", "f(o*o"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, concatStringsSep) {
-        ASSERT_TRACE2("concatStringsSep 1 {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument (the separator string) passed to builtins.concatStringsSep"));
-
-        ASSERT_TRACE2("concatStringsSep \"foo\" {}",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the second argument (the list of strings to concat) passed to builtins.concatStringsSep"));
-
-        ASSERT_TRACE2("concatStringsSep \"foo\" [ 1 2 {} ] # TODO: coerce to string is buggy",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating one element of the list of strings to concat passed to builtins.concatStringsSep"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, parseDrvName) {
-        ASSERT_TRACE2("parseDrvName 1",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.parseDrvName"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, compareVersions) {
-        ASSERT_TRACE2("compareVersions 1 {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.compareVersions"));
-
-        ASSERT_TRACE2("compareVersions \"abd\" {}",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
-                      HintFmt("while evaluating the second argument passed to builtins.compareVersions"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, splitVersion) {
-        ASSERT_TRACE2("splitVersion 1",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the first argument passed to builtins.splitVersion"));
-
-    }
-
-
-    TEST_F(ErrorTraceTest, traceVerbose) {
-    }
-
-
-    TEST_F(ErrorTraceTest, derivationStrict) {
-        ASSERT_TRACE2("derivationStrict \"\"",
-                      TypeError,
-                      HintFmt("expected a set but found %s: %s", "a string", "\"\""),
-                      HintFmt("while evaluating the argument passed to builtins.derivationStrict"));
-
-        ASSERT_TRACE2("derivationStrict {}",
-                      TypeError,
-                      HintFmt("attribute '%s' missing", "name"),
-                      HintFmt("in the attrset passed as argument to builtins.derivationStrict"));
-
-        ASSERT_TRACE3("derivationStrict { name = 1; }",
-                      TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
-                      HintFmt("while evaluating the `name` attribute passed to builtins.derivationStrict"),
-                      HintFmt("while evaluating the derivation attribute 'name'"));
-
-        ASSERT_DERIVATION_TRACE1("derivationStrict { name = \"foo\"; }",
-                      EvalError,
-                      HintFmt("required attribute 'builder' missing"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; __structuredAttrs = 15; }",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
-                      HintFmt("while evaluating the `__structuredAttrs` attribute passed to builtins.derivationStrict"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; __ignoreNulls = 15; }",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
-                      HintFmt("while evaluating the `__ignoreNulls` attribute passed to builtins.derivationStrict"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; outputHashMode = 15; }",
-                      EvalError,
-                      HintFmt("invalid value '%s' for 'outputHashMode' attribute", "15"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; outputHashMode = \"custom\"; }",
-                      EvalError,
-                      HintFmt("invalid value '%s' for 'outputHashMode' attribute", "custom"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = {}; }",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: { }", "a set"),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "system", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = {}; }",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: { }", "a set"),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"drvPath\"; }",
-                      EvalError,
-                      HintFmt("invalid derivation output name 'drvPath'"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; outputs = \"out\"; __structuredAttrs = true; }",
-                      EvalError,
-                      HintFmt("expected a list but found %s: %s", "a string", "\"out\""),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = []; }",
-                      EvalError,
-                      HintFmt("derivation cannot have an empty set of outputs"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"drvPath\" ]; }",
-                      EvalError,
-                      HintFmt("invalid derivation output name 'drvPath'"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"out\" \"out\" ]; }",
-                      EvalError,
-                      HintFmt("duplicate derivation output '%s'", "out"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __contentAddressed = \"true\"; }",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "__contentAddressed", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
-                      TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = \"foo\"; }",
-                      TypeError,
-                      HintFmt("expected a list but found %s: %s", "a string", "\"foo\""),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ {} ]; }",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: { }", "a set"),
-                      HintFmt("while evaluating an element of the argument list"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ \"a\" {} ]; }",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: { }", "a set"),
-                      HintFmt("while evaluating an element of the argument list"),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
-
-        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; FOO = {}; }",
-                      TypeError,
-                      HintFmt("cannot coerce %s to a string: { }", "a set"),
-                      HintFmt(""),
-                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "FOO", "foo"));
-    }
+#define ASSERT_DERIVATION_TRACE1(args, type, message) \
+    ASSERT_TRACE2(args, type, message, DERIVATION_TRACE_HINTFMT("foo"))
+#define ASSERT_DERIVATION_TRACE2(args, type, message, context) \
+    ASSERT_TRACE3(args, type, message, context, DERIVATION_TRACE_HINTFMT("foo"))
+#define ASSERT_DERIVATION_TRACE3(args, type, message, context1, context2) \
+    ASSERT_TRACE4(args, type, message, context1, context2, DERIVATION_TRACE_HINTFMT("foo"))
+
+TEST_F(ErrorTraceTest, genericClosure)
+{
+    ASSERT_TRACE2(
+        "genericClosure 1",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.genericClosure"));
+
+    ASSERT_TRACE2(
+        "genericClosure {}",
+        TypeError,
+        HintFmt("attribute '%s' missing", "startSet"),
+        HintFmt("in the attrset passed as argument to builtins.genericClosure"));
+
+    ASSERT_TRACE2(
+        "genericClosure { startSet = 1; }",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the 'startSet' attribute passed as argument to builtins.genericClosure"));
+
+    ASSERT_TRACE2(
+        "genericClosure { startSet = [{ key = 1;}]; operator = true; }",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
+        HintFmt("while evaluating the 'operator' attribute passed as argument to builtins.genericClosure"));
+
+    ASSERT_TRACE2(
+        "genericClosure { startSet = [{ key = 1;}]; operator = item: true; }",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the `operator` passed to builtins.genericClosure"));
+
+    ASSERT_TRACE2(
+        "genericClosure { startSet = [{ key = 1;}]; operator = item: [ true ]; }",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
+        HintFmt("while evaluating one of the elements generated by (or initially passed to) builtins.genericClosure"));
+
+    ASSERT_TRACE2(
+        "genericClosure { startSet = [{ key = 1;}]; operator = item: [ {} ]; }",
+        TypeError,
+        HintFmt("attribute '%s' missing", "key"),
+        HintFmt("in one of the attrsets generated by (or initially passed to) builtins.genericClosure"));
+
+    ASSERT_TRACE2(
+        "genericClosure { startSet = [{ key = 1;}]; operator = item: [{ key = ''a''; }]; }",
+        EvalError,
+        HintFmt("cannot compare %s with %s", "a string", "an integer"),
+        HintFmt("while comparing the `key` attributes of two genericClosure elements"));
+
+    ASSERT_TRACE2(
+        "genericClosure { startSet = [ true ]; operator = item: [{ key = ''a''; }]; }",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
+        HintFmt("while evaluating one of the elements generated by (or initially passed to) builtins.genericClosure"));
+}
+
+TEST_F(ErrorTraceTest, replaceStrings)
+{
+    ASSERT_TRACE2(
+        "replaceStrings 0 0 {}",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "0" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.replaceStrings"));
+
+    ASSERT_TRACE2(
+        "replaceStrings [] 0 {}",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "0" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.replaceStrings"));
+
+    ASSERT_TRACE1(
+        "replaceStrings [ 0 ] [] {}",
+        EvalError,
+        HintFmt("'from' and 'to' arguments passed to builtins.replaceStrings have different lengths"));
+
+    ASSERT_TRACE2(
+        "replaceStrings [ 1 ] [ \"new\" ] {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating one of the strings to replace passed to builtins.replaceStrings"));
+
+    ASSERT_TRACE2(
+        "replaceStrings [ \"oo\" ] [ true ] \"foo\"",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
+        HintFmt("while evaluating one of the replacement strings passed to builtins.replaceStrings"));
+
+    ASSERT_TRACE2(
+        "replaceStrings [ \"old\" ] [ \"new\" ] {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the third argument passed to builtins.replaceStrings"));
+}
+
+TEST_F(ErrorTraceTest, scopedImport) {}
+
+TEST_F(ErrorTraceTest, import) {}
+
+TEST_F(ErrorTraceTest, typeOf) {}
+
+TEST_F(ErrorTraceTest, isNull) {}
+
+TEST_F(ErrorTraceTest, isFunction) {}
+
+TEST_F(ErrorTraceTest, isInt) {}
+
+TEST_F(ErrorTraceTest, isFloat) {}
+
+TEST_F(ErrorTraceTest, isString) {}
+
+TEST_F(ErrorTraceTest, isBool) {}
+
+TEST_F(ErrorTraceTest, isPath) {}
+
+TEST_F(ErrorTraceTest, break) {}
+
+TEST_F(ErrorTraceTest, abort) {}
+
+TEST_F(ErrorTraceTest, throw) {}
+
+TEST_F(ErrorTraceTest, addErrorContext) {}
+
+TEST_F(ErrorTraceTest, ceil)
+{
+    ASSERT_TRACE2(
+        "ceil \"foo\"",
+        TypeError,
+        HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.ceil"));
+}
+
+TEST_F(ErrorTraceTest, floor)
+{
+    ASSERT_TRACE2(
+        "floor \"foo\"",
+        TypeError,
+        HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.floor"));
+}
+
+TEST_F(ErrorTraceTest, tryEval) {}
+
+TEST_F(ErrorTraceTest, getEnv)
+{
+    ASSERT_TRACE2(
+        "getEnv [ ]",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.getEnv"));
+}
+
+TEST_F(ErrorTraceTest, seq) {}
+
+TEST_F(ErrorTraceTest, deepSeq) {}
+
+TEST_F(ErrorTraceTest, trace) {}
+
+TEST_F(ErrorTraceTest, placeholder)
+{
+    ASSERT_TRACE2(
+        "placeholder []",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.placeholder"));
+}
+
+TEST_F(ErrorTraceTest, toPath)
+{
+    ASSERT_TRACE2(
+        "toPath []",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.toPath"));
+
+    ASSERT_TRACE2(
+        "toPath \"foo\"",
+        EvalError,
+        HintFmt("string '%s' doesn't represent an absolute path", "foo"),
+        HintFmt("while evaluating the first argument passed to builtins.toPath"));
+}
+
+TEST_F(ErrorTraceTest, storePath)
+{
+    ASSERT_TRACE2(
+        "storePath true",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to 'builtins.storePath'"));
+}
+
+TEST_F(ErrorTraceTest, pathExists)
+{
+    ASSERT_TRACE2(
+        "pathExists []",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while realising the context of a path"));
+
+    ASSERT_TRACE2(
+        "pathExists \"zorglub\"",
+        EvalError,
+        HintFmt("string '%s' doesn't represent an absolute path", "zorglub"),
+        HintFmt("while realising the context of a path"));
+}
+
+TEST_F(ErrorTraceTest, baseNameOf)
+{
+    ASSERT_TRACE2(
+        "baseNameOf []",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.baseNameOf"));
+}
+
+TEST_F(ErrorTraceTest, dirOf) {}
+
+TEST_F(ErrorTraceTest, readFile) {}
+
+TEST_F(ErrorTraceTest, findFile) {}
+
+TEST_F(ErrorTraceTest, hashFile) {}
+
+TEST_F(ErrorTraceTest, readDir) {}
+
+TEST_F(ErrorTraceTest, toXML) {}
+
+TEST_F(ErrorTraceTest, toJSON) {}
+
+TEST_F(ErrorTraceTest, fromJSON) {}
+
+TEST_F(ErrorTraceTest, toFile) {}
+
+TEST_F(ErrorTraceTest, filterSource)
+{
+    ASSERT_TRACE2(
+        "filterSource [] []",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'"));
+
+    ASSERT_TRACE2(
+        "filterSource [] \"foo\"",
+        EvalError,
+        HintFmt("string '%s' doesn't represent an absolute path", "foo"),
+        HintFmt("while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'"));
+
+    ASSERT_TRACE2(
+        "filterSource [] ./.",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.filterSource"));
+
+    // Unsupported by store "dummy"
+
+    // ASSERT_TRACE2("filterSource (_: 1) ./.",
+    //               TypeError,
+    //               HintFmt("attempt to call something which is not a function but %s", "an integer"),
+    //               HintFmt("while adding path '/home/layus/projects/nix'"));
+
+    // ASSERT_TRACE2("filterSource (_: _: 1) ./.",
+    //               TypeError,
+    //               HintFmt("expected a Boolean but found %s: %s", "an integer", "1"),
+    //               HintFmt("while evaluating the return value of the path filter function"));
+}
+
+TEST_F(ErrorTraceTest, path) {}
+
+TEST_F(ErrorTraceTest, attrNames)
+{
+    ASSERT_TRACE2(
+        "attrNames []",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the argument passed to builtins.attrNames"));
+}
+
+TEST_F(ErrorTraceTest, attrValues)
+{
+    ASSERT_TRACE2(
+        "attrValues []",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the argument passed to builtins.attrValues"));
+}
+
+TEST_F(ErrorTraceTest, getAttr)
+{
+    ASSERT_TRACE2(
+        "getAttr [] []",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.getAttr"));
+
+    ASSERT_TRACE2(
+        "getAttr \"foo\" []",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the second argument passed to builtins.getAttr"));
+
+    ASSERT_TRACE2(
+        "getAttr \"foo\" {}",
+        TypeError,
+        HintFmt("attribute '%s' missing", "foo"),
+        HintFmt("in the attribute set under consideration"));
+}
+
+TEST_F(ErrorTraceTest, unsafeGetAttrPos) {}
+
+TEST_F(ErrorTraceTest, hasAttr)
+{
+    ASSERT_TRACE2(
+        "hasAttr [] []",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.hasAttr"));
+
+    ASSERT_TRACE2(
+        "hasAttr \"foo\" []",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the second argument passed to builtins.hasAttr"));
+}
+
+TEST_F(ErrorTraceTest, isAttrs) {}
+
+TEST_F(ErrorTraceTest, removeAttrs)
+{
+    ASSERT_TRACE2(
+        "removeAttrs \"\" \"\"",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
+
+    ASSERT_TRACE2(
+        "removeAttrs \"\" [ 1 ]",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
+
+    ASSERT_TRACE2(
+        "removeAttrs \"\" [ \"1\" ]",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.removeAttrs"));
+}
+
+TEST_F(ErrorTraceTest, listToAttrs)
+{
+    ASSERT_TRACE2(
+        "listToAttrs 1",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the argument passed to builtins.listToAttrs"));
+
+    ASSERT_TRACE2(
+        "listToAttrs [ 1 ]",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating an element of the list passed to builtins.listToAttrs"));
+
+    ASSERT_TRACE2(
+        "listToAttrs [ {} ]",
+        TypeError,
+        HintFmt("attribute '%s' missing", "name"),
+        HintFmt("in a {name=...; value=...;} pair"));
+
+    ASSERT_TRACE2(
+        "listToAttrs [ { name = 1; } ]",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the `name` attribute of an element of the list passed to builtins.listToAttrs"));
+
+    ASSERT_TRACE2(
+        "listToAttrs [ { name = \"foo\"; } ]",
+        TypeError,
+        HintFmt("attribute '%s' missing", "value"),
+        HintFmt("in a {name=...; value=...;} pair"));
+}
+
+TEST_F(ErrorTraceTest, intersectAttrs)
+{
+    ASSERT_TRACE2(
+        "intersectAttrs [] []",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.intersectAttrs"));
+
+    ASSERT_TRACE2(
+        "intersectAttrs {} []",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the second argument passed to builtins.intersectAttrs"));
+}
+
+TEST_F(ErrorTraceTest, catAttrs)
+{
+    ASSERT_TRACE2(
+        "catAttrs [] {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.catAttrs"));
+
+    ASSERT_TRACE2(
+        "catAttrs \"foo\" {}",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the second argument passed to builtins.catAttrs"));
+
+    ASSERT_TRACE2(
+        "catAttrs \"foo\" [ 1 ]",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating an element in the list passed as second argument to builtins.catAttrs"));
+
+    ASSERT_TRACE2(
+        "catAttrs \"foo\" [ { foo = 1; } 1 { bar = 5;} ]",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating an element in the list passed as second argument to builtins.catAttrs"));
+}
+
+TEST_F(ErrorTraceTest, functionArgs)
+{
+    ASSERT_TRACE1("functionArgs {}", TypeError, HintFmt("'functionArgs' requires a function"));
+}
+
+TEST_F(ErrorTraceTest, mapAttrs)
+{
+    ASSERT_TRACE2(
+        "mapAttrs [] []",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the second argument passed to builtins.mapAttrs"));
+
+    // XXX: deferred
+    // ASSERT_TRACE2("mapAttrs \"\" { foo.bar = 1; }",
+    //               TypeError,
+    //               HintFmt("attempt to call something which is not a function but %s", "a string"),
+    //               HintFmt("while evaluating the attribute 'foo'"));
+
+    // ASSERT_TRACE2("mapAttrs (x: x + \"1\") { foo.bar = 1; }",
+    //               TypeError,
+    //               HintFmt("attempt to call something which is not a function but %s", "a string"),
+    //               HintFmt("while evaluating the attribute 'foo'"));
+
+    // ASSERT_TRACE2("mapAttrs (x: y: x + 1) { foo.bar = 1; }",
+    //               TypeError,
+    //               HintFmt("cannot coerce %s to a string", "an integer"),
+    //               HintFmt("while evaluating a path segment"));
+}
+
+TEST_F(ErrorTraceTest, zipAttrsWith)
+{
+    ASSERT_TRACE2(
+        "zipAttrsWith [] [ 1 ]",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "a list", Uncolored("[ ]")),
+        HintFmt("while evaluating the first argument passed to builtins.zipAttrsWith"));
+
+    ASSERT_TRACE2(
+        "zipAttrsWith (_: 1) [ 1 ]",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating a value of the list passed as second argument to builtins.zipAttrsWith"));
+
+    // XXX: How to properly tell that the function takes two arguments ?
+    // The same question also applies to sort, and maybe others.
+    // Due to laziness, we only create a thunk, and it fails later on.
+    // ASSERT_TRACE2("zipAttrsWith (_: 1) [ { foo = 1; } ]",
+    //               TypeError,
+    //               HintFmt("attempt to call something which is not a function but %s", "an integer"),
+    //               HintFmt("while evaluating the attribute 'foo'"));
+
+    // XXX: Also deferred deeply
+    // ASSERT_TRACE2("zipAttrsWith (a: b: a + b) [ { foo = 1; } { foo = 2; } ]",
+    //               TypeError,
+    //               HintFmt("cannot coerce %s to a string", "a list"),
+    //               HintFmt("while evaluating a path segment"));
+}
+
+TEST_F(ErrorTraceTest, isList) {}
+
+TEST_F(ErrorTraceTest, elemAt)
+{
+    ASSERT_TRACE2(
+        "elemAt \"foo\" (-1)",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to 'builtins.elemAt'"));
+
+    ASSERT_TRACE1(
+        "elemAt [] (-1)", Error, HintFmt("'builtins.elemAt' called with index %d on a list of size %d", -1, 0));
+
+    ASSERT_TRACE1(
+        "elemAt [\"foo\"] 3", Error, HintFmt("'builtins.elemAt' called with index %d on a list of size %d", 3, 1));
+}
+
+TEST_F(ErrorTraceTest, head)
+{
+    ASSERT_TRACE2(
+        "head 1",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to 'builtins.head'"));
+
+    ASSERT_TRACE1("head []", Error, HintFmt("'builtins.head' called on an empty list"));
+}
+
+TEST_F(ErrorTraceTest, tail)
+{
+    ASSERT_TRACE2(
+        "tail 1",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to 'builtins.tail'"));
+
+    ASSERT_TRACE1("tail []", Error, HintFmt("'builtins.tail' called on an empty list"));
+}
+
+TEST_F(ErrorTraceTest, map)
+{
+    ASSERT_TRACE2(
+        "map 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.map"));
+
+    ASSERT_TRACE2(
+        "map 1 [ 1 ]",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.map"));
+}
+
+TEST_F(ErrorTraceTest, filter)
+{
+    ASSERT_TRACE2(
+        "filter 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.filter"));
+
+    ASSERT_TRACE2(
+        "filter 1 [ \"foo\" ]",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.filter"));
+
+    ASSERT_TRACE2(
+        "filter (_: 5) [ \"foo\" ]",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "5" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the filtering function passed to builtins.filter"));
+}
+
+TEST_F(ErrorTraceTest, elem)
+{
+    ASSERT_TRACE2(
+        "elem 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.elem"));
+}
+
+TEST_F(ErrorTraceTest, concatLists)
+{
+    ASSERT_TRACE2(
+        "concatLists 1",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.concatLists"));
+
+    ASSERT_TRACE2(
+        "concatLists [ 1 ]",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating a value of the list passed to builtins.concatLists"));
+
+    ASSERT_TRACE2(
+        "concatLists [ [1] \"foo\" ]",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating a value of the list passed to builtins.concatLists"));
+}
+
+TEST_F(ErrorTraceTest, length)
+{
+    ASSERT_TRACE2(
+        "length 1",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.length"));
+
+    ASSERT_TRACE2(
+        "length \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.length"));
+}
+
+TEST_F(ErrorTraceTest, foldlPrime)
+{
+    ASSERT_TRACE2(
+        "foldl' 1 \"foo\" true",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.foldlStrict"));
+
+    ASSERT_TRACE2(
+        "foldl' (_: 1) \"foo\" true",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a Boolean", Uncolored(ANSI_CYAN "true" ANSI_NORMAL)),
+        HintFmt("while evaluating the third argument passed to builtins.foldlStrict"));
+
+    ASSERT_TRACE1(
+        "foldl' (_: 1) \"foo\" [ true ]",
+        TypeError,
+        HintFmt(
+            "attempt to call something which is not a function but %s: %s",
+            "an integer",
+            Uncolored(ANSI_CYAN "1" ANSI_NORMAL)));
+
+    ASSERT_TRACE2(
+        "foldl' (a: b: a && b) \"foo\" [ true ]",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("in the left operand of the AND (&&) operator"));
+}
+
+TEST_F(ErrorTraceTest, any)
+{
+    ASSERT_TRACE2(
+        "any 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.any"));
+
+    ASSERT_TRACE2(
+        "any (_: 1) \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.any"));
+
+    ASSERT_TRACE2(
+        "any (_: 1) [ \"foo\" ]",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the function passed to builtins.any"));
+}
+
+TEST_F(ErrorTraceTest, all)
+{
+    ASSERT_TRACE2(
+        "all 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.all"));
+
+    ASSERT_TRACE2(
+        "all (_: 1) \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.all"));
+
+    ASSERT_TRACE2(
+        "all (_: 1) [ \"foo\" ]",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the function passed to builtins.all"));
+}
+
+TEST_F(ErrorTraceTest, genList)
+{
+    ASSERT_TRACE2(
+        "genList 1 \"foo\"",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.genList"));
+
+    ASSERT_TRACE2(
+        "genList 1 2",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.genList"));
+
+    // XXX: deferred
+    // ASSERT_TRACE2("genList (x: x + \"foo\") 2 #TODO",
+    //               TypeError,
+    //               HintFmt("cannot add %s to an integer", "a string"),
+    //               HintFmt("while evaluating anonymous lambda"));
+
+    ASSERT_TRACE1("genList false (-3)", EvalError, HintFmt("cannot create list of size %d", -3));
+}
+
+TEST_F(ErrorTraceTest, sort)
+{
+    ASSERT_TRACE2(
+        "sort 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.sort"));
+
+    ASSERT_TRACE2(
+        "sort 1 [ \"foo\" ]",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.sort"));
+
+    ASSERT_TRACE1(
+        "sort (_: 1) [ \"foo\" \"bar\" ]",
+        TypeError,
+        HintFmt(
+            "attempt to call something which is not a function but %s: %s",
+            "an integer",
+            Uncolored(ANSI_CYAN "1" ANSI_NORMAL)));
+
+    ASSERT_TRACE2(
+        "sort (_: _: 1) [ \"foo\" \"bar\" ]",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the sorting function passed to builtins.sort"));
+
+    // XXX: Trace too deep, need better asserts
+    // ASSERT_TRACE1("sort (a: b: a <= b) [ \"foo\" {} ] # TODO",
+    //               TypeError,
+    //               HintFmt("cannot compare %s with %s", "a string", "a set"));
+
+    // ASSERT_TRACE1("sort (a: b: a <= b) [ {} {} ] # TODO",
+    //               TypeError,
+    //               HintFmt("cannot compare %s with %s; values of that type are incomparable", "a set", "a set"));
+}
+
+TEST_F(ErrorTraceTest, partition)
+{
+    ASSERT_TRACE2(
+        "partition 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.partition"));
+
+    ASSERT_TRACE2(
+        "partition (_: 1) \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.partition"));
+
+    ASSERT_TRACE2(
+        "partition (_: 1) [ \"foo\" ]",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the partition function passed to builtins.partition"));
+}
+
+TEST_F(ErrorTraceTest, groupBy)
+{
+    ASSERT_TRACE2(
+        "groupBy 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.groupBy"));
+
+    ASSERT_TRACE2(
+        "groupBy (_: 1) \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.groupBy"));
+
+    ASSERT_TRACE2(
+        "groupBy (x: x) [ \"foo\" \"bar\" 1 ]",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the grouping function passed to builtins.groupBy"));
+}
+
+TEST_F(ErrorTraceTest, concatMap)
+{
+    ASSERT_TRACE2(
+        "concatMap 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a function but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.concatMap"));
+
+    ASSERT_TRACE2(
+        "concatMap (x: 1) \"foo\"",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.concatMap"));
+
+    ASSERT_TRACE2(
+        "concatMap (x: 1) [ \"foo\" ] # TODO",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the function passed to builtins.concatMap"));
+
+    ASSERT_TRACE2(
+        "concatMap (x: \"foo\") [ 1 2 ] # TODO",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the return value of the function passed to builtins.concatMap"));
+}
+
+TEST_F(ErrorTraceTest, add)
+{
+    ASSERT_TRACE2(
+        "add \"foo\" 1",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument of the addition"));
+
+    ASSERT_TRACE2(
+        "add 1 \"foo\"",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument of the addition"));
+}
+
+TEST_F(ErrorTraceTest, sub)
+{
+    ASSERT_TRACE2(
+        "sub \"foo\" 1",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument of the subtraction"));
+
+    ASSERT_TRACE2(
+        "sub 1 \"foo\"",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument of the subtraction"));
+}
+
+TEST_F(ErrorTraceTest, mul)
+{
+    ASSERT_TRACE2(
+        "mul \"foo\" 1",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument of the multiplication"));
+
+    ASSERT_TRACE2(
+        "mul 1 \"foo\"",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument of the multiplication"));
+}
+
+TEST_F(ErrorTraceTest, div)
+{
+    ASSERT_TRACE2(
+        "div \"foo\" 1 # TODO: an integer was expected -> a number",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the first operand of the division"));
+
+    ASSERT_TRACE2(
+        "div 1 \"foo\"",
+        TypeError,
+        HintFmt("expected a float but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second operand of the division"));
+
+    ASSERT_TRACE1("div \"foo\" 0", EvalError, HintFmt("division by zero"));
+}
+
+TEST_F(ErrorTraceTest, bitAnd)
+{
+    ASSERT_TRACE2(
+        "bitAnd 1.1 2",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.bitAnd"));
+
+    ASSERT_TRACE2(
+        "bitAnd 1 2.2",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.bitAnd"));
+}
+
+TEST_F(ErrorTraceTest, bitOr)
+{
+    ASSERT_TRACE2(
+        "bitOr 1.1 2",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.bitOr"));
+
+    ASSERT_TRACE2(
+        "bitOr 1 2.2",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.bitOr"));
+}
+
+TEST_F(ErrorTraceTest, bitXor)
+{
+    ASSERT_TRACE2(
+        "bitXor 1.1 2",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "1.1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.bitXor"));
+
+    ASSERT_TRACE2(
+        "bitXor 1 2.2",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a float", Uncolored(ANSI_CYAN "2.2" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument passed to builtins.bitXor"));
+}
+
+TEST_F(ErrorTraceTest, lessThan)
+{
+    ASSERT_TRACE1("lessThan 1 \"foo\"", EvalError, HintFmt("cannot compare %s with %s", "an integer", "a string"));
+
+    ASSERT_TRACE1(
+        "lessThan {} {}",
+        EvalError,
+        HintFmt("cannot compare %s with %s; values of that type are incomparable", "a set", "a set"));
+
+    ASSERT_TRACE2(
+        "lessThan [ 1 2 ] [ \"foo\" ]",
+        EvalError,
+        HintFmt("cannot compare %s with %s", "an integer", "a string"),
+        HintFmt("while comparing two list elements"));
+}
+
+TEST_F(ErrorTraceTest, toString)
+{
+    ASSERT_TRACE2(
+        "toString { a = 1; }",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ a = " ANSI_CYAN "1" ANSI_NORMAL "; }")),
+        HintFmt("while evaluating the first argument passed to builtins.toString"));
+}
+
+TEST_F(ErrorTraceTest, substring)
+{
+    ASSERT_TRACE2(
+        "substring {} \"foo\" true",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the first argument (the start offset) passed to builtins.substring"));
+
+    ASSERT_TRACE2(
+        "substring 3 \"foo\" true",
+        TypeError,
+        HintFmt("expected an integer but found %s: %s", "a string", Uncolored(ANSI_MAGENTA "\"foo\"" ANSI_NORMAL)),
+        HintFmt("while evaluating the second argument (the substring length) passed to builtins.substring"));
+
+    ASSERT_TRACE2(
+        "substring 0 3 {}",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the third argument (the string) passed to builtins.substring"));
+
+    ASSERT_TRACE1("substring (-3) 3 \"sometext\"", EvalError, HintFmt("negative start position in 'substring'"));
+}
+
+TEST_F(ErrorTraceTest, stringLength)
+{
+    ASSERT_TRACE2(
+        "stringLength {} # TODO: context is missing ???",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the argument passed to builtins.stringLength"));
+}
+
+TEST_F(ErrorTraceTest, hashString)
+{
+    ASSERT_TRACE2(
+        "hashString 1 {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.hashString"));
+
+    ASSERT_TRACE1(
+        "hashString \"foo\" \"content\"",
+        UsageError,
+        HintFmt("unknown hash algorithm '%s', expect 'blake3', 'md5', 'sha1', 'sha256', or 'sha512'", "foo"));
+
+    ASSERT_TRACE2(
+        "hashString \"sha256\" {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the second argument passed to builtins.hashString"));
+}
+
+TEST_F(ErrorTraceTest, match)
+{
+    ASSERT_TRACE2(
+        "match 1 {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.match"));
+
+    ASSERT_TRACE2(
+        "match \"foo\" {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the second argument passed to builtins.match"));
+
+    ASSERT_TRACE1("match \"(.*\" \"\"", EvalError, HintFmt("invalid regular expression '%s'", "(.*"));
+}
+
+TEST_F(ErrorTraceTest, split)
+{
+    ASSERT_TRACE2(
+        "split 1 {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.split"));
+
+    ASSERT_TRACE2(
+        "split \"foo\" {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the second argument passed to builtins.split"));
+
+    ASSERT_TRACE1("split \"f(o*o\" \"1foo2\"", EvalError, HintFmt("invalid regular expression '%s'", "f(o*o"));
+}
+
+TEST_F(ErrorTraceTest, concatStringsSep)
+{
+    ASSERT_TRACE2(
+        "concatStringsSep 1 {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument (the separator string) passed to builtins.concatStringsSep"));
+
+    ASSERT_TRACE2(
+        "concatStringsSep \"foo\" {}",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt(
+            "while evaluating the second argument (the list of strings to concat) passed to builtins.concatStringsSep"));
+
+    ASSERT_TRACE2(
+        "concatStringsSep \"foo\" [ 1 2 {} ] # TODO: coerce to string is buggy",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating one element of the list of strings to concat passed to builtins.concatStringsSep"));
+}
+
+TEST_F(ErrorTraceTest, parseDrvName)
+{
+    ASSERT_TRACE2(
+        "parseDrvName 1",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.parseDrvName"));
+}
+
+TEST_F(ErrorTraceTest, compareVersions)
+{
+    ASSERT_TRACE2(
+        "compareVersions 1 {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.compareVersions"));
+
+    ASSERT_TRACE2(
+        "compareVersions \"abd\" {}",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "a set", Uncolored("{ }")),
+        HintFmt("while evaluating the second argument passed to builtins.compareVersions"));
+}
+
+TEST_F(ErrorTraceTest, splitVersion)
+{
+    ASSERT_TRACE2(
+        "splitVersion 1",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the first argument passed to builtins.splitVersion"));
+}
+
+TEST_F(ErrorTraceTest, traceVerbose) {}
+
+TEST_F(ErrorTraceTest, derivationStrict)
+{
+    ASSERT_TRACE2(
+        "derivationStrict \"\"",
+        TypeError,
+        HintFmt("expected a set but found %s: %s", "a string", "\"\""),
+        HintFmt("while evaluating the argument passed to builtins.derivationStrict"));
+
+    ASSERT_TRACE2(
+        "derivationStrict {}",
+        TypeError,
+        HintFmt("attribute '%s' missing", "name"),
+        HintFmt("in the attrset passed as argument to builtins.derivationStrict"));
+
+    ASSERT_TRACE3(
+        "derivationStrict { name = 1; }",
+        TypeError,
+        HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+        HintFmt("while evaluating the `name` attribute passed to builtins.derivationStrict"),
+        HintFmt("while evaluating the derivation attribute 'name'"));
+
+    ASSERT_DERIVATION_TRACE1(
+        "derivationStrict { name = \"foo\"; }", EvalError, HintFmt("required attribute 'builder' missing"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; __structuredAttrs = 15; }",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
+        HintFmt("while evaluating the `__structuredAttrs` attribute passed to builtins.derivationStrict"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; __ignoreNulls = 15; }",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
+        HintFmt("while evaluating the `__ignoreNulls` attribute passed to builtins.derivationStrict"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; outputHashMode = 15; }",
+        EvalError,
+        HintFmt("invalid value '%s' for 'outputHashMode' attribute", "15"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; outputHashMode = \"custom\"; }",
+        EvalError,
+        HintFmt("invalid value '%s' for 'outputHashMode' attribute", "custom"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = {}; }",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: { }", "a set"),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "system", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = {}; }",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: { }", "a set"),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"drvPath\"; }",
+        EvalError,
+        HintFmt("invalid derivation output name 'drvPath'"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; outputs = \"out\"; __structuredAttrs = true; }",
+        EvalError,
+        HintFmt("expected a list but found %s: %s", "a string", "\"out\""),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = []; }",
+        EvalError,
+        HintFmt("derivation cannot have an empty set of outputs"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"drvPath\" ]; }",
+        EvalError,
+        HintFmt("invalid derivation output name 'drvPath'"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
+
+    ASSERT_DERIVATION_TRACE2(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"out\" \"out\" ]; }",
+        EvalError,
+        HintFmt("duplicate derivation output '%s'", "out"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __contentAddressed = \"true\"; }",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "__contentAddressed", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
+        TypeError,
+        HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = \"foo\"; }",
+        TypeError,
+        HintFmt("expected a list but found %s: %s", "a string", "\"foo\""),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ {} ]; }",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: { }", "a set"),
+        HintFmt("while evaluating an element of the argument list"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ \"a\" {} ]; }",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: { }", "a set"),
+        HintFmt("while evaluating an element of the argument list"),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
+
+    ASSERT_DERIVATION_TRACE3(
+        "derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; FOO = {}; }",
+        TypeError,
+        HintFmt("cannot coerce %s to a string: { }", "a set"),
+        HintFmt(""),
+        HintFmt("while evaluating attribute '%s' of derivation '%s'", "FOO", "foo"));
+}
 
 } /* namespace nix */
diff --git a/src/libexpr-tests/eval.cc b/src/libexpr-tests/eval.cc
index e9664dc58..ad70ea5b8 100644
--- a/src/libexpr-tests/eval.cc
+++ b/src/libexpr-tests/eval.cc
@@ -6,7 +6,8 @@
 
 namespace nix {
 
-TEST(nix_isAllowedURI, http_example_com) {
+TEST(nix_isAllowedURI, http_example_com)
+{
     Strings allowed;
     allowed.push_back("http://example.com");
 
@@ -20,7 +21,8 @@ TEST(nix_isAllowedURI, http_example_com) {
     ASSERT_FALSE(isAllowedURI("http://example.org/foo", allowed));
 }
 
-TEST(nix_isAllowedURI, http_example_com_foo) {
+TEST(nix_isAllowedURI, http_example_com_foo)
+{
     Strings allowed;
     allowed.push_back("http://example.com/foo");
 
@@ -34,7 +36,8 @@ TEST(nix_isAllowedURI, http_example_com_foo) {
     // ASSERT_TRUE(isAllowedURI("http://example.com/foo?ok=1", allowed));
 }
 
-TEST(nix_isAllowedURI, http) {
+TEST(nix_isAllowedURI, http)
+{
     Strings allowed;
     allowed.push_back("http://");
 
@@ -48,7 +51,8 @@ TEST(nix_isAllowedURI, http) {
     ASSERT_FALSE(isAllowedURI("http:foo", allowed));
 }
 
-TEST(nix_isAllowedURI, https) {
+TEST(nix_isAllowedURI, https)
+{
     Strings allowed;
     allowed.push_back("https://");
 
@@ -58,7 +62,8 @@ TEST(nix_isAllowedURI, https) {
     ASSERT_FALSE(isAllowedURI("http://example.com/https:", allowed));
 }
 
-TEST(nix_isAllowedURI, absolute_path) {
+TEST(nix_isAllowedURI, absolute_path)
+{
     Strings allowed;
     allowed.push_back("/var/evil"); // bad idea
 
@@ -76,7 +81,8 @@ TEST(nix_isAllowedURI, absolute_path) {
     ASSERT_FALSE(isAllowedURI("http://example.com//var/evil/foo", allowed));
 }
 
-TEST(nix_isAllowedURI, file_url) {
+TEST(nix_isAllowedURI, file_url)
+{
     Strings allowed;
     allowed.push_back("file:///var/evil"); // bad idea
 
@@ -103,7 +109,8 @@ TEST(nix_isAllowedURI, file_url) {
     ASSERT_FALSE(isAllowedURI("file://", allowed));
 }
 
-TEST(nix_isAllowedURI, github_all) {
+TEST(nix_isAllowedURI, github_all)
+{
     Strings allowed;
     allowed.push_back("github:");
     ASSERT_TRUE(isAllowedURI("github:", allowed));
@@ -117,7 +124,8 @@ TEST(nix_isAllowedURI, github_all) {
     ASSERT_FALSE(isAllowedURI("github", allowed));
 }
 
-TEST(nix_isAllowedURI, github_org) {
+TEST(nix_isAllowedURI, github_org)
+{
     Strings allowed;
     allowed.push_back("github:foo");
     ASSERT_FALSE(isAllowedURI("github:", allowed));
@@ -130,7 +138,8 @@ TEST(nix_isAllowedURI, github_org) {
     ASSERT_FALSE(isAllowedURI("file:///github:foo/bar/archive/master.tar.gz", allowed));
 }
 
-TEST(nix_isAllowedURI, non_scheme_colon) {
+TEST(nix_isAllowedURI, non_scheme_colon)
+{
     Strings allowed;
     allowed.push_back("https://foo/bar:");
     ASSERT_TRUE(isAllowedURI("https://foo/bar:", allowed));
@@ -138,16 +147,19 @@ TEST(nix_isAllowedURI, non_scheme_colon) {
     ASSERT_FALSE(isAllowedURI("https://foo/bar:baz", allowed));
 }
 
-class EvalStateTest : public LibExprTest {};
+class EvalStateTest : public LibExprTest
+{};
 
-TEST_F(EvalStateTest, getBuiltins_ok) {
+TEST_F(EvalStateTest, getBuiltins_ok)
+{
     auto evaled = maybeThunk("builtins");
     auto & builtins = state.getBuiltins();
     ASSERT_TRUE(builtins.type() == nAttrs);
     ASSERT_EQ(evaled, &builtins);
 }
 
-TEST_F(EvalStateTest, getBuiltin_ok) {
+TEST_F(EvalStateTest, getBuiltin_ok)
+{
     auto & builtin = state.getBuiltin("toString");
     ASSERT_TRUE(builtin.type() == nFunction);
     // FIXME
@@ -157,7 +169,8 @@ TEST_F(EvalStateTest, getBuiltin_ok) {
     ASSERT_EQ(state.forceBool(builtin2, noPos, "in unit test"), true);
 }
 
-TEST_F(EvalStateTest, getBuiltin_fail) {
+TEST_F(EvalStateTest, getBuiltin_fail)
+{
     ASSERT_THROW(state.getBuiltin("nonexistent"), EvalError);
 }
 
diff --git a/src/libexpr-tests/json.cc b/src/libexpr-tests/json.cc
index 11f31d058..8b1bd7d96 100644
--- a/src/libexpr-tests/json.cc
+++ b/src/libexpr-tests/json.cc
@@ -4,65 +4,75 @@
 namespace nix {
 // Testing the conversion to JSON
 
-    class JSONValueTest : public LibExprTest {
-        protected:
-            std::string getJSONValue(Value& value) {
-                std::stringstream ss;
-                NixStringContext ps;
-                printValueAsJSON(state, true, value, noPos, ss, ps);
-                return ss.str();
-            }
-    };
-
-    TEST_F(JSONValueTest, null) {
-        Value v;
-        v.mkNull();
-        ASSERT_EQ(getJSONValue(v), "null");
+class JSONValueTest : public LibExprTest
+{
+protected:
+    std::string getJSONValue(Value & value)
+    {
+        std::stringstream ss;
+        NixStringContext ps;
+        printValueAsJSON(state, true, value, noPos, ss, ps);
+        return ss.str();
     }
+};
 
-    TEST_F(JSONValueTest, BoolFalse) {
-        Value v;
-        v.mkBool(false);
-        ASSERT_EQ(getJSONValue(v),"false");
-    }
+TEST_F(JSONValueTest, null)
+{
+    Value v;
+    v.mkNull();
+    ASSERT_EQ(getJSONValue(v), "null");
+}
 
-    TEST_F(JSONValueTest, BoolTrue) {
-        Value v;
-        v.mkBool(true);
-        ASSERT_EQ(getJSONValue(v), "true");
-    }
+TEST_F(JSONValueTest, BoolFalse)
+{
+    Value v;
+    v.mkBool(false);
+    ASSERT_EQ(getJSONValue(v), "false");
+}
 
-    TEST_F(JSONValueTest, IntPositive) {
-        Value v;
-        v.mkInt(100);
-        ASSERT_EQ(getJSONValue(v), "100");
-    }
+TEST_F(JSONValueTest, BoolTrue)
+{
+    Value v;
+    v.mkBool(true);
+    ASSERT_EQ(getJSONValue(v), "true");
+}
 
-    TEST_F(JSONValueTest, IntNegative) {
-        Value v;
-        v.mkInt(-100);
-        ASSERT_EQ(getJSONValue(v), "-100");
-    }
+TEST_F(JSONValueTest, IntPositive)
+{
+    Value v;
+    v.mkInt(100);
+    ASSERT_EQ(getJSONValue(v), "100");
+}
 
-    TEST_F(JSONValueTest, String) {
-        Value v;
-        v.mkString("test");
-        ASSERT_EQ(getJSONValue(v), "\"test\"");
-    }
+TEST_F(JSONValueTest, IntNegative)
+{
+    Value v;
+    v.mkInt(-100);
+    ASSERT_EQ(getJSONValue(v), "-100");
+}
 
-    TEST_F(JSONValueTest, StringQuotes) {
-        Value v;
+TEST_F(JSONValueTest, String)
+{
+    Value v;
+    v.mkStringNoCopy("test");
+    ASSERT_EQ(getJSONValue(v), "\"test\"");
+}
 
-        v.mkString("test\"");
-        ASSERT_EQ(getJSONValue(v), "\"test\\\"\"");
-    }
+TEST_F(JSONValueTest, StringQuotes)
+{
+    Value v;
 
-    // The dummy store doesn't support writing files. Fails with this exception message:
-    // C++ exception with description "error: operation 'addToStoreFromDump' is
-    // not supported by store 'dummy'" thrown in the test body.
-    TEST_F(JSONValueTest, DISABLED_Path) {
-        Value v;
-        v.mkPath(state.rootPath(CanonPath("/test")));
-        ASSERT_EQ(getJSONValue(v), "\"/nix/store/g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x\"");
-    }
+    v.mkStringNoCopy("test\"");
+    ASSERT_EQ(getJSONValue(v), "\"test\\\"\"");
+}
+
+// The dummy store doesn't support writing files. Fails with this exception message:
+// C++ exception with description "error: operation 'addToStoreFromDump' is
+// not supported by store 'dummy'" thrown in the test body.
+TEST_F(JSONValueTest, DISABLED_Path)
+{
+    Value v;
+    v.mkPath(state.rootPath(CanonPath("/test")));
+    ASSERT_EQ(getJSONValue(v), "\"/nix/store/g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x\"");
+}
 } /* namespace nix */
diff --git a/src/libexpr-tests/main.cc b/src/libexpr-tests/main.cc
index 52cca53c4..61b40e834 100644
--- a/src/libexpr-tests/main.cc
+++ b/src/libexpr-tests/main.cc
@@ -5,7 +5,8 @@
 
 using namespace nix;
 
-int main (int argc, char **argv) {
+int main(int argc, char ** argv)
+{
     if (argc > 1 && std::string_view(argv[1]) == "__build-remote") {
         printError("test-build-remote: not supported in libexpr unit tests");
         return 1;
@@ -14,25 +15,26 @@ int main (int argc, char **argv) {
     // Disable build hook. We won't be testing remote builds in these unit tests. If we do, fix the above build hook.
     settings.buildHook = {};
 
-    #ifdef __linux__ // should match the conditional around sandboxBuildDir declaration.
+#ifdef __linux__ // should match the conditional around sandboxBuildDir declaration.
 
-    // When building and testing nix within the host's Nix sandbox, our store dir will be located in the host's sandboxBuildDir, e.g.:
-    // Host
+    // When building and testing nix within the host's Nix sandbox, our store dir will be located in the host's
+    // sandboxBuildDir, e.g.: Host
     //   storeDir = /nix/store
     //   sandboxBuildDir = /build
     // This process
     //   storeDir = /build/foo/bar/store
     //   sandboxBuildDir = /build
-    // However, we have a rule that the store dir must not be inside the storeDir, so we need to pick a different sandboxBuildDir.
+    // However, we have a rule that the store dir must not be inside the storeDir, so we need to pick a different
+    // sandboxBuildDir.
     settings.sandboxBuildDir = "/test-build-dir-instead-of-usual-build-dir";
-    #endif
+#endif
 
-    #ifdef __APPLE__
+#ifdef __APPLE__
     // Avoid this error, when already running in a sandbox:
     // sandbox-exec: sandbox_apply: Operation not permitted
     settings.sandboxMode = smDisabled;
     setEnv("_NIX_TEST_NO_SANDBOX", "1");
-    #endif
+#endif
 
     // For pipe operator tests in trivial.cc
     experimentalFeatureSettings.set("experimental-features", "pipe-operators");
diff --git a/src/libexpr-tests/meson.build b/src/libexpr-tests/meson.build
index 35ae8a9d0..c5dafe0de 100644
--- a/src/libexpr-tests/meson.build
+++ b/src/libexpr-tests/meson.build
@@ -1,7 +1,9 @@
-project('nix-expr-tests', 'cpp',
+project(
+  'nix-expr-tests',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -19,8 +21,7 @@ deps_private_maybe_subproject = [
   dependency('nix-expr-c'),
   dependency('nix-expr-test-support'),
 ]
-deps_public_maybe_subproject = [
-]
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 subdir('nix-meson-build-support/export-all-symbols')
@@ -54,6 +55,7 @@ sources = files(
   'nix_api_expr.cc',
   'nix_api_external.cc',
   'nix_api_value.cc',
+  'nix_api_value_internal.cc',
   'primops.cc',
   'search-path.cc',
   'trivial.cc',
@@ -62,7 +64,7 @@ sources = files(
   'value/value.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 
 this_exe = executable(
@@ -72,15 +74,16 @@ this_exe = executable(
   dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
   # TODO: -lrapidcheck, see ../libutil-support/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 test(
   meson.project_name(),
   this_exe,
   env : {
-    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+    '_NIX_TEST_UNIT_DATA' : meson.current_source_dir() / 'data',
   },
   protocol : 'gtest',
 )
diff --git a/src/libexpr-tests/nix_api_expr.cc b/src/libexpr-tests/nix_api_expr.cc
index f3b6fed0e..5e0868b6e 100644
--- a/src/libexpr-tests/nix_api_expr.cc
+++ b/src/libexpr-tests/nix_api_expr.cc
@@ -1,7 +1,5 @@
 #include "nix_api_store.h"
-#include "nix_api_store_internal.h"
 #include "nix_api_util.h"
-#include "nix_api_util_internal.h"
 #include "nix_api_expr.h"
 #include "nix_api_value.h"
 
@@ -151,8 +149,8 @@ TEST_F(nix_api_expr_test, nix_expr_realise_context_bad_value)
     assert_ctx_ok();
     auto r = nix_string_realise(ctx, state, value, false);
     ASSERT_EQ(nullptr, r);
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
-    ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("cannot coerce")));
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_NIX_ERROR);
+    ASSERT_THAT(nix_err_msg(nullptr, ctx, nullptr), testing::HasSubstr("cannot coerce"));
 }
 
 TEST_F(nix_api_expr_test, nix_expr_realise_context_bad_build)
@@ -168,8 +166,8 @@ TEST_F(nix_api_expr_test, nix_expr_realise_context_bad_build)
     assert_ctx_ok();
     auto r = nix_string_realise(ctx, state, value, false);
     ASSERT_EQ(nullptr, r);
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
-    ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("failed with exit code 1")));
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_NIX_ERROR);
+    ASSERT_THAT(nix_err_msg(nullptr, ctx, nullptr), testing::HasSubstr("failed with exit code 1"));
 }
 
 TEST_F(nix_api_expr_test, nix_expr_realise_context)
@@ -381,12 +379,11 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_no_return)
     nix_value * result = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_value_call(ctx, state, primopValue, three, result);
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_NIX_ERROR);
     ASSERT_THAT(
-        ctx->last_err,
-        testing::Optional(
-            testing::HasSubstr("Implementation error in custom function: return value was not initialized")));
-    ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("badNoReturn")));
+        nix_err_msg(nullptr, ctx, nullptr),
+        testing::HasSubstr("Implementation error in custom function: return value was not initialized"));
+    ASSERT_THAT(nix_err_msg(nullptr, ctx, nullptr), testing::HasSubstr("badNoReturn"));
 }
 
 static void primop_bad_return_thunk(
@@ -394,6 +391,7 @@ static void primop_bad_return_thunk(
 {
     nix_init_apply(context, ret, args[0], args[1]);
 }
+
 TEST_F(nix_api_expr_test, nix_expr_primop_bad_return_thunk)
 {
     PrimOp * primop =
@@ -418,12 +416,11 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_return_thunk)
     assert_ctx_ok();
     NIX_VALUE_CALL(ctx, state, result, primopValue, toString, four);
 
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_NIX_ERROR);
     ASSERT_THAT(
-        ctx->last_err,
-        testing::Optional(
-            testing::HasSubstr("Implementation error in custom function: return value must not be a thunk")));
-    ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("badReturnThunk")));
+        nix_err_msg(nullptr, ctx, nullptr),
+        testing::HasSubstr("Implementation error in custom function: return value must not be a thunk"));
+    ASSERT_THAT(nix_err_msg(nullptr, ctx, nullptr), testing::HasSubstr("badReturnThunk"));
 }
 
 TEST_F(nix_api_expr_test, nix_value_call_multi_no_args)
diff --git a/src/libexpr-tests/nix_api_external.cc b/src/libexpr-tests/nix_api_external.cc
index c1deabad6..ec19f1212 100644
--- a/src/libexpr-tests/nix_api_external.cc
+++ b/src/libexpr-tests/nix_api_external.cc
@@ -1,9 +1,6 @@
 #include "nix_api_store.h"
-#include "nix_api_store_internal.h"
 #include "nix_api_util.h"
-#include "nix_api_util_internal.h"
 #include "nix_api_expr.h"
-#include "nix_api_expr_internal.h"
 #include "nix_api_value.h"
 #include "nix_api_external.h"
 
@@ -27,6 +24,7 @@ public:
 
 private:
     int _x;
+
     static void print_function(void * self, nix_printer * printer) {}
 
     static void show_type_function(void * self, nix_string_return * res) {}
@@ -38,7 +36,7 @@ private:
         std::string type_string = "nix-external<MyExternalValueDesc( ";
         type_string += std::to_string(obj->_x);
         type_string += " )>";
-        res->str = &*type_string.begin();
+        nix_set_string_return(res, &*type_string.begin());
     }
 };
 
@@ -68,4 +66,4 @@ TEST_F(nix_api_expr_test, nix_expr_eval_external)
     nix_state_free(stateFn);
 }
 
-}
+} // namespace nixC
diff --git a/src/libexpr-tests/nix_api_value.cc b/src/libexpr-tests/nix_api_value.cc
index 1da980ab8..af95224de 100644
--- a/src/libexpr-tests/nix_api_value.cc
+++ b/src/libexpr-tests/nix_api_value.cc
@@ -1,10 +1,7 @@
 #include "nix_api_store.h"
-#include "nix_api_store_internal.h"
 #include "nix_api_util.h"
-#include "nix_api_util_internal.h"
 #include "nix_api_expr.h"
 #include "nix_api_value.h"
-#include "nix_api_expr_internal.h"
 
 #include "nix/expr/tests/nix_api_expr.hh"
 #include "nix/util/tests/string_callback.hh"
@@ -16,14 +13,6 @@
 
 namespace nixC {
 
-TEST_F(nix_api_expr_test, as_nix_value_ptr)
-{
-    // nix_alloc_value casts nix::Value to nix_value
-    // It should be obvious from the decl that that works, but if it doesn't,
-    // the whole implementation would be utterly broken.
-    ASSERT_EQ(sizeof(nix::Value), sizeof(nix_value));
-}
-
 TEST_F(nix_api_expr_test, nix_value_get_int_invalid)
 {
     ASSERT_EQ(0, nix_get_int(ctx, nullptr));
@@ -120,6 +109,7 @@ TEST_F(nix_api_expr_test, nix_value_set_get_path_invalid)
     ASSERT_EQ(nullptr, nix_get_path_string(ctx, value));
     assert_ctx_err();
 }
+
 TEST_F(nix_api_expr_test, nix_value_set_get_path)
 {
     const char * p = "/nix/store/40s0qmrfb45vlh6610rk29ym318dswdr-myname";
@@ -319,8 +309,10 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_error)
 
     // Evaluate it
     nix_value_force(ctx, state, v);
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
-    ASSERT_THAT(ctx->last_err.value(), testing::HasSubstr("attempt to call something which is not a function but"));
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_NIX_ERROR);
+    ASSERT_THAT(
+        nix_err_msg(nullptr, ctx, nullptr),
+        testing::HasSubstr("attempt to call something which is not a function but"));
 
     // Clean up
     nix_gc_decref(ctx, some_string);
@@ -379,7 +371,9 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
     // nix_get_attr_byname isn't lazy (it could have been) so it will throw the exception
     nix_value * foo = nix_get_attr_byname(ctx, r, state, "foo");
     ASSERT_EQ(nullptr, foo);
-    ASSERT_THAT(ctx->last_err.value(), testing::HasSubstr("error message for test case nix_value_init_apply_lazy_arg"));
+    ASSERT_THAT(
+        nix_err_msg(nullptr, ctx, nullptr),
+        testing::HasSubstr("error message for test case nix_value_init_apply_lazy_arg"));
 
     // Clean up
     nix_gc_decref(ctx, f);
@@ -399,4 +393,4 @@ TEST_F(nix_api_expr_test, nix_copy_value)
     nix_gc_decref(ctx, source);
 }
 
-}
+} // namespace nixC
diff --git a/src/libexpr-tests/nix_api_value_internal.cc b/src/libexpr-tests/nix_api_value_internal.cc
new file mode 100644
index 000000000..34db6ac81
--- /dev/null
+++ b/src/libexpr-tests/nix_api_value_internal.cc
@@ -0,0 +1,25 @@
+#include "nix_api_store.h"
+#include "nix_api_util.h"
+#include "nix_api_expr.h"
+#include "nix_api_value.h"
+#include "nix_api_expr_internal.h"
+
+#include "nix/expr/tests/nix_api_expr.hh"
+#include "nix/util/tests/string_callback.hh"
+
+#include <gmock/gmock.h>
+#include <cstddef>
+#include <cstdlib>
+#include <gtest/gtest.h>
+
+namespace nixC {
+
+TEST_F(nix_api_expr_test, as_nix_value_ptr)
+{
+    // nix_alloc_value casts nix::Value to nix_value
+    // It should be obvious from the decl that that works, but if it doesn't,
+    // the whole implementation would be utterly broken.
+    ASSERT_EQ(sizeof(nix::Value), sizeof(nix_value));
+}
+
+} // namespace nixC
diff --git a/src/libexpr-tests/pch/precompiled-headers.hh b/src/libexpr-tests/pch/precompiled-headers.hh
new file mode 100644
index 000000000..63bf023a2
--- /dev/null
+++ b/src/libexpr-tests/pch/precompiled-headers.hh
@@ -0,0 +1,4 @@
+#include "nix/expr/tests/libexpr.hh"
+
+#include <gtest/gtest.h>
+#include <gmock/gmock.h>
diff --git a/src/libexpr-tests/primops.cc b/src/libexpr-tests/primops.cc
index 9b5590d8d..aa4ef5e21 100644
--- a/src/libexpr-tests/primops.cc
+++ b/src/libexpr-tests/primops.cc
@@ -7,887 +7,996 @@
 #include "nix/expr/tests/libexpr.hh"
 
 namespace nix {
-    class CaptureLogger : public Logger
+class CaptureLogger : public Logger
+{
+    std::ostringstream oss;
+
+public:
+    CaptureLogger() {}
+
+    std::string get() const
     {
-        std::ostringstream oss;
-
-        public:
-            CaptureLogger() {}
-
-            std::string get() const {
-                return oss.str();
-            }
-
-            void log(Verbosity lvl, std::string_view s) override {
-                oss << s << std::endl;
-            }
-
-            void logEI(const ErrorInfo & ei) override {
-                showErrorInfo(oss, ei, loggerSettings.showTrace.get());
-            }
-    };
-
-    class CaptureLogging {
-        std::unique_ptr<Logger> oldLogger;
-        public:
-            CaptureLogging() {
-                oldLogger = std::move(logger);
-                logger = std::make_unique<CaptureLogger>();
-            }
-
-            ~CaptureLogging() {
-                logger = std::move(oldLogger);
-            }
-    };
-
-
-    // Testing eval of PrimOp's
-    class PrimOpTest : public LibExprTest {};
-
-
-    TEST_F(PrimOpTest, throw) {
-        ASSERT_THROW(eval("throw \"foo\""), ThrownError);
+        return oss.str();
     }
 
-    TEST_F(PrimOpTest, abort) {
-        ASSERT_THROW(eval("abort \"abort\""), Abort);
+    void log(Verbosity lvl, std::string_view s) override
+    {
+        oss << s << std::endl;
     }
 
-    TEST_F(PrimOpTest, ceil) {
-        auto v = eval("builtins.ceil 1.9");
-        ASSERT_THAT(v, IsIntEq(2));
-        auto intMin = eval("builtins.ceil (-4611686018427387904 - 4611686018427387904)");
-        ASSERT_THAT(intMin, IsIntEq(std::numeric_limits<NixInt::Inner>::min()));
-        ASSERT_THROW(eval("builtins.ceil 1.0e200"), EvalError);
-        ASSERT_THROW(eval("builtins.ceil -1.0e200"), EvalError);
-        ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200)"), EvalError); // inf
-        ASSERT_THROW(eval("builtins.ceil (-1.0e200 * 1.0e200)"), EvalError); // -inf
-        ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200 - 1.0e200 * 1.0e200)"), EvalError); // nan
-        // bugs in previous Nix versions
-        ASSERT_THROW(eval("builtins.ceil (4611686018427387904 + 4611686018427387903)"), EvalError);
-        ASSERT_THROW(eval("builtins.ceil (-4611686018427387904 - 4611686018427387903)"), EvalError);
+    void logEI(const ErrorInfo & ei) override
+    {
+        showErrorInfo(oss, ei, loggerSettings.showTrace.get());
+    }
+};
+
+class CaptureLogging
+{
+    std::unique_ptr<Logger> oldLogger;
+public:
+    CaptureLogging()
+    {
+        oldLogger = std::move(logger);
+        logger = std::make_unique<CaptureLogger>();
     }
 
-    TEST_F(PrimOpTest, floor) {
-        auto v = eval("builtins.floor 1.9");
-        ASSERT_THAT(v, IsIntEq(1));
-        auto intMin = eval("builtins.ceil (-4611686018427387904 - 4611686018427387904)");
-        ASSERT_THAT(intMin, IsIntEq(std::numeric_limits<NixInt::Inner>::min()));
-        ASSERT_THROW(eval("builtins.ceil 1.0e200"), EvalError);
-        ASSERT_THROW(eval("builtins.ceil -1.0e200"), EvalError);
-        ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200)"), EvalError); // inf
-        ASSERT_THROW(eval("builtins.ceil (-1.0e200 * 1.0e200)"), EvalError); // -inf
-        ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200 - 1.0e200 * 1.0e200)"), EvalError); // nan
-        // bugs in previous Nix versions
-        ASSERT_THROW(eval("builtins.ceil (4611686018427387904 + 4611686018427387903)"), EvalError);
-        ASSERT_THROW(eval("builtins.ceil (-4611686018427387904 - 4611686018427387903)"), EvalError);
+    ~CaptureLogging()
+    {
+        logger = std::move(oldLogger);
     }
+};
 
-    TEST_F(PrimOpTest, tryEvalFailure) {
-        auto v = eval("builtins.tryEval (throw \"\")");
-        ASSERT_THAT(v, IsAttrsOfSize(2));
-        auto s = createSymbol("success");
-        auto p = v.attrs()->get(s);
-        ASSERT_NE(p, nullptr);
-        ASSERT_THAT(*p->value, IsFalse());
-    }
+// Testing eval of PrimOp's
+class PrimOpTest : public LibExprTest
+{};
 
-    TEST_F(PrimOpTest, tryEvalSuccess) {
-        auto v = eval("builtins.tryEval 123");
-        ASSERT_THAT(v, IsAttrs());
-        auto s = createSymbol("success");
-        auto p = v.attrs()->get(s);
-        ASSERT_NE(p, nullptr);
-        ASSERT_THAT(*p->value, IsTrue());
-        s = createSymbol("value");
-        p = v.attrs()->get(s);
-        ASSERT_NE(p, nullptr);
-        ASSERT_THAT(*p->value, IsIntEq(123));
-    }
+TEST_F(PrimOpTest, throw)
+{
+    ASSERT_THROW(eval("throw \"foo\""), ThrownError);
+}
 
-    TEST_F(PrimOpTest, getEnv) {
-        setEnv("_NIX_UNIT_TEST_ENV_VALUE", "test value");
-        auto v = eval("builtins.getEnv \"_NIX_UNIT_TEST_ENV_VALUE\"");
-        ASSERT_THAT(v, IsStringEq("test value"));
-    }
+TEST_F(PrimOpTest, abort)
+{
+    ASSERT_THROW(eval("abort \"abort\""), Abort);
+}
 
-    TEST_F(PrimOpTest, seq) {
-        ASSERT_THROW(eval("let x = throw \"test\"; in builtins.seq x { }"), ThrownError);
-    }
+TEST_F(PrimOpTest, ceil)
+{
+    auto v = eval("builtins.ceil 1.9");
+    ASSERT_THAT(v, IsIntEq(2));
+    auto intMin = eval("builtins.ceil (-4611686018427387904 - 4611686018427387904)");
+    ASSERT_THAT(intMin, IsIntEq(std::numeric_limits<NixInt::Inner>::min()));
+    ASSERT_THROW(eval("builtins.ceil 1.0e200"), EvalError);
+    ASSERT_THROW(eval("builtins.ceil -1.0e200"), EvalError);
+    ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200)"), EvalError);                     // inf
+    ASSERT_THROW(eval("builtins.ceil (-1.0e200 * 1.0e200)"), EvalError);                    // -inf
+    ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200 - 1.0e200 * 1.0e200)"), EvalError); // nan
+    // bugs in previous Nix versions
+    ASSERT_THROW(eval("builtins.ceil (4611686018427387904 + 4611686018427387903)"), EvalError);
+    ASSERT_THROW(eval("builtins.ceil (-4611686018427387904 - 4611686018427387903)"), EvalError);
+}
 
-    TEST_F(PrimOpTest, seqNotDeep) {
-        auto v = eval("let x = { z =  throw \"test\"; }; in builtins.seq x { }");
-        ASSERT_THAT(v, IsAttrs());
-    }
+TEST_F(PrimOpTest, floor)
+{
+    auto v = eval("builtins.floor 1.9");
+    ASSERT_THAT(v, IsIntEq(1));
+    auto intMin = eval("builtins.ceil (-4611686018427387904 - 4611686018427387904)");
+    ASSERT_THAT(intMin, IsIntEq(std::numeric_limits<NixInt::Inner>::min()));
+    ASSERT_THROW(eval("builtins.ceil 1.0e200"), EvalError);
+    ASSERT_THROW(eval("builtins.ceil -1.0e200"), EvalError);
+    ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200)"), EvalError);                     // inf
+    ASSERT_THROW(eval("builtins.ceil (-1.0e200 * 1.0e200)"), EvalError);                    // -inf
+    ASSERT_THROW(eval("builtins.ceil (1.0e200 * 1.0e200 - 1.0e200 * 1.0e200)"), EvalError); // nan
+    // bugs in previous Nix versions
+    ASSERT_THROW(eval("builtins.ceil (4611686018427387904 + 4611686018427387903)"), EvalError);
+    ASSERT_THROW(eval("builtins.ceil (-4611686018427387904 - 4611686018427387903)"), EvalError);
+}
 
-    TEST_F(PrimOpTest, deepSeq) {
-        ASSERT_THROW(eval("let x = { z =  throw \"test\"; }; in builtins.deepSeq x { }"), ThrownError);
-    }
+TEST_F(PrimOpTest, tryEvalFailure)
+{
+    auto v = eval("builtins.tryEval (throw \"\")");
+    ASSERT_THAT(v, IsAttrsOfSize(2));
+    auto s = createSymbol("success");
+    auto p = v.attrs()->get(s);
+    ASSERT_NE(p, nullptr);
+    ASSERT_THAT(*p->value, IsFalse());
+}
 
-    TEST_F(PrimOpTest, trace) {
-        CaptureLogging l;
-        auto v = eval("builtins.trace \"test string 123\" 123");
-        ASSERT_THAT(v, IsIntEq(123));
-        auto text = (dynamic_cast<CaptureLogger *>(logger.get()))->get();
-        ASSERT_NE(text.find("test string 123"), std::string::npos);
-    }
+TEST_F(PrimOpTest, tryEvalSuccess)
+{
+    auto v = eval("builtins.tryEval 123");
+    ASSERT_THAT(v, IsAttrs());
+    auto s = createSymbol("success");
+    auto p = v.attrs()->get(s);
+    ASSERT_NE(p, nullptr);
+    ASSERT_THAT(*p->value, IsTrue());
+    s = createSymbol("value");
+    p = v.attrs()->get(s);
+    ASSERT_NE(p, nullptr);
+    ASSERT_THAT(*p->value, IsIntEq(123));
+}
 
-    TEST_F(PrimOpTest, placeholder) {
-        auto v = eval("builtins.placeholder \"out\"");
-        ASSERT_THAT(v, IsStringEq("/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9"));
-    }
+TEST_F(PrimOpTest, getEnv)
+{
+    setEnv("_NIX_UNIT_TEST_ENV_VALUE", "test value");
+    auto v = eval("builtins.getEnv \"_NIX_UNIT_TEST_ENV_VALUE\"");
+    ASSERT_THAT(v, IsStringEq("test value"));
+}
 
-    TEST_F(PrimOpTest, baseNameOf) {
-        auto v = eval("builtins.baseNameOf /some/path");
-        ASSERT_THAT(v, IsStringEq("path"));
-    }
+TEST_F(PrimOpTest, seq)
+{
+    ASSERT_THROW(eval("let x = throw \"test\"; in builtins.seq x { }"), ThrownError);
+}
 
-    TEST_F(PrimOpTest, dirOf) {
-        auto v = eval("builtins.dirOf /some/path");
-        ASSERT_THAT(v, IsPathEq("/some"));
-    }
+TEST_F(PrimOpTest, seqNotDeep)
+{
+    auto v = eval("let x = { z =  throw \"test\"; }; in builtins.seq x { }");
+    ASSERT_THAT(v, IsAttrs());
+}
 
-    TEST_F(PrimOpTest, attrValues) {
-        auto v = eval("builtins.attrValues { x = \"foo\";  a = 1; }");
-        ASSERT_THAT(v, IsListOfSize(2));
-        ASSERT_THAT(*v.listView()[0], IsIntEq(1));
-        ASSERT_THAT(*v.listView()[1], IsStringEq("foo"));
-    }
+TEST_F(PrimOpTest, deepSeq)
+{
+    ASSERT_THROW(eval("let x = { z =  throw \"test\"; }; in builtins.deepSeq x { }"), ThrownError);
+}
 
-    TEST_F(PrimOpTest, getAttr) {
-        auto v = eval("builtins.getAttr \"x\" { x = \"foo\"; }");
-        ASSERT_THAT(v, IsStringEq("foo"));
-    }
+TEST_F(PrimOpTest, trace)
+{
+    CaptureLogging l;
+    auto v = eval("builtins.trace \"test string 123\" 123");
+    ASSERT_THAT(v, IsIntEq(123));
+    auto text = (dynamic_cast<CaptureLogger *>(logger.get()))->get();
+    ASSERT_NE(text.find("test string 123"), std::string::npos);
+}
 
-    TEST_F(PrimOpTest, getAttrNotFound) {
-        // FIXME: TypeError is really bad here, also the error wording is worse
-        // than on Nix <=2.3
-        ASSERT_THROW(eval("builtins.getAttr \"y\" { }"), TypeError);
-    }
+TEST_F(PrimOpTest, placeholder)
+{
+    auto v = eval("builtins.placeholder \"out\"");
+    ASSERT_THAT(v, IsStringEq("/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9"));
+}
 
-    TEST_F(PrimOpTest, unsafeGetAttrPos) {
-        state.corepkgsFS->addFile(CanonPath("foo.nix"), "\n\r\n\r{ y = \"x\"; }");
+TEST_F(PrimOpTest, baseNameOf)
+{
+    auto v = eval("builtins.baseNameOf /some/path");
+    ASSERT_THAT(v, IsStringEq("path"));
+}
 
-        auto expr = "builtins.unsafeGetAttrPos \"y\" (import <nix/foo.nix>)";
-        auto v = eval(expr);
-        ASSERT_THAT(v, IsAttrsOfSize(3));
+TEST_F(PrimOpTest, dirOf)
+{
+    auto v = eval("builtins.dirOf /some/path");
+    ASSERT_THAT(v, IsPathEq("/some"));
+}
 
-        auto file = v.attrs()->find(createSymbol("file"));
-        ASSERT_NE(file, nullptr);
-        ASSERT_THAT(*file->value, IsString());
-        auto s = baseNameOf(file->value->string_view());
-        ASSERT_EQ(s, "foo.nix");
+TEST_F(PrimOpTest, attrValues)
+{
+    auto v = eval("builtins.attrValues { x = \"foo\";  a = 1; }");
+    ASSERT_THAT(v, IsListOfSize(2));
+    ASSERT_THAT(*v.listView()[0], IsIntEq(1));
+    ASSERT_THAT(*v.listView()[1], IsStringEq("foo"));
+}
 
-        auto line = v.attrs()->find(createSymbol("line"));
-        ASSERT_NE(line, nullptr);
-        state.forceValue(*line->value, noPos);
-        ASSERT_THAT(*line->value, IsIntEq(4));
+TEST_F(PrimOpTest, getAttr)
+{
+    auto v = eval("builtins.getAttr \"x\" { x = \"foo\"; }");
+    ASSERT_THAT(v, IsStringEq("foo"));
+}
 
-        auto column = v.attrs()->find(createSymbol("column"));
-        ASSERT_NE(column, nullptr);
-        state.forceValue(*column->value, noPos);
-        ASSERT_THAT(*column->value, IsIntEq(3));
-    }
+TEST_F(PrimOpTest, getAttrNotFound)
+{
+    // FIXME: TypeError is really bad here, also the error wording is worse
+    // than on Nix <=2.3
+    ASSERT_THROW(eval("builtins.getAttr \"y\" { }"), TypeError);
+}
 
-    TEST_F(PrimOpTest, hasAttr) {
-        auto v = eval("builtins.hasAttr \"x\" { x = 1; }");
-        ASSERT_THAT(v, IsTrue());
-    }
+TEST_F(PrimOpTest, unsafeGetAttrPos)
+{
+    state.corepkgsFS->addFile(CanonPath("foo.nix"), "\n\r\n\r{ y = \"x\"; }");
 
-    TEST_F(PrimOpTest, hasAttrNotFound) {
-        auto v = eval("builtins.hasAttr \"x\" { }");
-        ASSERT_THAT(v, IsFalse());
-    }
+    auto expr = "builtins.unsafeGetAttrPos \"y\" (import <nix/foo.nix>)";
+    auto v = eval(expr);
+    ASSERT_THAT(v, IsAttrsOfSize(3));
 
-    TEST_F(PrimOpTest, isAttrs) {
-        auto v = eval("builtins.isAttrs {}");
-        ASSERT_THAT(v, IsTrue());
-    }
+    auto file = v.attrs()->get(createSymbol("file"));
+    ASSERT_NE(file, nullptr);
+    ASSERT_THAT(*file->value, IsString());
+    auto s = baseNameOf(file->value->string_view());
+    ASSERT_EQ(s, "foo.nix");
 
-    TEST_F(PrimOpTest, isAttrsFalse) {
-        auto v = eval("builtins.isAttrs null");
-        ASSERT_THAT(v, IsFalse());
-    }
+    auto line = v.attrs()->get(createSymbol("line"));
+    ASSERT_NE(line, nullptr);
+    state.forceValue(*line->value, noPos);
+    ASSERT_THAT(*line->value, IsIntEq(4));
 
-    TEST_F(PrimOpTest, removeAttrs) {
-        auto v = eval("builtins.removeAttrs { x = 1; } [\"x\"]");
-        ASSERT_THAT(v, IsAttrsOfSize(0));
-    }
+    auto column = v.attrs()->get(createSymbol("column"));
+    ASSERT_NE(column, nullptr);
+    state.forceValue(*column->value, noPos);
+    ASSERT_THAT(*column->value, IsIntEq(3));
+}
 
-    TEST_F(PrimOpTest, removeAttrsRetains) {
-        auto v = eval("builtins.removeAttrs { x = 1; y = 2; } [\"x\"]");
-        ASSERT_THAT(v, IsAttrsOfSize(1));
-        ASSERT_NE(v.attrs()->find(createSymbol("y")), nullptr);
-    }
+TEST_F(PrimOpTest, hasAttr)
+{
+    auto v = eval("builtins.hasAttr \"x\" { x = 1; }");
+    ASSERT_THAT(v, IsTrue());
+}
 
-    TEST_F(PrimOpTest, listToAttrsEmptyList) {
-        auto v = eval("builtins.listToAttrs []");
-        ASSERT_THAT(v, IsAttrsOfSize(0));
-        ASSERT_EQ(v.type(), nAttrs);
-        ASSERT_EQ(v.attrs()->size(), 0u);
-    }
+TEST_F(PrimOpTest, hasAttrNotFound)
+{
+    auto v = eval("builtins.hasAttr \"x\" { }");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(PrimOpTest, listToAttrsNotFieldName) {
-        ASSERT_THROW(eval("builtins.listToAttrs [{}]"), Error);
-    }
+TEST_F(PrimOpTest, isAttrs)
+{
+    auto v = eval("builtins.isAttrs {}");
+    ASSERT_THAT(v, IsTrue());
+}
 
-    TEST_F(PrimOpTest, listToAttrs) {
-        auto v = eval("builtins.listToAttrs [ { name = \"key\"; value = 123; } ]");
-        ASSERT_THAT(v, IsAttrsOfSize(1));
-        auto key = v.attrs()->find(createSymbol("key"));
-        ASSERT_NE(key, nullptr);
-        ASSERT_THAT(*key->value, IsIntEq(123));
-    }
+TEST_F(PrimOpTest, isAttrsFalse)
+{
+    auto v = eval("builtins.isAttrs null");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(PrimOpTest, intersectAttrs) {
-        auto v = eval("builtins.intersectAttrs { a = 1; b = 2; } { b = 3; c = 4; }");
-        ASSERT_THAT(v, IsAttrsOfSize(1));
-        auto b = v.attrs()->find(createSymbol("b"));
-        ASSERT_NE(b, nullptr);
-        ASSERT_THAT(*b->value, IsIntEq(3));
-    }
+TEST_F(PrimOpTest, removeAttrs)
+{
+    auto v = eval("builtins.removeAttrs { x = 1; } [\"x\"]");
+    ASSERT_THAT(v, IsAttrsOfSize(0));
+}
 
-    TEST_F(PrimOpTest, catAttrs) {
-        auto v = eval("builtins.catAttrs \"a\" [{a = 1;} {b = 0;} {a = 2;}]");
-        ASSERT_THAT(v, IsListOfSize(2));
-        ASSERT_THAT(*v.listView()[0], IsIntEq(1));
-        ASSERT_THAT(*v.listView()[1], IsIntEq(2));
-    }
+TEST_F(PrimOpTest, removeAttrsRetains)
+{
+    auto v = eval("builtins.removeAttrs { x = 1; y = 2; } [\"x\"]");
+    ASSERT_THAT(v, IsAttrsOfSize(1));
+    ASSERT_NE(v.attrs()->get(createSymbol("y")), nullptr);
+}
 
-    TEST_F(PrimOpTest, functionArgs) {
-        auto v = eval("builtins.functionArgs ({ x, y ? 123}: 1)");
-        ASSERT_THAT(v, IsAttrsOfSize(2));
+TEST_F(PrimOpTest, listToAttrsEmptyList)
+{
+    auto v = eval("builtins.listToAttrs []");
+    ASSERT_THAT(v, IsAttrsOfSize(0));
+    ASSERT_EQ(v.type(), nAttrs);
+    ASSERT_EQ(v.attrs()->size(), 0u);
+}
 
-        auto x = v.attrs()->find(createSymbol("x"));
-        ASSERT_NE(x, nullptr);
-        ASSERT_THAT(*x->value, IsFalse());
+TEST_F(PrimOpTest, listToAttrsNotFieldName)
+{
+    ASSERT_THROW(eval("builtins.listToAttrs [{}]"), Error);
+}
 
-        auto y = v.attrs()->find(createSymbol("y"));
-        ASSERT_NE(y, nullptr);
-        ASSERT_THAT(*y->value, IsTrue());
-    }
+TEST_F(PrimOpTest, listToAttrs)
+{
+    auto v = eval("builtins.listToAttrs [ { name = \"key\"; value = 123; } ]");
+    ASSERT_THAT(v, IsAttrsOfSize(1));
+    auto key = v.attrs()->get(createSymbol("key"));
+    ASSERT_NE(key, nullptr);
+    ASSERT_THAT(*key->value, IsIntEq(123));
+}
 
-    TEST_F(PrimOpTest, mapAttrs) {
-        auto v = eval("builtins.mapAttrs (name: value: value * 10) { a = 1; b = 2; }");
-        ASSERT_THAT(v, IsAttrsOfSize(2));
+TEST_F(PrimOpTest, intersectAttrs)
+{
+    auto v = eval("builtins.intersectAttrs { a = 1; b = 2; } { b = 3; c = 4; }");
+    ASSERT_THAT(v, IsAttrsOfSize(1));
+    auto b = v.attrs()->get(createSymbol("b"));
+    ASSERT_NE(b, nullptr);
+    ASSERT_THAT(*b->value, IsIntEq(3));
+}
 
-        auto a = v.attrs()->find(createSymbol("a"));
-        ASSERT_NE(a, nullptr);
-        ASSERT_THAT(*a->value, IsThunk());
-        state.forceValue(*a->value, noPos);
-        ASSERT_THAT(*a->value, IsIntEq(10));
+TEST_F(PrimOpTest, catAttrs)
+{
+    auto v = eval("builtins.catAttrs \"a\" [{a = 1;} {b = 0;} {a = 2;}]");
+    ASSERT_THAT(v, IsListOfSize(2));
+    ASSERT_THAT(*v.listView()[0], IsIntEq(1));
+    ASSERT_THAT(*v.listView()[1], IsIntEq(2));
+}
 
-        auto b = v.attrs()->find(createSymbol("b"));
-        ASSERT_NE(b, nullptr);
-        ASSERT_THAT(*b->value, IsThunk());
-        state.forceValue(*b->value, noPos);
-        ASSERT_THAT(*b->value, IsIntEq(20));
-    }
+TEST_F(PrimOpTest, functionArgs)
+{
+    auto v = eval("builtins.functionArgs ({ x, y ? 123}: 1)");
+    ASSERT_THAT(v, IsAttrsOfSize(2));
 
-    TEST_F(PrimOpTest, isList) {
-        auto v = eval("builtins.isList []");
-        ASSERT_THAT(v, IsTrue());
-    }
+    auto x = v.attrs()->get(createSymbol("x"));
+    ASSERT_NE(x, nullptr);
+    ASSERT_THAT(*x->value, IsFalse());
 
-    TEST_F(PrimOpTest, isListFalse) {
-        auto v = eval("builtins.isList null");
-        ASSERT_THAT(v, IsFalse());
-    }
+    auto y = v.attrs()->get(createSymbol("y"));
+    ASSERT_NE(y, nullptr);
+    ASSERT_THAT(*y->value, IsTrue());
+}
 
-    TEST_F(PrimOpTest, elemtAt) {
-        auto v = eval("builtins.elemAt [0 1 2 3] 3");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
+TEST_F(PrimOpTest, mapAttrs)
+{
+    auto v = eval("builtins.mapAttrs (name: value: value * 10) { a = 1; b = 2; }");
+    ASSERT_THAT(v, IsAttrsOfSize(2));
 
-    TEST_F(PrimOpTest, elemtAtOutOfBounds) {
-        ASSERT_THROW(eval("builtins.elemAt [0 1 2 3] 5"), Error);
-        ASSERT_THROW(eval("builtins.elemAt [0] 4294967296"), Error);
-    }
+    auto a = v.attrs()->get(createSymbol("a"));
+    ASSERT_NE(a, nullptr);
+    ASSERT_THAT(*a->value, IsThunk());
+    state.forceValue(*a->value, noPos);
+    ASSERT_THAT(*a->value, IsIntEq(10));
 
-    TEST_F(PrimOpTest, head) {
-        auto v = eval("builtins.head [ 3 2 1 0 ]");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
+    auto b = v.attrs()->get(createSymbol("b"));
+    ASSERT_NE(b, nullptr);
+    ASSERT_THAT(*b->value, IsThunk());
+    state.forceValue(*b->value, noPos);
+    ASSERT_THAT(*b->value, IsIntEq(20));
+}
 
-    TEST_F(PrimOpTest, headEmpty) {
-        ASSERT_THROW(eval("builtins.head [ ]"), Error);
-    }
+TEST_F(PrimOpTest, isList)
+{
+    auto v = eval("builtins.isList []");
+    ASSERT_THAT(v, IsTrue());
+}
 
-    TEST_F(PrimOpTest, headWrongType) {
-        ASSERT_THROW(eval("builtins.head { }"), Error);
-    }
+TEST_F(PrimOpTest, isListFalse)
+{
+    auto v = eval("builtins.isList null");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(PrimOpTest, tail) {
-        auto v = eval("builtins.tail [ 3 2 1 0 ]");
-        ASSERT_THAT(v, IsListOfSize(3));
-        auto listView = v.listView();
-        for (const auto [n, elem] : enumerate(listView))
-            ASSERT_THAT(*elem, IsIntEq(2 - static_cast<int>(n)));
-    }
+TEST_F(PrimOpTest, elemtAt)
+{
+    auto v = eval("builtins.elemAt [0 1 2 3] 3");
+    ASSERT_THAT(v, IsIntEq(3));
+}
 
-    TEST_F(PrimOpTest, tailEmpty) {
-        ASSERT_THROW(eval("builtins.tail []"), Error);
-    }
+TEST_F(PrimOpTest, elemtAtOutOfBounds)
+{
+    ASSERT_THROW(eval("builtins.elemAt [0 1 2 3] 5"), Error);
+    ASSERT_THROW(eval("builtins.elemAt [0] 4294967296"), Error);
+}
 
-    TEST_F(PrimOpTest, map) {
-        auto v = eval("map (x: \"foo\" + x) [ \"bar\" \"bla\" \"abc\" ]");
-        ASSERT_THAT(v, IsListOfSize(3));
-        auto elem = v.listView()[0];
+TEST_F(PrimOpTest, head)
+{
+    auto v = eval("builtins.head [ 3 2 1 0 ]");
+    ASSERT_THAT(v, IsIntEq(3));
+}
+
+TEST_F(PrimOpTest, headEmpty)
+{
+    ASSERT_THROW(eval("builtins.head [ ]"), Error);
+}
+
+TEST_F(PrimOpTest, headWrongType)
+{
+    ASSERT_THROW(eval("builtins.head { }"), Error);
+}
+
+TEST_F(PrimOpTest, tail)
+{
+    auto v = eval("builtins.tail [ 3 2 1 0 ]");
+    ASSERT_THAT(v, IsListOfSize(3));
+    auto listView = v.listView();
+    for (const auto [n, elem] : enumerate(listView))
+        ASSERT_THAT(*elem, IsIntEq(2 - static_cast<int>(n)));
+}
+
+TEST_F(PrimOpTest, tailEmpty)
+{
+    ASSERT_THROW(eval("builtins.tail []"), Error);
+}
+
+TEST_F(PrimOpTest, map)
+{
+    auto v = eval("map (x: \"foo\" + x) [ \"bar\" \"bla\" \"abc\" ]");
+    ASSERT_THAT(v, IsListOfSize(3));
+    auto elem = v.listView()[0];
+    ASSERT_THAT(*elem, IsThunk());
+    state.forceValue(*elem, noPos);
+    ASSERT_THAT(*elem, IsStringEq("foobar"));
+
+    elem = v.listView()[1];
+    ASSERT_THAT(*elem, IsThunk());
+    state.forceValue(*elem, noPos);
+    ASSERT_THAT(*elem, IsStringEq("foobla"));
+
+    elem = v.listView()[2];
+    ASSERT_THAT(*elem, IsThunk());
+    state.forceValue(*elem, noPos);
+    ASSERT_THAT(*elem, IsStringEq("fooabc"));
+}
+
+TEST_F(PrimOpTest, filter)
+{
+    auto v = eval("builtins.filter (x: x == 2) [ 3 2 3 2 3 2 ]");
+    ASSERT_THAT(v, IsListOfSize(3));
+    for (const auto elem : v.listView())
+        ASSERT_THAT(*elem, IsIntEq(2));
+}
+
+TEST_F(PrimOpTest, elemTrue)
+{
+    auto v = eval("builtins.elem 3 [ 1 2 3 4 5 ]");
+    ASSERT_THAT(v, IsTrue());
+}
+
+TEST_F(PrimOpTest, elemFalse)
+{
+    auto v = eval("builtins.elem 6 [ 1 2 3 4 5 ]");
+    ASSERT_THAT(v, IsFalse());
+}
+
+TEST_F(PrimOpTest, concatLists)
+{
+    auto v = eval("builtins.concatLists [[1 2] [3 4]]");
+    ASSERT_THAT(v, IsListOfSize(4));
+    auto listView = v.listView();
+    for (const auto [i, elem] : enumerate(listView))
+        ASSERT_THAT(*elem, IsIntEq(static_cast<int>(i) + 1));
+}
+
+TEST_F(PrimOpTest, length)
+{
+    auto v = eval("builtins.length [ 1 2 3 ]");
+    ASSERT_THAT(v, IsIntEq(3));
+}
+
+TEST_F(PrimOpTest, foldStrict)
+{
+    auto v = eval("builtins.foldl' (a: b: a + b) 0 [1 2 3]");
+    ASSERT_THAT(v, IsIntEq(6));
+}
+
+TEST_F(PrimOpTest, anyTrue)
+{
+    auto v = eval("builtins.any (x: x == 2) [ 1 2 3 ]");
+    ASSERT_THAT(v, IsTrue());
+}
+
+TEST_F(PrimOpTest, anyFalse)
+{
+    auto v = eval("builtins.any (x: x == 5) [ 1 2 3 ]");
+    ASSERT_THAT(v, IsFalse());
+}
+
+TEST_F(PrimOpTest, allTrue)
+{
+    auto v = eval("builtins.all (x: x > 0) [ 1 2 3 ]");
+    ASSERT_THAT(v, IsTrue());
+}
+
+TEST_F(PrimOpTest, allFalse)
+{
+    auto v = eval("builtins.all (x: x <= 0) [ 1 2 3 ]");
+    ASSERT_THAT(v, IsFalse());
+}
+
+TEST_F(PrimOpTest, genList)
+{
+    auto v = eval("builtins.genList (x: x + 1) 3");
+    ASSERT_EQ(v.type(), nList);
+    ASSERT_EQ(v.listSize(), 3u);
+    auto listView = v.listView();
+    for (const auto [i, elem] : enumerate(listView)) {
         ASSERT_THAT(*elem, IsThunk());
         state.forceValue(*elem, noPos);
-        ASSERT_THAT(*elem, IsStringEq("foobar"));
-
-        elem = v.listView()[1];
-        ASSERT_THAT(*elem, IsThunk());
-        state.forceValue(*elem, noPos);
-        ASSERT_THAT(*elem, IsStringEq("foobla"));
-
-        elem = v.listView()[2];
-        ASSERT_THAT(*elem, IsThunk());
-        state.forceValue(*elem, noPos);
-        ASSERT_THAT(*elem, IsStringEq("fooabc"));
+        ASSERT_THAT(*elem, IsIntEq(static_cast<int>(i) + 1));
     }
+}
 
-    TEST_F(PrimOpTest, filter) {
-        auto v = eval("builtins.filter (x: x == 2) [ 3 2 3 2 3 2 ]");
-        ASSERT_THAT(v, IsListOfSize(3));
-        for (const auto elem : v.listView())
-            ASSERT_THAT(*elem, IsIntEq(2));
-    }
+TEST_F(PrimOpTest, sortLessThan)
+{
+    auto v = eval("builtins.sort builtins.lessThan [ 483 249 526 147 42 77 ]");
+    ASSERT_EQ(v.type(), nList);
+    ASSERT_EQ(v.listSize(), 6u);
 
-    TEST_F(PrimOpTest, elemTrue) {
-        auto v = eval("builtins.elem 3 [ 1 2 3 4 5 ]");
-        ASSERT_THAT(v, IsTrue());
-    }
+    const std::vector<int> numbers = {42, 77, 147, 249, 483, 526};
+    auto listView = v.listView();
+    for (const auto [n, elem] : enumerate(listView))
+        ASSERT_THAT(*elem, IsIntEq(numbers[n]));
+}
 
-    TEST_F(PrimOpTest, elemFalse) {
-        auto v = eval("builtins.elem 6 [ 1 2 3 4 5 ]");
-        ASSERT_THAT(v, IsFalse());
-    }
+TEST_F(PrimOpTest, partition)
+{
+    auto v = eval("builtins.partition (x: x > 10) [1 23 9 3 42]");
+    ASSERT_THAT(v, IsAttrsOfSize(2));
 
-    TEST_F(PrimOpTest, concatLists) {
-        auto v = eval("builtins.concatLists [[1 2] [3 4]]");
-        ASSERT_THAT(v, IsListOfSize(4));
-        auto listView = v.listView();
-        for (const auto [i, elem] : enumerate(listView))
-            ASSERT_THAT(*elem, IsIntEq(static_cast<int>(i)+1));
-    }
+    auto right = v.attrs()->get(createSymbol("right"));
+    ASSERT_NE(right, nullptr);
+    ASSERT_THAT(*right->value, IsListOfSize(2));
+    ASSERT_THAT(*right->value->listView()[0], IsIntEq(23));
+    ASSERT_THAT(*right->value->listView()[1], IsIntEq(42));
 
-    TEST_F(PrimOpTest, length) {
-        auto v = eval("builtins.length [ 1 2 3 ]");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
+    auto wrong = v.attrs()->get(createSymbol("wrong"));
+    ASSERT_NE(wrong, nullptr);
+    ASSERT_EQ(wrong->value->type(), nList);
+    ASSERT_EQ(wrong->value->listSize(), 3u);
+    ASSERT_THAT(*wrong->value, IsListOfSize(3));
+    ASSERT_THAT(*wrong->value->listView()[0], IsIntEq(1));
+    ASSERT_THAT(*wrong->value->listView()[1], IsIntEq(9));
+    ASSERT_THAT(*wrong->value->listView()[2], IsIntEq(3));
+}
 
-    TEST_F(PrimOpTest, foldStrict) {
-        auto v = eval("builtins.foldl' (a: b: a + b) 0 [1 2 3]");
-        ASSERT_THAT(v, IsIntEq(6));
-    }
+TEST_F(PrimOpTest, concatMap)
+{
+    auto v = eval("builtins.concatMap (x: x ++ [0]) [ [1 2] [3 4] ]");
+    ASSERT_EQ(v.type(), nList);
+    ASSERT_EQ(v.listSize(), 6u);
 
-    TEST_F(PrimOpTest, anyTrue) {
-        auto v = eval("builtins.any (x: x == 2) [ 1 2 3 ]");
-        ASSERT_THAT(v, IsTrue());
-    }
+    const std::vector<int> numbers = {1, 2, 0, 3, 4, 0};
+    auto listView = v.listView();
+    for (const auto [n, elem] : enumerate(listView))
+        ASSERT_THAT(*elem, IsIntEq(numbers[n]));
+}
 
-    TEST_F(PrimOpTest, anyFalse) {
-        auto v = eval("builtins.any (x: x == 5) [ 1 2 3 ]");
-        ASSERT_THAT(v, IsFalse());
-    }
+TEST_F(PrimOpTest, addInt)
+{
+    auto v = eval("builtins.add 3 5");
+    ASSERT_THAT(v, IsIntEq(8));
+}
 
-    TEST_F(PrimOpTest, allTrue) {
-        auto v = eval("builtins.all (x: x > 0) [ 1 2 3 ]");
-        ASSERT_THAT(v, IsTrue());
-    }
+TEST_F(PrimOpTest, addFloat)
+{
+    auto v = eval("builtins.add 3.0 5.0");
+    ASSERT_THAT(v, IsFloatEq(8.0));
+}
 
-    TEST_F(PrimOpTest, allFalse) {
-        auto v = eval("builtins.all (x: x <= 0) [ 1 2 3 ]");
-        ASSERT_THAT(v, IsFalse());
-    }
+TEST_F(PrimOpTest, addFloatToInt)
+{
+    auto v = eval("builtins.add 3.0 5");
+    ASSERT_THAT(v, IsFloatEq(8.0));
 
-    TEST_F(PrimOpTest, genList) {
-        auto v = eval("builtins.genList (x: x + 1) 3");
-        ASSERT_EQ(v.type(), nList);
-        ASSERT_EQ(v.listSize(), 3u);
-        auto listView = v.listView();
-        for (const auto [i, elem] : enumerate(listView)) {
-            ASSERT_THAT(*elem, IsThunk());
-            state.forceValue(*elem, noPos);
-            ASSERT_THAT(*elem, IsIntEq(static_cast<int>(i)+1));
-        }
-    }
+    v = eval("builtins.add 3 5.0");
+    ASSERT_THAT(v, IsFloatEq(8.0));
+}
 
-    TEST_F(PrimOpTest, sortLessThan) {
-        auto v = eval("builtins.sort builtins.lessThan [ 483 249 526 147 42 77 ]");
-        ASSERT_EQ(v.type(), nList);
-        ASSERT_EQ(v.listSize(), 6u);
+TEST_F(PrimOpTest, subInt)
+{
+    auto v = eval("builtins.sub 5 2");
+    ASSERT_THAT(v, IsIntEq(3));
+}
 
-        const std::vector<int> numbers = { 42, 77, 147, 249, 483, 526 };
-        auto listView = v.listView();
-        for (const auto [n, elem] : enumerate(listView))
-            ASSERT_THAT(*elem, IsIntEq(numbers[n]));
-    }
+TEST_F(PrimOpTest, subFloat)
+{
+    auto v = eval("builtins.sub 5.0 2.0");
+    ASSERT_THAT(v, IsFloatEq(3.0));
+}
 
-    TEST_F(PrimOpTest, partition) {
-        auto v = eval("builtins.partition (x: x > 10) [1 23 9 3 42]");
-        ASSERT_THAT(v, IsAttrsOfSize(2));
+TEST_F(PrimOpTest, subFloatFromInt)
+{
+    auto v = eval("builtins.sub 5.0 2");
+    ASSERT_THAT(v, IsFloatEq(3.0));
 
-        auto right = v.attrs()->get(createSymbol("right"));
-        ASSERT_NE(right, nullptr);
-        ASSERT_THAT(*right->value, IsListOfSize(2));
-        ASSERT_THAT(*right->value->listView()[0], IsIntEq(23));
-        ASSERT_THAT(*right->value->listView()[1], IsIntEq(42));
+    v = eval("builtins.sub 4 2.0");
+    ASSERT_THAT(v, IsFloatEq(2.0));
+}
 
-        auto wrong = v.attrs()->get(createSymbol("wrong"));
-        ASSERT_NE(wrong, nullptr);
-        ASSERT_EQ(wrong->value->type(), nList);
-        ASSERT_EQ(wrong->value->listSize(), 3u);
-        ASSERT_THAT(*wrong->value, IsListOfSize(3));
-        ASSERT_THAT(*wrong->value->listView()[0], IsIntEq(1));
-        ASSERT_THAT(*wrong->value->listView()[1], IsIntEq(9));
-        ASSERT_THAT(*wrong->value->listView()[2], IsIntEq(3));
-    }
+TEST_F(PrimOpTest, mulInt)
+{
+    auto v = eval("builtins.mul 3 5");
+    ASSERT_THAT(v, IsIntEq(15));
+}
 
-    TEST_F(PrimOpTest, concatMap) {
-        auto v = eval("builtins.concatMap (x: x ++ [0]) [ [1 2] [3 4] ]");
-        ASSERT_EQ(v.type(), nList);
-        ASSERT_EQ(v.listSize(), 6u);
+TEST_F(PrimOpTest, mulFloat)
+{
+    auto v = eval("builtins.mul 3.0 5.0");
+    ASSERT_THAT(v, IsFloatEq(15.0));
+}
 
-        const std::vector<int> numbers = { 1, 2, 0, 3, 4, 0 };
-        auto listView = v.listView();
-        for (const auto [n, elem] : enumerate(listView))
-            ASSERT_THAT(*elem, IsIntEq(numbers[n]));
-    }
+TEST_F(PrimOpTest, mulFloatMixed)
+{
+    auto v = eval("builtins.mul 3 5.0");
+    ASSERT_THAT(v, IsFloatEq(15.0));
 
-    TEST_F(PrimOpTest, addInt) {
-        auto v = eval("builtins.add 3 5");
-        ASSERT_THAT(v, IsIntEq(8));
-    }
+    v = eval("builtins.mul 2.0 5");
+    ASSERT_THAT(v, IsFloatEq(10.0));
+}
 
-    TEST_F(PrimOpTest, addFloat) {
-        auto v = eval("builtins.add 3.0 5.0");
-        ASSERT_THAT(v, IsFloatEq(8.0));
-    }
+TEST_F(PrimOpTest, divInt)
+{
+    auto v = eval("builtins.div 5 (-1)");
+    ASSERT_THAT(v, IsIntEq(-5));
+}
 
-    TEST_F(PrimOpTest, addFloatToInt) {
-        auto v = eval("builtins.add 3.0 5");
-        ASSERT_THAT(v, IsFloatEq(8.0));
+TEST_F(PrimOpTest, divIntZero)
+{
+    ASSERT_THROW(eval("builtins.div 5 0"), EvalError);
+}
 
-        v = eval("builtins.add 3 5.0");
-        ASSERT_THAT(v, IsFloatEq(8.0));
-    }
+TEST_F(PrimOpTest, divFloat)
+{
+    auto v = eval("builtins.div 5.0 (-1)");
+    ASSERT_THAT(v, IsFloatEq(-5.0));
+}
 
-    TEST_F(PrimOpTest, subInt) {
-        auto v = eval("builtins.sub 5 2");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
+TEST_F(PrimOpTest, divFloatZero)
+{
+    ASSERT_THROW(eval("builtins.div 5.0 0.0"), EvalError);
+}
 
-    TEST_F(PrimOpTest, subFloat) {
-        auto v = eval("builtins.sub 5.0 2.0");
-        ASSERT_THAT(v, IsFloatEq(3.0));
-    }
+TEST_F(PrimOpTest, bitOr)
+{
+    auto v = eval("builtins.bitOr 1 2");
+    ASSERT_THAT(v, IsIntEq(3));
+}
 
-    TEST_F(PrimOpTest, subFloatFromInt) {
-        auto v = eval("builtins.sub 5.0 2");
-        ASSERT_THAT(v, IsFloatEq(3.0));
+TEST_F(PrimOpTest, bitXor)
+{
+    auto v = eval("builtins.bitXor 3 2");
+    ASSERT_THAT(v, IsIntEq(1));
+}
 
-        v = eval("builtins.sub 4 2.0");
-        ASSERT_THAT(v, IsFloatEq(2.0));
-    }
+TEST_F(PrimOpTest, lessThanFalse)
+{
+    auto v = eval("builtins.lessThan 3 1");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(PrimOpTest, mulInt) {
-        auto v = eval("builtins.mul 3 5");
-        ASSERT_THAT(v, IsIntEq(15));
-    }
+TEST_F(PrimOpTest, lessThanTrue)
+{
+    auto v = eval("builtins.lessThan 1 3");
+    ASSERT_THAT(v, IsTrue());
+}
 
-    TEST_F(PrimOpTest, mulFloat) {
-        auto v = eval("builtins.mul 3.0 5.0");
-        ASSERT_THAT(v, IsFloatEq(15.0));
-    }
+TEST_F(PrimOpTest, toStringAttrsThrows)
+{
+    ASSERT_THROW(eval("builtins.toString {}"), EvalError);
+}
 
-    TEST_F(PrimOpTest, mulFloatMixed) {
-        auto v = eval("builtins.mul 3 5.0");
-        ASSERT_THAT(v, IsFloatEq(15.0));
+TEST_F(PrimOpTest, toStringLambdaThrows)
+{
+    ASSERT_THROW(eval("builtins.toString (x: x)"), EvalError);
+}
 
-        v = eval("builtins.mul 2.0 5");
-        ASSERT_THAT(v, IsFloatEq(10.0));
-    }
+class ToStringPrimOpTest : public PrimOpTest,
+                           public testing::WithParamInterface<std::tuple<std::string, std::string_view>>
+{};
 
-    TEST_F(PrimOpTest, divInt) {
-        auto v = eval("builtins.div 5 (-1)");
-        ASSERT_THAT(v, IsIntEq(-5));
-    }
-
-    TEST_F(PrimOpTest, divIntZero) {
-        ASSERT_THROW(eval("builtins.div 5 0"), EvalError);
-    }
-
-    TEST_F(PrimOpTest, divFloat) {
-        auto v = eval("builtins.div 5.0 (-1)");
-        ASSERT_THAT(v, IsFloatEq(-5.0));
-    }
-
-    TEST_F(PrimOpTest, divFloatZero) {
-        ASSERT_THROW(eval("builtins.div 5.0 0.0"), EvalError);
-    }
-
-    TEST_F(PrimOpTest, bitOr) {
-        auto v = eval("builtins.bitOr 1 2");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
-
-    TEST_F(PrimOpTest, bitXor) {
-        auto v = eval("builtins.bitXor 3 2");
-        ASSERT_THAT(v, IsIntEq(1));
-    }
-
-    TEST_F(PrimOpTest, lessThanFalse) {
-        auto v = eval("builtins.lessThan 3 1");
-        ASSERT_THAT(v, IsFalse());
-    }
-
-    TEST_F(PrimOpTest, lessThanTrue) {
-        auto v = eval("builtins.lessThan 1 3");
-        ASSERT_THAT(v, IsTrue());
-    }
-
-    TEST_F(PrimOpTest, toStringAttrsThrows) {
-        ASSERT_THROW(eval("builtins.toString {}"), EvalError);
-    }
-
-    TEST_F(PrimOpTest, toStringLambdaThrows) {
-        ASSERT_THROW(eval("builtins.toString (x: x)"), EvalError);
-    }
-
-    class ToStringPrimOpTest :
-        public PrimOpTest,
-        public testing::WithParamInterface<std::tuple<std::string, std::string_view>>
-        {};
-
-    TEST_P(ToStringPrimOpTest, toString) {
-        const auto [input, output] = GetParam();
-        auto v = eval(input);
-        ASSERT_THAT(v, IsStringEq(output));
-    }
+TEST_P(ToStringPrimOpTest, toString)
+{
+    const auto [input, output] = GetParam();
+    auto v = eval(input);
+    ASSERT_THAT(v, IsStringEq(output));
+}
 
 #define CASE(input, output) (std::make_tuple(std::string_view("builtins.toString " input), std::string_view(output)))
-    INSTANTIATE_TEST_SUITE_P(
-            toString,
-            ToStringPrimOpTest,
-            testing::Values(
-                CASE(R"("foo")", "foo"),
-                CASE(R"(1)", "1"),
-                CASE(R"([1 2 3])", "1 2 3"),
-                CASE(R"(.123)", "0.123000"),
-                CASE(R"(true)", "1"),
-                CASE(R"(false)", ""),
-                CASE(R"(null)", ""),
-                CASE(R"({ v = "bar"; __toString = self: self.v; })", "bar"),
-                CASE(R"({ v = "bar"; __toString = self: self.v; outPath = "foo"; })", "bar"),
-                CASE(R"({ outPath = "foo"; })", "foo"),
-                CASE(R"(./test)", "/test")
-            )
-    );
+INSTANTIATE_TEST_SUITE_P(
+    toString,
+    ToStringPrimOpTest,
+    testing::Values(
+        CASE(R"("foo")", "foo"),
+        CASE(R"(1)", "1"),
+        CASE(R"([1 2 3])", "1 2 3"),
+        CASE(R"(.123)", "0.123000"),
+        CASE(R"(true)", "1"),
+        CASE(R"(false)", ""),
+        CASE(R"(null)", ""),
+        CASE(R"({ v = "bar"; __toString = self: self.v; })", "bar"),
+        CASE(R"({ v = "bar"; __toString = self: self.v; outPath = "foo"; })", "bar"),
+        CASE(R"({ outPath = "foo"; })", "foo"),
+        CASE(R"(./test)", "/test")));
 #undef CASE
 
-    TEST_F(PrimOpTest, substring){
-        auto v = eval("builtins.substring 0 3 \"nixos\"");
-        ASSERT_THAT(v, IsStringEq("nix"));
-    }
+TEST_F(PrimOpTest, substring)
+{
+    auto v = eval("builtins.substring 0 3 \"nixos\"");
+    ASSERT_THAT(v, IsStringEq("nix"));
+}
 
-    TEST_F(PrimOpTest, substringSmallerString){
-        auto v = eval("builtins.substring 0 3 \"n\"");
-        ASSERT_THAT(v, IsStringEq("n"));
-    }
+TEST_F(PrimOpTest, substringSmallerString)
+{
+    auto v = eval("builtins.substring 0 3 \"n\"");
+    ASSERT_THAT(v, IsStringEq("n"));
+}
 
-    TEST_F(PrimOpTest, substringHugeStart){
-        auto v = eval("builtins.substring 4294967296 5 \"nixos\"");
-        ASSERT_THAT(v, IsStringEq(""));
-    }
+TEST_F(PrimOpTest, substringHugeStart)
+{
+    auto v = eval("builtins.substring 4294967296 5 \"nixos\"");
+    ASSERT_THAT(v, IsStringEq(""));
+}
 
-    TEST_F(PrimOpTest, substringHugeLength){
-        auto v = eval("builtins.substring 0 4294967296 \"nixos\"");
-        ASSERT_THAT(v, IsStringEq("nixos"));
-    }
+TEST_F(PrimOpTest, substringHugeLength)
+{
+    auto v = eval("builtins.substring 0 4294967296 \"nixos\"");
+    ASSERT_THAT(v, IsStringEq("nixos"));
+}
 
-    TEST_F(PrimOpTest, substringEmptyString){
-        auto v = eval("builtins.substring 1 3 \"\"");
-        ASSERT_THAT(v, IsStringEq(""));
-    }
+TEST_F(PrimOpTest, substringEmptyString)
+{
+    auto v = eval("builtins.substring 1 3 \"\"");
+    ASSERT_THAT(v, IsStringEq(""));
+}
 
-    TEST_F(PrimOpTest, stringLength) {
-        auto v = eval("builtins.stringLength \"123\"");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
-    TEST_F(PrimOpTest, hashStringMd5) {
-        auto v = eval("builtins.hashString \"md5\" \"asdf\"");
-        ASSERT_THAT(v, IsStringEq("912ec803b2ce49e4a541068d495ab570"));
-    }
+TEST_F(PrimOpTest, stringLength)
+{
+    auto v = eval("builtins.stringLength \"123\"");
+    ASSERT_THAT(v, IsIntEq(3));
+}
 
-    TEST_F(PrimOpTest, hashStringSha1) {
-        auto v = eval("builtins.hashString \"sha1\" \"asdf\"");
-        ASSERT_THAT(v, IsStringEq("3da541559918a808c2402bba5012f6c60b27661c"));
-    }
+TEST_F(PrimOpTest, hashStringMd5)
+{
+    auto v = eval("builtins.hashString \"md5\" \"asdf\"");
+    ASSERT_THAT(v, IsStringEq("912ec803b2ce49e4a541068d495ab570"));
+}
 
-    TEST_F(PrimOpTest, hashStringSha256) {
-        auto v = eval("builtins.hashString \"sha256\" \"asdf\"");
-        ASSERT_THAT(v, IsStringEq("f0e4c2f76c58916ec258f246851bea091d14d4247a2fc3e18694461b1816e13b"));
-    }
+TEST_F(PrimOpTest, hashStringSha1)
+{
+    auto v = eval("builtins.hashString \"sha1\" \"asdf\"");
+    ASSERT_THAT(v, IsStringEq("3da541559918a808c2402bba5012f6c60b27661c"));
+}
 
-    TEST_F(PrimOpTest, hashStringSha512) {
-        auto v = eval("builtins.hashString \"sha512\" \"asdf\"");
-        ASSERT_THAT(v, IsStringEq("401b09eab3c013d4ca54922bb802bec8fd5318192b0a75f201d8b3727429080fb337591abd3e44453b954555b7a0812e1081c39b740293f765eae731f5a65ed1"));
-    }
+TEST_F(PrimOpTest, hashStringSha256)
+{
+    auto v = eval("builtins.hashString \"sha256\" \"asdf\"");
+    ASSERT_THAT(v, IsStringEq("f0e4c2f76c58916ec258f246851bea091d14d4247a2fc3e18694461b1816e13b"));
+}
 
-    TEST_F(PrimOpTest, hashStringInvalidHashAlgorithm) {
-        ASSERT_THROW(eval("builtins.hashString \"foobar\" \"asdf\""), Error);
-    }
+TEST_F(PrimOpTest, hashStringSha512)
+{
+    auto v = eval("builtins.hashString \"sha512\" \"asdf\"");
+    ASSERT_THAT(
+        v,
+        IsStringEq(
+            "401b09eab3c013d4ca54922bb802bec8fd5318192b0a75f201d8b3727429080fb337591abd3e44453b954555b7a0812e1081c39b740293f765eae731f5a65ed1"));
+}
 
-    TEST_F(PrimOpTest, nixPath) {
-        auto v = eval("builtins.nixPath");
-        ASSERT_EQ(v.type(), nList);
-        // We can't test much more as currently the EvalSettings are a global
-        // that we can't easily swap / replace
-    }
+TEST_F(PrimOpTest, hashStringInvalidHashAlgorithm)
+{
+    ASSERT_THROW(eval("builtins.hashString \"foobar\" \"asdf\""), Error);
+}
 
-    TEST_F(PrimOpTest, langVersion) {
-        auto v = eval("builtins.langVersion");
-        ASSERT_EQ(v.type(), nInt);
-    }
+TEST_F(PrimOpTest, nixPath)
+{
+    auto v = eval("builtins.nixPath");
+    ASSERT_EQ(v.type(), nList);
+    // We can't test much more as currently the EvalSettings are a global
+    // that we can't easily swap / replace
+}
 
-    TEST_F(PrimOpTest, storeDir) {
-        auto v = eval("builtins.storeDir");
-        ASSERT_THAT(v, IsStringEq(settings.nixStore));
-    }
+TEST_F(PrimOpTest, langVersion)
+{
+    auto v = eval("builtins.langVersion");
+    ASSERT_EQ(v.type(), nInt);
+}
 
-    TEST_F(PrimOpTest, nixVersion) {
-        auto v = eval("builtins.nixVersion");
-        ASSERT_THAT(v, IsStringEq(nixVersion));
-    }
+TEST_F(PrimOpTest, storeDir)
+{
+    auto v = eval("builtins.storeDir");
+    ASSERT_THAT(v, IsStringEq(settings.nixStore));
+}
 
-    TEST_F(PrimOpTest, currentSystem) {
-        auto v = eval("builtins.currentSystem");
-        ASSERT_THAT(v, IsStringEq(evalSettings.getCurrentSystem()));
-    }
+TEST_F(PrimOpTest, nixVersion)
+{
+    auto v = eval("builtins.nixVersion");
+    ASSERT_THAT(v, IsStringEq(nixVersion));
+}
 
-    TEST_F(PrimOpTest, derivation) {
-        auto v = eval("derivation");
-        ASSERT_EQ(v.type(), nFunction);
-        ASSERT_TRUE(v.isLambda());
-        ASSERT_NE(v.lambda().fun, nullptr);
-        ASSERT_TRUE(v.lambda().fun->hasFormals());
-    }
+TEST_F(PrimOpTest, currentSystem)
+{
+    auto v = eval("builtins.currentSystem");
+    ASSERT_THAT(v, IsStringEq(evalSettings.getCurrentSystem()));
+}
 
-    TEST_F(PrimOpTest, currentTime) {
-        auto v = eval("builtins.currentTime");
-        ASSERT_EQ(v.type(), nInt);
-        ASSERT_TRUE(v.integer() > 0);
-    }
+TEST_F(PrimOpTest, derivation)
+{
+    auto v = eval("derivation");
+    ASSERT_EQ(v.type(), nFunction);
+    ASSERT_TRUE(v.isLambda());
+    ASSERT_NE(v.lambda().fun, nullptr);
+    ASSERT_TRUE(v.lambda().fun->hasFormals());
+}
 
-    TEST_F(PrimOpTest, splitVersion) {
-        auto v = eval("builtins.splitVersion \"1.2.3git\"");
-        ASSERT_THAT(v, IsListOfSize(4));
+TEST_F(PrimOpTest, currentTime)
+{
+    auto v = eval("builtins.currentTime");
+    ASSERT_EQ(v.type(), nInt);
+    ASSERT_TRUE(v.integer() > 0);
+}
 
-        const std::vector<std::string_view> strings = { "1", "2", "3", "git" };
-        auto listView = v.listView();
-        for (const auto [n, p] : enumerate(listView))
-            ASSERT_THAT(*p, IsStringEq(strings[n]));
-    }
+TEST_F(PrimOpTest, splitVersion)
+{
+    auto v = eval("builtins.splitVersion \"1.2.3git\"");
+    ASSERT_THAT(v, IsListOfSize(4));
 
-    class CompareVersionsPrimOpTest :
-        public PrimOpTest,
-        public testing::WithParamInterface<std::tuple<std::string, const int>>
-        {};
+    const std::vector<std::string_view> strings = {"1", "2", "3", "git"};
+    auto listView = v.listView();
+    for (const auto [n, p] : enumerate(listView))
+        ASSERT_THAT(*p, IsStringEq(strings[n]));
+}
 
-    TEST_P(CompareVersionsPrimOpTest, compareVersions) {
-        auto [expression, expectation] = GetParam();
-        auto v = eval(expression);
-        ASSERT_THAT(v, IsIntEq(expectation));
-    }
+class CompareVersionsPrimOpTest : public PrimOpTest,
+                                  public testing::WithParamInterface<std::tuple<std::string, const int>>
+{};
+
+TEST_P(CompareVersionsPrimOpTest, compareVersions)
+{
+    auto [expression, expectation] = GetParam();
+    auto v = eval(expression);
+    ASSERT_THAT(v, IsIntEq(expectation));
+}
 
 #define CASE(a, b, expected) (std::make_tuple("builtins.compareVersions \"" #a "\" \"" #b "\"", expected))
-    INSTANTIATE_TEST_SUITE_P(
-            compareVersions,
-            CompareVersionsPrimOpTest,
-            testing::Values(
-                // The first two are weird cases. Intuition tells they should
-                // be the same but they aren't.
-                CASE(1.0, 1.0.0, -1),
-                CASE(1.0.0, 1.0, 1),
-                // the following are from the nix-env manual:
-                CASE(1.0, 2.3, -1),
-                CASE(2.1, 2.3, -1),
-                CASE(2.3, 2.3, 0),
-                CASE(2.5, 2.3, 1),
-                CASE(3.1, 2.3, 1),
-                CASE(2.3.1, 2.3, 1),
-                CASE(2.3.1, 2.3a, 1),
-                CASE(2.3pre1, 2.3, -1),
-                CASE(2.3pre3, 2.3pre12, -1),
-                CASE(2.3a, 2.3c, -1),
-                CASE(2.3pre1, 2.3c, -1),
-                CASE(2.3pre1, 2.3q, -1)
-            )
-    );
+INSTANTIATE_TEST_SUITE_P(
+    compareVersions,
+    CompareVersionsPrimOpTest,
+    testing::Values(
+        // The first two are weird cases. Intuition tells they should
+        // be the same but they aren't.
+        CASE(1.0, 1.0.0, -1),
+        CASE(1.0.0, 1.0, 1),
+        // the following are from the nix-env manual:
+        CASE(1.0, 2.3, -1),
+        CASE(2.1, 2.3, -1),
+        CASE(2.3, 2.3, 0),
+        CASE(2.5, 2.3, 1),
+        CASE(3.1, 2.3, 1),
+        CASE(2.3.1, 2.3, 1),
+        CASE(2.3.1, 2.3a, 1),
+        CASE(2.3pre1, 2.3, -1),
+        CASE(2.3pre3, 2.3pre12, -1),
+        CASE(2.3a, 2.3c, -1),
+        CASE(2.3pre1, 2.3c, -1),
+        CASE(2.3pre1, 2.3q, -1)));
 #undef CASE
 
-
-  class ParseDrvNamePrimOpTest :
-      public PrimOpTest,
+class ParseDrvNamePrimOpTest
+    : public PrimOpTest,
       public testing::WithParamInterface<std::tuple<std::string, std::string_view, std::string_view>>
-      {};
+{};
 
-    TEST_P(ParseDrvNamePrimOpTest, parseDrvName) {
-        auto [input, expectedName, expectedVersion] = GetParam();
-        const auto expr = fmt("builtins.parseDrvName \"%1%\"", input);
-        auto v = eval(expr);
-        ASSERT_THAT(v, IsAttrsOfSize(2));
+TEST_P(ParseDrvNamePrimOpTest, parseDrvName)
+{
+    auto [input, expectedName, expectedVersion] = GetParam();
+    const auto expr = fmt("builtins.parseDrvName \"%1%\"", input);
+    auto v = eval(expr);
+    ASSERT_THAT(v, IsAttrsOfSize(2));
 
-        auto name = v.attrs()->find(createSymbol("name"));
-        ASSERT_TRUE(name);
-        ASSERT_THAT(*name->value, IsStringEq(expectedName));
+    auto name = v.attrs()->get(createSymbol("name"));
+    ASSERT_TRUE(name);
+    ASSERT_THAT(*name->value, IsStringEq(expectedName));
 
-        auto version = v.attrs()->find(createSymbol("version"));
-        ASSERT_TRUE(version);
-        ASSERT_THAT(*version->value, IsStringEq(expectedVersion));
-    }
+    auto version = v.attrs()->get(createSymbol("version"));
+    ASSERT_TRUE(version);
+    ASSERT_THAT(*version->value, IsStringEq(expectedVersion));
+}
 
-    INSTANTIATE_TEST_SUITE_P(
-            parseDrvName,
-            ParseDrvNamePrimOpTest,
-            testing::Values(
-                std::make_tuple("nix-0.12pre12876", "nix", "0.12pre12876"),
-                std::make_tuple("a-b-c-1234pre5+git", "a-b-c", "1234pre5+git")
-            )
-    );
+INSTANTIATE_TEST_SUITE_P(
+    parseDrvName,
+    ParseDrvNamePrimOpTest,
+    testing::Values(
+        std::make_tuple("nix-0.12pre12876", "nix", "0.12pre12876"),
+        std::make_tuple("a-b-c-1234pre5+git", "a-b-c", "1234pre5+git")));
 
-    TEST_F(PrimOpTest, replaceStrings) {
-        // FIXME: add a test that verifies the string context is as expected
-        auto v = eval("builtins.replaceStrings [\"oo\" \"a\"] [\"a\" \"i\"] \"foobar\"");
-        ASSERT_EQ(v.type(), nString);
-        ASSERT_EQ(v.string_view(), "fabir");
-    }
+TEST_F(PrimOpTest, replaceStrings)
+{
+    // FIXME: add a test that verifies the string context is as expected
+    auto v = eval("builtins.replaceStrings [\"oo\" \"a\"] [\"a\" \"i\"] \"foobar\"");
+    ASSERT_EQ(v.type(), nString);
+    ASSERT_EQ(v.string_view(), "fabir");
+}
 
-    TEST_F(PrimOpTest, concatStringsSep) {
-        // FIXME: add a test that verifies the string context is as expected
-        auto v = eval("builtins.concatStringsSep \"%\" [\"foo\" \"bar\" \"baz\"]");
-        ASSERT_EQ(v.type(), nString);
-        ASSERT_EQ(v.string_view(), "foo%bar%baz");
-    }
+TEST_F(PrimOpTest, concatStringsSep)
+{
+    // FIXME: add a test that verifies the string context is as expected
+    auto v = eval("builtins.concatStringsSep \"%\" [\"foo\" \"bar\" \"baz\"]");
+    ASSERT_EQ(v.type(), nString);
+    ASSERT_EQ(v.string_view(), "foo%bar%baz");
+}
 
-    TEST_F(PrimOpTest, split1) {
-        // v = [ "" [ "a" ] "c" ]
-        auto v = eval("builtins.split \"(a)b\" \"abc\"");
-        ASSERT_THAT(v, IsListOfSize(3));
+TEST_F(PrimOpTest, split1)
+{
+    // v = [ "" [ "a" ] "c" ]
+    auto v = eval("builtins.split \"(a)b\" \"abc\"");
+    ASSERT_THAT(v, IsListOfSize(3));
 
-        ASSERT_THAT(*v.listView()[0], IsStringEq(""));
+    ASSERT_THAT(*v.listView()[0], IsStringEq(""));
 
-        ASSERT_THAT(*v.listView()[1], IsListOfSize(1));
-        ASSERT_THAT(*v.listView()[1]->listView()[0], IsStringEq("a"));
+    ASSERT_THAT(*v.listView()[1], IsListOfSize(1));
+    ASSERT_THAT(*v.listView()[1]->listView()[0], IsStringEq("a"));
 
-        ASSERT_THAT(*v.listView()[2], IsStringEq("c"));
-    }
+    ASSERT_THAT(*v.listView()[2], IsStringEq("c"));
+}
 
-    TEST_F(PrimOpTest, split2) {
-        // v is expected to be a list [ "" [ "a" ] "b" [ "c"] "" ]
-        auto v = eval("builtins.split \"([ac])\" \"abc\"");
-        ASSERT_THAT(v, IsListOfSize(5));
+TEST_F(PrimOpTest, split2)
+{
+    // v is expected to be a list [ "" [ "a" ] "b" [ "c"] "" ]
+    auto v = eval("builtins.split \"([ac])\" \"abc\"");
+    ASSERT_THAT(v, IsListOfSize(5));
 
-        ASSERT_THAT(*v.listView()[0], IsStringEq(""));
+    ASSERT_THAT(*v.listView()[0], IsStringEq(""));
 
-        ASSERT_THAT(*v.listView()[1], IsListOfSize(1));
-        ASSERT_THAT(*v.listView()[1]->listView()[0], IsStringEq("a"));
+    ASSERT_THAT(*v.listView()[1], IsListOfSize(1));
+    ASSERT_THAT(*v.listView()[1]->listView()[0], IsStringEq("a"));
 
-        ASSERT_THAT(*v.listView()[2], IsStringEq("b"));
+    ASSERT_THAT(*v.listView()[2], IsStringEq("b"));
 
-        ASSERT_THAT(*v.listView()[3], IsListOfSize(1));
-        ASSERT_THAT(*v.listView()[3]->listView()[0], IsStringEq("c"));
+    ASSERT_THAT(*v.listView()[3], IsListOfSize(1));
+    ASSERT_THAT(*v.listView()[3]->listView()[0], IsStringEq("c"));
 
-        ASSERT_THAT(*v.listView()[4], IsStringEq(""));
-    }
+    ASSERT_THAT(*v.listView()[4], IsStringEq(""));
+}
 
-    TEST_F(PrimOpTest, split3) {
-        auto v = eval("builtins.split \"(a)|(c)\" \"abc\"");
-        ASSERT_THAT(v, IsListOfSize(5));
+TEST_F(PrimOpTest, split3)
+{
+    auto v = eval("builtins.split \"(a)|(c)\" \"abc\"");
+    ASSERT_THAT(v, IsListOfSize(5));
 
-        // First list element
-        ASSERT_THAT(*v.listView()[0], IsStringEq(""));
+    // First list element
+    ASSERT_THAT(*v.listView()[0], IsStringEq(""));
 
-        // 2nd list element is a list [ "" null ]
-        ASSERT_THAT(*v.listView()[1], IsListOfSize(2));
-        ASSERT_THAT(*v.listView()[1]->listView()[0], IsStringEq("a"));
-        ASSERT_THAT(*v.listView()[1]->listView()[1], IsNull());
+    // 2nd list element is a list [ "" null ]
+    ASSERT_THAT(*v.listView()[1], IsListOfSize(2));
+    ASSERT_THAT(*v.listView()[1]->listView()[0], IsStringEq("a"));
+    ASSERT_THAT(*v.listView()[1]->listView()[1], IsNull());
 
-        // 3rd element
-        ASSERT_THAT(*v.listView()[2], IsStringEq("b"));
+    // 3rd element
+    ASSERT_THAT(*v.listView()[2], IsStringEq("b"));
 
-        // 4th element is a list: [ null "c" ]
-        ASSERT_THAT(*v.listView()[3], IsListOfSize(2));
-        ASSERT_THAT(*v.listView()[3]->listView()[0], IsNull());
-        ASSERT_THAT(*v.listView()[3]->listView()[1], IsStringEq("c"));
+    // 4th element is a list: [ null "c" ]
+    ASSERT_THAT(*v.listView()[3], IsListOfSize(2));
+    ASSERT_THAT(*v.listView()[3]->listView()[0], IsNull());
+    ASSERT_THAT(*v.listView()[3]->listView()[1], IsStringEq("c"));
 
-        // 5th element is the empty string
-        ASSERT_THAT(*v.listView()[4], IsStringEq(""));
-    }
+    // 5th element is the empty string
+    ASSERT_THAT(*v.listView()[4], IsStringEq(""));
+}
 
-    TEST_F(PrimOpTest, split4) {
-        auto v = eval("builtins.split \"([[:upper:]]+)\" \" FOO \"");
-        ASSERT_THAT(v, IsListOfSize(3));
-        auto first = v.listView()[0];
-        auto second = v.listView()[1];
-        auto third = v.listView()[2];
+TEST_F(PrimOpTest, split4)
+{
+    auto v = eval("builtins.split \"([[:upper:]]+)\" \" FOO \"");
+    ASSERT_THAT(v, IsListOfSize(3));
+    auto first = v.listView()[0];
+    auto second = v.listView()[1];
+    auto third = v.listView()[2];
 
-        ASSERT_THAT(*first, IsStringEq(" "));
+    ASSERT_THAT(*first, IsStringEq(" "));
 
-        ASSERT_THAT(*second, IsListOfSize(1));
-        ASSERT_THAT(*second->listView()[0], IsStringEq("FOO"));
+    ASSERT_THAT(*second, IsListOfSize(1));
+    ASSERT_THAT(*second->listView()[0], IsStringEq("FOO"));
 
-        ASSERT_THAT(*third, IsStringEq(" "));
-    }
+    ASSERT_THAT(*third, IsStringEq(" "));
+}
 
-    TEST_F(PrimOpTest, match1) {
-        auto v = eval("builtins.match \"ab\" \"abc\"");
-        ASSERT_THAT(v, IsNull());
-    }
+TEST_F(PrimOpTest, match1)
+{
+    auto v = eval("builtins.match \"ab\" \"abc\"");
+    ASSERT_THAT(v, IsNull());
+}
 
-    TEST_F(PrimOpTest, match2) {
-        auto v = eval("builtins.match \"abc\" \"abc\"");
-        ASSERT_THAT(v, IsListOfSize(0));
-    }
+TEST_F(PrimOpTest, match2)
+{
+    auto v = eval("builtins.match \"abc\" \"abc\"");
+    ASSERT_THAT(v, IsListOfSize(0));
+}
 
-    TEST_F(PrimOpTest, match3) {
-        auto v = eval("builtins.match \"a(b)(c)\" \"abc\"");
-        ASSERT_THAT(v, IsListOfSize(2));
-        ASSERT_THAT(*v.listView()[0], IsStringEq("b"));
-        ASSERT_THAT(*v.listView()[1], IsStringEq("c"));
-    }
+TEST_F(PrimOpTest, match3)
+{
+    auto v = eval("builtins.match \"a(b)(c)\" \"abc\"");
+    ASSERT_THAT(v, IsListOfSize(2));
+    ASSERT_THAT(*v.listView()[0], IsStringEq("b"));
+    ASSERT_THAT(*v.listView()[1], IsStringEq("c"));
+}
 
-    TEST_F(PrimOpTest, match4) {
-        auto v = eval("builtins.match \"[[:space:]]+([[:upper:]]+)[[:space:]]+\" \"  FOO   \"");
-        ASSERT_THAT(v, IsListOfSize(1));
-        ASSERT_THAT(*v.listView()[0], IsStringEq("FOO"));
-    }
+TEST_F(PrimOpTest, match4)
+{
+    auto v = eval("builtins.match \"[[:space:]]+([[:upper:]]+)[[:space:]]+\" \"  FOO   \"");
+    ASSERT_THAT(v, IsListOfSize(1));
+    ASSERT_THAT(*v.listView()[0], IsStringEq("FOO"));
+}
 
-    TEST_F(PrimOpTest, match5) {
-        // The regex "\\{}" is valid and matches the string "{}".
-        // Caused a regression before when trying to switch from std::regex to boost::regex.
-        // See https://github.com/NixOS/nix/pull/7762#issuecomment-1834303659
-        auto v = eval("builtins.match \"\\\\{}\" \"{}\"");
-        ASSERT_THAT(v, IsListOfSize(0));
-    }
+TEST_F(PrimOpTest, match5)
+{
+    // The regex "\\{}" is valid and matches the string "{}".
+    // Caused a regression before when trying to switch from std::regex to boost::regex.
+    // See https://github.com/NixOS/nix/pull/7762#issuecomment-1834303659
+    auto v = eval("builtins.match \"\\\\{}\" \"{}\"");
+    ASSERT_THAT(v, IsListOfSize(0));
+}
 
-    TEST_F(PrimOpTest, attrNames) {
-        auto v = eval("builtins.attrNames { x = 1; y = 2; z = 3; a = 2; }");
-        ASSERT_THAT(v, IsListOfSize(4));
+TEST_F(PrimOpTest, attrNames)
+{
+    auto v = eval("builtins.attrNames { x = 1; y = 2; z = 3; a = 2; }");
+    ASSERT_THAT(v, IsListOfSize(4));
 
-        // ensure that the list is sorted
-        const std::vector<std::string_view> expected { "a", "x", "y", "z" };
-        auto listView = v.listView();
-        for (const auto [n, elem] : enumerate(listView))
-            ASSERT_THAT(*elem, IsStringEq(expected[n]));
-    }
+    // ensure that the list is sorted
+    const std::vector<std::string_view> expected{"a", "x", "y", "z"};
+    auto listView = v.listView();
+    for (const auto [n, elem] : enumerate(listView))
+        ASSERT_THAT(*elem, IsStringEq(expected[n]));
+}
 
-    TEST_F(PrimOpTest, genericClosure_not_strict) {
-        // Operator should not be used when startSet is empty
-        auto v = eval("builtins.genericClosure { startSet = []; }");
-        ASSERT_THAT(v, IsListOfSize(0));
-    }
+TEST_F(PrimOpTest, genericClosure_not_strict)
+{
+    // Operator should not be used when startSet is empty
+    auto v = eval("builtins.genericClosure { startSet = []; }");
+    ASSERT_THAT(v, IsListOfSize(0));
+}
 } /* namespace nix */
diff --git a/src/libexpr-tests/search-path.cc b/src/libexpr-tests/search-path.cc
index 792bb0812..b48dcdaff 100644
--- a/src/libexpr-tests/search-path.cc
+++ b/src/libexpr-tests/search-path.cc
@@ -5,86 +5,98 @@
 
 namespace nix {
 
-TEST(LookupPathElem, parse_justPath) {
+TEST(LookupPathElem, parse_justPath)
+{
     ASSERT_EQ(
         LookupPath::Elem::parse("foo"),
-        (LookupPath::Elem {
-            .prefix = LookupPath::Prefix { .s = "" },
-            .path = LookupPath::Path { .s = "foo" },
+        (LookupPath::Elem{
+            .prefix = LookupPath::Prefix{.s = ""},
+            .path = LookupPath::Path{.s = "foo"},
         }));
 }
 
-TEST(LookupPathElem, parse_emptyPrefix) {
+TEST(LookupPathElem, parse_emptyPrefix)
+{
     ASSERT_EQ(
         LookupPath::Elem::parse("=foo"),
-        (LookupPath::Elem {
-            .prefix = LookupPath::Prefix { .s = "" },
-            .path = LookupPath::Path { .s = "foo" },
+        (LookupPath::Elem{
+            .prefix = LookupPath::Prefix{.s = ""},
+            .path = LookupPath::Path{.s = "foo"},
         }));
 }
 
-TEST(LookupPathElem, parse_oneEq) {
+TEST(LookupPathElem, parse_oneEq)
+{
     ASSERT_EQ(
         LookupPath::Elem::parse("foo=bar"),
-        (LookupPath::Elem {
-            .prefix = LookupPath::Prefix { .s = "foo" },
-            .path = LookupPath::Path { .s = "bar" },
+        (LookupPath::Elem{
+            .prefix = LookupPath::Prefix{.s = "foo"},
+            .path = LookupPath::Path{.s = "bar"},
         }));
 }
 
-TEST(LookupPathElem, parse_twoEqs) {
+TEST(LookupPathElem, parse_twoEqs)
+{
     ASSERT_EQ(
         LookupPath::Elem::parse("foo=bar=baz"),
-        (LookupPath::Elem {
-            .prefix = LookupPath::Prefix { .s = "foo" },
-            .path = LookupPath::Path { .s = "bar=baz" },
+        (LookupPath::Elem{
+            .prefix = LookupPath::Prefix{.s = "foo"},
+            .path = LookupPath::Path{.s = "bar=baz"},
         }));
 }
 
-
-TEST(LookupPathElem, suffixIfPotentialMatch_justPath) {
-    LookupPath::Prefix prefix { .s = "" };
-    ASSERT_EQ(prefix.suffixIfPotentialMatch("any/thing"), std::optional { "any/thing" });
+TEST(LookupPathElem, suffixIfPotentialMatch_justPath)
+{
+    LookupPath::Prefix prefix{.s = ""};
+    ASSERT_EQ(prefix.suffixIfPotentialMatch("any/thing"), std::optional{"any/thing"});
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_misleadingPrefix1) {
-    LookupPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_misleadingPrefix1)
+{
+    LookupPath::Prefix prefix{.s = "foo"};
     ASSERT_EQ(prefix.suffixIfPotentialMatch("fooX"), std::nullopt);
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_misleadingPrefix2) {
-    LookupPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_misleadingPrefix2)
+{
+    LookupPath::Prefix prefix{.s = "foo"};
     ASSERT_EQ(prefix.suffixIfPotentialMatch("fooX/bar"), std::nullopt);
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_partialPrefix) {
-    LookupPath::Prefix prefix { .s = "fooX" };
+TEST(LookupPathElem, suffixIfPotentialMatch_partialPrefix)
+{
+    LookupPath::Prefix prefix{.s = "fooX"};
     ASSERT_EQ(prefix.suffixIfPotentialMatch("foo"), std::nullopt);
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_exactPrefix) {
-    LookupPath::Prefix prefix { .s = "foo" };
-    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo"), std::optional { "" });
+TEST(LookupPathElem, suffixIfPotentialMatch_exactPrefix)
+{
+    LookupPath::Prefix prefix{.s = "foo"};
+    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo"), std::optional{""});
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_multiKey) {
-    LookupPath::Prefix prefix { .s = "foo/bar" };
-    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/bar/baz"), std::optional { "baz" });
+TEST(LookupPathElem, suffixIfPotentialMatch_multiKey)
+{
+    LookupPath::Prefix prefix{.s = "foo/bar"};
+    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/bar/baz"), std::optional{"baz"});
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_trailingSlash) {
-    LookupPath::Prefix prefix { .s = "foo" };
-    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/"), std::optional { "" });
+TEST(LookupPathElem, suffixIfPotentialMatch_trailingSlash)
+{
+    LookupPath::Prefix prefix{.s = "foo"};
+    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/"), std::optional{""});
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_trailingDoubleSlash) {
-    LookupPath::Prefix prefix { .s = "foo" };
-    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo//"), std::optional { "/" });
+TEST(LookupPathElem, suffixIfPotentialMatch_trailingDoubleSlash)
+{
+    LookupPath::Prefix prefix{.s = "foo"};
+    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo//"), std::optional{"/"});
 }
 
-TEST(LookupPathElem, suffixIfPotentialMatch_trailingPath) {
-    LookupPath::Prefix prefix { .s = "foo" };
-    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/bar/baz"), std::optional { "bar/baz" });
+TEST(LookupPathElem, suffixIfPotentialMatch_trailingPath)
+{
+    LookupPath::Prefix prefix{.s = "foo"};
+    ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/bar/baz"), std::optional{"bar/baz"});
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr-tests/trivial.cc b/src/libexpr-tests/trivial.cc
index 6eabad6d7..a287ce4d1 100644
--- a/src/libexpr-tests/trivial.cc
+++ b/src/libexpr-tests/trivial.cc
@@ -1,181 +1,202 @@
 #include "nix/expr/tests/libexpr.hh"
 
 namespace nix {
-    // Testing of trivial expressions
-    class TrivialExpressionTest : public LibExprTest {};
+// Testing of trivial expressions
+class TrivialExpressionTest : public LibExprTest
+{};
 
-    TEST_F(TrivialExpressionTest, true) {
-        auto v = eval("true");
-        ASSERT_THAT(v, IsTrue());
-    }
+TEST_F(TrivialExpressionTest, true)
+{
+    auto v = eval("true");
+    ASSERT_THAT(v, IsTrue());
+}
 
-    TEST_F(TrivialExpressionTest, false) {
-        auto v = eval("false");
-        ASSERT_THAT(v, IsFalse());
-    }
+TEST_F(TrivialExpressionTest, false)
+{
+    auto v = eval("false");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(TrivialExpressionTest, null) {
-        auto v = eval("null");
-        ASSERT_THAT(v, IsNull());
-    }
+TEST_F(TrivialExpressionTest, null)
+{
+    auto v = eval("null");
+    ASSERT_THAT(v, IsNull());
+}
 
-    TEST_F(TrivialExpressionTest, 1) {
-        auto v = eval("1");
-        ASSERT_THAT(v, IsIntEq(1));
-    }
+TEST_F(TrivialExpressionTest, 1)
+{
+    auto v = eval("1");
+    ASSERT_THAT(v, IsIntEq(1));
+}
 
-    TEST_F(TrivialExpressionTest, 1plus1) {
-        auto v = eval("1+1");
-        ASSERT_THAT(v, IsIntEq(2));
-    }
+TEST_F(TrivialExpressionTest, 1plus1)
+{
+    auto v = eval("1+1");
+    ASSERT_THAT(v, IsIntEq(2));
+}
 
-    TEST_F(TrivialExpressionTest, minus1) {
-        auto v = eval("-1");
-        ASSERT_THAT(v, IsIntEq(-1));
-    }
+TEST_F(TrivialExpressionTest, minus1)
+{
+    auto v = eval("-1");
+    ASSERT_THAT(v, IsIntEq(-1));
+}
 
-    TEST_F(TrivialExpressionTest, 1minus1) {
-        auto v = eval("1-1");
-        ASSERT_THAT(v, IsIntEq(0));
-    }
+TEST_F(TrivialExpressionTest, 1minus1)
+{
+    auto v = eval("1-1");
+    ASSERT_THAT(v, IsIntEq(0));
+}
 
-    TEST_F(TrivialExpressionTest, lambdaAdd) {
-        auto v = eval("let add = a: b: a + b; in add 1 2");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
+TEST_F(TrivialExpressionTest, lambdaAdd)
+{
+    auto v = eval("let add = a: b: a + b; in add 1 2");
+    ASSERT_THAT(v, IsIntEq(3));
+}
 
-    TEST_F(TrivialExpressionTest, list) {
-        auto v = eval("[]");
-        ASSERT_THAT(v, IsListOfSize(0));
-    }
+TEST_F(TrivialExpressionTest, list)
+{
+    auto v = eval("[]");
+    ASSERT_THAT(v, IsListOfSize(0));
+}
 
-    TEST_F(TrivialExpressionTest, attrs) {
-        auto v = eval("{}");
-        ASSERT_THAT(v, IsAttrsOfSize(0));
-    }
+TEST_F(TrivialExpressionTest, attrs)
+{
+    auto v = eval("{}");
+    ASSERT_THAT(v, IsAttrsOfSize(0));
+}
 
-    TEST_F(TrivialExpressionTest, float) {
-        auto v = eval("1.234");
-        ASSERT_THAT(v, IsFloatEq(1.234));
-    }
+TEST_F(TrivialExpressionTest, float)
+{
+    auto v = eval("1.234");
+    ASSERT_THAT(v, IsFloatEq(1.234));
+}
 
-    TEST_F(TrivialExpressionTest, updateAttrs) {
-        auto v = eval("{ a = 1; } // { b = 2; a = 3; }");
-        ASSERT_THAT(v, IsAttrsOfSize(2));
-        auto a = v.attrs()->find(createSymbol("a"));
-        ASSERT_NE(a, nullptr);
-        ASSERT_THAT(*a->value, IsIntEq(3));
+TEST_F(TrivialExpressionTest, updateAttrs)
+{
+    auto v = eval("{ a = 1; } // { b = 2; a = 3; }");
+    ASSERT_THAT(v, IsAttrsOfSize(2));
+    auto a = v.attrs()->get(createSymbol("a"));
+    ASSERT_NE(a, nullptr);
+    ASSERT_THAT(*a->value, IsIntEq(3));
 
-        auto b = v.attrs()->find(createSymbol("b"));
-        ASSERT_NE(b, nullptr);
-        ASSERT_THAT(*b->value, IsIntEq(2));
-    }
+    auto b = v.attrs()->get(createSymbol("b"));
+    ASSERT_NE(b, nullptr);
+    ASSERT_THAT(*b->value, IsIntEq(2));
+}
 
-    TEST_F(TrivialExpressionTest, hasAttrOpFalse) {
-        auto v = eval("{} ? a");
-        ASSERT_THAT(v, IsFalse());
-    }
+TEST_F(TrivialExpressionTest, hasAttrOpFalse)
+{
+    auto v = eval("{} ? a");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(TrivialExpressionTest, hasAttrOpTrue) {
-        auto v = eval("{ a = 123; } ? a");
-        ASSERT_THAT(v, IsTrue());
-    }
+TEST_F(TrivialExpressionTest, hasAttrOpTrue)
+{
+    auto v = eval("{ a = 123; } ? a");
+    ASSERT_THAT(v, IsTrue());
+}
 
-    TEST_F(TrivialExpressionTest, withFound) {
-        auto v = eval("with { a = 23; }; a");
-        ASSERT_THAT(v, IsIntEq(23));
-    }
+TEST_F(TrivialExpressionTest, withFound)
+{
+    auto v = eval("with { a = 23; }; a");
+    ASSERT_THAT(v, IsIntEq(23));
+}
 
-    TEST_F(TrivialExpressionTest, withNotFound) {
-        ASSERT_THROW(eval("with {}; a"), Error);
-    }
+TEST_F(TrivialExpressionTest, withNotFound)
+{
+    ASSERT_THROW(eval("with {}; a"), Error);
+}
 
-    TEST_F(TrivialExpressionTest, withOverride) {
-        auto v = eval("with { a = 23; }; with { a = 42; }; a");
-        ASSERT_THAT(v, IsIntEq(42));
-    }
+TEST_F(TrivialExpressionTest, withOverride)
+{
+    auto v = eval("with { a = 23; }; with { a = 42; }; a");
+    ASSERT_THAT(v, IsIntEq(42));
+}
 
-    TEST_F(TrivialExpressionTest, letOverWith) {
-        auto v = eval("let a = 23; in with { a = 1; }; a");
-        ASSERT_THAT(v, IsIntEq(23));
-    }
+TEST_F(TrivialExpressionTest, letOverWith)
+{
+    auto v = eval("let a = 23; in with { a = 1; }; a");
+    ASSERT_THAT(v, IsIntEq(23));
+}
 
-    TEST_F(TrivialExpressionTest, multipleLet) {
-        auto v = eval("let a = 23; in let a = 42; in a");
-        ASSERT_THAT(v, IsIntEq(42));
-    }
+TEST_F(TrivialExpressionTest, multipleLet)
+{
+    auto v = eval("let a = 23; in let a = 42; in a");
+    ASSERT_THAT(v, IsIntEq(42));
+}
 
-    TEST_F(TrivialExpressionTest, defaultFunctionArgs) {
-        auto v = eval("({ a ? 123 }: a) {}");
-        ASSERT_THAT(v, IsIntEq(123));
-    }
+TEST_F(TrivialExpressionTest, defaultFunctionArgs)
+{
+    auto v = eval("({ a ? 123 }: a) {}");
+    ASSERT_THAT(v, IsIntEq(123));
+}
 
-    TEST_F(TrivialExpressionTest, defaultFunctionArgsOverride) {
-        auto v = eval("({ a ? 123 }: a) { a = 5; }");
-        ASSERT_THAT(v, IsIntEq(5));
-    }
+TEST_F(TrivialExpressionTest, defaultFunctionArgsOverride)
+{
+    auto v = eval("({ a ? 123 }: a) { a = 5; }");
+    ASSERT_THAT(v, IsIntEq(5));
+}
 
-    TEST_F(TrivialExpressionTest, defaultFunctionArgsCaptureBack) {
-        auto v = eval("({ a ? 123 }@args: args) {}");
-        ASSERT_THAT(v, IsAttrsOfSize(0));
-    }
+TEST_F(TrivialExpressionTest, defaultFunctionArgsCaptureBack)
+{
+    auto v = eval("({ a ? 123 }@args: args) {}");
+    ASSERT_THAT(v, IsAttrsOfSize(0));
+}
 
-    TEST_F(TrivialExpressionTest, defaultFunctionArgsCaptureFront) {
-        auto v = eval("(args@{ a ? 123 }: args) {}");
-        ASSERT_THAT(v, IsAttrsOfSize(0));
-    }
+TEST_F(TrivialExpressionTest, defaultFunctionArgsCaptureFront)
+{
+    auto v = eval("(args@{ a ? 123 }: args) {}");
+    ASSERT_THAT(v, IsAttrsOfSize(0));
+}
 
-    TEST_F(TrivialExpressionTest, assertThrows) {
-        ASSERT_THROW(eval("let x = arg: assert arg == 1; 123; in x 2"), Error);
-    }
+TEST_F(TrivialExpressionTest, assertThrows)
+{
+    ASSERT_THROW(eval("let x = arg: assert arg == 1; 123; in x 2"), Error);
+}
 
-    TEST_F(TrivialExpressionTest, assertPassed) {
-        auto v = eval("let x = arg: assert arg == 1; 123; in x 1");
-        ASSERT_THAT(v, IsIntEq(123));
-    }
+TEST_F(TrivialExpressionTest, assertPassed)
+{
+    auto v = eval("let x = arg: assert arg == 1; 123; in x 1");
+    ASSERT_THAT(v, IsIntEq(123));
+}
 
-    class AttrSetMergeTrvialExpressionTest :
-        public TrivialExpressionTest,
-        public testing::WithParamInterface<const char*>
-        {};
+class AttrSetMergeTrvialExpressionTest : public TrivialExpressionTest, public testing::WithParamInterface<const char *>
+{};
 
-    TEST_P(AttrSetMergeTrvialExpressionTest, attrsetMergeLazy) {
-        // Usually Nix rejects duplicate keys in an attrset but it does allow
-        // so if it is an attribute set that contains disjoint sets of keys.
-        // The below is equivalent to `{a.b = 1; a.c = 2; }`.
-        // The attribute set `a` will be a Thunk at first as the attributes
-        // have to be merged (or otherwise computed) and that is done in a lazy
-        // manner.
+TEST_P(AttrSetMergeTrvialExpressionTest, attrsetMergeLazy)
+{
+    // Usually Nix rejects duplicate keys in an attrset but it does allow
+    // so if it is an attribute set that contains disjoint sets of keys.
+    // The below is equivalent to `{a.b = 1; a.c = 2; }`.
+    // The attribute set `a` will be a Thunk at first as the attributes
+    // have to be merged (or otherwise computed) and that is done in a lazy
+    // manner.
 
-        auto expr = GetParam();
-        auto v = eval(expr);
-        ASSERT_THAT(v, IsAttrsOfSize(1));
+    auto expr = GetParam();
+    auto v = eval(expr);
+    ASSERT_THAT(v, IsAttrsOfSize(1));
 
-        auto a = v.attrs()->find(createSymbol("a"));
-        ASSERT_NE(a, nullptr);
+    auto a = v.attrs()->get(createSymbol("a"));
+    ASSERT_NE(a, nullptr);
 
-        ASSERT_THAT(*a->value, IsThunk());
-        state.forceValue(*a->value, noPos);
+    ASSERT_THAT(*a->value, IsThunk());
+    state.forceValue(*a->value, noPos);
 
-        ASSERT_THAT(*a->value, IsAttrsOfSize(2));
+    ASSERT_THAT(*a->value, IsAttrsOfSize(2));
 
-        auto b = a->value->attrs()->find(createSymbol("b"));
-        ASSERT_NE(b, nullptr);
-        ASSERT_THAT(*b->value, IsIntEq(1));
+    auto b = a->value->attrs()->get(createSymbol("b"));
+    ASSERT_NE(b, nullptr);
+    ASSERT_THAT(*b->value, IsIntEq(1));
 
-        auto c = a->value->attrs()->find(createSymbol("c"));
-        ASSERT_NE(c, nullptr);
-        ASSERT_THAT(*c->value, IsIntEq(2));
-    }
+    auto c = a->value->attrs()->get(createSymbol("c"));
+    ASSERT_NE(c, nullptr);
+    ASSERT_THAT(*c->value, IsIntEq(2));
+}
 
-    INSTANTIATE_TEST_SUITE_P(
-            attrsetMergeLazy,
-            AttrSetMergeTrvialExpressionTest,
-            testing::Values(
-                "{ a.b = 1; a.c = 2; }",
-                "{ a = { b = 1; }; a = { c = 2; }; }"
-            )
-    );
+INSTANTIATE_TEST_SUITE_P(
+    attrsetMergeLazy,
+    AttrSetMergeTrvialExpressionTest,
+    testing::Values("{ a.b = 1; a.c = 2; }", "{ a = { b = 1; }; a = { c = 2; }; }"));
 
 // The following macros ultimately define 48 tests (16 variations on three
 // templates). Each template tests an expression that can be written in 2^4
@@ -199,28 +220,34 @@ namespace nix {
 // expanded.
 #define X_EXPAND_IF0(k, v) k "." v
 #define X_EXPAND_IF1(k, v) k " = { " v " };"
-#define X4(w, x, y, z) \
-    TEST_F(TrivialExpressionTest, nestedAttrsetMerge##w##x##y##z) { \
-        auto v = eval("{ a.b = { c = 1; d = 2; }; } == { " \
-                X_EXPAND_IF##w("a", X_EXPAND_IF##x("b", "c = 1;")) " " \
-                X_EXPAND_IF##y("a", X_EXPAND_IF##z("b", "d = 2;")) " }"); \
-        ASSERT_THAT(v, IsTrue()); \
-    }; \
-    TEST_F(TrivialExpressionTest, nestedAttrsetMergeDup##w##x##y##z) { \
-        ASSERT_THROW(eval("{ " \
-                X_EXPAND_IF##w("a", X_EXPAND_IF##x("b", "c = 1;")) " " \
-                X_EXPAND_IF##y("a", X_EXPAND_IF##z("b", "c = 2;")) " }"), Error); \
-    }; \
-    TEST_F(TrivialExpressionTest, nestedAttrsetMergeLet##w##x##y##z) { \
-        auto v = eval("{ b = { c = 1; d = 2; }; } == (let " \
-                X_EXPAND_IF##w("a", X_EXPAND_IF##x("b", "c = 1;")) " " \
-                X_EXPAND_IF##y("a", X_EXPAND_IF##z("b", "d = 2;")) " in a)"); \
-        ASSERT_THAT(v, IsTrue()); \
+#define X4(w, x, y, z)                                                                                                \
+    TEST_F(TrivialExpressionTest, nestedAttrsetMerge##w##x##y##z)                                                     \
+    {                                                                                                                 \
+        auto v = eval(                                                                                                \
+            "{ a.b = { c = 1; d = 2; }; } == { " X_EXPAND_IF##w(                                                      \
+                "a", X_EXPAND_IF##x("b", "c = 1;")) " " X_EXPAND_IF##y("a", X_EXPAND_IF##z("b", "d = 2;")) " }");     \
+        ASSERT_THAT(v, IsTrue());                                                                                     \
+    };                                                                                                                \
+    TEST_F(TrivialExpressionTest, nestedAttrsetMergeDup##w##x##y##z)                                                  \
+    {                                                                                                                 \
+        ASSERT_THROW(                                                                                                 \
+            eval(                                                                                                     \
+                "{ " X_EXPAND_IF##w("a", X_EXPAND_IF##x("b", "c = 1;")) " " X_EXPAND_IF##y(                           \
+                    "a", X_EXPAND_IF##z("b", "c = 2;")) " }"),                                                        \
+            Error);                                                                                                   \
+    };                                                                                                                \
+    TEST_F(TrivialExpressionTest, nestedAttrsetMergeLet##w##x##y##z)                                                  \
+    {                                                                                                                 \
+        auto v = eval(                                                                                                \
+            "{ b = { c = 1; d = 2; }; } == (let " X_EXPAND_IF##w(                                                     \
+                "a", X_EXPAND_IF##x("b", "c = 1;")) " " X_EXPAND_IF##y("a", X_EXPAND_IF##z("b", "d = 2;")) " in a)"); \
+        ASSERT_THAT(v, IsTrue());                                                                                     \
     };
 #define X3(...) X4(__VA_ARGS__, 0) X4(__VA_ARGS__, 1)
 #define X2(...) X3(__VA_ARGS__, 0) X3(__VA_ARGS__, 1)
 #define X1(...) X2(__VA_ARGS__, 0) X2(__VA_ARGS__, 1)
-    X1(0) X1(1)
+X1(0)
+X1(1)
 #undef X_EXPAND_IF0
 #undef X_EXPAND_IF1
 #undef X1
@@ -228,74 +255,88 @@ namespace nix {
 #undef X3
 #undef X4
 
-    TEST_F(TrivialExpressionTest, functor) {
-        auto v = eval("{ __functor = self: arg: self.v + arg; v = 10; } 5");
-        ASSERT_THAT(v, IsIntEq(15));
-    }
+TEST_F(TrivialExpressionTest, functor)
+{
+    auto v = eval("{ __functor = self: arg: self.v + arg; v = 10; } 5");
+    ASSERT_THAT(v, IsIntEq(15));
+}
 
-    TEST_F(TrivialExpressionTest, forwardPipe) {
-        auto v = eval("1 |> builtins.add 2 |> builtins.mul 3");
-        ASSERT_THAT(v, IsIntEq(9));
-    }
+TEST_F(TrivialExpressionTest, forwardPipe)
+{
+    auto v = eval("1 |> builtins.add 2 |> builtins.mul 3");
+    ASSERT_THAT(v, IsIntEq(9));
+}
 
-    TEST_F(TrivialExpressionTest, backwardPipe) {
-        auto v = eval("builtins.add 1 <| builtins.mul 2 <| 3");
-        ASSERT_THAT(v, IsIntEq(7));
-    }
+TEST_F(TrivialExpressionTest, backwardPipe)
+{
+    auto v = eval("builtins.add 1 <| builtins.mul 2 <| 3");
+    ASSERT_THAT(v, IsIntEq(7));
+}
 
-    TEST_F(TrivialExpressionTest, forwardPipeEvaluationOrder) {
-        auto v = eval("1 |> null |> (x: 2)");
-        ASSERT_THAT(v, IsIntEq(2));
-    }
+TEST_F(TrivialExpressionTest, forwardPipeEvaluationOrder)
+{
+    auto v = eval("1 |> null |> (x: 2)");
+    ASSERT_THAT(v, IsIntEq(2));
+}
 
-    TEST_F(TrivialExpressionTest, backwardPipeEvaluationOrder) {
-        auto v = eval("(x: 1) <| null <| 2");
-        ASSERT_THAT(v, IsIntEq(1));
-    }
+TEST_F(TrivialExpressionTest, backwardPipeEvaluationOrder)
+{
+    auto v = eval("(x: 1) <| null <| 2");
+    ASSERT_THAT(v, IsIntEq(1));
+}
 
-    TEST_F(TrivialExpressionTest, differentPipeOperatorsDoNotAssociate) {
-        ASSERT_THROW(eval("(x: 1) <| 2 |> (x: 3)"), ParseError);
-    }
+TEST_F(TrivialExpressionTest, differentPipeOperatorsDoNotAssociate)
+{
+    ASSERT_THROW(eval("(x: 1) <| 2 |> (x: 3)"), ParseError);
+}
 
-    TEST_F(TrivialExpressionTest, differentPipeOperatorsParensLeft) {
-        auto v = eval("((x: 1) <| 2) |> (x: 3)");
-        ASSERT_THAT(v, IsIntEq(3));
-    }
+TEST_F(TrivialExpressionTest, differentPipeOperatorsParensLeft)
+{
+    auto v = eval("((x: 1) <| 2) |> (x: 3)");
+    ASSERT_THAT(v, IsIntEq(3));
+}
 
-    TEST_F(TrivialExpressionTest, differentPipeOperatorsParensRight) {
-        auto v = eval("(x: 1) <| (2 |> (x: 3))");
-        ASSERT_THAT(v, IsIntEq(1));
-    }
+TEST_F(TrivialExpressionTest, differentPipeOperatorsParensRight)
+{
+    auto v = eval("(x: 1) <| (2 |> (x: 3))");
+    ASSERT_THAT(v, IsIntEq(1));
+}
 
-    TEST_F(TrivialExpressionTest, forwardPipeLowestPrecedence) {
-        auto v = eval("false -> true |> (x: !x)");
-        ASSERT_THAT(v, IsFalse());
-    }
+TEST_F(TrivialExpressionTest, forwardPipeLowestPrecedence)
+{
+    auto v = eval("false -> true |> (x: !x)");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(TrivialExpressionTest, backwardPipeLowestPrecedence) {
-        auto v = eval("(x: !x) <| false -> true");
-        ASSERT_THAT(v, IsFalse());
-    }
+TEST_F(TrivialExpressionTest, backwardPipeLowestPrecedence)
+{
+    auto v = eval("(x: !x) <| false -> true");
+    ASSERT_THAT(v, IsFalse());
+}
 
-    TEST_F(TrivialExpressionTest, forwardPipeStrongerThanElse) {
-        auto v = eval("if true then 1 else 2 |> 3");
-        ASSERT_THAT(v, IsIntEq(1));
-    }
+TEST_F(TrivialExpressionTest, forwardPipeStrongerThanElse)
+{
+    auto v = eval("if true then 1 else 2 |> 3");
+    ASSERT_THAT(v, IsIntEq(1));
+}
 
-    TEST_F(TrivialExpressionTest, backwardPipeStrongerThanElse) {
-        auto v = eval("if true then 1 else 2 <| 3");
-        ASSERT_THAT(v, IsIntEq(1));
-    }
+TEST_F(TrivialExpressionTest, backwardPipeStrongerThanElse)
+{
+    auto v = eval("if true then 1 else 2 <| 3");
+    ASSERT_THAT(v, IsIntEq(1));
+}
 
-    TEST_F(TrivialExpressionTest, bindOr) {
-        auto v = eval("{ or = 1; }");
-        ASSERT_THAT(v, IsAttrsOfSize(1));
-        auto b = v.attrs()->find(createSymbol("or"));
-        ASSERT_NE(b, nullptr);
-        ASSERT_THAT(*b->value, IsIntEq(1));
-    }
+TEST_F(TrivialExpressionTest, bindOr)
+{
+    auto v = eval("{ or = 1; }");
+    ASSERT_THAT(v, IsAttrsOfSize(1));
+    auto b = v.attrs()->get(createSymbol("or"));
+    ASSERT_NE(b, nullptr);
+    ASSERT_THAT(*b->value, IsIntEq(1));
+}
 
-    TEST_F(TrivialExpressionTest, orCantBeUsed) {
-        ASSERT_THROW(eval("let or = 1; in or"), Error);
-    }
+TEST_F(TrivialExpressionTest, orCantBeUsed)
+{
+    ASSERT_THROW(eval("let or = 1; in or"), Error);
+}
 } /* namespace nix */
diff --git a/src/libexpr-tests/value/context.cc b/src/libexpr-tests/value/context.cc
index 97cd50f75..fe3072b64 100644
--- a/src/libexpr-tests/value/context.cc
+++ b/src/libexpr-tests/value/context.cc
@@ -10,46 +10,42 @@ namespace nix {
 
 // Test a few cases of invalid string context elements.
 
-TEST(NixStringContextElemTest, empty_invalid) {
-    EXPECT_THROW(
-        NixStringContextElem::parse(""),
-        BadNixStringContextElem);
+TEST(NixStringContextElemTest, empty_invalid)
+{
+    EXPECT_THROW(NixStringContextElem::parse(""), BadNixStringContextElem);
 }
 
-TEST(NixStringContextElemTest, single_bang_invalid) {
-    EXPECT_THROW(
-        NixStringContextElem::parse("!"),
-        BadNixStringContextElem);
+TEST(NixStringContextElemTest, single_bang_invalid)
+{
+    EXPECT_THROW(NixStringContextElem::parse("!"), BadNixStringContextElem);
 }
 
-TEST(NixStringContextElemTest, double_bang_invalid) {
-    EXPECT_THROW(
-        NixStringContextElem::parse("!!/"),
-        BadStorePath);
+TEST(NixStringContextElemTest, double_bang_invalid)
+{
+    EXPECT_THROW(NixStringContextElem::parse("!!/"), BadStorePath);
 }
 
-TEST(NixStringContextElemTest, eq_slash_invalid) {
-    EXPECT_THROW(
-        NixStringContextElem::parse("=/"),
-        BadStorePath);
+TEST(NixStringContextElemTest, eq_slash_invalid)
+{
+    EXPECT_THROW(NixStringContextElem::parse("=/"), BadStorePath);
 }
 
-TEST(NixStringContextElemTest, slash_invalid) {
-    EXPECT_THROW(
-        NixStringContextElem::parse("/"),
-        BadStorePath);
+TEST(NixStringContextElemTest, slash_invalid)
+{
+    EXPECT_THROW(NixStringContextElem::parse("/"), BadStorePath);
 }
 
 /**
  * Round trip (string <-> data structure) test for
  * `NixStringContextElem::Opaque`.
  */
-TEST(NixStringContextElemTest, opaque) {
+TEST(NixStringContextElemTest, opaque)
+{
     std::string_view opaque = "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x";
     auto elem = NixStringContextElem::parse(opaque);
     auto * p = std::get_if<NixStringContextElem::Opaque>(&elem.raw);
     ASSERT_TRUE(p);
-    ASSERT_EQ(p->path, StorePath { opaque });
+    ASSERT_EQ(p->path, StorePath{opaque});
     ASSERT_EQ(elem.to_string(), opaque);
 }
 
@@ -57,12 +53,13 @@ TEST(NixStringContextElemTest, opaque) {
  * Round trip (string <-> data structure) test for
  * `NixStringContextElem::DrvDeep`.
  */
-TEST(NixStringContextElemTest, drvDeep) {
+TEST(NixStringContextElemTest, drvDeep)
+{
     std::string_view drvDeep = "=g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x.drv";
     auto elem = NixStringContextElem::parse(drvDeep);
     auto * p = std::get_if<NixStringContextElem::DrvDeep>(&elem.raw);
     ASSERT_TRUE(p);
-    ASSERT_EQ(p->drvPath, StorePath { drvDeep.substr(1) });
+    ASSERT_EQ(p->drvPath, StorePath{drvDeep.substr(1)});
     ASSERT_EQ(elem.to_string(), drvDeep);
 }
 
@@ -70,15 +67,18 @@ TEST(NixStringContextElemTest, drvDeep) {
  * Round trip (string <-> data structure) test for a simpler
  * `NixStringContextElem::Built`.
  */
-TEST(NixStringContextElemTest, built_opaque) {
+TEST(NixStringContextElemTest, built_opaque)
+{
     std::string_view built = "!foo!g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x.drv";
     auto elem = NixStringContextElem::parse(built);
     auto * p = std::get_if<NixStringContextElem::Built>(&elem.raw);
     ASSERT_TRUE(p);
     ASSERT_EQ(p->output, "foo");
-    ASSERT_EQ(*p->drvPath, ((SingleDerivedPath) SingleDerivedPath::Opaque {
-        .path = StorePath { built.substr(5) },
-    }));
+    ASSERT_EQ(
+        *p->drvPath,
+        ((SingleDerivedPath) SingleDerivedPath::Opaque{
+            .path = StorePath{built.substr(5)},
+        }));
     ASSERT_EQ(elem.to_string(), built);
 }
 
@@ -86,7 +86,8 @@ TEST(NixStringContextElemTest, built_opaque) {
  * Round trip (string <-> data structure) test for a more complex,
  * inductive `NixStringContextElem::Built`.
  */
-TEST(NixStringContextElemTest, built_built) {
+TEST(NixStringContextElemTest, built_built)
+{
     /**
      * We set these in tests rather than the regular globals so we don't have
      * to worry about race conditions if the tests run concurrently.
@@ -102,9 +103,11 @@ TEST(NixStringContextElemTest, built_built) {
     auto * drvPath = std::get_if<SingleDerivedPath::Built>(&*p->drvPath);
     ASSERT_TRUE(drvPath);
     ASSERT_EQ(drvPath->output, "bar");
-    ASSERT_EQ(*drvPath->drvPath, ((SingleDerivedPath) SingleDerivedPath::Opaque {
-        .path = StorePath { built.substr(9) },
-    }));
+    ASSERT_EQ(
+        *drvPath->drvPath,
+        ((SingleDerivedPath) SingleDerivedPath::Opaque{
+            .path = StorePath{built.substr(9)},
+        }));
     ASSERT_EQ(elem.to_string(), built);
 }
 
@@ -112,17 +115,15 @@ TEST(NixStringContextElemTest, built_built) {
  * Without the right experimental features enabled, we cannot parse a
  * complex inductive string context element.
  */
-TEST(NixStringContextElemTest, built_built_xp) {
+TEST(NixStringContextElemTest, built_built_xp)
+{
     ASSERT_THROW(
-        NixStringContextElem::parse("!foo!bar!g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x.drv"),        MissingExperimentalFeature);
+        NixStringContextElem::parse("!foo!bar!g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x.drv"), MissingExperimentalFeature);
 }
 
 #ifndef COVERAGE
 
-RC_GTEST_PROP(
-    NixStringContextElemTest,
-    prop_round_rip,
-    (const NixStringContextElem & o))
+RC_GTEST_PROP(NixStringContextElemTest, prop_round_rip, (const NixStringContextElem & o))
 {
     ExperimentalFeatureSettings xpSettings;
     xpSettings.set("experimental-features", "dynamic-derivations");
@@ -131,4 +132,4 @@ RC_GTEST_PROP(
 
 #endif
 
-}
+} // namespace nix
diff --git a/src/libexpr-tests/value/print.cc b/src/libexpr-tests/value/print.cc
index d337a29a3..1959fddf2 100644
--- a/src/libexpr-tests/value/print.cc
+++ b/src/libexpr-tests/value/print.cc
@@ -35,14 +35,14 @@ TEST_F(ValuePrintingTests, tBool)
 TEST_F(ValuePrintingTests, tString)
 {
     Value vString;
-    vString.mkString("some-string");
+    vString.mkStringNoCopy("some-string");
     test(vString, "\"some-string\"");
 }
 
 TEST_F(ValuePrintingTests, tPath)
 {
     Value vPath;
-    vPath.mkString("/foo");
+    vPath.mkStringNoCopy("/foo");
     test(vPath, "\"/foo\"");
 }
 
@@ -61,7 +61,7 @@ TEST_F(ValuePrintingTests, tAttrs)
     Value vTwo;
     vTwo.mkInt(2);
 
-    BindingsBuilder builder(state, state.allocBindings(10));
+    BindingsBuilder builder = state.buildBindings(10);
     builder.insert(state.symbols.create("one"), &vOne);
     builder.insert(state.symbols.create("two"), &vTwo);
 
@@ -106,14 +106,11 @@ TEST_F(ValuePrintingTests, vApp)
 
 TEST_F(ValuePrintingTests, vLambda)
 {
-    Env env {
-        .up = nullptr,
-        .values = { }
-    };
+    Env env{.up = nullptr, .values = {}};
     PosTable::Origin origin = state.positions.addOrigin(std::monostate(), 1);
     auto posIdx = state.positions.add(origin, 0);
     auto body = ExprInt(0);
-    auto formals = Formals {};
+    auto formals = Formals{};
 
     ExprLambda eLambda(posIdx, createSymbol("a"), &formals, &body);
 
@@ -130,9 +127,7 @@ TEST_F(ValuePrintingTests, vLambda)
 TEST_F(ValuePrintingTests, vPrimOp)
 {
     Value vPrimOp;
-    PrimOp primOp{
-        .name = "puppy"
-    };
+    PrimOp primOp{.name = "puppy"};
     vPrimOp.mkPrimOp(&primOp);
 
     test(vPrimOp, "«primop puppy»");
@@ -140,9 +135,7 @@ TEST_F(ValuePrintingTests, vPrimOp)
 
 TEST_F(ValuePrintingTests, vPrimOpApp)
 {
-    PrimOp primOp{
-        .name = "puppy"
-    };
+    PrimOp primOp{.name = "puppy"};
     Value vPrimOp;
     vPrimOp.mkPrimOp(&primOp);
 
@@ -161,16 +154,19 @@ TEST_F(ValuePrintingTests, vExternal)
         {
             return "";
         }
+
         std::string typeOf() const override
         {
             return "";
         }
+
         virtual std::ostream & print(std::ostream & str) const override
         {
             str << "testing-external!";
             return str;
         }
     } myExternal;
+
     Value vExternal;
     vExternal.mkExternal(&myExternal);
 
@@ -200,11 +196,11 @@ TEST_F(ValuePrintingTests, depthAttrs)
     Value vTwo;
     vTwo.mkInt(2);
 
-    BindingsBuilder builderEmpty(state, state.allocBindings(0));
+    BindingsBuilder builderEmpty = state.buildBindings(0);
     Value vAttrsEmpty;
     vAttrsEmpty.mkAttrs(builderEmpty.finish());
 
-    BindingsBuilder builder(state, state.allocBindings(10));
+    BindingsBuilder builder = state.buildBindings(10);
     builder.insert(state.symbols.create("one"), &vOne);
     builder.insert(state.symbols.create("two"), &vTwo);
     builder.insert(state.symbols.create("nested"), &vAttrsEmpty);
@@ -212,7 +208,7 @@ TEST_F(ValuePrintingTests, depthAttrs)
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    BindingsBuilder builder2(state, state.allocBindings(10));
+    BindingsBuilder builder2 = state.buildBindings(10);
     builder2.insert(state.symbols.create("one"), &vOne);
     builder2.insert(state.symbols.create("two"), &vTwo);
     builder2.insert(state.symbols.create("nested"), &vAttrs);
@@ -220,10 +216,13 @@ TEST_F(ValuePrintingTests, depthAttrs)
     Value vNested;
     vNested.mkAttrs(builder2.finish());
 
-    test(vNested, "{ nested = { ... }; one = 1; two = 2; }", PrintOptions { .maxDepth = 1 });
-    test(vNested, "{ nested = { nested = { ... }; one = 1; two = 2; }; one = 1; two = 2; }", PrintOptions { .maxDepth = 2 });
-    test(vNested, "{ nested = { nested = { }; one = 1; two = 2; }; one = 1; two = 2; }", PrintOptions { .maxDepth = 3 });
-    test(vNested, "{ nested = { nested = { }; one = 1; two = 2; }; one = 1; two = 2; }", PrintOptions { .maxDepth = 4 });
+    test(vNested, "{ nested = { ... }; one = 1; two = 2; }", PrintOptions{.maxDepth = 1});
+    test(
+        vNested,
+        "{ nested = { nested = { ... }; one = 1; two = 2; }; one = 1; two = 2; }",
+        PrintOptions{.maxDepth = 2});
+    test(vNested, "{ nested = { nested = { }; one = 1; two = 2; }; one = 1; two = 2; }", PrintOptions{.maxDepth = 3});
+    test(vNested, "{ nested = { nested = { }; one = 1; two = 2; }; one = 1; two = 2; }", PrintOptions{.maxDepth = 4});
 }
 
 TEST_F(ValuePrintingTests, depthList)
@@ -234,14 +233,14 @@ TEST_F(ValuePrintingTests, depthList)
     Value vTwo;
     vTwo.mkInt(2);
 
-    BindingsBuilder builder(state, state.allocBindings(10));
+    BindingsBuilder builder = state.buildBindings(10);
     builder.insert(state.symbols.create("one"), &vOne);
     builder.insert(state.symbols.create("two"), &vTwo);
 
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    BindingsBuilder builder2(state, state.allocBindings(10));
+    BindingsBuilder builder2 = state.buildBindings(10);
     builder2.insert(state.symbols.create("one"), &vOne);
     builder2.insert(state.symbols.create("two"), &vTwo);
     builder2.insert(state.symbols.create("nested"), &vAttrs);
@@ -256,11 +255,11 @@ TEST_F(ValuePrintingTests, depthList)
     Value vList;
     vList.mkList(list);
 
-    test(vList, "[ 1 2 { ... } ]", PrintOptions { .maxDepth = 1 });
-    test(vList, "[ 1 2 { nested = { ... }; one = 1; two = 2; } ]", PrintOptions { .maxDepth = 2 });
-    test(vList, "[ 1 2 { nested = { one = 1; two = 2; }; one = 1; two = 2; } ]", PrintOptions { .maxDepth = 3 });
-    test(vList, "[ 1 2 { nested = { one = 1; two = 2; }; one = 1; two = 2; } ]", PrintOptions { .maxDepth = 4 });
-    test(vList, "[ 1 2 { nested = { one = 1; two = 2; }; one = 1; two = 2; } ]", PrintOptions { .maxDepth = 5 });
+    test(vList, "[ 1 2 { ... } ]", PrintOptions{.maxDepth = 1});
+    test(vList, "[ 1 2 { nested = { ... }; one = 1; two = 2; } ]", PrintOptions{.maxDepth = 2});
+    test(vList, "[ 1 2 { nested = { one = 1; two = 2; }; one = 1; two = 2; } ]", PrintOptions{.maxDepth = 3});
+    test(vList, "[ 1 2 { nested = { one = 1; two = 2; }; one = 1; two = 2; } ]", PrintOptions{.maxDepth = 4});
+    test(vList, "[ 1 2 { nested = { one = 1; two = 2; }; one = 1; two = 2; } ]", PrintOptions{.maxDepth = 5});
 }
 
 struct StringPrintingTests : LibExprTest
@@ -272,9 +271,7 @@ struct StringPrintingTests : LibExprTest
         v.mkString(literal);
 
         std::stringstream out;
-        printValue(state, out, v, PrintOptions {
-            .maxStringLength = maxLength
-        });
+        printValue(state, out, v, PrintOptions{.maxStringLength = maxLength});
         ASSERT_EQ(out.str(), expected);
     }
 };
@@ -293,27 +290,21 @@ TEST_F(StringPrintingTests, maxLengthTruncation)
 TEST_F(ValuePrintingTests, attrsTypeFirst)
 {
     Value vType;
-    vType.mkString("puppy");
+    vType.mkStringNoCopy("puppy");
 
     Value vApple;
-    vApple.mkString("apple");
+    vApple.mkStringNoCopy("apple");
 
-    BindingsBuilder builder(state, state.allocBindings(10));
+    BindingsBuilder builder = state.buildBindings(10);
     builder.insert(state.symbols.create("type"), &vType);
     builder.insert(state.symbols.create("apple"), &vApple);
 
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    test(vAttrs,
-         "{ type = \"puppy\"; apple = \"apple\"; }",
-         PrintOptions {
-            .maxAttrs = 100
-         });
+    test(vAttrs, "{ type = \"puppy\"; apple = \"apple\"; }", PrintOptions{.maxAttrs = 100});
 
-    test(vAttrs,
-         "{ apple = \"apple\"; type = \"puppy\"; }",
-         PrintOptions { });
+    test(vAttrs, "{ apple = \"apple\"; type = \"puppy\"; }", PrintOptions{});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsInt)
@@ -321,11 +312,7 @@ TEST_F(ValuePrintingTests, ansiColorsInt)
     Value v;
     v.mkInt(10);
 
-    test(v,
-         ANSI_CYAN "10" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_CYAN "10" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsFloat)
@@ -333,11 +320,7 @@ TEST_F(ValuePrintingTests, ansiColorsFloat)
     Value v;
     v.mkFloat(1.6);
 
-    test(v,
-         ANSI_CYAN "1.6" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_CYAN "1.6" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsBool)
@@ -345,36 +328,26 @@ TEST_F(ValuePrintingTests, ansiColorsBool)
     Value v;
     v.mkBool(true);
 
-    test(v,
-         ANSI_CYAN "true" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_CYAN "true" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsString)
 {
     Value v;
-    v.mkString("puppy");
+    v.mkStringNoCopy("puppy");
 
-    test(v,
-         ANSI_MAGENTA "\"puppy\"" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-        });
+    test(v, ANSI_MAGENTA "\"puppy\"" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsStringElided)
 {
     Value v;
-    v.mkString("puppy");
+    v.mkStringNoCopy("puppy");
 
-    test(v,
-         ANSI_MAGENTA "\"pup\" " ANSI_FAINT "«2 bytes elided»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true,
-             .maxStringLength = 3
-         });
+    test(
+        v,
+        ANSI_MAGENTA "\"pup\" " ANSI_FAINT "«2 bytes elided»" ANSI_NORMAL,
+        PrintOptions{.ansiColors = true, .maxStringLength = 3});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsPath)
@@ -382,11 +355,7 @@ TEST_F(ValuePrintingTests, ansiColorsPath)
     Value v;
     v.mkPath(state.rootPath(CanonPath("puppy")));
 
-    test(v,
-         ANSI_GREEN "/puppy" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_GREEN "/puppy" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsNull)
@@ -394,11 +363,7 @@ TEST_F(ValuePrintingTests, ansiColorsNull)
     Value v;
     v.mkNull();
 
-    test(v,
-         ANSI_CYAN "null" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_CYAN "null" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsAttrs)
@@ -409,107 +374,90 @@ TEST_F(ValuePrintingTests, ansiColorsAttrs)
     Value vTwo;
     vTwo.mkInt(2);
 
-    BindingsBuilder builder(state, state.allocBindings(10));
+    BindingsBuilder builder = state.buildBindings(10);
     builder.insert(state.symbols.create("one"), &vOne);
     builder.insert(state.symbols.create("two"), &vTwo);
 
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    test(vAttrs,
-         "{ one = " ANSI_CYAN "1" ANSI_NORMAL "; two = " ANSI_CYAN "2" ANSI_NORMAL "; }",
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(
+        vAttrs,
+        "{ one = " ANSI_CYAN "1" ANSI_NORMAL "; two = " ANSI_CYAN "2" ANSI_NORMAL "; }",
+        PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsDerivation)
 {
     Value vDerivation;
-    vDerivation.mkString("derivation");
+    vDerivation.mkStringNoCopy("derivation");
 
-    BindingsBuilder builder(state, state.allocBindings(10));
-    builder.insert(state.sType, &vDerivation);
+    BindingsBuilder builder = state.buildBindings(10);
+    builder.insert(state.s.type, &vDerivation);
 
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    test(vAttrs,
-         ANSI_GREEN "«derivation»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true,
-             .force = true,
-             .derivationPaths = true
-         });
+    test(
+        vAttrs,
+        ANSI_GREEN "«derivation»" ANSI_NORMAL,
+        PrintOptions{.ansiColors = true, .force = true, .derivationPaths = true});
 
-    test(vAttrs,
-         "{ type = " ANSI_MAGENTA "\"derivation\"" ANSI_NORMAL "; }",
-         PrintOptions {
-             .ansiColors = true,
-             .force = true
-         });
+    test(
+        vAttrs,
+        "{ type = " ANSI_MAGENTA "\"derivation\"" ANSI_NORMAL "; }",
+        PrintOptions{.ansiColors = true, .force = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsError)
 {
     Value throw_ = state.getBuiltin("throw");
     Value message;
-    message.mkString("uh oh!");
+    message.mkStringNoCopy("uh oh!");
     Value vError;
     vError.mkApp(&throw_, &message);
 
-    test(vError,
-         ANSI_RED
-         "«error: uh oh!»"
-         ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true,
-             .force = true,
-         });
+    test(
+        vError,
+        ANSI_RED "«error: uh oh!»" ANSI_NORMAL,
+        PrintOptions{
+            .ansiColors = true,
+            .force = true,
+        });
 }
 
 TEST_F(ValuePrintingTests, ansiColorsDerivationError)
 {
     Value throw_ = state.getBuiltin("throw");
     Value message;
-    message.mkString("uh oh!");
+    message.mkStringNoCopy("uh oh!");
     Value vError;
     vError.mkApp(&throw_, &message);
 
     Value vDerivation;
-    vDerivation.mkString("derivation");
+    vDerivation.mkStringNoCopy("derivation");
 
-    BindingsBuilder builder(state, state.allocBindings(10));
-    builder.insert(state.sType, &vDerivation);
-    builder.insert(state.sDrvPath, &vError);
+    BindingsBuilder builder = state.buildBindings(10);
+    builder.insert(state.s.type, &vDerivation);
+    builder.insert(state.s.drvPath, &vError);
 
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    test(vAttrs,
-         "{ drvPath = "
-         ANSI_RED
-         "«error: uh oh!»"
-         ANSI_NORMAL
-         "; type = "
-         ANSI_MAGENTA
-         "\"derivation\""
-         ANSI_NORMAL
-         "; }",
-         PrintOptions {
-             .ansiColors = true,
-             .force = true
-         });
+    test(
+        vAttrs,
+        "{ drvPath = " ANSI_RED "«error: uh oh!»" ANSI_NORMAL "; type = " ANSI_MAGENTA "\"derivation\"" ANSI_NORMAL
+        "; }",
+        PrintOptions{.ansiColors = true, .force = true});
 
-    test(vAttrs,
-         ANSI_RED
-         "«error: uh oh!»"
-         ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true,
-             .force = true,
-             .derivationPaths = true,
-         });
+    test(
+        vAttrs,
+        ANSI_RED "«error: uh oh!»" ANSI_NORMAL,
+        PrintOptions{
+            .ansiColors = true,
+            .force = true,
+            .derivationPaths = true,
+        });
 }
 
 TEST_F(ValuePrintingTests, ansiColorsAssert)
@@ -523,12 +471,7 @@ TEST_F(ValuePrintingTests, ansiColorsAssert)
     Value v;
     state.mkThunk_(v, &expr);
 
-    test(v,
-         ANSI_RED "«error: assertion 'false' failed»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true,
-             .force = true
-         });
+    test(v, ANSI_RED "«error: assertion 'false' failed»" ANSI_NORMAL, PrintOptions{.ansiColors = true, .force = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsList)
@@ -545,77 +488,51 @@ TEST_F(ValuePrintingTests, ansiColorsList)
     Value vList;
     vList.mkList(list);
 
-    test(vList,
-         "[ " ANSI_CYAN "1" ANSI_NORMAL " " ANSI_CYAN "2" ANSI_NORMAL " " ANSI_MAGENTA "«nullptr»" ANSI_NORMAL " ]",
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(
+        vList,
+        "[ " ANSI_CYAN "1" ANSI_NORMAL " " ANSI_CYAN "2" ANSI_NORMAL " " ANSI_MAGENTA "«nullptr»" ANSI_NORMAL " ]",
+        PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsLambda)
 {
-    Env env {
-        .up = nullptr,
-        .values = { }
-    };
+    Env env{.up = nullptr, .values = {}};
     PosTable::Origin origin = state.positions.addOrigin(std::monostate(), 1);
     auto posIdx = state.positions.add(origin, 0);
     auto body = ExprInt(0);
-    auto formals = Formals {};
+    auto formals = Formals{};
 
     ExprLambda eLambda(posIdx, createSymbol("a"), &formals, &body);
 
     Value vLambda;
     vLambda.mkLambda(&env, &eLambda);
 
-    test(vLambda,
-         ANSI_BLUE "«lambda @ «none»:1:1»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true,
-             .force = true
-         });
+    test(vLambda, ANSI_BLUE "«lambda @ «none»:1:1»" ANSI_NORMAL, PrintOptions{.ansiColors = true, .force = true});
 
     eLambda.setName(createSymbol("puppy"));
 
-    test(vLambda,
-         ANSI_BLUE "«lambda puppy @ «none»:1:1»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true,
-             .force = true
-         });
+    test(vLambda, ANSI_BLUE "«lambda puppy @ «none»:1:1»" ANSI_NORMAL, PrintOptions{.ansiColors = true, .force = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsPrimOp)
 {
-    PrimOp primOp{
-        .name = "puppy"
-    };
+    PrimOp primOp{.name = "puppy"};
     Value v;
     v.mkPrimOp(&primOp);
 
-    test(v,
-         ANSI_BLUE "«primop puppy»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_BLUE "«primop puppy»" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsPrimOpApp)
 {
-    PrimOp primOp{
-        .name = "puppy"
-    };
+    PrimOp primOp{.name = "puppy"};
     Value vPrimOp;
     vPrimOp.mkPrimOp(&primOp);
 
     Value v;
     v.mkPrimOpApp(&vPrimOp, nullptr);
 
-    test(v,
-         ANSI_BLUE "«partially applied primop puppy»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_BLUE "«partially applied primop puppy»" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsThunk)
@@ -623,11 +540,7 @@ TEST_F(ValuePrintingTests, ansiColorsThunk)
     Value v;
     v.mkThunk(nullptr, nullptr);
 
-    test(v,
-         ANSI_MAGENTA "«thunk»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_MAGENTA "«thunk»" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsBlackhole)
@@ -635,37 +548,29 @@ TEST_F(ValuePrintingTests, ansiColorsBlackhole)
     Value v;
     v.mkBlackhole();
 
-    test(v,
-         ANSI_RED "«potential infinite recursion»" ANSI_NORMAL,
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(v, ANSI_RED "«potential infinite recursion»" ANSI_NORMAL, PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsAttrsRepeated)
 {
-    BindingsBuilder emptyBuilder(state, state.allocBindings(1));
+    BindingsBuilder emptyBuilder = state.buildBindings(1);
 
     Value vEmpty;
     vEmpty.mkAttrs(emptyBuilder.finish());
 
-    BindingsBuilder builder(state, state.allocBindings(10));
+    BindingsBuilder builder = state.buildBindings(10);
     builder.insert(state.symbols.create("a"), &vEmpty);
     builder.insert(state.symbols.create("b"), &vEmpty);
 
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    test(vAttrs,
-         "{ a = { }; b = " ANSI_MAGENTA "«repeated»" ANSI_NORMAL "; }",
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(vAttrs, "{ a = { }; b = " ANSI_MAGENTA "«repeated»" ANSI_NORMAL "; }", PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsListRepeated)
 {
-    BindingsBuilder emptyBuilder(state, state.allocBindings(1));
+    BindingsBuilder emptyBuilder = state.buildBindings(1);
 
     Value vEmpty;
     vEmpty.mkAttrs(emptyBuilder.finish());
@@ -676,16 +581,12 @@ TEST_F(ValuePrintingTests, ansiColorsListRepeated)
     Value vList;
     vList.mkList(list);
 
-    test(vList,
-         "[ { } " ANSI_MAGENTA "«repeated»" ANSI_NORMAL " ]",
-         PrintOptions {
-             .ansiColors = true
-         });
+    test(vList, "[ { } " ANSI_MAGENTA "«repeated»" ANSI_NORMAL " ]", PrintOptions{.ansiColors = true});
 }
 
 TEST_F(ValuePrintingTests, listRepeated)
 {
-    BindingsBuilder emptyBuilder(state, state.allocBindings(1));
+    BindingsBuilder emptyBuilder = state.buildBindings(1);
 
     Value vEmpty;
     vEmpty.mkAttrs(emptyBuilder.finish());
@@ -696,12 +597,8 @@ TEST_F(ValuePrintingTests, listRepeated)
     Value vList;
     vList.mkList(list);
 
-    test(vList, "[ { } «repeated» ]", PrintOptions { });
-    test(vList,
-         "[ { } { } ]",
-         PrintOptions {
-             .trackRepeated = false
-         });
+    test(vList, "[ { } «repeated» ]", PrintOptions{});
+    test(vList, "[ { } { } ]", PrintOptions{.trackRepeated = false});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsAttrsElided)
@@ -712,19 +609,17 @@ TEST_F(ValuePrintingTests, ansiColorsAttrsElided)
     Value vTwo;
     vTwo.mkInt(2);
 
-    BindingsBuilder builder(state, state.allocBindings(10));
+    BindingsBuilder builder = state.buildBindings(10);
     builder.insert(state.symbols.create("one"), &vOne);
     builder.insert(state.symbols.create("two"), &vTwo);
 
     Value vAttrs;
     vAttrs.mkAttrs(builder.finish());
 
-    test(vAttrs,
-         "{ one = " ANSI_CYAN "1" ANSI_NORMAL "; " ANSI_FAINT "«1 attribute elided»" ANSI_NORMAL " }",
-         PrintOptions {
-             .ansiColors = true,
-             .maxAttrs = 1
-         });
+    test(
+        vAttrs,
+        "{ one = " ANSI_CYAN "1" ANSI_NORMAL "; " ANSI_FAINT "«1 attribute elided»" ANSI_NORMAL " }",
+        PrintOptions{.ansiColors = true, .maxAttrs = 1});
 
     Value vThree;
     vThree.mkInt(3);
@@ -732,18 +627,14 @@ TEST_F(ValuePrintingTests, ansiColorsAttrsElided)
     builder.insert(state.symbols.create("three"), &vThree);
     vAttrs.mkAttrs(builder.finish());
 
-    test(vAttrs,
-         "{ one = " ANSI_CYAN "1" ANSI_NORMAL "; " ANSI_FAINT "«2 attributes elided»" ANSI_NORMAL " }",
-         PrintOptions {
-             .ansiColors = true,
-             .maxAttrs = 1
-         });
+    test(
+        vAttrs,
+        "{ one = " ANSI_CYAN "1" ANSI_NORMAL "; " ANSI_FAINT "«2 attributes elided»" ANSI_NORMAL " }",
+        PrintOptions{.ansiColors = true, .maxAttrs = 1});
 }
 
 TEST_F(ValuePrintingTests, ansiColorsListElided)
 {
-    BindingsBuilder emptyBuilder(state, state.allocBindings(1));
-
     Value vOne;
     vOne.mkInt(1);
 
@@ -751,37 +642,33 @@ TEST_F(ValuePrintingTests, ansiColorsListElided)
     vTwo.mkInt(2);
 
     {
-    auto list = state.buildList(2);
-    list.elems[0] = &vOne;
-    list.elems[1] = &vTwo;
-    Value vList;
-    vList.mkList(list);
+        auto list = state.buildList(2);
+        list.elems[0] = &vOne;
+        list.elems[1] = &vTwo;
+        Value vList;
+        vList.mkList(list);
 
-    test(vList,
-         "[ " ANSI_CYAN "1" ANSI_NORMAL " " ANSI_FAINT "«1 item elided»" ANSI_NORMAL " ]",
-         PrintOptions {
-             .ansiColors = true,
-             .maxListItems = 1
-         });
+        test(
+            vList,
+            "[ " ANSI_CYAN "1" ANSI_NORMAL " " ANSI_FAINT "«1 item elided»" ANSI_NORMAL " ]",
+            PrintOptions{.ansiColors = true, .maxListItems = 1});
     }
 
     Value vThree;
     vThree.mkInt(3);
 
     {
-    auto list = state.buildList(3);
-    list.elems[0] = &vOne;
-    list.elems[1] = &vTwo;
-    list.elems[2] = &vThree;
-    Value vList;
-    vList.mkList(list);
+        auto list = state.buildList(3);
+        list.elems[0] = &vOne;
+        list.elems[1] = &vTwo;
+        list.elems[2] = &vThree;
+        Value vList;
+        vList.mkList(list);
 
-    test(vList,
-         "[ " ANSI_CYAN "1" ANSI_NORMAL " " ANSI_FAINT "«2 items elided»" ANSI_NORMAL " ]",
-         PrintOptions {
-             .ansiColors = true,
-             .maxListItems = 1
-         });
+        test(
+            vList,
+            "[ " ANSI_CYAN "1" ANSI_NORMAL " " ANSI_FAINT "«2 items elided»" ANSI_NORMAL " ]",
+            PrintOptions{.ansiColors = true, .maxListItems = 1});
     }
 }
 
diff --git a/src/libexpr/attr-path.cc b/src/libexpr/attr-path.cc
index 111d04cf2..58705bfa1 100644
--- a/src/libexpr/attr-path.cc
+++ b/src/libexpr/attr-path.cc
@@ -1,10 +1,8 @@
 #include "nix/expr/attr-path.hh"
 #include "nix/expr/eval-inline.hh"
 
-
 namespace nix {
 
-
 static Strings parseAttrPath(std::string_view s)
 {
     Strings res;
@@ -19,18 +17,19 @@ static Strings parseAttrPath(std::string_view s)
             while (1) {
                 if (i == s.end())
                     throw ParseError("missing closing quote in selection path '%1%'", s);
-                if (*i == '"') break;
+                if (*i == '"')
+                    break;
                 cur.push_back(*i++);
             }
         } else
             cur.push_back(*i);
         ++i;
     }
-    if (!cur.empty()) res.push_back(cur);
+    if (!cur.empty())
+        res.push_back(cur);
     return res;
 }
 
-
 std::vector<Symbol> parseAttrPath(EvalState & state, std::string_view s)
 {
     std::vector<Symbol> res;
@@ -39,9 +38,8 @@ std::vector<Symbol> parseAttrPath(EvalState & state, std::string_view s)
     return res;
 }
 
-
-std::pair<Value *, PosIdx> findAlongAttrPath(EvalState & state, const std::string & attrPath,
-    Bindings & autoArgs, Value & vIn)
+std::pair<Value *, PosIdx>
+findAlongAttrPath(EvalState & state, const std::string & attrPath, Bindings & autoArgs, Value & vIn)
 {
     Strings tokens = parseAttrPath(attrPath);
 
@@ -65,10 +63,12 @@ std::pair<Value *, PosIdx> findAlongAttrPath(EvalState & state, const std::strin
         if (!attrIndex) {
 
             if (v->type() != nAttrs)
-                state.error<TypeError>(
-                    "the expression selected by the selection path '%1%' should be a set but is %2%",
-                    attrPath,
-                    showType(*v)).debugThrow();
+                state
+                    .error<TypeError>(
+                        "the expression selected by the selection path '%1%' should be a set but is %2%",
+                        attrPath,
+                        showType(*v))
+                    .debugThrow();
             if (attr.empty())
                 throw Error("empty attribute name in selection path '%1%'", attrPath);
 
@@ -79,7 +79,8 @@ std::pair<Value *, PosIdx> findAlongAttrPath(EvalState & state, const std::strin
                     attrNames.insert(std::string(state.symbols[attr.name]));
 
                 auto suggestions = Suggestions::bestMatches(attrNames, attr);
-                throw AttrPathNotFound(suggestions, "attribute '%1%' in selection path '%2%' not found", attr, attrPath);
+                throw AttrPathNotFound(
+                    suggestions, "attribute '%1%' in selection path '%2%' not found", attr, attrPath);
             }
             v = &*a->value;
             pos = a->pos;
@@ -88,29 +89,29 @@ std::pair<Value *, PosIdx> findAlongAttrPath(EvalState & state, const std::strin
         else {
 
             if (!v->isList())
-                state.error<TypeError>(
-                    "the expression selected by the selection path '%1%' should be a list but is %2%",
-                    attrPath,
-                    showType(*v)).debugThrow();
+                state
+                    .error<TypeError>(
+                        "the expression selected by the selection path '%1%' should be a list but is %2%",
+                        attrPath,
+                        showType(*v))
+                    .debugThrow();
             if (*attrIndex >= v->listSize())
                 throw AttrPathNotFound("list index %1% in selection path '%2%' is out of range", *attrIndex, attrPath);
 
             v = v->listView()[*attrIndex];
             pos = noPos;
         }
-
     }
 
     return {v, pos};
 }
 
-
 std::pair<SourcePath, uint32_t> findPackageFilename(EvalState & state, Value & v, std::string what)
 {
     Value * v2;
     try {
-        auto dummyArgs = state.allocBindings(0);
-        v2 = findAlongAttrPath(state, "meta.position", *dummyArgs, v).first;
+        auto & dummyArgs = Bindings::emptyBindings;
+        v2 = findAlongAttrPath(state, "meta.position", dummyArgs, v).first;
     } catch (Error &) {
         throw NoPositionInfo("package '%s' has no source location information", what);
     }
@@ -118,17 +119,17 @@ std::pair<SourcePath, uint32_t> findPackageFilename(EvalState & state, Value & v
     // FIXME: is it possible to extract the Pos object instead of doing this
     //        toString + parsing?
     NixStringContext context;
-    auto path = state.coerceToPath(noPos, *v2, context, "while evaluating the 'meta.position' attribute of a derivation");
+    auto path =
+        state.coerceToPath(noPos, *v2, context, "while evaluating the 'meta.position' attribute of a derivation");
 
     auto fn = path.path.abs();
 
-    auto fail = [fn]() {
-        throw ParseError("cannot parse 'meta.position' attribute '%s'", fn);
-    };
+    auto fail = [fn]() { throw ParseError("cannot parse 'meta.position' attribute '%s'", fn); };
 
     try {
         auto colon = fn.rfind(':');
-        if (colon == std::string::npos) fail();
+        if (colon == std::string::npos)
+            fail();
         auto lineno = std::stoi(std::string(fn, colon + 1, std::string::npos));
         return {SourcePath{path.accessor, CanonPath(fn.substr(0, colon))}, lineno};
     } catch (std::invalid_argument & e) {
@@ -137,5 +138,4 @@ std::pair<SourcePath, uint32_t> findPackageFilename(EvalState & state, Value & v
     }
 }
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/attr-set.cc b/src/libexpr/attr-set.cc
index 06e245aea..88474c36f 100644
--- a/src/libexpr/attr-set.cc
+++ b/src/libexpr/attr-set.cc
@@ -3,10 +3,9 @@
 
 #include <algorithm>
 
-
 namespace nix {
 
-
+Bindings Bindings::emptyBindings;
 
 /* Allocate a new array of attributes for an attribute set with a specific
    capacity. The space is implicitly reserved after the Bindings
@@ -14,40 +13,35 @@ namespace nix {
 Bindings * EvalState::allocBindings(size_t capacity)
 {
     if (capacity == 0)
-        return &emptyBindings;
+        return &Bindings::emptyBindings;
     if (capacity > std::numeric_limits<Bindings::size_t>::max())
         throw Error("attribute set of size %d is too big", capacity);
     nrAttrsets++;
     nrAttrsInAttrsets += capacity;
-    return new (allocBytes(sizeof(Bindings) + sizeof(Attr) * capacity)) Bindings((Bindings::size_t) capacity);
+    return new (allocBytes(sizeof(Bindings) + sizeof(Attr) * capacity)) Bindings();
 }
 
-
 Value & BindingsBuilder::alloc(Symbol name, PosIdx pos)
 {
-    auto value = state.allocValue();
+    auto value = state.get().allocValue();
     bindings->push_back(Attr(name, value, pos));
     return *value;
 }
 
-
 Value & BindingsBuilder::alloc(std::string_view name, PosIdx pos)
 {
-    return alloc(state.symbols.create(name), pos);
+    return alloc(state.get().symbols.create(name), pos);
 }
 
-
 void Bindings::sort()
 {
-    if (size_) std::sort(begin(), end());
+    std::sort(attrs, attrs + size_);
 }
 
-
 Value & Value::mkAttrs(BindingsBuilder & bindings)
 {
     mkAttrs(bindings.finish());
     return *this;
 }
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index 27d60d6ef..480ca72c7 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -4,6 +4,7 @@
 #include "nix/expr/eval.hh"
 #include "nix/expr/eval-inline.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/globals.hh"
 // Need specialization involving `SymbolStr` just in this one module.
 #include "nix/util/strings-inline.hh"
 
@@ -11,8 +12,10 @@ namespace nix::eval_cache {
 
 CachedEvalError::CachedEvalError(ref<AttrCursor> cursor, Symbol attr)
     : EvalError(cursor->root->state, "cached failure of attribute '%s'", cursor->getAttrPathStr(attr))
-    , cursor(cursor), attr(attr)
-{ }
+    , cursor(cursor)
+    , attr(attr)
+{
+}
 
 void CachedEvalError::force()
 {
@@ -25,7 +28,8 @@ void CachedEvalError::force()
     }
 
     // Shouldn't happen.
-    throw EvalError(state, "evaluation of cached failed attribute '%s' unexpectedly succeeded", cursor->getAttrPathStr(attr));
+    throw EvalError(
+        state, "evaluation of cached failed attribute '%s' unexpectedly succeeded", cursor->getAttrPathStr(attr));
 }
 
 static const char * schema = R"sql(
@@ -59,36 +63,32 @@ struct AttrDb
 
     SymbolTable & symbols;
 
-    AttrDb(
-        const StoreDirConfig & cfg,
-        const Hash & fingerprint,
-        SymbolTable & symbols)
+    AttrDb(const StoreDirConfig & cfg, const Hash & fingerprint, SymbolTable & symbols)
         : cfg(cfg)
         , _state(std::make_unique<Sync<State>>())
         , symbols(symbols)
     {
         auto state(_state->lock());
 
-        Path cacheDir = getCacheDir() + "/eval-cache-v5";
+        auto cacheDir = std::filesystem::path(getCacheDir()) / "eval-cache-v6";
         createDirs(cacheDir);
 
-        Path dbPath = cacheDir + "/" + fingerprint.to_string(HashFormat::Base16, false) + ".sqlite";
+        auto dbPath = cacheDir / (fingerprint.to_string(HashFormat::Base16, false) + ".sqlite");
 
         state->db = SQLite(dbPath);
         state->db.isCache();
         state->db.exec(schema);
 
-        state->insertAttribute.create(state->db,
-            "insert or replace into Attributes(parent, name, type, value) values (?, ?, ?, ?)");
+        state->insertAttribute.create(
+            state->db, "insert or replace into Attributes(parent, name, type, value) values (?, ?, ?, ?)");
 
-        state->insertAttributeWithContext.create(state->db,
-            "insert or replace into Attributes(parent, name, type, value, context) values (?, ?, ?, ?, ?)");
+        state->insertAttributeWithContext.create(
+            state->db, "insert or replace into Attributes(parent, name, type, value, context) values (?, ?, ?, ?, ?)");
 
-        state->queryAttribute.create(state->db,
-            "select rowid, type, value, context from Attributes where parent = ? and name = ?");
+        state->queryAttribute.create(
+            state->db, "select rowid, type, value, context from Attributes where parent = ? and name = ?");
 
-        state->queryAttributes.create(state->db,
-            "select name from Attributes where parent = ?");
+        state->queryAttributes.create(state->db, "select name from Attributes where parent = ?");
 
         state->txn = std::make_unique<SQLiteTxn>(state->db);
     }
@@ -108,7 +108,8 @@ struct AttrDb
     template<typename F>
     AttrId doSQLite(F && fun)
     {
-        if (failed) return 0;
+        if (failed)
+            return 0;
         try {
             return fun();
         } catch (SQLiteError &) {
@@ -118,116 +119,76 @@ struct AttrDb
         }
     }
 
-    AttrId setAttrs(
-        AttrKey key,
-        const std::vector<Symbol> & attrs)
+    AttrId setAttrs(AttrKey key, const std::vector<Symbol> & attrs)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::FullAttrs)
-                (0, false).exec();
+            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::FullAttrs) (0, false).exec();
 
             AttrId rowId = state->db.getLastInsertedRowId();
             assert(rowId);
 
             for (auto & attr : attrs)
-                state->insertAttribute.use()
-                    (rowId)
-                    (symbols[attr])
-                    (AttrType::Placeholder)
-                    (0, false).exec();
+                state->insertAttribute.use()(rowId)(symbols[attr])(AttrType::Placeholder) (0, false).exec();
 
             return rowId;
         });
     }
 
-    AttrId setString(
-        AttrKey key,
-        std::string_view s,
-        const char * * context = nullptr)
+    AttrId setString(AttrKey key, std::string_view s, const char ** context = nullptr)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
             if (context) {
                 std::string ctx;
-                for (const char * * p = context; *p; ++p) {
-                    if (p != context) ctx.push_back(' ');
+                for (const char ** p = context; *p; ++p) {
+                    if (p != context)
+                        ctx.push_back(' ');
                     ctx.append(*p);
                 }
-                state->insertAttributeWithContext.use()
-                    (key.first)
-                    (symbols[key.second])
-                    (AttrType::String)
-                    (s)
-                    (ctx).exec();
+                state->insertAttributeWithContext.use()(key.first)(symbols[key.second])(AttrType::String) (s) (ctx)
+                    .exec();
             } else {
-                state->insertAttribute.use()
-                    (key.first)
-                    (symbols[key.second])
-                    (AttrType::String)
-                (s).exec();
+                state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::String) (s).exec();
             }
 
             return state->db.getLastInsertedRowId();
         });
     }
 
-    AttrId setBool(
-        AttrKey key,
-        bool b)
+    AttrId setBool(AttrKey key, bool b)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::Bool)
-                (b ? 1 : 0).exec();
+            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Bool) (b ? 1 : 0).exec();
 
             return state->db.getLastInsertedRowId();
         });
     }
 
-    AttrId setInt(
-        AttrKey key,
-        int n)
+    AttrId setInt(AttrKey key, int n)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::Int)
-                (n).exec();
+            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Int) (n).exec();
 
             return state->db.getLastInsertedRowId();
         });
     }
 
-    AttrId setListOfStrings(
-        AttrKey key,
-        const std::vector<std::string> & l)
+    AttrId setListOfStrings(AttrKey key, const std::vector<std::string> & l)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::ListOfStrings)
-                (dropEmptyInitThenConcatStringsSep("\t", l)).exec();
+            state->insertAttribute
+                .use()(key.first)(symbols[key.second])(
+                    AttrType::ListOfStrings) (dropEmptyInitThenConcatStringsSep("\t", l))
+                .exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -235,15 +196,10 @@ struct AttrDb
 
     AttrId setPlaceholder(AttrKey key)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::Placeholder)
-                (0, false).exec();
+            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Placeholder) (0, false).exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -251,15 +207,10 @@ struct AttrDb
 
     AttrId setMissing(AttrKey key)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::Missing)
-                (0, false).exec();
+            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Missing) (0, false).exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -267,15 +218,10 @@ struct AttrDb
 
     AttrId setMisc(AttrKey key)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::Misc)
-                (0, false).exec();
+            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Misc) (0, false).exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -283,15 +229,10 @@ struct AttrDb
 
     AttrId setFailed(AttrKey key)
     {
-        return doSQLite([&]()
-        {
+        return doSQLite([&]() {
             auto state(_state->lock());
 
-            state->insertAttribute.use()
-                (key.first)
-                (symbols[key.second])
-                (AttrType::Failed)
-                (0, false).exec();
+            state->insertAttribute.use()(key.first)(symbols[key.second])(AttrType::Failed) (0, false).exec();
 
             return state->db.getLastInsertedRowId();
         });
@@ -302,51 +243,49 @@ struct AttrDb
         auto state(_state->lock());
 
         auto queryAttribute(state->queryAttribute.use()(key.first)(symbols[key.second]));
-        if (!queryAttribute.next()) return {};
+        if (!queryAttribute.next())
+            return {};
 
         auto rowId = (AttrId) queryAttribute.getInt(0);
         auto type = (AttrType) queryAttribute.getInt(1);
 
         switch (type) {
-            case AttrType::Placeholder:
-                return {{rowId, placeholder_t()}};
-            case AttrType::FullAttrs: {
-                // FIXME: expensive, should separate this out.
-                std::vector<Symbol> attrs;
-                auto queryAttributes(state->queryAttributes.use()(rowId));
-                while (queryAttributes.next())
-                    attrs.emplace_back(symbols.create(queryAttributes.getStr(0)));
-                return {{rowId, attrs}};
-            }
-            case AttrType::String: {
-                NixStringContext context;
-                if (!queryAttribute.isNull(3))
-                    for (auto & s : tokenizeString<std::vector<std::string>>(queryAttribute.getStr(3), ";"))
-                        context.insert(NixStringContextElem::parse(s));
-                return {{rowId, string_t{queryAttribute.getStr(2), context}}};
-            }
-            case AttrType::Bool:
-                return {{rowId, queryAttribute.getInt(2) != 0}};
-            case AttrType::Int:
-                return {{rowId, int_t{NixInt{queryAttribute.getInt(2)}}}};
-            case AttrType::ListOfStrings:
-                return {{rowId, tokenizeString<std::vector<std::string>>(queryAttribute.getStr(2), "\t")}};
-            case AttrType::Missing:
-                return {{rowId, missing_t()}};
-            case AttrType::Misc:
-                return {{rowId, misc_t()}};
-            case AttrType::Failed:
-                return {{rowId, failed_t()}};
-            default:
-                throw Error("unexpected type in evaluation cache");
+        case AttrType::Placeholder:
+            return {{rowId, placeholder_t()}};
+        case AttrType::FullAttrs: {
+            // FIXME: expensive, should separate this out.
+            std::vector<Symbol> attrs;
+            auto queryAttributes(state->queryAttributes.use()(rowId));
+            while (queryAttributes.next())
+                attrs.emplace_back(symbols.create(queryAttributes.getStr(0)));
+            return {{rowId, attrs}};
+        }
+        case AttrType::String: {
+            NixStringContext context;
+            if (!queryAttribute.isNull(3))
+                for (auto & s : tokenizeString<std::vector<std::string>>(queryAttribute.getStr(3), ";"))
+                    context.insert(NixStringContextElem::parse(s));
+            return {{rowId, string_t{queryAttribute.getStr(2), context}}};
+        }
+        case AttrType::Bool:
+            return {{rowId, queryAttribute.getInt(2) != 0}};
+        case AttrType::Int:
+            return {{rowId, int_t{NixInt{queryAttribute.getInt(2)}}}};
+        case AttrType::ListOfStrings:
+            return {{rowId, tokenizeString<std::vector<std::string>>(queryAttribute.getStr(2), "\t")}};
+        case AttrType::Missing:
+            return {{rowId, missing_t()}};
+        case AttrType::Misc:
+            return {{rowId, misc_t()}};
+        case AttrType::Failed:
+            return {{rowId, failed_t()}};
+        default:
+            throw Error("unexpected type in evaluation cache");
         }
     }
 };
 
-static std::shared_ptr<AttrDb> makeAttrDb(
-    const StoreDirConfig & cfg,
-    const Hash & fingerprint,
-    SymbolTable & symbols)
+static std::shared_ptr<AttrDb> makeAttrDb(const StoreDirConfig & cfg, const Hash & fingerprint, SymbolTable & symbols)
 {
     try {
         return std::make_shared<AttrDb>(cfg, fingerprint, symbols);
@@ -357,9 +296,7 @@ static std::shared_ptr<AttrDb> makeAttrDb(
 }
 
 EvalCache::EvalCache(
-    std::optional<std::reference_wrapper<const Hash>> useCache,
-    EvalState & state,
-    RootLoader rootLoader)
+    std::optional<std::reference_wrapper<const Hash>> useCache, EvalState & state, RootLoader rootLoader)
     : db(useCache ? makeAttrDb(*state.store, *useCache, state.symbols) : nullptr)
     , state(state)
     , rootLoader(rootLoader)
@@ -381,11 +318,10 @@ ref<AttrCursor> EvalCache::getRoot()
 }
 
 AttrCursor::AttrCursor(
-    ref<EvalCache> root,
-    Parent parent,
-    Value * value,
-    std::optional<std::pair<AttrId, AttrValue>> && cachedValue)
-    : root(root), parent(parent), cachedValue(std::move(cachedValue))
+    ref<EvalCache> root, Parent parent, Value * value, std::optional<std::pair<AttrId, AttrValue>> && cachedValue)
+    : root(root)
+    , parent(parent)
+    , cachedValue(std::move(cachedValue))
 {
     if (value)
         _value = allocRootValue(value);
@@ -394,7 +330,7 @@ AttrCursor::AttrCursor(
 AttrKey AttrCursor::getKey()
 {
     if (!parent)
-        return {0, root->state.sEpsilon};
+        return {0, root->state.s.epsilon};
     if (!parent->first->cachedValue) {
         parent->first->cachedValue = root->db->getAttr(parent->first->getKey());
         assert(parent->first->cachedValue);
@@ -470,13 +406,11 @@ Value & AttrCursor::forceValue()
 
     if (root->db && (!cachedValue || std::get_if<placeholder_t>(&cachedValue->second))) {
         if (v.type() == nString)
-            cachedValue = {root->db->setString(getKey(), v.c_str(), v.context()),
-                           string_t{v.c_str(), {}}};
+            cachedValue = {root->db->setString(getKey(), v.c_str(), v.context()), string_t{v.c_str(), {}}};
         else if (v.type() == nPath) {
             auto path = v.path().path;
             cachedValue = {root->db->setString(getKey(), path.abs()), string_t{path.abs(), {}}};
-        }
-        else if (v.type() == nBool)
+        } else if (v.type() == nBool)
             cachedValue = {root->db->setBool(getKey(), v.boolean()), v.boolean()};
         else if (v.type() == nInt)
             cachedValue = {root->db->setInt(getKey(), v.integer().value), int_t{v.integer()}};
@@ -518,14 +452,14 @@ std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name)
                     else if (std::get_if<failed_t>(&attr->second))
                         throw CachedEvalError(ref(shared_from_this()), name);
                     else
-                        return std::make_shared<AttrCursor>(root,
-                            std::make_pair(ref(shared_from_this()), name), nullptr, std::move(attr));
+                        return std::make_shared<AttrCursor>(
+                            root, std::make_pair(ref(shared_from_this()), name), nullptr, std::move(attr));
                 }
                 // Incomplete attrset, so need to fall thru and
                 // evaluate to see whether 'name' exists
             } else
                 return nullptr;
-                //error<TypeError>("'%s' is not an attribute set", getAttrPathStr()).debugThrow();
+            // error<TypeError>("'%s' is not an attribute set", getAttrPathStr()).debugThrow();
         }
     }
 
@@ -533,7 +467,7 @@ std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name)
 
     if (v.type() != nAttrs)
         return nullptr;
-        //error<TypeError>("'%s' is not an attribute set", getAttrPathStr()).debugThrow();
+    // error<TypeError>("'%s' is not an attribute set", getAttrPathStr()).debugThrow();
 
     auto attr = v.attrs()->get(name);
 
@@ -618,17 +552,15 @@ string_t AttrCursor::getStringWithContext()
             if (auto s = std::get_if<string_t>(&cachedValue->second)) {
                 bool valid = true;
                 for (auto & c : s->second) {
-                    const StorePath & path = std::visit(overloaded {
-                        [&](const NixStringContextElem::DrvDeep & d) -> const StorePath & {
-                            return d.drvPath;
+                    const StorePath & path = std::visit(
+                        overloaded{
+                            [&](const NixStringContextElem::DrvDeep & d) -> const StorePath & { return d.drvPath; },
+                            [&](const NixStringContextElem::Built & b) -> const StorePath & {
+                                return b.drvPath->getBaseStorePath();
+                            },
+                            [&](const NixStringContextElem::Opaque & o) -> const StorePath & { return o.path; },
                         },
-                        [&](const NixStringContextElem::Built & b) -> const StorePath & {
-                            return b.drvPath->getBaseStorePath();
-                        },
-                        [&](const NixStringContextElem::Opaque & o) -> const StorePath & {
-                            return o.path;
-                        },
-                    }, c.raw);
+                        c.raw);
                     if (!root->state.store->isValidPath(path)) {
                         valid = false;
                         break;
@@ -649,8 +581,7 @@ string_t AttrCursor::getStringWithContext()
         NixStringContext context;
         copyContext(v, context);
         return {v.c_str(), std::move(context)};
-    }
-    else if (v.type() == nPath)
+    } else if (v.type() == nPath)
         return {v.path().to_string(), {}};
     else
         root->state.error<TypeError>("'%s' is not a string but %s", getAttrPathStr(), showType(v)).debugThrow();
@@ -722,7 +653,8 @@ std::vector<std::string> AttrCursor::getListOfStrings()
     std::vector<std::string> res;
 
     for (auto elem : v.listView())
-        res.push_back(std::string(root->state.forceStringNoCtx(*elem, noPos, "while evaluating an attribute for caching")));
+        res.push_back(
+            std::string(root->state.forceStringNoCtx(*elem, noPos, "while evaluating an attribute for caching")));
 
     if (root->db)
         cachedValue = {root->db->setListOfStrings(getKey(), res), res};
@@ -770,7 +702,7 @@ bool AttrCursor::isDerivation()
 
 StorePath AttrCursor::forceDerivation()
 {
-    auto aDrvPath = getAttr(root->state.sDrvPath);
+    auto aDrvPath = getAttr(root->state.s.drvPath);
     auto drvPath = root->state.store->parseStorePath(aDrvPath->getString());
     drvPath.requireDerivation();
     if (!root->state.store->isValidPath(drvPath) && !settings.readOnlyMode) {
@@ -778,10 +710,10 @@ StorePath AttrCursor::forceDerivation()
            been garbage-collected. So force it to be regenerated. */
         aDrvPath->forceValue();
         if (!root->state.store->isValidPath(drvPath))
-            throw Error("don't know how to recreate store derivation '%s'!",
-                root->state.store->printStorePath(drvPath));
+            throw Error(
+                "don't know how to recreate store derivation '%s'!", root->state.store->printStorePath(drvPath));
     }
     return drvPath;
 }
 
-}
+} // namespace nix::eval_cache
diff --git a/src/libexpr/eval-error.cc b/src/libexpr/eval-error.cc
index eac135008..7f0174715 100644
--- a/src/libexpr/eval-error.cc
+++ b/src/libexpr/eval-error.cc
@@ -44,12 +44,13 @@ EvalErrorBuilder<T> & EvalErrorBuilder<T>::withFrame(const Env & env, const Expr
     // NOTE: This is abusing side-effects.
     // TODO: check compatibility with nested debugger calls.
     // TODO: What side-effects??
-    error.state.debugTraces.push_front(DebugTrace{
-        .pos = expr.getPos(),
-        .expr = expr,
-        .env = env,
-        .hint = HintFmt("Fake frame for debugging purposes"),
-        .isError = true});
+    error.state.debugTraces.push_front(
+        DebugTrace{
+            .pos = expr.getPos(),
+            .expr = expr,
+            .env = env,
+            .hint = HintFmt("Fake frame for debugging purposes"),
+            .isError = true});
     return *this;
 }
 
@@ -96,7 +97,8 @@ template<class T>
 void EvalErrorBuilder<T>::panic()
 {
     logError(error.info());
-    printError("This is a bug! An unexpected condition occurred, causing the Nix evaluator to have to stop. If you could share a reproducible example or a core dump, please open an issue at https://github.com/NixOS/nix/issues");
+    printError(
+        "This is a bug! An unexpected condition occurred, causing the Nix evaluator to have to stop. If you could share a reproducible example or a core dump, please open an issue at https://github.com/NixOS/nix/issues");
     abort();
 }
 
@@ -112,4 +114,4 @@ template class EvalErrorBuilder<InfiniteRecursionError>;
 template class EvalErrorBuilder<InvalidPathError>;
 template class EvalErrorBuilder<IFDError>;
 
-}
+} // namespace nix
diff --git a/src/libexpr/eval-gc.cc b/src/libexpr/eval-gc.cc
index 5a4ecf035..0d25f38f6 100644
--- a/src/libexpr/eval-gc.cc
+++ b/src/libexpr/eval-gc.cc
@@ -15,9 +15,8 @@
 #    include <pthread_np.h>
 #  endif
 
-#  include <gc/gc.h>
-#  include <gc/gc_cpp.h>
 #  include <gc/gc_allocator.h>
+#  include <gc/gc_tiny_fl.h> // For GC_GRANULE_BYTES
 
 #  include <boost/coroutine2/coroutine.hpp>
 #  include <boost/coroutine2/protected_fixedsize_stack.hpp>
@@ -28,6 +27,18 @@
 namespace nix {
 
 #if NIX_USE_BOEHMGC
+
+/*
+ * Ensure that Boehm satisfies our alignment requirements. This is the default configuration [^]
+ * and this assertion should never break for any platform. Let's assert it just in case.
+ *
+ * This alignment is particularly useful to be able to use aligned
+ * load/store instructions for loading/writing Values.
+ *
+ * [^]: https://github.com/bdwgc/bdwgc/blob/54ac18ccbc5a833dd7edaff94a10ab9b65044d61/include/gc/gc_tiny_fl.h#L31-L33
+ */
+static_assert(sizeof(void *) * 2 == GC_GRANULE_BYTES, "Boehm GC must use GC_GRANULE_WORDS = 2");
+
 /* Called when the Boehm GC runs out of memory. */
 static void * oomHandler(size_t requested)
 {
@@ -53,6 +64,9 @@ static inline void initGCReal()
 
     GC_INIT();
 
+    /* Enable parallel marking. */
+    GC_allow_register_threads();
+
     /* Register valid displacements in case we are using alignment niches
        for storing the type information. This way tagged pointers are considered
        to be valid, even when they are not aligned. */
diff --git a/src/libexpr/eval-profiler-settings.cc b/src/libexpr/eval-profiler-settings.cc
index 1a35d4a2d..57bd6a46d 100644
--- a/src/libexpr/eval-profiler-settings.cc
+++ b/src/libexpr/eval-profiler-settings.cc
@@ -1,6 +1,5 @@
 #include "nix/expr/eval-profiler-settings.hh"
 #include "nix/util/configuration.hh"
-#include "nix/util/logging.hh" /* Needs to be included before config-impl.hh */
 #include "nix/util/config-impl.hh"
 #include "nix/util/abstract-setting-to-json.hh"
 
@@ -46,4 +45,4 @@ NLOHMANN_JSON_SERIALIZE_ENUM(
 /* Explicit instantiation of templates */
 template class BaseSetting<EvalProfilerMode>;
 
-}
+} // namespace nix
diff --git a/src/libexpr/eval-profiler.cc b/src/libexpr/eval-profiler.cc
index b65bc3a4d..ba92faf18 100644
--- a/src/libexpr/eval-profiler.cc
+++ b/src/libexpr/eval-profiler.cc
@@ -185,7 +185,7 @@ FrameInfo SampleStack::getPrimOpFrameInfo(const PrimOp & primOp, std::span<Value
                 /* Error context strings don't actually matter, since we ignore all eval errors. */
                 state.forceAttrs(*args[0], pos, "");
                 auto attrs = args[0]->attrs();
-                auto nameAttr = state.getAttr(state.sName, attrs, "");
+                auto nameAttr = state.getAttr(state.s.name, attrs, "");
                 auto drvName = std::string(state.forceStringNoCtx(*nameAttr->value, pos, ""));
                 return DerivationStrictFrameInfo{.callPos = pos, .drvName = std::move(drvName)};
             } catch (...) {
@@ -211,7 +211,7 @@ FrameInfo SampleStack::getFrameInfoFromValueAndPos(const Value & v, std::span<Va
         /* Resolve primOp eagerly. Must not hold on to a reference to a Value. */
         return PrimOpFrameInfo{.expr = v.primOpAppPrimOp(), .callPos = pos};
     else if (state.isFunctor(v)) {
-        const auto functor = v.attrs()->get(state.sFunctor);
+        const auto functor = v.attrs()->get(state.s.functor);
         if (auto pos_ = posCache.lookup(pos); std::holds_alternative<std::monostate>(pos_.origin))
             /* HACK: In case callsite position is unresolved. */
             return FunctorFrameInfo{.pos = functor->pos};
@@ -352,4 +352,4 @@ ref<EvalProfiler> makeSampleStackProfiler(EvalState & state, std::filesystem::pa
     return make_ref<SampleStack>(state, profileFile, period);
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/eval-settings.cc b/src/libexpr/eval-settings.cc
index 659c01a9e..93db5aebb 100644
--- a/src/libexpr/eval-settings.cc
+++ b/src/libexpr/eval-settings.cc
@@ -19,12 +19,14 @@ Strings EvalSettings::parseNixPath(const std::string & s)
         auto start2 = p;
 
         while (p != s.end() && *p != ':') {
-            if (*p == '=') start2 = p + 1;
+            if (*p == '=')
+                start2 = p + 1;
             ++p;
         }
 
         if (p == s.end()) {
-            if (p != start) res.push_back(std::string(start, p));
+            if (p != start)
+                res.push_back(std::string(start, p));
             break;
         }
 
@@ -32,10 +34,12 @@ Strings EvalSettings::parseNixPath(const std::string & s)
             auto prefix = std::string(start2, s.end());
             if (EvalSettings::isPseudoUrl(prefix) || hasPrefix(prefix, "flake:")) {
                 ++p;
-                while (p != s.end() && *p != ':') ++p;
+                while (p != s.end() && *p != ':')
+                    ++p;
             }
             res.push_back(std::string(start, p));
-            if (p == s.end()) break;
+            if (p == s.end())
+                break;
         }
 
         ++p;
@@ -75,11 +79,14 @@ Strings EvalSettings::getDefaultNixPath()
 
 bool EvalSettings::isPseudoUrl(std::string_view s)
 {
-    if (s.compare(0, 8, "channel:") == 0) return true;
+    if (s.compare(0, 8, "channel:") == 0)
+        return true;
     size_t pos = s.find("://");
-    if (pos == std::string::npos) return false;
+    if (pos == std::string::npos)
+        return false;
     std::string scheme(s, 0, pos);
-    return scheme == "http" || scheme == "https" || scheme == "file" || scheme == "channel" || scheme == "git" || scheme == "s3" || scheme == "ssh";
+    return scheme == "http" || scheme == "https" || scheme == "file" || scheme == "channel" || scheme == "git"
+           || scheme == "s3" || scheme == "ssh";
 }
 
 std::string EvalSettings::resolvePseudoUrl(std::string_view url)
@@ -98,9 +105,7 @@ const std::string & EvalSettings::getCurrentSystem() const
 
 Path getNixDefExpr()
 {
-    return settings.useXDGBaseDirectories
-        ? getStateDir() + "/defexpr"
-        : getHome() + "/.nix-defexpr";
+    return settings.useXDGBaseDirectories ? getStateDir() + "/defexpr" : getHome() + "/.nix-defexpr";
 }
 
 } // namespace nix
\ No newline at end of file
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 1321e00a5..dc8fd4d38 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -6,6 +6,7 @@
 #include "nix/util/exit.hh"
 #include "nix/util/types.hh"
 #include "nix/util/util.hh"
+#include "nix/util/environment-variables.hh"
 #include "nix/store/store-api.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/downstream-placeholder.hh"
@@ -21,6 +22,7 @@
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/fetchers/tarball.hh"
 #include "nix/fetchers/input-cache.hh"
+#include "nix/util/current-process.hh"
 
 #include "parser-tab.hh"
 
@@ -37,10 +39,6 @@
 #include <nlohmann/json.hpp>
 #include <boost/container/small_vector.hpp>
 
-#ifndef _WIN32 // TODO use portable implementation
-#  include <sys/resource.h>
-#endif
-
 #include "nix/util/strings-inline.hh"
 
 using json = nlohmann::json;
@@ -51,11 +49,11 @@ static char * allocString(size_t size)
 {
     char * t;
     t = (char *) GC_MALLOC_ATOMIC(size);
-    if (!t) throw std::bad_alloc();
+    if (!t)
+        throw std::bad_alloc();
     return t;
 }
 
-
 // When there's no need to write to the string, we can optimize away empty
 // string allocations.
 // This function handles makeImmutableString(std::string_view()) by returning
@@ -71,14 +69,14 @@ static const char * makeImmutableString(std::string_view s)
     return t;
 }
 
-
 RootValue allocRootValue(Value * v)
 {
     return std::allocate_shared<Value *>(traceable_allocator<Value *>(), v);
 }
 
 // Pretty print types for assertion errors
-std::ostream & operator << (std::ostream & os, const ValueType t) {
+std::ostream & operator<<(std::ostream & os, const ValueType t)
+{
     os << showType(t);
     return os;
 }
@@ -102,70 +100,84 @@ void Value::print(EvalState & state, std::ostream & str, PrintOptions options)
 
 std::string_view showType(ValueType type, bool withArticle)
 {
-    #define WA(a, w) withArticle ? a " " w : w
+#define WA(a, w) withArticle ? a " " w : w
     switch (type) {
-        case nInt: return WA("an", "integer");
-        case nBool: return WA("a", "Boolean");
-        case nString: return WA("a", "string");
-        case nPath: return WA("a", "path");
-        case nNull: return "null";
-        case nAttrs: return WA("a", "set");
-        case nList: return WA("a", "list");
-        case nFunction: return WA("a", "function");
-        case nExternal: return WA("an", "external value");
-        case nFloat: return WA("a", "float");
-        case nThunk: return WA("a", "thunk");
+    case nInt:
+        return WA("an", "integer");
+    case nBool:
+        return WA("a", "Boolean");
+    case nString:
+        return WA("a", "string");
+    case nPath:
+        return WA("a", "path");
+    case nNull:
+        return "null";
+    case nAttrs:
+        return WA("a", "set");
+    case nList:
+        return WA("a", "list");
+    case nFunction:
+        return WA("a", "function");
+    case nExternal:
+        return WA("an", "external value");
+    case nFloat:
+        return WA("a", "float");
+    case nThunk:
+        return WA("a", "thunk");
     }
     unreachable();
 }
 
-
 std::string showType(const Value & v)
 {
-    // Allow selecting a subset of enum values
-    #pragma GCC diagnostic push
-    #pragma GCC diagnostic ignored "-Wswitch-enum"
+// Allow selecting a subset of enum values
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch-enum"
     switch (v.getInternalType()) {
-        case tString: return v.context() ? "a string with context" : "a string";
-        case tPrimOp:
-            return fmt("the built-in function '%s'", std::string(v.primOp()->name));
-        case tPrimOpApp:
-            return fmt("the partially applied built-in function '%s'", v.primOpAppPrimOp()->name);
-        case tExternal: return v.external()->showType();
-        case tThunk: return v.isBlackhole() ? "a black hole" : "a thunk";
-        case tApp: return "a function application";
+    case tString:
+        return v.context() ? "a string with context" : "a string";
+    case tPrimOp:
+        return fmt("the built-in function '%s'", std::string(v.primOp()->name));
+    case tPrimOpApp:
+        return fmt("the partially applied built-in function '%s'", v.primOpAppPrimOp()->name);
+    case tExternal:
+        return v.external()->showType();
+    case tThunk:
+        return v.isBlackhole() ? "a black hole" : "a thunk";
+    case tApp:
+        return "a function application";
     default:
         return std::string(showType(v.type()));
     }
-    #pragma GCC diagnostic pop
+#pragma GCC diagnostic pop
 }
 
 PosIdx Value::determinePos(const PosIdx pos) const
 {
-    // Allow selecting a subset of enum values
-    #pragma GCC diagnostic push
-    #pragma GCC diagnostic ignored "-Wswitch-enum"
+// Allow selecting a subset of enum values
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch-enum"
     switch (getInternalType()) {
-        case tAttrs: return attrs()->pos;
-        case tLambda: return lambda().fun->pos;
-        case tApp: return app().left->determinePos(pos);
-        default: return pos;
+    case tAttrs:
+        return attrs()->pos;
+    case tLambda:
+        return lambda().fun->pos;
+    case tApp:
+        return app().left->determinePos(pos);
+    default:
+        return pos;
     }
-    #pragma GCC diagnostic pop
+#pragma GCC diagnostic pop
 }
 
 bool Value::isTrivial() const
 {
-    return
-        !isa<tApp, tPrimOpApp>()
-        && (!isa<tThunk>()
-            || (dynamic_cast<ExprAttrs *>(thunk().expr)
-                && ((ExprAttrs *) thunk().expr)->dynamicAttrs.empty())
-            || dynamic_cast<ExprLambda *>(thunk().expr)
-            || dynamic_cast<ExprList *>(thunk().expr));
+    return !isa<tApp, tPrimOpApp>()
+           && (!isa<tThunk>()
+               || (dynamic_cast<ExprAttrs *>(thunk().expr) && ((ExprAttrs *) thunk().expr)->dynamicAttrs.empty())
+               || dynamic_cast<ExprLambda *>(thunk().expr) || dynamic_cast<ExprList *>(thunk().expr));
 }
 
-
 static Symbol getName(const AttrName & name, EvalState & state, Env & env)
 {
     if (name.symbol) {
@@ -188,124 +200,64 @@ EvalState::EvalState(
     std::shared_ptr<Store> buildStore)
     : fetchSettings{fetchSettings}
     , settings{settings}
-    , sWith(symbols.create("<with>"))
-    , sOutPath(symbols.create("outPath"))
-    , sDrvPath(symbols.create("drvPath"))
-    , sType(symbols.create("type"))
-    , sMeta(symbols.create("meta"))
-    , sName(symbols.create("name"))
-    , sValue(symbols.create("value"))
-    , sSystem(symbols.create("system"))
-    , sOverrides(symbols.create("__overrides"))
-    , sOutputs(symbols.create("outputs"))
-    , sOutputName(symbols.create("outputName"))
-    , sIgnoreNulls(symbols.create("__ignoreNulls"))
-    , sFile(symbols.create("file"))
-    , sLine(symbols.create("line"))
-    , sColumn(symbols.create("column"))
-    , sFunctor(symbols.create("__functor"))
-    , sToString(symbols.create("__toString"))
-    , sRight(symbols.create("right"))
-    , sWrong(symbols.create("wrong"))
-    , sStructuredAttrs(symbols.create("__structuredAttrs"))
-    , sJson(symbols.create("__json"))
-    , sAllowedReferences(symbols.create("allowedReferences"))
-    , sAllowedRequisites(symbols.create("allowedRequisites"))
-    , sDisallowedReferences(symbols.create("disallowedReferences"))
-    , sDisallowedRequisites(symbols.create("disallowedRequisites"))
-    , sMaxSize(symbols.create("maxSize"))
-    , sMaxClosureSize(symbols.create("maxClosureSize"))
-    , sBuilder(symbols.create("builder"))
-    , sArgs(symbols.create("args"))
-    , sContentAddressed(symbols.create("__contentAddressed"))
-    , sImpure(symbols.create("__impure"))
-    , sOutputHash(symbols.create("outputHash"))
-    , sOutputHashAlgo(symbols.create("outputHashAlgo"))
-    , sOutputHashMode(symbols.create("outputHashMode"))
-    , sRecurseForDerivations(symbols.create("recurseForDerivations"))
-    , sDescription(symbols.create("description"))
-    , sSelf(symbols.create("self"))
-    , sEpsilon(symbols.create(""))
-    , sStartSet(symbols.create("startSet"))
-    , sOperator(symbols.create("operator"))
-    , sKey(symbols.create("key"))
-    , sPath(symbols.create("path"))
-    , sPrefix(symbols.create("prefix"))
-    , sOutputSpecified(symbols.create("outputSpecified"))
-    , exprSymbols{
-        .sub = symbols.create("__sub"),
-        .lessThan = symbols.create("__lessThan"),
-        .mul = symbols.create("__mul"),
-        .div = symbols.create("__div"),
-        .or_ = symbols.create("or"),
-        .findFile = symbols.create("__findFile"),
-        .nixPath = symbols.create("__nixPath"),
-        .body = symbols.create("body"),
-    }
+    , symbols(StaticEvalSymbols::staticSymbolTable())
     , repair(NoRepair)
-    , emptyBindings(0)
-    , storeFS(
-        makeMountedSourceAccessor(
-            {
-                {CanonPath::root, makeEmptySourceAccessor()},
-                /* In the pure eval case, we can simply require
-                   valid paths. However, in the *impure* eval
-                   case this gets in the way of the union
-                   mechanism, because an invalid access in the
-                   upper layer will *not* be caught by the union
-                   source accessor, but instead abort the entire
-                   lookup.
+    , storeFS(makeMountedSourceAccessor({
+          {CanonPath::root, makeEmptySourceAccessor()},
+          /* In the pure eval case, we can simply require
+             valid paths. However, in the *impure* eval
+             case this gets in the way of the union
+             mechanism, because an invalid access in the
+             upper layer will *not* be caught by the union
+             source accessor, but instead abort the entire
+             lookup.
 
-                   This happens when the store dir in the
-                   ambient file system has a path (e.g. because
-                   another Nix store there), but the relocated
-                   store does not.
+             This happens when the store dir in the
+             ambient file system has a path (e.g. because
+             another Nix store there), but the relocated
+             store does not.
 
-                   TODO make the various source accessors doing
-                   access control all throw the same type of
-                   exception, and make union source accessor
-                   catch it, so we don't need to do this hack.
-                 */
-                {CanonPath(store->storeDir), store->getFSAccessor(settings.pureEval)},
-            }))
-    , rootFS(
-        ({
-            /* In pure eval mode, we provide a filesystem that only
-               contains the Nix store.
+             TODO make the various source accessors doing
+             access control all throw the same type of
+             exception, and make union source accessor
+             catch it, so we don't need to do this hack.
+           */
+          {CanonPath(store->storeDir), store->getFSAccessor(settings.pureEval)},
+      }))
+    , rootFS(({
+        /* In pure eval mode, we provide a filesystem that only
+           contains the Nix store.
 
-               If we have a chroot store and pure eval is not enabled,
-               use a union accessor to make the chroot store available
-               at its logical location while still having the
-               underlying directory available. This is necessary for
-               instance if we're evaluating a file from the physical
-               /nix/store while using a chroot store. */
-            auto accessor = getFSSourceAccessor();
+           If we have a chroot store and pure eval is not enabled,
+           use a union accessor to make the chroot store available
+           at its logical location while still having the
+           underlying directory available. This is necessary for
+           instance if we're evaluating a file from the physical
+           /nix/store while using a chroot store. */
+        auto accessor = getFSSourceAccessor();
 
-            auto realStoreDir = dirOf(store->toRealPath(StorePath::dummy));
-            if (settings.pureEval || store->storeDir != realStoreDir) {
-                accessor = settings.pureEval
-                    ? storeFS
-                    : makeUnionSourceAccessor({accessor, storeFS});
-            }
+        auto realStoreDir = dirOf(store->toRealPath(StorePath::dummy));
+        if (settings.pureEval || store->storeDir != realStoreDir) {
+            accessor = settings.pureEval ? storeFS : makeUnionSourceAccessor({accessor, storeFS});
+        }
 
-            /* Apply access control if needed. */
-            if (settings.restrictEval || settings.pureEval)
-                accessor = AllowListSourceAccessor::create(accessor, {}, {},
-                    [&settings](const CanonPath & path) -> RestrictedPathError {
-                        auto modeInformation = settings.pureEval
-                            ? "in pure evaluation mode (use '--impure' to override)"
-                            : "in restricted mode";
-                        throw RestrictedPathError("access to absolute path '%1%' is forbidden %2%", path, modeInformation);
-                    });
+        /* Apply access control if needed. */
+        if (settings.restrictEval || settings.pureEval)
+            accessor = AllowListSourceAccessor::create(
+                accessor, {}, {}, [&settings](const CanonPath & path) -> RestrictedPathError {
+                    auto modeInformation = settings.pureEval ? "in pure evaluation mode (use '--impure' to override)"
+                                                             : "in restricted mode";
+                    throw RestrictedPathError("access to absolute path '%1%' is forbidden %2%", path, modeInformation);
+                });
 
-            accessor;
-        }))
+        accessor;
+    }))
     , corepkgsFS(make_ref<MemorySourceAccessor>())
     , internalFS(make_ref<MemorySourceAccessor>())
     , derivationInternal{corepkgsFS->addFile(
-        CanonPath("derivation-internal.nix"),
-        #include "primops/derivation.nix.gen.hh"
-    )}
+          CanonPath("derivation-internal.nix"),
+#include "primops/derivation.nix.gen.hh"
+          )}
     , store(store)
     , buildStore(buildStore ? buildStore : store)
     , inputCache(fetchers::InputCache::create())
@@ -332,20 +284,11 @@ EvalState::EvalState(
 
     static_assert(sizeof(Env) <= 16, "environment must be <= 16 bytes");
 
-    vEmptyList.mkList(buildList(0));
-    vNull.mkNull();
-    vTrue.mkBool(true);
-    vFalse.mkBool(false);
-    vStringRegular.mkString("regular");
-    vStringDirectory.mkString("directory");
-    vStringSymlink.mkString("symlink");
-    vStringUnknown.mkString("unknown");
-
     /* Construct the Nix expression search path. */
     assert(lookupPath.elements.empty());
     if (!settings.pureEval) {
         for (auto & i : lookupPathFromArguments.elements) {
-            lookupPath.elements.emplace_back(LookupPath::Elem {i});
+            lookupPath.elements.emplace_back(LookupPath::Elem{i});
         }
         /* $NIX_PATH overriding regular settings is implemented as a hack in `initGC()` */
         for (auto & i : settings.nixPath.get()) {
@@ -365,7 +308,7 @@ EvalState::EvalState(
 
     corepkgsFS->addFile(
         CanonPath("fetchurl.nix"),
-        #include "fetchurl.nix.gen.hh"
+#include "fetchurl.nix.gen.hh"
     );
 
     createBaseEnv(settings);
@@ -376,18 +319,15 @@ EvalState::EvalState(
 
     switch (settings.evalProfilerMode) {
     case EvalProfilerMode::flamegraph:
-        profiler.addProfiler(makeSampleStackProfiler(
-            *this, settings.evalProfileFile.get(), settings.evalProfilerFrequency));
+        profiler.addProfiler(
+            makeSampleStackProfiler(*this, settings.evalProfileFile.get(), settings.evalProfilerFrequency));
         break;
     case EvalProfilerMode::disabled:
         break;
     }
 }
 
-EvalState::~EvalState()
-{
-}
-
+EvalState::~EvalState() {}
 
 void EvalState::allowPath(const Path & path)
 {
@@ -403,7 +343,8 @@ void EvalState::allowPath(const StorePath & storePath)
 
 void EvalState::allowClosure(const StorePath & storePath)
 {
-    if (!rootFS.dynamic_pointer_cast<AllowListSourceAccessor>()) return;
+    if (!rootFS.dynamic_pointer_cast<AllowListSourceAccessor>())
+        return;
 
     StorePathSet closure;
     store->computeFSClosure(storePath, closure);
@@ -420,10 +361,8 @@ void EvalState::allowAndSetStorePathString(const StorePath & storePath, Value &
 
 inline static bool isJustSchemePrefix(std::string_view prefix)
 {
-    return
-        !prefix.empty()
-        && prefix[prefix.size() - 1] == ':'
-        && isValidSchemeName(prefix.substr(0, prefix.size() - 1));
+    return !prefix.empty() && prefix[prefix.size() - 1] == ':'
+           && isValidSchemeName(prefix.substr(0, prefix.size() - 1));
 }
 
 bool isAllowedURI(std::string_view uri, const Strings & allowedUris)
@@ -434,18 +373,14 @@ bool isAllowedURI(std::string_view uri, const Strings & allowedUris)
     for (auto & prefix : allowedUris) {
         if (uri == prefix
             // Allow access to subdirectories of the prefix.
-            || (uri.size() > prefix.size()
-                && prefix.size() > 0
-                && hasPrefix(uri, prefix)
+            || (uri.size() > prefix.size() && prefix.size() > 0 && hasPrefix(uri, prefix)
                 && (
                     // Allow access to subdirectories of the prefix.
                     prefix[prefix.size() - 1] == '/'
                     || uri[prefix.size()] == '/'
 
                     // Allow access to whole schemes
-                    || isJustSchemePrefix(prefix)
-                    )
-                ))
+                    || isJustSchemePrefix(prefix))))
             return true;
     }
 
@@ -454,9 +389,11 @@ bool isAllowedURI(std::string_view uri, const Strings & allowedUris)
 
 void EvalState::checkURI(const std::string & uri)
 {
-    if (!settings.restrictEval) return;
+    if (!settings.restrictEval)
+        return;
 
-    if (isAllowedURI(uri, settings.allowedUris.get())) return;
+    if (isAllowedURI(uri, settings.allowedUris.get()))
+        return;
 
     /* If the URI is a path, then check it against allowedPaths as
        well. */
@@ -475,7 +412,6 @@ void EvalState::checkURI(const std::string & uri)
     throw RestrictedPathError("access to URI '%s' is forbidden in restricted mode", uri);
 }
 
-
 Value * EvalState::addConstant(const std::string & name, Value & v, Constant info)
 {
     Value * v2 = allocValue();
@@ -484,7 +420,6 @@ Value * EvalState::addConstant(const std::string & name, Value & v, Constant inf
     return v2;
 }
 
-
 void EvalState::addConstant(const std::string & name, Value * v, Constant info)
 {
     auto name2 = name.substr(0, 2) == "__" ? name.substr(2) : name;
@@ -506,7 +441,6 @@ void EvalState::addConstant(const std::string & name, Value * v, Constant info)
     }
 }
 
-
 void PrimOp::check()
 {
     if (arity > maxPrimOpArity) {
@@ -514,14 +448,12 @@ void PrimOp::check()
     }
 }
 
-
 std::ostream & operator<<(std::ostream & output, const PrimOp & primOp)
 {
     output << "primop " << primOp.name;
     return output;
 }
 
-
 const PrimOp * Value::primOpAppPrimOp() const
 {
     Value * left = primOpApp().left;
@@ -536,14 +468,12 @@ const PrimOp * Value::primOpAppPrimOp() const
     return left->primOp();
 }
 
-
 void Value::mkPrimOp(PrimOp * p)
 {
     p->check();
     setStorage(p);
 }
 
-
 Value * EvalState::addPrimOp(PrimOp && primOp)
 {
     /* Hack to make constants lazy: turn them into a application of
@@ -554,10 +484,13 @@ Value * EvalState::addPrimOp(PrimOp && primOp)
         vPrimOp->mkPrimOp(new PrimOp(primOp));
         Value v;
         v.mkApp(vPrimOp, vPrimOp);
-        return addConstant(primOp.name, v, {
-            .type = nThunk, // FIXME
-            .doc = primOp.doc,
-        });
+        return addConstant(
+            primOp.name,
+            v,
+            {
+                .type = nThunk, // FIXME
+                .doc = primOp.doc,
+            });
     }
 
     auto envName = symbols.create(primOp.name);
@@ -578,13 +511,11 @@ Value * EvalState::addPrimOp(PrimOp && primOp)
     return v;
 }
 
-
 Value & EvalState::getBuiltins()
 {
     return *baseEnv.values[0];
 }
 
-
 Value & EvalState::getBuiltin(const std::string & name)
 {
     auto it = getBuiltins().attrs()->get(symbols.create(name));
@@ -594,13 +525,12 @@ Value & EvalState::getBuiltin(const std::string & name)
         error<EvalError>("builtin '%1%' not found", name).debugThrow();
 }
 
-
 std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
 {
     if (v.isPrimOp()) {
         auto v2 = &v;
         if (auto * doc = v2->primOp()->doc)
-            return Doc {
+            return Doc{
                 .pos = {},
                 .name = v2->primOp()->name,
                 .arity = v2->primOp()->arity,
@@ -626,11 +556,10 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
 
         if (name.empty()) {
             s << "Function ";
-        }
-        else {
+        } else {
             s << "Function `" << name << "`";
             if (pos)
-                s << "\\\n  … " ;
+                s << "\\\n  … ";
             else
                 s << "\\\n";
         }
@@ -643,7 +572,7 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
 
         s << docStr;
 
-        return Doc {
+        return Doc{
             .pos = pos,
             .name = name,
             .arity = 0, // FIXME: figure out how deep by syntax only? It's not semantically useful though...
@@ -653,7 +582,7 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
     }
     if (isFunctor(v)) {
         try {
-            Value & functor = *v.attrs()->find(sFunctor)->value;
+            Value & functor = *v.attrs()->get(s.functor)->value;
             Value * vp[] = {&v};
             Value partiallyApplied;
             // The first parameter is not user-provided, and may be
@@ -664,8 +593,7 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
             callFunction(functor, vp, partiallyApplied, noPos);
             auto _level = addCallDepth(noPos);
             return getDoc(partiallyApplied);
-        }
-        catch (Error & e) {
+        } catch (Error & e) {
             e.addTrace(nullptr, "while partially calling '%1%' to retrieve documentation", "__functor");
             throw;
         }
@@ -673,7 +601,6 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
     return {};
 }
 
-
 // just for the current level of StaticEnv, not the whole chain.
 void printStaticEnvBindings(const SymbolTable & st, const StaticEnv & se)
 {
@@ -721,13 +648,12 @@ void printEnvBindings(const SymbolTable & st, const StaticEnv & se, const Env &
         std::cout << ANSI_NORMAL;
         std::cout << std::endl;
         if (se.isWith)
-            printWithBindings(st, env);  // probably nothing there for the top level.
+            printWithBindings(st, env); // probably nothing there for the top level.
         std::cout << std::endl;
-
     }
 }
 
-void printEnvBindings(const EvalState &es, const Expr & expr, const Env & env)
+void printEnvBindings(const EvalState & es, const Expr & expr, const Env & env)
 {
     // just print the names for now
     auto se = es.getStaticEnv(expr);
@@ -765,13 +691,18 @@ std::unique_ptr<ValMap> mapStaticEnvBindings(const SymbolTable & st, const Stati
 /**
  * Sets `inDebugger` to true on construction and false on destruction.
  */
-class DebuggerGuard {
+class DebuggerGuard
+{
     bool & inDebugger;
 public:
-    DebuggerGuard(bool & inDebugger) : inDebugger(inDebugger) {
+    DebuggerGuard(bool & inDebugger)
+        : inDebugger(inDebugger)
+    {
         inDebugger = true;
     }
-    ~DebuggerGuard() {
+
+    ~DebuggerGuard()
+    {
         inDebugger = false;
     }
 };
@@ -821,60 +752,52 @@ void EvalState::runDebugRepl(const Error * error, const Env & env, const Expr &
         return nullptr;
     }();
 
-    if (error)
-    {
+    if (error) {
         printError("%s\n", error->what());
 
         if (trylevel > 0 && error->info().level != lvlInfo)
-            printError("This exception occurred in a 'tryEval' call. Use " ANSI_GREEN "--ignore-try" ANSI_NORMAL " to skip these.\n");
+            printError(
+                "This exception occurred in a 'tryEval' call. Use " ANSI_GREEN "--ignore-try" ANSI_NORMAL
+                " to skip these.\n");
     }
 
     auto se = getStaticEnv(expr);
     if (se) {
         auto vm = mapStaticEnvBindings(symbols, *se.get(), env);
         DebuggerGuard _guard(inDebugger);
-        auto exitStatus = (debugRepl)(ref<EvalState>(shared_from_this()), *vm);
+        auto exitStatus = (debugRepl) (ref<EvalState>(shared_from_this()), *vm);
         switch (exitStatus) {
-            case ReplExitStatus::QuitAll:
-                if (error)
-                    throw *error;
-                throw Exit(0);
-            case ReplExitStatus::Continue:
-                break;
-            default:
-                unreachable();
+        case ReplExitStatus::QuitAll:
+            if (error)
+                throw *error;
+            throw Exit(0);
+        case ReplExitStatus::Continue:
+            break;
+        default:
+            unreachable();
         }
     }
 }
 
 template<typename... Args>
-void EvalState::addErrorTrace(Error & e, const Args & ... formatArgs) const
+void EvalState::addErrorTrace(Error & e, const Args &... formatArgs) const
 {
     e.addTrace(nullptr, HintFmt(formatArgs...));
 }
 
 template<typename... Args>
-void EvalState::addErrorTrace(Error & e, const PosIdx pos, const Args & ... formatArgs) const
+void EvalState::addErrorTrace(Error & e, const PosIdx pos, const Args &... formatArgs) const
 {
     e.addTrace(positions[pos], HintFmt(formatArgs...));
 }
 
 template<typename... Args>
 static std::unique_ptr<DebugTraceStacker> makeDebugTraceStacker(
-    EvalState & state,
-    Expr & expr,
-    Env & env,
-    std::variant<Pos, PosIdx> pos,
-    const Args & ... formatArgs)
+    EvalState & state, Expr & expr, Env & env, std::variant<Pos, PosIdx> pos, const Args &... formatArgs)
 {
-    return std::make_unique<DebugTraceStacker>(state,
-        DebugTrace {
-            .pos = std::move(pos),
-            .expr = expr,
-            .env = env,
-            .hint = HintFmt(formatArgs...),
-            .isError = false
-        });
+    return std::make_unique<DebugTraceStacker>(
+        state,
+        DebugTrace{.pos = std::move(pos), .expr = expr, .env = env, .hint = HintFmt(formatArgs...), .isError = false});
 }
 
 DebugTraceStacker::DebugTraceStacker(EvalState & evalState, DebugTrace t)
@@ -888,16 +811,14 @@ DebugTraceStacker::DebugTraceStacker(EvalState & evalState, DebugTrace t)
 
 void Value::mkString(std::string_view s)
 {
-    mkString(makeImmutableString(s));
+    mkStringNoCopy(makeImmutableString(s));
 }
 
-
-static const char * * encodeContext(const NixStringContext & context)
+static const char ** encodeContext(const NixStringContext & context)
 {
     if (!context.empty()) {
         size_t n = 0;
-        auto ctx = (const char * *)
-            allocBytes((context.size() + 1) * sizeof(char *));
+        auto ctx = (const char **) allocBytes((context.size() + 1) * sizeof(char *));
         for (auto & i : context) {
             ctx[n++] = makeImmutableString({i.to_string()});
         }
@@ -909,12 +830,12 @@ static const char * * encodeContext(const NixStringContext & context)
 
 void Value::mkString(std::string_view s, const NixStringContext & context)
 {
-    mkString(makeImmutableString(s), encodeContext(context));
+    mkStringNoCopy(makeImmutableString(s), encodeContext(context));
 }
 
 void Value::mkStringMove(const char * s, const NixStringContext & context)
 {
-    mkString(s, encodeContext(context));
+    mkStringNoCopy(s, encodeContext(context));
 }
 
 void Value::mkPath(const SourcePath & path)
@@ -922,41 +843,49 @@ void Value::mkPath(const SourcePath & path)
     mkPath(&*path.accessor, makeImmutableString(path.path.abs()));
 }
 
-
 inline Value * EvalState::lookupVar(Env * env, const ExprVar & var, bool noEval)
 {
-    for (auto l = var.level; l; --l, env = env->up) ;
+    for (auto l = var.level; l; --l, env = env->up)
+        ;
 
-    if (!var.fromWith) return env->values[var.displ];
+    if (!var.fromWith)
+        return env->values[var.displ];
 
     // This early exit defeats the `maybeThunk` optimization for variables from `with`,
     // The added complexity of handling this appears to be similarly in cost, or
     // the cases where applicable were insignificant in the first place.
-    if (noEval) return nullptr;
+    if (noEval)
+        return nullptr;
 
     auto * fromWith = var.fromWith;
     while (1) {
         forceAttrs(*env->values[0], fromWith->pos, "while evaluating the first subexpression of a with expression");
         if (auto j = env->values[0]->attrs()->get(var.name)) {
-            if (countCalls) attrSelects[j->pos]++;
+            if (countCalls)
+                attrSelects[j->pos]++;
             return j->value;
         }
         if (!fromWith->parentWith)
-            error<UndefinedVarError>("undefined variable '%1%'", symbols[var.name]).atPos(var.pos).withFrame(*env, var).debugThrow();
-        for (size_t l = fromWith->prevWith; l; --l, env = env->up) ;
+            error<UndefinedVarError>("undefined variable '%1%'", symbols[var.name])
+                .atPos(var.pos)
+                .withFrame(*env, var)
+                .debugThrow();
+        for (size_t l = fromWith->prevWith; l; --l, env = env->up)
+            ;
         fromWith = fromWith->parentWith;
     }
 }
 
 ListBuilder::ListBuilder(EvalState & state, size_t size)
     : size(size)
-    , elems(size <= 2 ? inlineElems : (Value * *) allocBytes(size * sizeof(Value *)))
+    , elems(size <= 2 ? inlineElems : (Value **) allocBytes(size * sizeof(Value *)))
 {
     state.nrListElems += size;
 }
 
-Value * EvalState::getBool(bool b) {
-    return b ? &vTrue : &vFalse;
+Value * EvalState::getBool(bool b)
+{
+    return b ? &Value::vTrue : &Value::vFalse;
 }
 
 unsigned long nrThunks = 0;
@@ -967,36 +896,32 @@ static inline void mkThunk(Value & v, Env & env, Expr * expr)
     nrThunks++;
 }
 
-
 void EvalState::mkThunk_(Value & v, Expr * expr)
 {
     mkThunk(v, baseEnv, expr);
 }
 
-
 void EvalState::mkPos(Value & v, PosIdx p)
 {
     auto origin = positions.originOf(p);
     if (auto path = std::get_if<SourcePath>(&origin)) {
         auto attrs = buildBindings(3);
-        attrs.alloc(sFile).mkString(path->path.abs());
-        makePositionThunks(*this, p, attrs.alloc(sLine), attrs.alloc(sColumn));
+        attrs.alloc(s.file).mkString(path->path.abs());
+        makePositionThunks(*this, p, attrs.alloc(s.line), attrs.alloc(s.column));
         v.mkAttrs(attrs);
     } else
         v.mkNull();
 }
 
-
 void EvalState::mkStorePathString(const StorePath & p, Value & v)
 {
     v.mkString(
         store->printStorePath(p),
-        NixStringContext {
-            NixStringContextElem::Opaque { .path = p },
+        NixStringContext{
+            NixStringContextElem::Opaque{.path = p},
         });
 }
 
-
 std::string EvalState::mkOutputStringRaw(
     const SingleDerivedPath::Built & b,
     std::optional<StorePath> optStaticOutputPath,
@@ -1004,64 +929,56 @@ std::string EvalState::mkOutputStringRaw(
 {
     /* In practice, this is testing for the case of CA derivations, or
        dynamic derivations. */
-    return optStaticOutputPath
-        ? store->printStorePath(std::move(*optStaticOutputPath))
-        /* Downstream we would substitute this for an actual path once
-           we build the floating CA derivation */
-        : DownstreamPlaceholder::fromSingleDerivedPathBuilt(b, xpSettings).render();
+    return optStaticOutputPath ? store->printStorePath(std::move(*optStaticOutputPath))
+                               /* Downstream we would substitute this for an actual path once
+                                  we build the floating CA derivation */
+                               : DownstreamPlaceholder::fromSingleDerivedPathBuilt(b, xpSettings).render();
 }
 
-
 void EvalState::mkOutputString(
     Value & value,
     const SingleDerivedPath::Built & b,
     std::optional<StorePath> optStaticOutputPath,
     const ExperimentalFeatureSettings & xpSettings)
 {
-    value.mkString(
-        mkOutputStringRaw(b, optStaticOutputPath, xpSettings),
-        NixStringContext { b });
+    value.mkString(mkOutputStringRaw(b, optStaticOutputPath, xpSettings), NixStringContext{b});
 }
 
-
-std::string EvalState::mkSingleDerivedPathStringRaw(
-    const SingleDerivedPath & p)
+std::string EvalState::mkSingleDerivedPathStringRaw(const SingleDerivedPath & p)
 {
-    return std::visit(overloaded {
-        [&](const SingleDerivedPath::Opaque & o) {
-            return store->printStorePath(o.path);
-        },
-        [&](const SingleDerivedPath::Built & b) {
-            auto optStaticOutputPath = std::visit(overloaded {
-                [&](const SingleDerivedPath::Opaque & o) {
-                    auto drv = store->readDerivation(o.path);
-                    auto i = drv.outputs.find(b.output);
-                    if (i == drv.outputs.end())
-                        throw Error("derivation '%s' does not have output '%s'", b.drvPath->to_string(*store), b.output);
-                    return i->second.path(*store, drv.name, b.output);
-                },
-                [&](const SingleDerivedPath::Built & o) -> std::optional<StorePath> {
-                    return std::nullopt;
-                },
-            }, b.drvPath->raw());
-            return mkOutputStringRaw(b, optStaticOutputPath);
-        }
-    }, p.raw());
+    return std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Opaque & o) { return store->printStorePath(o.path); },
+            [&](const SingleDerivedPath::Built & b) {
+                auto optStaticOutputPath = std::visit(
+                    overloaded{
+                        [&](const SingleDerivedPath::Opaque & o) {
+                            auto drv = store->readDerivation(o.path);
+                            auto i = drv.outputs.find(b.output);
+                            if (i == drv.outputs.end())
+                                throw Error(
+                                    "derivation '%s' does not have output '%s'",
+                                    b.drvPath->to_string(*store),
+                                    b.output);
+                            return i->second.path(*store, drv.name, b.output);
+                        },
+                        [&](const SingleDerivedPath::Built & o) -> std::optional<StorePath> { return std::nullopt; },
+                    },
+                    b.drvPath->raw());
+                return mkOutputStringRaw(b, optStaticOutputPath);
+            }},
+        p.raw());
 }
 
-
-void EvalState::mkSingleDerivedPathString(
-    const SingleDerivedPath & p,
-    Value & v)
+void EvalState::mkSingleDerivedPathString(const SingleDerivedPath & p, Value & v)
 {
     v.mkString(
         mkSingleDerivedPathStringRaw(p),
-        NixStringContext {
+        NixStringContext{
             std::visit([](auto && v) -> NixStringContextElem { return v; }, p),
         });
 }
 
-
 /* Create a thunk for the delayed computation of the given expression
    in the given environment.  But if the expression is a variable,
    then look it up right away.  This significantly reduces the number
@@ -1073,17 +990,18 @@ Value * Expr::maybeThunk(EvalState & state, Env & env)
     return v;
 }
 
-
 Value * ExprVar::maybeThunk(EvalState & state, Env & env)
 {
     Value * v = state.lookupVar(&env, *this, true);
     /* The value might not be initialised in the environment yet.
        In that case, ignore it. */
-    if (v) { state.nrAvoided++; return v; }
+    if (v) {
+        state.nrAvoided++;
+        return v;
+    }
     return Expr::maybeThunk(state, env);
 }
 
-
 Value * ExprString::maybeThunk(EvalState & state, Env & env)
 {
     state.nrAvoided++;
@@ -1108,7 +1026,6 @@ Value * ExprPath::maybeThunk(EvalState & state, Env & env)
     return &v;
 }
 
-
 void EvalState::evalFile(const SourcePath & path, Value & v, bool mustBeTrivial)
 {
     FileEvalCache::iterator i;
@@ -1136,19 +1053,18 @@ void EvalState::evalFile(const SourcePath & path, Value & v, bool mustBeTrivial)
     fileParseCache.emplace(resolvedPath, e);
 
     try {
-        auto dts = debugRepl
-            ? makeDebugTraceStacker(
-                *this,
-                *e,
-                this->baseEnv,
-                e->getPos(),
-                "while evaluating the file '%1%':", resolvedPath.to_string())
-            : nullptr;
+        auto dts = debugRepl ? makeDebugTraceStacker(
+                                   *this,
+                                   *e,
+                                   this->baseEnv,
+                                   e->getPos(),
+                                   "while evaluating the file '%1%':",
+                                   resolvedPath.to_string())
+                             : nullptr;
 
         // Enforce that 'flake.nix' is a direct attrset, not a
         // computation.
-        if (mustBeTrivial &&
-            !(dynamic_cast<ExprAttrs *>(e)))
+        if (mustBeTrivial && !(dynamic_cast<ExprAttrs *>(e)))
             error<EvalError>("file '%s' must be an attribute set", path).debugThrow();
         eval(e, v);
     } catch (Error & e) {
@@ -1157,24 +1073,24 @@ void EvalState::evalFile(const SourcePath & path, Value & v, bool mustBeTrivial)
     }
 
     fileEvalCache.emplace(resolvedPath, v);
-    if (path != resolvedPath) fileEvalCache.emplace(path, v);
+    if (path != resolvedPath)
+        fileEvalCache.emplace(path, v);
 }
 
-
 void EvalState::resetFileCache()
 {
     fileEvalCache.clear();
+    fileEvalCache.rehash(0);
     fileParseCache.clear();
+    fileParseCache.rehash(0);
     inputCache->clear();
 }
 
-
 void EvalState::eval(Expr * e, Value & v)
 {
     e->eval(*this, baseEnv, v);
 }
 
-
 inline bool EvalState::evalBool(Env & env, Expr * e, const PosIdx pos, std::string_view errorCtx)
 {
     try {
@@ -1182,10 +1098,10 @@ inline bool EvalState::evalBool(Env & env, Expr * e, const PosIdx pos, std::stri
         e->eval(*this, env, v);
         if (v.type() != nBool)
             error<TypeError>(
-                 "expected a Boolean but found %1%: %2%",
-                 showType(v),
-                 ValuePrinter(*this, v, errorPrintOptions)
-             ).atPos(pos).withFrame(env, *e).debugThrow();
+                "expected a Boolean but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+                .atPos(pos)
+                .withFrame(env, *e)
+                .debugThrow();
         return v.boolean();
     } catch (Error & e) {
         e.addTrace(positions[pos], errorCtx);
@@ -1193,36 +1109,31 @@ inline bool EvalState::evalBool(Env & env, Expr * e, const PosIdx pos, std::stri
     }
 }
 
-
 inline void EvalState::evalAttrs(Env & env, Expr * e, Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     try {
         e->eval(*this, env, v);
         if (v.type() != nAttrs)
             error<TypeError>(
-                "expected a set but found %1%: %2%",
-                showType(v),
-                ValuePrinter(*this, v, errorPrintOptions)
-            ).withFrame(env, *e).debugThrow();
+                "expected a set but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+                .withFrame(env, *e)
+                .debugThrow();
     } catch (Error & e) {
         e.addTrace(positions[pos], errorCtx);
         throw;
     }
 }
 
-
 void Expr::eval(EvalState & state, Env & env, Value & v)
 {
     unreachable();
 }
 
-
 void ExprInt::eval(EvalState & state, Env & env, Value & v)
 {
     v = this->v;
 }
 
-
 void ExprFloat::eval(EvalState & state, Env & env, Value & v)
 {
     v = this->v;
@@ -1233,13 +1144,11 @@ void ExprString::eval(EvalState & state, Env & env, Value & v)
     v = this->v;
 }
 
-
 void ExprPath::eval(EvalState & state, Env & env, Value & v)
 {
     v = this->v;
 }
 
-
 Env * ExprAttrs::buildInheritFromEnv(EvalState & state, Env & up)
 {
     Env & inheritEnv = state.allocEnv(inheritFromExprs->size());
@@ -1266,7 +1175,7 @@ void ExprAttrs::eval(EvalState & state, Env & env, Value & v)
         dynamicEnv = &env2;
         Env * inheritEnv = inheritFromExprs ? buildInheritFromEnv(state, env2) : nullptr;
 
-        AttrDefs::iterator overrides = attrs.find(state.sOverrides);
+        AttrDefs::iterator overrides = attrs.find(state.s.overrides);
         bool hasOverrides = overrides != attrs.end();
 
         /* The recursive attributes are evaluated in the new
@@ -1294,8 +1203,11 @@ void ExprAttrs::eval(EvalState & state, Env & env, Value & v)
            Hence we need __overrides.) */
         if (hasOverrides) {
             Value * vOverrides = (*bindings.bindings)[overrides->second.displ].value;
-            state.forceAttrs(*vOverrides, [&]() { return vOverrides->determinePos(noPos); }, "while evaluating the `__overrides` attribute");
-            bindings.grow(state.allocBindings(bindings.capacity() + vOverrides->attrs()->size()));
+            state.forceAttrs(
+                *vOverrides,
+                [&]() { return vOverrides->determinePos(noPos); },
+                "while evaluating the `__overrides` attribute");
+            bindings.grow(state.buildBindings(bindings.capacity() + vOverrides->attrs()->size()));
             for (auto & i : *vOverrides->attrs()) {
                 AttrDefs::iterator j = attrs.find(i.name);
                 if (j != attrs.end()) {
@@ -1312,9 +1224,7 @@ void ExprAttrs::eval(EvalState & state, Env & env, Value & v)
         Env * inheritEnv = inheritFromExprs ? buildInheritFromEnv(state, env) : nullptr;
         for (auto & i : attrs)
             bindings.insert(
-                i.first,
-                i.second.e->maybeThunk(state, *i.second.chooseByKind(&env, &env, inheritEnv)),
-                i.second.pos);
+                i.first, i.second.e->maybeThunk(state, *i.second.chooseByKind(&env, &env, inheritEnv)), i.second.pos);
     }
 
     /* Dynamic attrs apply *after* rec and __overrides. */
@@ -1330,7 +1240,12 @@ void ExprAttrs::eval(EvalState & state, Env & env, Value & v)
             // FIXME: inefficient
             bindings.bindings->sort();
         if (auto j = bindings.bindings->get(nameSym))
-            state.error<EvalError>("dynamic attribute '%1%' already defined at %2%", state.symbols[nameSym], state.positions[j->pos]).atPos(i.pos).withFrame(env, *this).debugThrow();
+            state
+                .error<EvalError>(
+                    "dynamic attribute '%1%' already defined at %2%", state.symbols[nameSym], state.positions[j->pos])
+                .atPos(i.pos)
+                .withFrame(env, *this)
+                .debugThrow();
 
         i.valueExpr->setName(nameSym);
         /* Keep sorted order so find can catch duplicates */
@@ -1343,7 +1258,6 @@ void ExprAttrs::eval(EvalState & state, Env & env, Value & v)
     v.mkAttrs(sort ? bindings.finish() : bindings.alreadySorted());
 }
 
-
 void ExprLet::eval(EvalState & state, Env & env, Value & v)
 {
     /* Create a new environment that contains the attributes in this
@@ -1358,26 +1272,16 @@ void ExprLet::eval(EvalState & state, Env & env, Value & v)
        environment. */
     Displacement displ = 0;
     for (auto & i : attrs->attrs) {
-        env2.values[displ++] = i.second.e->maybeThunk(
-            state,
-            *i.second.chooseByKind(&env2, &env, inheritEnv));
+        env2.values[displ++] = i.second.e->maybeThunk(state, *i.second.chooseByKind(&env2, &env, inheritEnv));
     }
 
     auto dts = state.debugRepl
-        ? makeDebugTraceStacker(
-            state,
-            *this,
-            env2,
-            getPos(),
-            "while evaluating a '%1%' expression",
-            "let"
-        )
-        : nullptr;
+                   ? makeDebugTraceStacker(state, *this, env2, getPos(), "while evaluating a '%1%' expression", "let")
+                   : nullptr;
 
     body->eval(state, env2, v);
 }
 
-
 void ExprList::eval(EvalState & state, Env & env, Value & v)
 {
     auto list = state.buildList(elems.size());
@@ -1386,16 +1290,14 @@ void ExprList::eval(EvalState & state, Env & env, Value & v)
     v.mkList(list);
 }
 
-
 Value * ExprList::maybeThunk(EvalState & state, Env & env)
 {
     if (elems.empty()) {
-        return &state.vEmptyList;
+        return &Value::vEmptyList;
     }
     return Expr::maybeThunk(state, env);
 }
 
-
 void ExprVar::eval(EvalState & state, Env & env, Value & v)
 {
     Value * v2 = state.lookupVar(&env, *this, false);
@@ -1403,13 +1305,15 @@ void ExprVar::eval(EvalState & state, Env & env, Value & v)
     v = *v2;
 }
 
-
 static std::string showAttrPath(EvalState & state, Env & env, const AttrPath & attrPath)
 {
     std::ostringstream out;
     bool first = true;
     for (auto & i : attrPath) {
-        if (!first) out << '.'; else first = false;
+        if (!first)
+            out << '.';
+        else
+            first = false;
         try {
             out << state.symbols[getName(i, state, env)];
         } catch (Error & e) {
@@ -1422,7 +1326,6 @@ static std::string showAttrPath(EvalState & state, Env & env, const AttrPath & a
     return out.str();
 }
 
-
 void ExprSelect::eval(EvalState & state, Env & env, Value & v)
 {
     Value vTmp;
@@ -1432,15 +1335,14 @@ void ExprSelect::eval(EvalState & state, Env & env, Value & v)
     e->eval(state, env, vTmp);
 
     try {
-        auto dts = state.debugRepl
-            ? makeDebugTraceStacker(
-                state,
-                *this,
-                env,
-                getPos(),
-                "while evaluating the attribute '%1%'",
-                showAttrPath(state, env, attrPath))
-            : nullptr;
+        auto dts = state.debugRepl ? makeDebugTraceStacker(
+                                         state,
+                                         *this,
+                                         env,
+                                         getPos(),
+                                         "while evaluating the attribute '%1%'",
+                                         showAttrPath(state, env, attrPath))
+                                   : nullptr;
 
         for (auto & i : attrPath) {
             state.nrLookups++;
@@ -1448,9 +1350,7 @@ void ExprSelect::eval(EvalState & state, Env & env, Value & v)
             auto name = getName(i, state, env);
             if (def) {
                 state.forceValue(*vAttrs, pos);
-                if (vAttrs->type() != nAttrs ||
-                    !(j = vAttrs->attrs()->get(name)))
-                {
+                if (vAttrs->type() != nAttrs || !(j = vAttrs->attrs()->get(name))) {
                     def->eval(state, env, v);
                     return;
                 }
@@ -1462,23 +1362,27 @@ void ExprSelect::eval(EvalState & state, Env & env, Value & v)
                         allAttrNames.insert(std::string(state.symbols[attr.name]));
                     auto suggestions = Suggestions::bestMatches(allAttrNames, state.symbols[name]);
                     state.error<EvalError>("attribute '%1%' missing", state.symbols[name])
-                        .atPos(pos).withSuggestions(suggestions).withFrame(env, *this).debugThrow();
+                        .atPos(pos)
+                        .withSuggestions(suggestions)
+                        .withFrame(env, *this)
+                        .debugThrow();
                 }
             }
             vAttrs = j->value;
             pos2 = j->pos;
-            if (state.countCalls) state.attrSelects[pos2]++;
+            if (state.countCalls)
+                state.attrSelects[pos2]++;
         }
 
-        state.forceValue(*vAttrs, (pos2 ? pos2 : this->pos ) );
+        state.forceValue(*vAttrs, (pos2 ? pos2 : this->pos));
 
     } catch (Error & e) {
         if (pos2) {
             auto pos2r = state.positions[pos2];
             auto origin = std::get_if<SourcePath>(&pos2r.origin);
             if (!(origin && *origin == state.derivationInternal))
-                state.addErrorTrace(e, pos2, "while evaluating the attribute '%1%'",
-                    showAttrPath(state, env, attrPath));
+                state.addErrorTrace(
+                    e, pos2, "while evaluating the attribute '%1%'", showAttrPath(state, env, attrPath));
         }
         throw;
     }
@@ -1502,7 +1406,6 @@ Symbol ExprSelect::evalExceptFinalSelect(EvalState & state, Env & env, Value & a
     return name;
 }
 
-
 void ExprOpHasAttr::eval(EvalState & state, Env & env, Value & v)
 {
     Value vTmp;
@@ -1514,9 +1417,7 @@ void ExprOpHasAttr::eval(EvalState & state, Env & env, Value & v)
         state.forceValue(*vAttrs, getPos());
         const Attr * j;
         auto name = getName(i, state, env);
-        if (vAttrs->type() == nAttrs &&
-            (j = vAttrs->attrs()->get(name)))
-        {
+        if (vAttrs->type() == nAttrs && (j = vAttrs->attrs()->get(name))) {
             vAttrs = j->value;
         } else {
             v.mkBool(false);
@@ -1527,7 +1428,6 @@ void ExprOpHasAttr::eval(EvalState & state, Env & env, Value & v)
     v.mkBool(true);
 }
 
-
 void ExprLambda::eval(EvalState & state, Env & env, Value & v)
 {
     v.mkLambda(&env, this);
@@ -1541,7 +1441,7 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
     if (neededHooks.test(EvalProfiler::preFunctionCall)) [[unlikely]]
         profiler.preFunctionCallHook(*this, fun, args, pos);
 
-    Finally traceExit_{[&](){
+    Finally traceExit_{[&]() {
         if (profiler.getNeededHooks().test(EvalProfiler::postFunctionCall)) [[unlikely]]
             profiler.postFunctionCallHook(*this, fun, args, pos);
     }};
@@ -1550,8 +1450,7 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
 
     Value vCur(fun);
 
-    auto makeAppChain = [&]()
-    {
+    auto makeAppChain = [&]() {
         vRes = vCur;
         for (auto arg : args) {
             auto fun2 = allocValue();
@@ -1568,9 +1467,7 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
 
             ExprLambda & lambda(*vCur.lambda().fun);
 
-            auto size =
-                (!lambda.arg ? 0 : 1) +
-                (lambda.hasFormals() ? lambda.formals->formals.size() : 0);
+            auto size = (!lambda.arg ? 0 : 1) + (lambda.hasFormals() ? lambda.formals->formals.size() : 0);
             Env & env2(allocEnv(size));
             env2.up = vCur.lambda().env;
 
@@ -1582,7 +1479,8 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
                 try {
                     forceAttrs(*args[0], lambda.pos, "while evaluating the value passed for the lambda argument");
                 } catch (Error & e) {
-                    if (pos) e.addTrace(positions[pos], "from call site");
+                    if (pos)
+                        e.addTrace(positions[pos], "from call site");
                     throw;
                 }
 
@@ -1597,13 +1495,14 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
                     auto j = args[0]->attrs()->get(i.name);
                     if (!j) {
                         if (!i.def) {
-                            error<TypeError>("function '%1%' called without required argument '%2%'",
-                                             (lambda.name ? std::string(symbols[lambda.name]) : "anonymous lambda"),
-                                             symbols[i.name])
-                                    .atPos(lambda.pos)
-                                    .withTrace(pos, "from call site")
-                                    .withFrame(*fun.lambda().env, lambda)
-                                    .debugThrow();
+                            error<TypeError>(
+                                "function '%1%' called without required argument '%2%'",
+                                (lambda.name ? std::string(symbols[lambda.name]) : "anonymous lambda"),
+                                symbols[i.name])
+                                .atPos(lambda.pos)
+                                .withTrace(pos, "from call site")
+                                .withFrame(*vCur.lambda().env, lambda)
+                                .debugThrow();
                         }
                         env2.values[displ++] = i.def->maybeThunk(*this, env2);
                     } else {
@@ -1623,13 +1522,14 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
                             for (auto & formal : lambda.formals->formals)
                                 formalNames.insert(std::string(symbols[formal.name]));
                             auto suggestions = Suggestions::bestMatches(formalNames, symbols[i.name]);
-                            error<TypeError>("function '%1%' called with unexpected argument '%2%'",
-                                             (lambda.name ? std::string(symbols[lambda.name]) : "anonymous lambda"),
-                                             symbols[i.name])
+                            error<TypeError>(
+                                "function '%1%' called with unexpected argument '%2%'",
+                                (lambda.name ? std::string(symbols[lambda.name]) : "anonymous lambda"),
+                                symbols[i.name])
                                 .atPos(lambda.pos)
                                 .withTrace(pos, "from call site")
                                 .withSuggestions(suggestions)
-                                .withFrame(*fun.lambda().env, lambda)
+                                .withFrame(*vCur.lambda().env, lambda)
                                 .debugThrow();
                         }
                     unreachable();
@@ -1637,18 +1537,20 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
             }
 
             nrFunctionCalls++;
-            if (countCalls) incrFunctionCall(&lambda);
+            if (countCalls)
+                incrFunctionCall(&lambda);
 
             /* Evaluate the body. */
             try {
                 auto dts = debugRepl
-                    ? makeDebugTraceStacker(
-                        *this, *lambda.body, env2, lambda.pos,
-                        "while calling %s",
-                        lambda.name
-                        ? concatStrings("'", symbols[lambda.name], "'")
-                        : "anonymous lambda")
-                    : nullptr;
+                               ? makeDebugTraceStacker(
+                                     *this,
+                                     *lambda.body,
+                                     env2,
+                                     lambda.pos,
+                                     "while calling %s",
+                                     lambda.name ? concatStrings("'", symbols[lambda.name], "'") : "anonymous lambda")
+                               : nullptr;
 
                 lambda.body->eval(*this, env2, vCur);
             } catch (Error & e) {
@@ -1657,10 +1559,9 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
                         e,
                         lambda.pos,
                         "while calling %s",
-                        lambda.name
-                        ? concatStrings("'", symbols[lambda.name], "'")
-                        : "anonymous lambda");
-                    if (pos) addErrorTrace(e, pos, "from call site");
+                        lambda.name ? concatStrings("'", symbols[lambda.name], "'") : "anonymous lambda");
+                    if (pos)
+                        addErrorTrace(e, pos, "from call site");
                 }
                 throw;
             }
@@ -1681,7 +1582,8 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
                 auto * fn = vCur.primOp();
 
                 nrPrimOpCalls++;
-                if (countCalls) primOpCalls[fn->name]++;
+                if (countCalls)
+                    primOpCalls[fn->name]++;
 
                 try {
                     fn->fun(*this, vCur.determinePos(noPos), args.data(), vCur);
@@ -1725,12 +1627,14 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
 
                 auto fn = primOp->primOp();
                 nrPrimOpCalls++;
-                if (countCalls) primOpCalls[fn->name]++;
+                if (countCalls)
+                    primOpCalls[fn->name]++;
 
                 try {
                     // TODO:
                     // 1. Unify this and above code. Heavily redundant.
-                    // 2. Create a fake env (arg1, arg2, etc.) and a fake expr (arg1: arg2: etc: builtins.name arg1 arg2 etc)
+                    // 2. Create a fake env (arg1, arg2, etc.) and a fake expr (arg1: arg2: etc: builtins.name arg1 arg2
+                    // etc)
                     //    so the debugger allows to inspect the wrong parameters passed to the builtin.
                     fn->fun(*this, vCur.determinePos(noPos), vArgs, vCur);
                 } catch (Error & e) {
@@ -1743,7 +1647,7 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
             }
         }
 
-        else if (vCur.type() == nAttrs && (functor = vCur.attrs()->get(sFunctor))) {
+        else if (vCur.type() == nAttrs && (functor = vCur.attrs()->get(s.functor))) {
             /* 'vCur' may be allocated on the stack of the calling
                function, but for functors we may keep a reference, so
                heap-allocate a copy and use that instead. */
@@ -1760,9 +1664,9 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
 
         else
             error<TypeError>(
-                    "attempt to call something which is not a function but %1%: %2%",
-                    showType(vCur),
-                    ValuePrinter(*this, vCur, errorPrintOptions))
+                "attempt to call something which is not a function but %1%: %2%",
+                showType(vCur),
+                ValuePrinter(*this, vCur, errorPrintOptions))
                 .atPos(pos)
                 .debugThrow();
     }
@@ -1770,18 +1674,10 @@ void EvalState::callFunction(Value & fun, std::span<Value *> args, Value & vRes,
     vRes = vCur;
 }
 
-
 void ExprCall::eval(EvalState & state, Env & env, Value & v)
 {
-    auto dts = state.debugRepl
-        ? makeDebugTraceStacker(
-            state,
-            *this,
-            env,
-            getPos(),
-            "while calling a function"
-        )
-        : nullptr;
+    auto dts =
+        state.debugRepl ? makeDebugTraceStacker(state, *this, env, getPos(), "while calling a function") : nullptr;
 
     Value vFun;
     fun->eval(state, env, vFun);
@@ -1799,7 +1695,6 @@ void ExprCall::eval(EvalState & state, Env & env, Value & v)
     state.callFunction(vFun, vArgs, v, pos);
 }
 
-
 // Lifted out of callFunction() because it creates a temporary that
 // prevents tail-call optimisation.
 void EvalState::incrFunctionCall(ExprLambda * fun)
@@ -1807,7 +1702,6 @@ void EvalState::incrFunctionCall(ExprLambda * fun)
     functionCalls[fun]++;
 }
 
-
 void EvalState::autoCallFunction(const Bindings & args, Value & fun, Value & res)
 {
     auto pos = fun.determinePos(noPos);
@@ -1815,8 +1709,8 @@ void EvalState::autoCallFunction(const Bindings & args, Value & fun, Value & res
     forceValue(fun, pos);
 
     if (fun.type() == nAttrs) {
-        auto found = fun.attrs()->find(sFunctor);
-        if (found != fun.attrs()->end()) {
+        auto found = fun.attrs()->get(s.functor);
+        if (found) {
             Value * v = allocValue();
             callFunction(*found->value, fun, *v, pos);
             forceValue(*v, pos);
@@ -1844,12 +1738,16 @@ void EvalState::autoCallFunction(const Bindings & args, Value & fun, Value & res
             if (j) {
                 attrs.insert(*j);
             } else if (!i.def) {
-                error<MissingArgumentError>(R"(cannot evaluate a function that has an argument without a value ('%1%')
+                error<MissingArgumentError>(
+                    R"(cannot evaluate a function that has an argument without a value ('%1%')
 Nix attempted to evaluate a function as a top level expression; in
 this case it must have its arguments supplied either by default
 values, or passed explicitly with '--arg' or '--argstr'. See
-https://nixos.org/manual/nix/stable/language/constructs.html#functions.)", symbols[i.name])
-                    .atPos(i.pos).withFrame(*fun.lambda().env, *fun.lambda().fun).debugThrow();
+https://nix.dev/manual/nix/stable/language/syntax.html#functions.)",
+                    symbols[i.name])
+                    .atPos(i.pos)
+                    .withFrame(*fun.lambda().env, *fun.lambda().fun)
+                    .debugThrow();
             }
         }
     }
@@ -1857,7 +1755,6 @@ https://nixos.org/manual/nix/stable/language/constructs.html#functions.)", symbo
     callFunction(fun, allocValue()->mkAttrs(attrs), res, pos);
 }
 
-
 void ExprWith::eval(EvalState & state, Env & env, Value & v)
 {
     Env & env2(state.allocEnv(1));
@@ -1867,14 +1764,12 @@ void ExprWith::eval(EvalState & state, Env & env, Value & v)
     body->eval(state, env2, v);
 }
 
-
 void ExprIf::eval(EvalState & state, Env & env, Value & v)
 {
     // We cheat in the parser, and pass the position of the condition as the position of the if itself.
     (state.evalBool(env, cond, pos, "while evaluating a branch condition") ? then : else_)->eval(state, env, v);
 }
 
-
 void ExprAssert::eval(EvalState & state, Env & env, Value & v)
 {
     if (!state.evalBool(env, cond, pos, "in the condition of the assert statement")) {
@@ -1884,8 +1779,10 @@ void ExprAssert::eval(EvalState & state, Env & env, Value & v)
 
         if (auto eq = dynamic_cast<ExprOpEq *>(cond)) {
             try {
-                Value v1; eq->e1->eval(state, env, v1);
-                Value v2; eq->e2->eval(state, env, v2);
+                Value v1;
+                eq->e1->eval(state, env, v1);
+                Value v2;
+                eq->e2->eval(state, env, v2);
                 state.assertEqValues(v1, v2, eq->pos, "in an equality assertion");
             } catch (AssertionError & e) {
                 e.addTrace(state.positions[pos], "while evaluating the condition of the assertion '%s'", exprStr);
@@ -1898,47 +1795,50 @@ void ExprAssert::eval(EvalState & state, Env & env, Value & v)
     body->eval(state, env, v);
 }
 
-
 void ExprOpNot::eval(EvalState & state, Env & env, Value & v)
 {
     v.mkBool(!state.evalBool(env, e, getPos(), "in the argument of the not operator")); // XXX: FIXME: !
 }
 
-
 void ExprOpEq::eval(EvalState & state, Env & env, Value & v)
 {
-    Value v1; e1->eval(state, env, v1);
-    Value v2; e2->eval(state, env, v2);
+    Value v1;
+    e1->eval(state, env, v1);
+    Value v2;
+    e2->eval(state, env, v2);
     v.mkBool(state.eqValues(v1, v2, pos, "while testing two values for equality"));
 }
 
-
 void ExprOpNEq::eval(EvalState & state, Env & env, Value & v)
 {
-    Value v1; e1->eval(state, env, v1);
-    Value v2; e2->eval(state, env, v2);
+    Value v1;
+    e1->eval(state, env, v1);
+    Value v2;
+    e2->eval(state, env, v2);
     v.mkBool(!state.eqValues(v1, v2, pos, "while testing two values for inequality"));
 }
 
-
 void ExprOpAnd::eval(EvalState & state, Env & env, Value & v)
 {
-    v.mkBool(state.evalBool(env, e1, pos, "in the left operand of the AND (&&) operator") && state.evalBool(env, e2, pos, "in the right operand of the AND (&&) operator"));
+    v.mkBool(
+        state.evalBool(env, e1, pos, "in the left operand of the AND (&&) operator")
+        && state.evalBool(env, e2, pos, "in the right operand of the AND (&&) operator"));
 }
 
-
 void ExprOpOr::eval(EvalState & state, Env & env, Value & v)
 {
-    v.mkBool(state.evalBool(env, e1, pos, "in the left operand of the OR (||) operator") || state.evalBool(env, e2, pos, "in the right operand of the OR (||) operator"));
+    v.mkBool(
+        state.evalBool(env, e1, pos, "in the left operand of the OR (||) operator")
+        || state.evalBool(env, e2, pos, "in the right operand of the OR (||) operator"));
 }
 
-
 void ExprOpImpl::eval(EvalState & state, Env & env, Value & v)
 {
-    v.mkBool(!state.evalBool(env, e1, pos, "in the left operand of the IMPL (->) operator") || state.evalBool(env, e2, pos, "in the right operand of the IMPL (->) operator"));
+    v.mkBool(
+        !state.evalBool(env, e1, pos, "in the left operand of the IMPL (->) operator")
+        || state.evalBool(env, e2, pos, "in the right operand of the IMPL (->) operator"));
 }
 
-
 void ExprOpUpdate::eval(EvalState & state, Env & env, Value & v)
 {
     Value v1, v2;
@@ -1947,8 +1847,14 @@ void ExprOpUpdate::eval(EvalState & state, Env & env, Value & v)
 
     state.nrOpUpdates++;
 
-    if (v1.attrs()->size() == 0) { v = v2; return; }
-    if (v2.attrs()->size() == 0) { v = v1; return; }
+    if (v1.attrs()->size() == 0) {
+        v = v2;
+        return;
+    }
+    if (v2.attrs()->size() == 0) {
+        v = v1;
+        return;
+    }
 
     auto attrs = state.buildBindings(v1.attrs()->size() + v2.attrs()->size());
 
@@ -1960,33 +1866,36 @@ void ExprOpUpdate::eval(EvalState & state, Env & env, Value & v)
     while (i != v1.attrs()->end() && j != v2.attrs()->end()) {
         if (i->name == j->name) {
             attrs.insert(*j);
-            ++i; ++j;
-        }
-        else if (i->name < j->name)
+            ++i;
+            ++j;
+        } else if (i->name < j->name)
             attrs.insert(*i++);
         else
             attrs.insert(*j++);
     }
 
-    while (i != v1.attrs()->end()) attrs.insert(*i++);
-    while (j != v2.attrs()->end()) attrs.insert(*j++);
+    while (i != v1.attrs()->end())
+        attrs.insert(*i++);
+    while (j != v2.attrs()->end())
+        attrs.insert(*j++);
 
     v.mkAttrs(attrs.alreadySorted());
 
     state.nrOpUpdateValuesCopied += v.attrs()->size();
 }
 
-
 void ExprOpConcatLists::eval(EvalState & state, Env & env, Value & v)
 {
-    Value v1; e1->eval(state, env, v1);
-    Value v2; e2->eval(state, env, v2);
-    Value * lists[2] = { &v1, &v2 };
+    Value v1;
+    e1->eval(state, env, v1);
+    Value v2;
+    e2->eval(state, env, v2);
+    Value * lists[2] = {&v1, &v2};
     state.concatLists(v, 2, lists, pos, "while evaluating one of the elements to concatenate");
 }
 
-
-void EvalState::concatLists(Value & v, size_t nrLists, Value * const * lists, const PosIdx pos, std::string_view errorCtx)
+void EvalState::concatLists(
+    Value & v, size_t nrLists, Value * const * lists, const PosIdx pos, std::string_view errorCtx)
 {
     nrListConcats++;
 
@@ -1996,7 +1905,8 @@ void EvalState::concatLists(Value & v, size_t nrLists, Value * const * lists, co
         forceList(*lists[n], pos, errorCtx);
         auto l = lists[n]->listSize();
         len += l;
-        if (l) nonEmpty = lists[n];
+        if (l)
+            nonEmpty = lists[n];
     }
 
     if (nonEmpty && len == nonEmpty->listSize()) {
@@ -2016,7 +1926,6 @@ void EvalState::concatLists(Value & v, size_t nrLists, Value * const * lists, co
     v.mkList(list);
 }
 
-
 void ExprConcatStrings::eval(EvalState & state, Env & env, Value & v)
 {
     NixStringContext context;
@@ -2031,7 +1940,8 @@ void ExprConcatStrings::eval(EvalState & state, Env & env, Value & v)
     const auto str = [&] {
         std::string result;
         result.reserve(sSize);
-        for (const auto & part : s) result += *part;
+        for (const auto & part : s)
+            result += *part;
         return result;
     };
     /* c_str() is not str().c_str() because we want to create a string
@@ -2070,7 +1980,9 @@ void ExprConcatStrings::eval(EvalState & state, Env & env, Value & v)
                 if (auto checked = newN.valueChecked(); checked.has_value()) {
                     n = NixInt(*checked);
                 } else {
-                    state.error<EvalError>("integer overflow in adding %1% + %2%", n, vTmp.integer()).atPos(i_pos).debugThrow();
+                    state.error<EvalError>("integer overflow in adding %1% + %2%", n, vTmp.integer())
+                        .atPos(i_pos)
+                        .debugThrow();
                 }
             } else if (vTmp.type() == nFloat) {
                 // Upgrade the type from int to float;
@@ -2078,22 +1990,28 @@ void ExprConcatStrings::eval(EvalState & state, Env & env, Value & v)
                 nf = n.value;
                 nf += vTmp.fpoint();
             } else
-                state.error<EvalError>("cannot add %1% to an integer", showType(vTmp)).atPos(i_pos).withFrame(env, *this).debugThrow();
+                state.error<EvalError>("cannot add %1% to an integer", showType(vTmp))
+                    .atPos(i_pos)
+                    .withFrame(env, *this)
+                    .debugThrow();
         } else if (firstType == nFloat) {
             if (vTmp.type() == nInt) {
                 nf += vTmp.integer().value;
             } else if (vTmp.type() == nFloat) {
                 nf += vTmp.fpoint();
             } else
-                state.error<EvalError>("cannot add %1% to a float", showType(vTmp)).atPos(i_pos).withFrame(env, *this).debugThrow();
+                state.error<EvalError>("cannot add %1% to a float", showType(vTmp))
+                    .atPos(i_pos)
+                    .withFrame(env, *this)
+                    .debugThrow();
         } else {
-            if (s.empty()) s.reserve(es->size());
+            if (s.empty())
+                s.reserve(es->size());
             /* skip canonization of first path, which would only be not
             canonized in the first place if it's coming from a ./${foo} type
             path */
-            auto part = state.coerceToString(i_pos, vTmp, context,
-                                             "while evaluating a path segment",
-                                             false, firstType == nString, !first);
+            auto part = state.coerceToString(
+                i_pos, vTmp, context, "while evaluating a path segment", false, firstType == nString, !first);
             sSize += part->size();
             s.emplace_back(std::move(part));
         }
@@ -2107,13 +2025,15 @@ void ExprConcatStrings::eval(EvalState & state, Env & env, Value & v)
         v.mkFloat(nf);
     else if (firstType == nPath) {
         if (!context.empty())
-            state.error<EvalError>("a string that refers to a store path cannot be appended to a path").atPos(pos).withFrame(env, *this).debugThrow();
+            state.error<EvalError>("a string that refers to a store path cannot be appended to a path")
+                .atPos(pos)
+                .withFrame(env, *this)
+                .debugThrow();
         v.mkPath(state.rootPath(CanonPath(str())));
     } else
         v.mkStringMove(c_str(), context);
 }
 
-
 void ExprPos::eval(EvalState & state, Env & env, Value & v)
 {
     state.mkPos(v, pos);
@@ -2124,10 +2044,9 @@ void ExprBlackHole::eval(EvalState & state, [[maybe_unused]] Env & env, Value &
     throwInfiniteRecursionError(state, v);
 }
 
-[[gnu::noinline]] [[noreturn]] void ExprBlackHole::throwInfiniteRecursionError(EvalState & state, Value &v) {
-    state.error<InfiniteRecursionError>("infinite recursion encountered")
-        .atPos(v.determinePos(noPos))
-        .debugThrow();
+[[gnu::noinline]] [[noreturn]] void ExprBlackHole::throwInfiniteRecursionError(EvalState & state, Value & v)
+{
+    state.error<InfiniteRecursionError>("infinite recursion encountered").atPos(v.determinePos(noPos)).debugThrow();
 }
 
 // always force this to be separate, otherwise forceValue may inline it and take
@@ -2146,7 +2065,6 @@ void EvalState::tryFixupBlackHolePos(Value & v, PosIdx pos)
     }
 }
 
-
 void EvalState::forceValueDeep(Value & v)
 {
     std::set<const Value *> seen;
@@ -2154,7 +2072,8 @@ void EvalState::forceValueDeep(Value & v)
     std::function<void(Value & v)> recurse;
 
     recurse = [&](Value & v) {
-        if (!seen.insert(&v).second) return;
+        if (!seen.insert(&v).second)
+            return;
 
         forceValue(v, v.determinePos(noPos));
 
@@ -2162,10 +2081,14 @@ void EvalState::forceValueDeep(Value & v)
             for (auto & i : *v.attrs())
                 try {
                     // If the value is a thunk, we're evaling. Otherwise no trace necessary.
-                    auto dts = debugRepl && i.value->isThunk()
-                        ? makeDebugTraceStacker(*this, *i.value->thunk().expr, *i.value->thunk().env, i.pos,
-                            "while evaluating the attribute '%1%'", symbols[i.name])
-                        : nullptr;
+                    auto dts = debugRepl && i.value->isThunk() ? makeDebugTraceStacker(
+                                                                     *this,
+                                                                     *i.value->thunk().expr,
+                                                                     *i.value->thunk().env,
+                                                                     i.pos,
+                                                                     "while evaluating the attribute '%1%'",
+                                                                     symbols[i.name])
+                                                               : nullptr;
 
                     recurse(*i.value);
                 } catch (Error & e) {
@@ -2183,17 +2106,15 @@ void EvalState::forceValueDeep(Value & v)
     recurse(v);
 }
 
-
 NixInt EvalState::forceInt(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     try {
         forceValue(v, pos);
         if (v.type() != nInt)
             error<TypeError>(
-                "expected an integer but found %1%: %2%",
-                showType(v),
-                ValuePrinter(*this, v, errorPrintOptions)
-            ).atPos(pos).debugThrow();
+                "expected an integer but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+                .atPos(pos)
+                .debugThrow();
         return v.integer();
     } catch (Error & e) {
         e.addTrace(positions[pos], errorCtx);
@@ -2203,7 +2124,6 @@ NixInt EvalState::forceInt(Value & v, const PosIdx pos, std::string_view errorCt
     return v.integer();
 }
 
-
 NixFloat EvalState::forceFloat(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     try {
@@ -2212,10 +2132,9 @@ NixFloat EvalState::forceFloat(Value & v, const PosIdx pos, std::string_view err
             return v.integer().value;
         else if (v.type() != nFloat)
             error<TypeError>(
-                "expected a float but found %1%: %2%",
-                showType(v),
-                ValuePrinter(*this, v, errorPrintOptions)
-            ).atPos(pos).debugThrow();
+                "expected a float but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+                .atPos(pos)
+                .debugThrow();
         return v.fpoint();
     } catch (Error & e) {
         e.addTrace(positions[pos], errorCtx);
@@ -2223,17 +2142,15 @@ NixFloat EvalState::forceFloat(Value & v, const PosIdx pos, std::string_view err
     }
 }
 
-
 bool EvalState::forceBool(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     try {
         forceValue(v, pos);
         if (v.type() != nBool)
             error<TypeError>(
-                "expected a Boolean but found %1%: %2%",
-                showType(v),
-                ValuePrinter(*this, v, errorPrintOptions)
-            ).atPos(pos).debugThrow();
+                "expected a Boolean but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+                .atPos(pos)
+                .debugThrow();
         return v.boolean();
     } catch (Error & e) {
         e.addTrace(positions[pos], errorCtx);
@@ -2243,50 +2160,44 @@ bool EvalState::forceBool(Value & v, const PosIdx pos, std::string_view errorCtx
     return v.boolean();
 }
 
-Bindings::const_iterator EvalState::getAttr(Symbol attrSym, const Bindings * attrSet, std::string_view errorCtx)
+const Attr * EvalState::getAttr(Symbol attrSym, const Bindings * attrSet, std::string_view errorCtx)
 {
-    auto value = attrSet->find(attrSym);
-    if (value == attrSet->end()) {
-        error<TypeError>("attribute '%s' missing", symbols[attrSym])
-            .withTrace(noPos, errorCtx)
-            .debugThrow();
+    auto value = attrSet->get(attrSym);
+    if (!value) {
+        error<TypeError>("attribute '%s' missing", symbols[attrSym]).withTrace(noPos, errorCtx).debugThrow();
     }
     return value;
 }
 
 bool EvalState::isFunctor(const Value & fun) const
 {
-    return fun.type() == nAttrs && fun.attrs()->find(sFunctor) != fun.attrs()->end();
+    return fun.type() == nAttrs && fun.attrs()->get(s.functor);
 }
 
-
 void EvalState::forceFunction(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     try {
         forceValue(v, pos);
         if (v.type() != nFunction && !isFunctor(v))
             error<TypeError>(
-                "expected a function but found %1%: %2%",
-                showType(v),
-                ValuePrinter(*this, v, errorPrintOptions)
-            ).atPos(pos).debugThrow();
+                "expected a function but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+                .atPos(pos)
+                .debugThrow();
     } catch (Error & e) {
         e.addTrace(positions[pos], errorCtx);
         throw;
     }
 }
 
-
 std::string_view EvalState::forceString(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     try {
         forceValue(v, pos);
         if (v.type() != nString)
             error<TypeError>(
-                "expected a string but found %1%: %2%",
-                showType(v),
-                ValuePrinter(*this, v, errorPrintOptions)
-            ).atPos(pos).debugThrow();
+                "expected a string but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+                .atPos(pos)
+                .debugThrow();
         return v.string_view();
     } catch (Error & e) {
         e.addTrace(positions[pos], errorCtx);
@@ -2294,54 +2205,65 @@ std::string_view EvalState::forceString(Value & v, const PosIdx pos, std::string
     }
 }
 
-
 void copyContext(const Value & v, NixStringContext & context, const ExperimentalFeatureSettings & xpSettings)
 {
     if (v.context())
-        for (const char * * p = v.context(); *p; ++p)
+        for (const char ** p = v.context(); *p; ++p)
             context.insert(NixStringContextElem::parse(*p, xpSettings));
 }
 
-
-std::string_view EvalState::forceString(Value & v, NixStringContext & context, const PosIdx pos, std::string_view errorCtx, const ExperimentalFeatureSettings & xpSettings)
+std::string_view EvalState::forceString(
+    Value & v,
+    NixStringContext & context,
+    const PosIdx pos,
+    std::string_view errorCtx,
+    const ExperimentalFeatureSettings & xpSettings)
 {
     auto s = forceString(v, pos, errorCtx);
     copyContext(v, context, xpSettings);
     return s;
 }
 
-
 std::string_view EvalState::forceStringNoCtx(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     auto s = forceString(v, pos, errorCtx);
     if (v.context()) {
-        error<EvalError>("the string '%1%' is not allowed to refer to a store path (such as '%2%')", v.string_view(), v.context()[0]).withTrace(pos, errorCtx).debugThrow();
+        error<EvalError>(
+            "the string '%1%' is not allowed to refer to a store path (such as '%2%')", v.string_view(), v.context()[0])
+            .withTrace(pos, errorCtx)
+            .debugThrow();
     }
     return s;
 }
 
-
 bool EvalState::isDerivation(Value & v)
 {
-    if (v.type() != nAttrs) return false;
-    auto i = v.attrs()->get(sType);
-    if (!i) return false;
+    if (v.type() != nAttrs)
+        return false;
+    auto i = v.attrs()->get(s.type);
+    if (!i)
+        return false;
     forceValue(*i->value, i->pos);
-    if (i->value->type() != nString) return false;
+    if (i->value->type() != nString)
+        return false;
     return i->value->string_view().compare("derivation") == 0;
 }
 
-
-std::optional<std::string> EvalState::tryAttrsToString(const PosIdx pos, Value & v,
-    NixStringContext & context, bool coerceMore, bool copyToStore)
+std::optional<std::string>
+EvalState::tryAttrsToString(const PosIdx pos, Value & v, NixStringContext & context, bool coerceMore, bool copyToStore)
 {
-    auto i = v.attrs()->find(sToString);
-    if (i != v.attrs()->end()) {
+    auto i = v.attrs()->get(s.toString);
+    if (i) {
         Value v1;
         callFunction(*i->value, v, v1, pos);
-        return coerceToString(pos, v1, context,
-                "while evaluating the result of the `__toString` attribute",
-                coerceMore, copyToStore).toOwned();
+        return coerceToString(
+                   pos,
+                   v1,
+                   context,
+                   "while evaluating the result of the `__toString` attribute",
+                   coerceMore,
+                   copyToStore)
+            .toOwned();
     }
 
     return {};
@@ -2364,32 +2286,26 @@ BackedStringView EvalState::coerceToString(
     }
 
     if (v.type() == nPath) {
-        return
-            !canonicalizePath && !copyToStore
-            ? // FIXME: hack to preserve path literals that end in a
-              // slash, as in /foo/${x}.
-              v.pathStr()
-            : copyToStore
-            ? store->printStorePath(copyPathToStore(context, v.path()))
-            : std::string(v.path().path.abs());
+        return !canonicalizePath && !copyToStore
+                   ? // FIXME: hack to preserve path literals that end in a
+                     // slash, as in /foo/${x}.
+                   v.pathStr()
+                   : copyToStore ? store->printStorePath(copyPathToStore(context, v.path()))
+                                 : std::string(v.path().path.abs());
     }
 
     if (v.type() == nAttrs) {
         auto maybeString = tryAttrsToString(pos, v, context, coerceMore, copyToStore);
         if (maybeString)
             return std::move(*maybeString);
-        auto i = v.attrs()->find(sOutPath);
-        if (i == v.attrs()->end()) {
+        auto i = v.attrs()->get(s.outPath);
+        if (!i) {
             error<TypeError>(
-                "cannot coerce %1% to a string: %2%",
-                showType(v),
-                ValuePrinter(*this, v, errorPrintOptions)
-            )
+                "cannot coerce %1% to a string: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
                 .withTrace(pos, errorCtx)
                 .debugThrow();
         }
-        return coerceToString(pos, *i->value, context, errorCtx,
-                              coerceMore, copyToStore, canonicalizePath);
+        return coerceToString(pos, *i->value, context, errorCtx, coerceMore, copyToStore, canonicalizePath);
     }
 
     if (v.type() == nExternal) {
@@ -2404,20 +2320,30 @@ BackedStringView EvalState::coerceToString(
     if (coerceMore) {
         /* Note that `false' is represented as an empty string for
            shell scripting convenience, just like `null'. */
-        if (v.type() == nBool && v.boolean()) return "1";
-        if (v.type() == nBool && !v.boolean()) return "";
-        if (v.type() == nInt) return std::to_string(v.integer().value);
-        if (v.type() == nFloat) return std::to_string(v.fpoint());
-        if (v.type() == nNull) return "";
+        if (v.type() == nBool && v.boolean())
+            return "1";
+        if (v.type() == nBool && !v.boolean())
+            return "";
+        if (v.type() == nInt)
+            return std::to_string(v.integer().value);
+        if (v.type() == nFloat)
+            return std::to_string(v.fpoint());
+        if (v.type() == nNull)
+            return "";
 
         if (v.isList()) {
             std::string result;
             auto listView = v.listView();
             for (auto [n, v2] : enumerate(listView)) {
                 try {
-                    result += *coerceToString(pos, *v2, context,
-                            "while evaluating one element of the list",
-                            coerceMore, copyToStore, canonicalizePath);
+                    result += *coerceToString(
+                        pos,
+                        *v2,
+                        context,
+                        "while evaluating one element of the list",
+                        coerceMore,
+                        copyToStore,
+                        canonicalizePath);
                 } catch (Error & e) {
                     e.addTrace(positions[pos], errorCtx);
                     throw;
@@ -2431,47 +2357,36 @@ BackedStringView EvalState::coerceToString(
         }
     }
 
-    error<TypeError>("cannot coerce %1% to a string: %2%",
-        showType(v),
-        ValuePrinter(*this, v, errorPrintOptions)
-    )
+    error<TypeError>("cannot coerce %1% to a string: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
         .withTrace(pos, errorCtx)
         .debugThrow();
 }
 
-
 StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePath & path)
 {
     if (nix::isDerivation(path.path.abs()))
         error<EvalError>("file names are not allowed to end in '%1%'", drvExtension).debugThrow();
 
-    auto dstPathCached = get(*srcToStore.lock(), path);
+    std::optional<StorePath> dstPath;
+    if (!srcToStore.cvisit(path, [&dstPath](const auto & kv) { dstPath.emplace(kv.second); })) {
+        dstPath.emplace(fetchToStore(
+            fetchSettings,
+            *store,
+            path.resolveSymlinks(SymlinkResolution::Ancestors),
+            settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy,
+            path.baseName(),
+            ContentAddressMethod::Raw::NixArchive,
+            nullptr,
+            repair));
+        allowPath(*dstPath);
+        srcToStore.try_emplace(path, *dstPath);
+        printMsg(lvlChatty, "copied source '%1%' -> '%2%'", path, store->printStorePath(*dstPath));
+    }
 
-    auto dstPath = dstPathCached
-        ? *dstPathCached
-        : [&]() {
-            auto dstPath = fetchToStore(
-                fetchSettings,
-                *store,
-                path.resolveSymlinks(SymlinkResolution::Ancestors),
-                settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy,
-                path.baseName(),
-                ContentAddressMethod::Raw::NixArchive,
-                nullptr,
-                repair);
-            allowPath(dstPath);
-            srcToStore.lock()->try_emplace(path, dstPath);
-            printMsg(lvlChatty, "copied source '%1%' -> '%2%'", path, store->printStorePath(dstPath));
-            return dstPath;
-        }();
-
-    context.insert(NixStringContextElem::Opaque {
-        .path = dstPath
-    });
-    return dstPath;
+    context.insert(NixStringContextElem::Opaque{.path = *dstPath});
+    return *dstPath;
 }
 
-
 SourcePath EvalState::coerceToPath(const PosIdx pos, Value & v, NixStringContext & context, std::string_view errorCtx)
 {
     try {
@@ -2488,8 +2403,8 @@ SourcePath EvalState::coerceToPath(const PosIdx pos, Value & v, NixStringContext
     /* Similarly, handle __toString where the result may be a path
        value. */
     if (v.type() == nAttrs) {
-        auto i = v.attrs()->find(sToString);
-        if (i != v.attrs()->end()) {
+        auto i = v.attrs()->get(s.toString);
+        if (i) {
             Value v1;
             callFunction(*i->value, v, v1, pos);
             return coerceToPath(pos, v1, context, errorCtx);
@@ -2504,8 +2419,8 @@ SourcePath EvalState::coerceToPath(const PosIdx pos, Value & v, NixStringContext
     return rootPath(path);
 }
 
-
-StorePath EvalState::coerceToStorePath(const PosIdx pos, Value & v, NixStringContext & context, std::string_view errorCtx)
+StorePath
+EvalState::coerceToStorePath(const PosIdx pos, Value & v, NixStringContext & context, std::string_view errorCtx)
 {
     auto path = coerceToString(pos, v, context, errorCtx, false, false, true).toOwned();
     if (auto storePath = store->maybeParseStorePath(path))
@@ -2513,37 +2428,35 @@ StorePath EvalState::coerceToStorePath(const PosIdx pos, Value & v, NixStringCon
     error<EvalError>("path '%1%' is not in the Nix store", path).withTrace(pos, errorCtx).debugThrow();
 }
 
-
-std::pair<SingleDerivedPath, std::string_view> EvalState::coerceToSingleDerivedPathUnchecked(const PosIdx pos, Value & v, std::string_view errorCtx, const ExperimentalFeatureSettings & xpSettings)
+std::pair<SingleDerivedPath, std::string_view> EvalState::coerceToSingleDerivedPathUnchecked(
+    const PosIdx pos, Value & v, std::string_view errorCtx, const ExperimentalFeatureSettings & xpSettings)
 {
     NixStringContext context;
     auto s = forceString(v, context, pos, errorCtx, xpSettings);
     auto csize = context.size();
     if (csize != 1)
-        error<EvalError>(
-            "string '%s' has %d entries in its context. It should only have exactly one entry",
-            s, csize)
-            .withTrace(pos, errorCtx).debugThrow();
-    auto derivedPath = std::visit(overloaded {
-        [&](NixStringContextElem::Opaque && o) -> SingleDerivedPath {
-            return std::move(o);
+        error<EvalError>("string '%s' has %d entries in its context. It should only have exactly one entry", s, csize)
+            .withTrace(pos, errorCtx)
+            .debugThrow();
+    auto derivedPath = std::visit(
+        overloaded{
+            [&](NixStringContextElem::Opaque && o) -> SingleDerivedPath { return std::move(o); },
+            [&](NixStringContextElem::DrvDeep &&) -> SingleDerivedPath {
+                error<EvalError>(
+                    "string '%s' has a context which refers to a complete source and binary closure. This is not supported at this time",
+                    s)
+                    .withTrace(pos, errorCtx)
+                    .debugThrow();
+            },
+            [&](NixStringContextElem::Built && b) -> SingleDerivedPath { return std::move(b); },
         },
-        [&](NixStringContextElem::DrvDeep &&) -> SingleDerivedPath {
-            error<EvalError>(
-                "string '%s' has a context which refers to a complete source and binary closure. This is not supported at this time",
-                s).withTrace(pos, errorCtx).debugThrow();
-        },
-        [&](NixStringContextElem::Built && b) -> SingleDerivedPath {
-            return std::move(b);
-        },
-    }, ((NixStringContextElem &&) *context.begin()).raw);
+        ((NixStringContextElem &&) *context.begin()).raw);
     return {
         std::move(derivedPath),
         std::move(s),
     };
 }
 
-
 SingleDerivedPath EvalState::coerceToSingleDerivedPath(const PosIdx pos, Value & v, std::string_view errorCtx)
 {
     auto [derivedPath, s_] = coerceToSingleDerivedPathUnchecked(pos, v, errorCtx);
@@ -2552,26 +2465,28 @@ SingleDerivedPath EvalState::coerceToSingleDerivedPath(const PosIdx pos, Value &
     if (s != sExpected) {
         /* `std::visit` is used here just to provide a more precise
            error message. */
-        std::visit(overloaded {
-            [&](const SingleDerivedPath::Opaque & o) {
-                error<EvalError>(
-                    "path string '%s' has context with the different path '%s'",
-                    s, sExpected)
-                    .withTrace(pos, errorCtx).debugThrow();
-            },
-            [&](const SingleDerivedPath::Built & b) {
-                error<EvalError>(
-                    "string '%s' has context with the output '%s' from derivation '%s', but the string is not the right placeholder for this derivation output. It should be '%s'",
-                    s, b.output, b.drvPath->to_string(*store), sExpected)
-                    .withTrace(pos, errorCtx).debugThrow();
-            }
-        }, derivedPath.raw());
+        std::visit(
+            overloaded{
+                [&](const SingleDerivedPath::Opaque & o) {
+                    error<EvalError>("path string '%s' has context with the different path '%s'", s, sExpected)
+                        .withTrace(pos, errorCtx)
+                        .debugThrow();
+                },
+                [&](const SingleDerivedPath::Built & b) {
+                    error<EvalError>(
+                        "string '%s' has context with the output '%s' from derivation '%s', but the string is not the right placeholder for this derivation output. It should be '%s'",
+                        s,
+                        b.output,
+                        b.drvPath->to_string(*store),
+                        sExpected)
+                        .withTrace(pos, errorCtx)
+                        .debugThrow();
+                }},
+            derivedPath.raw());
     }
     return derivedPath;
 }
 
-
-
 // NOTE: This implementation must match eqValues!
 // We accept this burden because informative error messages for
 // `assert a == b; x` are critical for our users' testing UX.
@@ -2678,8 +2593,8 @@ void EvalState::assertEqValues(Value & v1, Value & v2, const PosIdx pos, std::st
 
     case nAttrs: {
         if (isDerivation(v1) && isDerivation(v2)) {
-            auto i = v1.attrs()->get(sOutPath);
-            auto j = v2.attrs()->get(sOutPath);
+            auto i = v1.attrs()->get(s.outPath);
+            auto j = v2.attrs()->get(s.outPath);
             if (i && j) {
                 try {
                     assertEqValues(*i->value, *j->value, pos, errorCtx);
@@ -2774,7 +2689,9 @@ void EvalState::assertEqValues(Value & v1, Value & v2, const PosIdx pos, std::st
         // Also note that this probably ran after `eqValues`, which implements
         // the same logic more efficiently (without having to unwind stacks),
         // so maybe `assertEqValues` and `eqValues` are out of sync. Check it for solutions.
-        error<EvalError>("assertEqValues: cannot compare %1% with %2%", showType(v1), showType(v2)).withTrace(pos, errorCtx).panic();
+        error<EvalError>("assertEqValues: cannot compare %1% with %2%", showType(v1), showType(v2))
+            .withTrace(pos, errorCtx)
+            .panic();
     }
 }
 
@@ -2787,7 +2704,8 @@ bool EvalState::eqValues(Value & v1, Value & v2, const PosIdx pos, std::string_v
     /* !!! Hack to support some old broken code that relies on pointer
        equality tests between sets.  (Specifically, builderDefs calls
        uniqList on a list of sets.)  Will remove this eventually. */
-    if (&v1 == &v2) return true;
+    if (&v1 == &v2)
+        return true;
 
     // Special case type-compatibility between float and int
     if (v1.type() == nInt && v2.type() == nFloat)
@@ -2796,73 +2714,79 @@ bool EvalState::eqValues(Value & v1, Value & v2, const PosIdx pos, std::string_v
         return v1.fpoint() == v2.integer().value;
 
     // All other types are not compatible with each other.
-    if (v1.type() != v2.type()) return false;
+    if (v1.type() != v2.type())
+        return false;
 
     switch (v1.type()) {
-        case nInt:
-            return v1.integer() == v2.integer();
+    case nInt:
+        return v1.integer() == v2.integer();
 
-        case nBool:
-            return v1.boolean() == v2.boolean();
+    case nBool:
+        return v1.boolean() == v2.boolean();
 
-        case nString:
-            return strcmp(v1.c_str(), v2.c_str()) == 0;
+    case nString:
+        return strcmp(v1.c_str(), v2.c_str()) == 0;
 
-        case nPath:
-            return
-                // FIXME: compare accessors by their fingerprint.
-                v1.pathAccessor() == v2.pathAccessor()
-                && strcmp(v1.pathStr(), v2.pathStr()) == 0;
+    case nPath:
+        return
+            // FIXME: compare accessors by their fingerprint.
+            v1.pathAccessor() == v2.pathAccessor() && strcmp(v1.pathStr(), v2.pathStr()) == 0;
 
-        case nNull:
-            return true;
+    case nNull:
+        return true;
 
-        case nList:
-            if (v1.listSize() != v2.listSize()) return false;
-            for (size_t n = 0; n < v1.listSize(); ++n)
-                if (!eqValues(*v1.listView()[n], *v2.listView()[n], pos, errorCtx)) return false;
-            return true;
+    case nList:
+        if (v1.listSize() != v2.listSize())
+            return false;
+        for (size_t n = 0; n < v1.listSize(); ++n)
+            if (!eqValues(*v1.listView()[n], *v2.listView()[n], pos, errorCtx))
+                return false;
+        return true;
 
-        case nAttrs: {
-            /* If both sets denote a derivation (type = "derivation"),
-               then compare their outPaths. */
-            if (isDerivation(v1) && isDerivation(v2)) {
-                auto i = v1.attrs()->get(sOutPath);
-                auto j = v2.attrs()->get(sOutPath);
-                if (i && j)
-                    return eqValues(*i->value, *j->value, pos, errorCtx);
-            }
-
-            if (v1.attrs()->size() != v2.attrs()->size()) return false;
-
-            /* Otherwise, compare the attributes one by one. */
-            Bindings::const_iterator i, j;
-            for (i = v1.attrs()->begin(), j = v2.attrs()->begin(); i != v1.attrs()->end(); ++i, ++j)
-                if (i->name != j->name || !eqValues(*i->value, *j->value, pos, errorCtx))
-                    return false;
-
-            return true;
+    case nAttrs: {
+        /* If both sets denote a derivation (type = "derivation"),
+           then compare their outPaths. */
+        if (isDerivation(v1) && isDerivation(v2)) {
+            auto i = v1.attrs()->get(s.outPath);
+            auto j = v2.attrs()->get(s.outPath);
+            if (i && j)
+                return eqValues(*i->value, *j->value, pos, errorCtx);
         }
 
-        /* Functions are incomparable. */
-        case nFunction:
+        if (v1.attrs()->size() != v2.attrs()->size())
             return false;
 
-        case nExternal:
-            return *v1.external() == *v2.external();
+        /* Otherwise, compare the attributes one by one. */
+        Bindings::const_iterator i, j;
+        for (i = v1.attrs()->begin(), j = v2.attrs()->begin(); i != v1.attrs()->end(); ++i, ++j)
+            if (i->name != j->name || !eqValues(*i->value, *j->value, pos, errorCtx))
+                return false;
 
-        case nFloat:
-            // !!!
-            return v1.fpoint() == v2.fpoint();
+        return true;
+    }
 
-        case nThunk: // Must not be left by forceValue
-            assert(false);
-        default: // Note that we pass compiler flags that should make `default:` unreachable.
-            error<EvalError>("eqValues: cannot compare %1% with %2%", showType(v1), showType(v2)).withTrace(pos, errorCtx).panic();
+    /* Functions are incomparable. */
+    case nFunction:
+        return false;
+
+    case nExternal:
+        return *v1.external() == *v2.external();
+
+    case nFloat:
+        // !!!
+        return v1.fpoint() == v2.fpoint();
+
+    case nThunk: // Must not be left by forceValue
+        assert(false);
+    default: // Note that we pass compiler flags that should make `default:` unreachable.
+        error<EvalError>("eqValues: cannot compare %1% with %2%", showType(v1), showType(v2))
+            .withTrace(pos, errorCtx)
+            .panic();
     }
 }
 
-bool EvalState::fullGC() {
+bool EvalState::fullGC()
+{
 #if NIX_USE_BOEHMGC
     GC_gcollect();
     // Check that it ran. We might replace this with a version that uses more
@@ -2893,11 +2817,8 @@ void EvalState::maybePrintStats()
 
 void EvalState::printStatistics()
 {
-#ifndef _WIN32 // TODO use portable implementation
-    struct rusage buf;
-    getrusage(RUSAGE_SELF, &buf);
-    float cpuTime = buf.ru_utime.tv_sec + ((float) buf.ru_utime.tv_usec / 1000000);
-#endif
+    std::chrono::microseconds cpuTimeDuration = getCpuUserTime();
+    float cpuTime = std::chrono::duration_cast<std::chrono::duration<float>>(cpuTimeDuration).count();
 
     uint64_t bEnvs = nrEnvs * sizeof(Env) + nrValuesInEnvs * sizeof(Value *);
     uint64_t bLists = nrListElems * sizeof(Value *);
@@ -2919,18 +2840,12 @@ void EvalState::printStatistics()
     if (outPath != "-")
         fs.open(outPath, std::fstream::out);
     json topObj = json::object();
-#ifndef _WIN32 // TODO implement
     topObj["cpuTime"] = cpuTime;
-#endif
     topObj["time"] = {
-#ifndef _WIN32 // TODO implement
         {"cpu", cpuTime},
-#endif
 #if NIX_USE_BOEHMGC
         {GC_is_incremental_mode() ? "gcNonIncremental" : "gc", gcFullOnlyTime},
-#ifndef _WIN32 // TODO implement
         {GC_is_incremental_mode() ? "gcNonIncrementalFraction" : "gcFraction", gcFullOnlyTime / cpuTime},
-#endif
 #endif
     };
     topObj["envs"] = {
@@ -2981,7 +2896,7 @@ void EvalState::printStatistics()
     if (countCalls) {
         topObj["primops"] = primOpCalls;
         {
-            auto& list = topObj["functions"];
+            auto & list = topObj["functions"];
             list = json::array();
             for (auto & [fun, count] : functionCalls) {
                 json obj = json::object();
@@ -3019,7 +2934,7 @@ void EvalState::printStatistics()
     if (getEnv("NIX_SHOW_SYMBOLS").value_or("0") != "0") {
         // XXX: overrides earlier assignment
         topObj["symbols"] = json::array();
-        auto &list = topObj["symbols"];
+        auto & list = topObj["symbols"];
         symbols.dump([&](std::string_view s) { list.emplace_back(s); });
     }
     if (outPath == "-") {
@@ -3029,7 +2944,6 @@ void EvalState::printStatistics()
     }
 }
 
-
 SourcePath resolveExprPath(SourcePath path, bool addDefaultNix)
 {
     unsigned int followCount = 0, maxFollow = 1024;
@@ -3041,7 +2955,8 @@ SourcePath resolveExprPath(SourcePath path, bool addDefaultNix)
         if (++followCount >= maxFollow)
             throw Error("too many symbolic links encountered while traversing the path '%s'", path);
         auto p = path.parent().resolveSymlinks() / path.baseName();
-        if (p.lstat().type != SourceAccessor::tSymlink) break;
+        if (p.lstat().type != SourceAccessor::tSymlink)
+            break;
         path = {path.accessor, CanonPath(p.readLink(), path.path.parent().value_or(CanonPath::root))};
     }
 
@@ -3052,13 +2967,11 @@ SourcePath resolveExprPath(SourcePath path, bool addDefaultNix)
     return path;
 }
 
-
 Expr * EvalState::parseExprFromFile(const SourcePath & path)
 {
     return parseExprFromFile(path, staticBaseEnv);
 }
 
-
 Expr * EvalState::parseExprFromFile(const SourcePath & path, std::shared_ptr<StaticEnv> & staticEnv)
 {
     auto buffer = path.resolveSymlinks().readFile();
@@ -3067,8 +2980,8 @@ Expr * EvalState::parseExprFromFile(const SourcePath & path, std::shared_ptr<Sta
     return parse(buffer.data(), buffer.size(), Pos::Origin(path), path.parent(), staticEnv);
 }
 
-
-Expr * EvalState::parseExprFromString(std::string s_, const SourcePath & basePath, std::shared_ptr<StaticEnv> & staticEnv)
+Expr *
+EvalState::parseExprFromString(std::string s_, const SourcePath & basePath, std::shared_ptr<StaticEnv> & staticEnv)
 {
     // NOTE this method (and parseStdin) must take care to *fully copy* their input
     // into their respective Pos::Origin until the parser stops overwriting its input
@@ -3078,19 +2991,17 @@ Expr * EvalState::parseExprFromString(std::string s_, const SourcePath & basePat
     return parse(s_.data(), s_.size(), Pos::String{.source = s}, basePath, staticEnv);
 }
 
-
 Expr * EvalState::parseExprFromString(std::string s, const SourcePath & basePath)
 {
     return parseExprFromString(std::move(s), basePath, staticBaseEnv);
 }
 
-
 Expr * EvalState::parseStdin()
 {
     // NOTE this method (and parseExprFromString) must take care to *fully copy* their
     // input into their respective Pos::Origin until the parser stops overwriting its
     // input data.
-    //Activity act(*logger, lvlTalkative, "parsing standard input");
+    // Activity act(*logger, lvlTalkative, "parsing standard input");
     auto buffer = drainFD(0);
     // drainFD should have left some extra space for terminators
     buffer.append("\0\0", 2);
@@ -3098,46 +3009,47 @@ Expr * EvalState::parseStdin()
     return parse(buffer.data(), buffer.size(), Pos::Stdin{.source = s}, rootPath("."), staticBaseEnv);
 }
 
-
 SourcePath EvalState::findFile(const std::string_view path)
 {
     return findFile(lookupPath, path);
 }
 
-
 SourcePath EvalState::findFile(const LookupPath & lookupPath, const std::string_view path, const PosIdx pos)
 {
     for (auto & i : lookupPath.elements) {
         auto suffixOpt = i.prefix.suffixIfPotentialMatch(path);
 
-        if (!suffixOpt) continue;
+        if (!suffixOpt)
+            continue;
         auto suffix = *suffixOpt;
 
         auto rOpt = resolveLookupPathPath(i.path);
-        if (!rOpt) continue;
+        if (!rOpt)
+            continue;
         auto r = *rOpt;
 
         auto res = (r / CanonPath(suffix)).resolveSymlinks();
-        if (res.pathExists()) return res;
+        if (res.pathExists())
+            return res;
     }
 
     if (hasPrefix(path, "nix/"))
         return {corepkgsFS, CanonPath(path.substr(3))};
 
     error<ThrownError>(
-        settings.pureEval
-            ? "cannot look up '<%s>' in pure evaluation mode (use '--impure' to override)"
-            : "file '%s' was not found in the Nix search path (add it using $NIX_PATH or -I)",
-        path
-    ).atPos(pos).debugThrow();
+        settings.pureEval ? "cannot look up '<%s>' in pure evaluation mode (use '--impure' to override)"
+                          : "file '%s' was not found in the Nix search path (add it using $NIX_PATH or -I)",
+        path)
+        .atPos(pos)
+        .debugThrow();
 }
 
-
 std::optional<SourcePath> EvalState::resolveLookupPathPath(const LookupPath::Path & value0, bool initAccessControl)
 {
     auto & value = value0.s;
     auto i = lookupPathResolved.find(value);
-    if (i != lookupPathResolved.end()) return i->second;
+    if (i != lookupPathResolved.end())
+        return i->second;
 
     auto finish = [&](std::optional<SourcePath> res) {
         if (res)
@@ -3150,16 +3062,11 @@ std::optional<SourcePath> EvalState::resolveLookupPathPath(const LookupPath::Pat
 
     if (EvalSettings::isPseudoUrl(value)) {
         try {
-            auto accessor = fetchers::downloadTarball(
-                store,
-                fetchSettings,
-                EvalSettings::resolvePseudoUrl(value));
+            auto accessor = fetchers::downloadTarball(store, fetchSettings, EvalSettings::resolvePseudoUrl(value));
             auto storePath = fetchToStore(fetchSettings, *store, SourcePath(accessor), FetchMode::Copy);
             return finish(this->storePath(storePath));
         } catch (Error & e) {
-            logWarning({
-                .msg = HintFmt("Nix search path entry '%1%' cannot be downloaded, ignoring", value)
-            });
+            logWarning({.msg = HintFmt("Nix search path entry '%1%' cannot be downloaded, ignoring", value)});
         }
     }
 
@@ -3182,39 +3089,33 @@ std::optional<SourcePath> EvalState::resolveLookupPathPath(const LookupPath::Pat
             if (store->isInStore(path.path.abs())) {
                 try {
                     allowClosure(store->toStorePath(path.path.abs()).first);
-                } catch (InvalidPath &) { }
+                } catch (InvalidPath &) {
+                }
             }
         }
 
         if (path.resolveSymlinks().pathExists())
             return finish(std::move(path));
         else {
-            logWarning({
-                .msg = HintFmt("Nix search path entry '%1%' does not exist, ignoring", value)
-            });
+            logWarning({.msg = HintFmt("Nix search path entry '%1%' does not exist, ignoring", value)});
         }
     }
 
     return finish(std::nullopt);
 }
 
-
 Expr * EvalState::parse(
-    char * text,
-    size_t length,
-    Pos::Origin origin,
-    const SourcePath & basePath,
-    std::shared_ptr<StaticEnv> & staticEnv)
+    char * text, size_t length, Pos::Origin origin, const SourcePath & basePath, std::shared_ptr<StaticEnv> & staticEnv)
 {
     DocCommentMap tmpDocComments; // Only used when not origin is not a SourcePath
-    DocCommentMap *docComments = &tmpDocComments;
+    DocCommentMap * docComments = &tmpDocComments;
 
     if (auto sourcePath = std::get_if<SourcePath>(&origin)) {
         auto [it, _] = positionToDocComment.try_emplace(*sourcePath);
         docComments = &it->second;
     }
 
-    auto result = parseExprFromBuf(text, length, origin, basePath, symbols, settings, positions, *docComments, rootFS, exprSymbols);
+    auto result = parseExprFromBuf(text, length, origin, basePath, symbols, settings, positions, *docComments, rootFS);
 
     result->bindVars(*this, staticEnv);
 
@@ -3238,21 +3139,19 @@ DocComment EvalState::getDocCommentForPos(PosIdx pos)
     return it->second;
 }
 
-std::string ExternalValueBase::coerceToString(EvalState & state, const PosIdx & pos, NixStringContext & context, bool copyMore, bool copyToStore) const
+std::string ExternalValueBase::coerceToString(
+    EvalState & state, const PosIdx & pos, NixStringContext & context, bool copyMore, bool copyToStore) const
 {
-    state.error<TypeError>(
-        "cannot coerce %1% to a string: %2%", showType(), *this
-    ).atPos(pos).debugThrow();
+    state.error<TypeError>("cannot coerce %1% to a string: %2%", showType(), *this).atPos(pos).debugThrow();
 }
 
-
 bool ExternalValueBase::operator==(const ExternalValueBase & b) const noexcept
 {
     return false;
 }
 
-
-std::ostream & operator << (std::ostream & str, const ExternalValueBase & v) {
+std::ostream & operator<<(std::ostream & str, const ExternalValueBase & v)
+{
     return v.print(str);
 }
 
@@ -3269,5 +3168,4 @@ void forceNoNullByte(std::string_view s, std::function<Pos()> pos)
     }
 }
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/function-trace.cc b/src/libexpr/function-trace.cc
index cda3bc2db..55ccfc791 100644
--- a/src/libexpr/function-trace.cc
+++ b/src/libexpr/function-trace.cc
@@ -19,4 +19,4 @@ void FunctionCallTrace::postFunctionCallHook(
     printMsg(lvlInfo, "function-trace exited %1% at %2%", state.positions[pos], ns.count());
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 3c9ff9ff3..5a7281b2b 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -7,18 +7,19 @@
 #include <cstring>
 #include <regex>
 
-
 namespace nix {
 
-
 PackageInfo::PackageInfo(EvalState & state, std::string attrPath, const Bindings * attrs)
-    : state(&state), attrs(attrs), attrPath(std::move(attrPath))
+    : state(&state)
+    , attrs(attrs)
+    , attrPath(std::move(attrPath))
 {
 }
 
-
 PackageInfo::PackageInfo(EvalState & state, ref<Store> store, const std::string & drvPathWithOutputs)
-    : state(&state), attrs(nullptr), attrPath("")
+    : state(&state)
+    , attrs(nullptr)
+    , attrPath("")
 {
     auto [drvPath, selectedOutputs] = parsePathWithOutputs(*store, drvPathWithOutputs);
 
@@ -31,10 +32,7 @@ PackageInfo::PackageInfo(EvalState & state, ref<Store> store, const std::string
     if (selectedOutputs.size() > 1)
         throw Error("building more than one derivation output is not supported, in '%s'", drvPathWithOutputs);
 
-    outputName =
-        selectedOutputs.empty()
-        ? getOr(drv.env, "outputName", "out")
-        : *selectedOutputs.begin();
+    outputName = selectedOutputs.empty() ? getOr(drv.env, "outputName", "out") : *selectedOutputs.begin();
 
     auto i = drv.outputs.find(outputName);
     if (i == drv.outputs.end())
@@ -44,34 +42,35 @@ PackageInfo::PackageInfo(EvalState & state, ref<Store> store, const std::string
     outPath = {output.path(*store, drv.name, outputName)};
 }
 
-
 std::string PackageInfo::queryName() const
 {
     if (name == "" && attrs) {
-        auto i = attrs->find(state->sName);
-        if (i == attrs->end()) state->error<TypeError>("derivation name missing").debugThrow();
+        auto i = attrs->get(state->s.name);
+        if (!i)
+            state->error<TypeError>("derivation name missing").debugThrow();
         name = state->forceStringNoCtx(*i->value, noPos, "while evaluating the 'name' attribute of a derivation");
     }
     return name;
 }
 
-
 std::string PackageInfo::querySystem() const
 {
     if (system == "" && attrs) {
-        auto i = attrs->find(state->sSystem);
-        system = i == attrs->end() ? "unknown" : state->forceStringNoCtx(*i->value, i->pos, "while evaluating the 'system' attribute of a derivation");
+        auto i = attrs->get(state->s.system);
+        system =
+            !i ? "unknown"
+               : state->forceStringNoCtx(*i->value, i->pos, "while evaluating the 'system' attribute of a derivation");
     }
     return system;
 }
 
-
 std::optional<StorePath> PackageInfo::queryDrvPath() const
 {
     if (!drvPath && attrs) {
-        if (auto i = attrs->get(state->sDrvPath)) {
+        if (auto i = attrs->get(state->s.drvPath)) {
             NixStringContext context;
-            auto found = state->coerceToStorePath(i->pos, *i->value, context, "while evaluating the 'drvPath' attribute of a derivation");
+            auto found = state->coerceToStorePath(
+                i->pos, *i->value, context, "while evaluating the 'drvPath' attribute of a derivation");
             try {
                 found.requireDerivation();
             } catch (Error & e) {
@@ -85,7 +84,6 @@ std::optional<StorePath> PackageInfo::queryDrvPath() const
     return drvPath.value_or(std::nullopt);
 }
 
-
 StorePath PackageInfo::requireDrvPath() const
 {
     if (auto drvPath = queryDrvPath())
@@ -93,44 +91,49 @@ StorePath PackageInfo::requireDrvPath() const
     throw Error("derivation does not contain a 'drvPath' attribute");
 }
 
-
 StorePath PackageInfo::queryOutPath() const
 {
     if (!outPath && attrs) {
-        auto i = attrs->find(state->sOutPath);
+        auto i = attrs->get(state->s.outPath);
         NixStringContext context;
-        if (i != attrs->end())
-            outPath = state->coerceToStorePath(i->pos, *i->value, context, "while evaluating the output path of a derivation");
+        if (i)
+            outPath = state->coerceToStorePath(
+                i->pos, *i->value, context, "while evaluating the output path of a derivation");
     }
     if (!outPath)
         throw UnimplementedError("CA derivations are not yet supported");
     return *outPath;
 }
 
-
 PackageInfo::Outputs PackageInfo::queryOutputs(bool withPaths, bool onlyOutputsToInstall)
 {
     if (outputs.empty()) {
         /* Get the ‘outputs’ list. */
         const Attr * i;
-        if (attrs && (i = attrs->get(state->sOutputs))) {
+        if (attrs && (i = attrs->get(state->s.outputs))) {
             state->forceList(*i->value, i->pos, "while evaluating the 'outputs' attribute of a derivation");
 
             /* For each output... */
             for (auto elem : i->value->listView()) {
-                std::string output(state->forceStringNoCtx(*elem, i->pos, "while evaluating the name of an output of a derivation"));
+                std::string output(
+                    state->forceStringNoCtx(*elem, i->pos, "while evaluating the name of an output of a derivation"));
 
                 if (withPaths) {
                     /* Evaluate the corresponding set. */
                     auto out = attrs->get(state->symbols.create(output));
-                    if (!out) continue; // FIXME: throw error?
+                    if (!out)
+                        continue; // FIXME: throw error?
                     state->forceAttrs(*out->value, i->pos, "while evaluating an output of a derivation");
 
                     /* And evaluate its ‘outPath’ attribute. */
-                    auto outPath = out->value->attrs()->get(state->sOutPath);
-                    if (!outPath) continue; // FIXME: throw error?
+                    auto outPath = out->value->attrs()->get(state->s.outPath);
+                    if (!outPath)
+                        continue; // FIXME: throw error?
                     NixStringContext context;
-                    outputs.emplace(output, state->coerceToStorePath(outPath->pos, *outPath->value, context, "while evaluating an output path of a derivation"));
+                    outputs.emplace(
+                        output,
+                        state->coerceToStorePath(
+                            outPath->pos, *outPath->value, context, "while evaluating an output path of a derivation"));
                 } else
                     outputs.emplace(output, std::nullopt);
             }
@@ -142,7 +145,8 @@ PackageInfo::Outputs PackageInfo::queryOutputs(bool withPaths, bool onlyOutputsT
         return outputs;
 
     const Attr * i;
-    if (attrs && (i = attrs->get(state->sOutputSpecified)) && state->forceBool(*i->value, i->pos, "while evaluating the 'outputSpecified' attribute of a derivation")) {
+    if (attrs && (i = attrs->get(state->s.outputSpecified))
+        && state->forceBool(*i->value, i->pos, "while evaluating the 'outputSpecified' attribute of a derivation")) {
         Outputs result;
         auto out = outputs.find(queryOutputName());
         if (out == outputs.end())
@@ -154,95 +158,103 @@ PackageInfo::Outputs PackageInfo::queryOutputs(bool withPaths, bool onlyOutputsT
     else {
         /* Check for `meta.outputsToInstall` and return `outputs` reduced to that. */
         const Value * outTI = queryMeta("outputsToInstall");
-        if (!outTI) return outputs;
+        if (!outTI)
+            return outputs;
         auto errMsg = Error("this derivation has bad 'meta.outputsToInstall'");
-            /* ^ this shows during `nix-env -i` right under the bad derivation */
-        if (!outTI->isList()) throw errMsg;
+        /* ^ this shows during `nix-env -i` right under the bad derivation */
+        if (!outTI->isList())
+            throw errMsg;
         Outputs result;
         for (auto elem : outTI->listView()) {
-            if (elem->type() != nString) throw errMsg;
+            if (elem->type() != nString)
+                throw errMsg;
             auto out = outputs.find(elem->c_str());
-            if (out == outputs.end()) throw errMsg;
+            if (out == outputs.end())
+                throw errMsg;
             result.insert(*out);
         }
         return result;
     }
 }
 
-
 std::string PackageInfo::queryOutputName() const
 {
     if (outputName == "" && attrs) {
-        auto i = attrs->get(state->sOutputName);
-        outputName = i ? state->forceStringNoCtx(*i->value, noPos, "while evaluating the output name of a derivation") : "";
+        auto i = attrs->get(state->s.outputName);
+        outputName =
+            i ? state->forceStringNoCtx(*i->value, noPos, "while evaluating the output name of a derivation") : "";
     }
     return outputName;
 }
 
-
 const Bindings * PackageInfo::getMeta()
 {
-    if (meta) return meta;
-    if (!attrs) return 0;
-    auto a = attrs->get(state->sMeta);
-    if (!a) return 0;
+    if (meta)
+        return meta;
+    if (!attrs)
+        return 0;
+    auto a = attrs->get(state->s.meta);
+    if (!a)
+        return 0;
     state->forceAttrs(*a->value, a->pos, "while evaluating the 'meta' attribute of a derivation");
     meta = a->value->attrs();
     return meta;
 }
 
-
 StringSet PackageInfo::queryMetaNames()
 {
     StringSet res;
-    if (!getMeta()) return res;
+    if (!getMeta())
+        return res;
     for (auto & i : *meta)
         res.emplace(state->symbols[i.name]);
     return res;
 }
 
-
 bool PackageInfo::checkMeta(Value & v)
 {
     state->forceValue(v, v.determinePos(noPos));
     if (v.type() == nList) {
         for (auto elem : v.listView())
-            if (!checkMeta(*elem)) return false;
+            if (!checkMeta(*elem))
+                return false;
         return true;
-    }
-    else if (v.type() == nAttrs) {
-        if (v.attrs()->get(state->sOutPath)) return false;
+    } else if (v.type() == nAttrs) {
+        if (v.attrs()->get(state->s.outPath))
+            return false;
         for (auto & i : *v.attrs())
-            if (!checkMeta(*i.value)) return false;
+            if (!checkMeta(*i.value))
+                return false;
         return true;
-    }
-    else return v.type() == nInt || v.type() == nBool || v.type() == nString ||
-                v.type() == nFloat;
+    } else
+        return v.type() == nInt || v.type() == nBool || v.type() == nString || v.type() == nFloat;
 }
 
-
 Value * PackageInfo::queryMeta(const std::string & name)
 {
-    if (!getMeta()) return 0;
+    if (!getMeta())
+        return 0;
     auto a = meta->get(state->symbols.create(name));
-    if (!a || !checkMeta(*a->value)) return 0;
+    if (!a || !checkMeta(*a->value))
+        return 0;
     return a->value;
 }
 
-
 std::string PackageInfo::queryMetaString(const std::string & name)
 {
     Value * v = queryMeta(name);
-    if (!v || v->type() != nString) return "";
+    if (!v || v->type() != nString)
+        return "";
     return v->c_str();
 }
 
-
 NixInt PackageInfo::queryMetaInt(const std::string & name, NixInt def)
 {
     Value * v = queryMeta(name);
-    if (!v) return def;
-    if (v->type() == nInt) return v->integer();
+    if (!v)
+        return def;
+    if (v->type() == nInt)
+        return v->integer();
     if (v->type() == nString) {
         /* Backwards compatibility with before we had support for
            integer meta fields. */
@@ -255,8 +267,10 @@ NixInt PackageInfo::queryMetaInt(const std::string & name, NixInt def)
 NixFloat PackageInfo::queryMetaFloat(const std::string & name, NixFloat def)
 {
     Value * v = queryMeta(name);
-    if (!v) return def;
-    if (v->type() == nFloat) return v->fpoint();
+    if (!v)
+        return def;
+    if (v->type() == nFloat)
+        return v->fpoint();
     if (v->type() == nString) {
         /* Backwards compatibility with before we had support for
            float meta fields. */
@@ -266,22 +280,24 @@ NixFloat PackageInfo::queryMetaFloat(const std::string & name, NixFloat def)
     return def;
 }
 
-
 bool PackageInfo::queryMetaBool(const std::string & name, bool def)
 {
     Value * v = queryMeta(name);
-    if (!v) return def;
-    if (v->type() == nBool) return v->boolean();
+    if (!v)
+        return def;
+    if (v->type() == nBool)
+        return v->boolean();
     if (v->type() == nString) {
         /* Backwards compatibility with before we had support for
            Boolean meta fields. */
-        if (v->string_view() == "true") return true;
-        if (v->string_view() == "false") return false;
+        if (v->string_view() == "true")
+            return true;
+        if (v->string_view() == "false")
+            return false;
     }
     return def;
 }
 
-
 void PackageInfo::setMeta(const std::string & name, Value * v)
 {
     getMeta();
@@ -291,30 +307,35 @@ void PackageInfo::setMeta(const std::string & name, Value * v)
         for (auto i : *meta)
             if (i.name != sym)
                 attrs.insert(i);
-    if (v) attrs.insert(sym, v);
+    if (v)
+        attrs.insert(sym, v);
     meta = attrs.finish();
 }
 
-
 /* Cache for already considered attrsets. */
 typedef std::set<const Bindings *> Done;
 
-
 /* Evaluate value `v'.  If it evaluates to a set of type `derivation',
    then put information about it in `drvs' (unless it's already in `done').
    The result boolean indicates whether it makes sense
    for the caller to recursively search for derivations in `v'. */
-static bool getDerivation(EvalState & state, Value & v,
-    const std::string & attrPath, PackageInfos & drvs, Done & done,
+static bool getDerivation(
+    EvalState & state,
+    Value & v,
+    const std::string & attrPath,
+    PackageInfos & drvs,
+    Done & done,
     bool ignoreAssertionFailures)
 {
     try {
         state.forceValue(v, v.determinePos(noPos));
-        if (!state.isDerivation(v)) return true;
+        if (!state.isDerivation(v))
+            return true;
 
         /* Remove spurious duplicates (e.g., a set like `rec { x =
            derivation {...}; y = x;}'. */
-        if (!done.insert(v.attrs()).second) return false;
+        if (!done.insert(v.attrs()).second)
+            return false;
 
         PackageInfo drv(state, attrPath, v.attrs());
 
@@ -325,42 +346,44 @@ static bool getDerivation(EvalState & state, Value & v,
         return false;
 
     } catch (AssertionError & e) {
-        if (ignoreAssertionFailures) return false;
+        if (ignoreAssertionFailures)
+            return false;
         throw;
     }
 }
 
-
-std::optional<PackageInfo> getDerivation(EvalState & state, Value & v,
-    bool ignoreAssertionFailures)
+std::optional<PackageInfo> getDerivation(EvalState & state, Value & v, bool ignoreAssertionFailures)
 {
     Done done;
     PackageInfos drvs;
     getDerivation(state, v, "", drvs, done, ignoreAssertionFailures);
-    if (drvs.size() != 1) return {};
+    if (drvs.size() != 1)
+        return {};
     return std::move(drvs.front());
 }
 
-
 static std::string addToPath(const std::string & s1, std::string_view s2)
 {
     return s1.empty() ? std::string(s2) : s1 + "." + s2;
 }
 
-
 static std::regex attrRegex("[A-Za-z_][A-Za-z0-9-_+]*");
 
-
-static void getDerivations(EvalState & state, Value & vIn,
-    const std::string & pathPrefix, Bindings & autoArgs,
-    PackageInfos & drvs, Done & done,
+static void getDerivations(
+    EvalState & state,
+    Value & vIn,
+    const std::string & pathPrefix,
+    Bindings & autoArgs,
+    PackageInfos & drvs,
+    Done & done,
     bool ignoreAssertionFailures)
 {
     Value v;
     state.autoCallFunction(autoArgs, vIn, v);
 
     /* Process the expression. */
-    if (!getDerivation(state, v, pathPrefix, drvs, done, ignoreAssertionFailures)) ;
+    if (!getDerivation(state, v, pathPrefix, drvs, done, ignoreAssertionFailures))
+        ;
 
     else if (v.type() == nAttrs) {
 
@@ -387,9 +410,12 @@ static void getDerivations(EvalState & state, Value & vIn,
                     should we recurse into it?  => Only if it has a
                     `recurseForDerivations = true' attribute. */
                     if (i->value->type() == nAttrs) {
-                        auto j = i->value->attrs()->get(state.sRecurseForDerivations);
-                        if (j && state.forceBool(*j->value, j->pos, "while evaluating the attribute `recurseForDerivations`"))
-                            getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
+                        auto j = i->value->attrs()->get(state.s.recurseForDerivations);
+                        if (j
+                            && state.forceBool(
+                                *j->value, j->pos, "while evaluating the attribute `recurseForDerivations`"))
+                            getDerivations(
+                                state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
                     }
                 }
             } catch (Error & e) {
@@ -412,13 +438,16 @@ static void getDerivations(EvalState & state, Value & vIn,
         state.error<TypeError>("expression does not evaluate to a derivation (or a set or list of those)").debugThrow();
 }
 
-
-void getDerivations(EvalState & state, Value & v, const std::string & pathPrefix,
-    Bindings & autoArgs, PackageInfos & drvs, bool ignoreAssertionFailures)
+void getDerivations(
+    EvalState & state,
+    Value & v,
+    const std::string & pathPrefix,
+    Bindings & autoArgs,
+    PackageInfos & drvs,
+    bool ignoreAssertionFailures)
 {
     Done done;
     getDerivations(state, v, pathPrefix, autoArgs, drvs, done, ignoreAssertionFailures);
 }
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/attr-path.hh b/src/libexpr/include/nix/expr/attr-path.hh
index 66a3f4e00..10e3e300f 100644
--- a/src/libexpr/include/nix/expr/attr-path.hh
+++ b/src/libexpr/include/nix/expr/attr-path.hh
@@ -11,11 +11,8 @@ namespace nix {
 MakeError(AttrPathNotFound, Error);
 MakeError(NoPositionInfo, Error);
 
-std::pair<Value *, PosIdx> findAlongAttrPath(
-    EvalState & state,
-    const std::string & attrPath,
-    Bindings & autoArgs,
-    Value & vIn);
+std::pair<Value *, PosIdx>
+findAlongAttrPath(EvalState & state, const std::string & attrPath, Bindings & autoArgs, Value & vIn);
 
 /**
  * Heuristic to find the filename and lineno or a nix value.
@@ -24,4 +21,4 @@ std::pair<SourcePath, uint32_t> findPackageFilename(EvalState & state, Value & v
 
 std::vector<Symbol> parseAttrPath(EvalState & state, std::string_view s);
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/attr-set.hh b/src/libexpr/include/nix/expr/attr-set.hh
index 283786f4d..8b8edddf4 100644
--- a/src/libexpr/include/nix/expr/attr-set.hh
+++ b/src/libexpr/include/nix/expr/attr-set.hh
@@ -5,10 +5,11 @@
 #include "nix/expr/symbol-table.hh"
 
 #include <algorithm>
+#include <functional>
+#include <concepts>
 
 namespace nix {
 
-
 class EvalState;
 struct Value;
 
@@ -23,17 +24,21 @@ struct Attr
        way we keep Attr size at two words with no wasted space. */
     Symbol name;
     PosIdx pos;
-    Value * value;
+    Value * value = nullptr;
     Attr(Symbol name, Value * value, PosIdx pos = noPos)
-        : name(name), pos(pos), value(value) { };
-    Attr() { };
-    auto operator <=> (const Attr & a) const
+        : name(name)
+        , pos(pos)
+        , value(value) {};
+    Attr() {};
+
+    auto operator<=>(const Attr & a) const
     {
         return name <=> a.name;
     }
 };
 
-static_assert(sizeof(Attr) == 2 * sizeof(uint32_t) + sizeof(Value *),
+static_assert(
+    sizeof(Attr) == 2 * sizeof(uint32_t) + sizeof(Value *),
     "performance of the evaluator is highly sensitive to the size of Attr. "
     "avoid introducing any padding into Attr if at all possible, and do not "
     "introduce new fields that need not be present for almost every instance.");
@@ -50,49 +55,108 @@ public:
     typedef uint32_t size_t;
     PosIdx pos;
 
+    /**
+     * An instance of bindings objects with 0 attributes.
+     * This object must never be modified.
+     */
+    static Bindings emptyBindings;
+
 private:
-    size_t size_, capacity_;
+    size_t size_ = 0;
     Attr attrs[0];
 
-    Bindings(size_t capacity) : size_(0), capacity_(capacity) { }
-    Bindings(const Bindings & bindings) = delete;
+    Bindings() = default;
+    Bindings(const Bindings &) = delete;
+    Bindings(Bindings &&) = delete;
+    Bindings & operator=(const Bindings &) = delete;
+    Bindings & operator=(Bindings &&) = delete;
 
 public:
-    size_t size() const { return size_; }
+    size_t size() const
+    {
+        return size_;
+    }
 
-    bool empty() const { return !size_; }
+    bool empty() const
+    {
+        return !size_;
+    }
 
-    typedef Attr * iterator;
+    class iterator
+    {
+    public:
+        using value_type = Attr;
+        using pointer = const value_type *;
+        using reference = const value_type &;
+        using difference_type = std::ptrdiff_t;
+        using iterator_category = std::forward_iterator_tag;
 
-    typedef const Attr * const_iterator;
+        friend class Bindings;
+
+    private:
+        pointer ptr = nullptr;
+
+        explicit iterator(pointer ptr)
+            : ptr(ptr)
+        {
+        }
+
+    public:
+        iterator() = default;
+
+        reference operator*() const
+        {
+            return *ptr;
+        }
+
+        const value_type * operator->() const
+        {
+            return ptr;
+        }
+
+        iterator & operator++()
+        {
+            ++ptr;
+            return *this;
+        }
+
+        iterator operator++(int)
+        {
+            pointer tmp = ptr;
+            ++*this;
+            return iterator(tmp);
+        }
+
+        bool operator==(const iterator & rhs) const = default;
+    };
+
+    using const_iterator = iterator;
 
     void push_back(const Attr & attr)
     {
-        assert(size_ < capacity_);
         attrs[size_++] = attr;
     }
 
-    const_iterator find(Symbol name) const
-    {
-        Attr key(name, 0);
-        const_iterator i = std::lower_bound(begin(), end(), key);
-        if (i != end() && i->name == name) return i;
-        return end();
-    }
-
     const Attr * get(Symbol name) const
     {
         Attr key(name, 0);
-        const_iterator i = std::lower_bound(begin(), end(), key);
-        if (i != end() && i->name == name) return &*i;
+        auto first = attrs;
+        auto last = attrs + size_;
+        const Attr * i = std::lower_bound(first, last, key);
+        if (i != last && i->name == name)
+            return i;
         return nullptr;
     }
 
-    iterator begin() { return &attrs[0]; }
-    iterator end() { return &attrs[size_]; }
+    const_iterator begin() const
+    {
+        return const_iterator(attrs);
+    }
 
-    const_iterator begin() const { return &attrs[0]; }
-    const_iterator end() const { return &attrs[size_]; }
+    const_iterator end() const
+    {
+        return const_iterator(attrs + size_);
+    }
 
     Attr & operator[](size_t pos)
     {
@@ -106,8 +170,6 @@ public:
 
     void sort();
 
-    size_t capacity() const { return capacity_; }
-
     /**
      * Returns the attributes in lexicographically sorted order.
      */
@@ -127,24 +189,36 @@ public:
     friend class EvalState;
 };
 
+static_assert(std::forward_iterator<Bindings::iterator>);
+static_assert(std::ranges::forward_range<Bindings>);
+
 /**
  * A wrapper around Bindings that ensures that its always in sorted
  * order at the end. The only way to consume a BindingsBuilder is to
  * call finish(), which sorts the bindings.
  */
-class BindingsBuilder
+class BindingsBuilder final
 {
-    Bindings * bindings;
-
 public:
     // needed by std::back_inserter
     using value_type = Attr;
+    using size_type = Bindings::size_t;
 
-    EvalState & state;
+private:
+    Bindings * bindings;
+    Bindings::size_t capacity_;
 
-    BindingsBuilder(EvalState & state, Bindings * bindings)
-        : bindings(bindings), state(state)
-    { }
+    friend class EvalState;
+
+    BindingsBuilder(EvalState & state, Bindings * bindings, size_type capacity)
+        : bindings(bindings)
+        , capacity_(capacity)
+        , state(state)
+    {
+    }
+
+public:
+    std::reference_wrapper<EvalState> state;
 
     void insert(Symbol name, Value * value, PosIdx pos = noPos)
     {
@@ -158,6 +232,7 @@ public:
 
     void push_back(const Attr & attr)
     {
+        assert(bindings->size() < capacity_);
         bindings->push_back(attr);
     }
 
@@ -176,19 +251,19 @@ public:
         return bindings;
     }
 
-    size_t capacity()
+    size_t capacity() const noexcept
     {
-        return bindings->capacity();
+        return capacity_;
     }
 
-    void grow(Bindings * newBindings)
+    void grow(BindingsBuilder newBindings)
     {
         for (auto & i : *bindings)
-            newBindings->push_back(i);
-        bindings = newBindings;
+            newBindings.push_back(i);
+        std::swap(*this, newBindings);
     }
 
     friend struct ExprAttrs;
 };
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval-cache.hh b/src/libexpr/include/nix/expr/eval-cache.hh
index 31873f7a3..0a0461c19 100644
--- a/src/libexpr/include/nix/expr/eval-cache.hh
+++ b/src/libexpr/include/nix/expr/eval-cache.hh
@@ -43,10 +43,7 @@ class EvalCache : public std::enable_shared_from_this<EvalCache>
 
 public:
 
-    EvalCache(
-        std::optional<std::reference_wrapper<const Hash>> useCache,
-        EvalState & state,
-        RootLoader rootLoader);
+    EvalCache(std::optional<std::reference_wrapper<const Hash>> useCache, EvalState & state, RootLoader rootLoader);
 
     ref<AttrCursor> getRoot();
 };
@@ -63,11 +60,23 @@ enum AttrType {
     Int = 8,
 };
 
-struct placeholder_t {};
-struct missing_t {};
-struct misc_t {};
-struct failed_t {};
-struct int_t { NixInt x; };
+struct placeholder_t
+{};
+
+struct missing_t
+{};
+
+struct misc_t
+{};
+
+struct failed_t
+{};
+
+struct int_t
+{
+    NixInt x;
+};
+
 typedef uint64_t AttrId;
 typedef std::pair<AttrId, Symbol> AttrKey;
 typedef std::pair<std::string, NixStringContext> string_t;
@@ -81,8 +90,8 @@ typedef std::variant<
     failed_t,
     bool,
     int_t,
-    std::vector<std::string>
-    > AttrValue;
+    std::vector<std::string>>
+    AttrValue;
 
 class AttrCursor : public std::enable_shared_from_this<AttrCursor>
 {
@@ -161,4 +170,4 @@ public:
     StorePath forceDerivation();
 };
 
-}
+} // namespace nix::eval_cache
diff --git a/src/libexpr/include/nix/expr/eval-error.hh b/src/libexpr/include/nix/expr/eval-error.hh
index 6f4c37f90..38db9b706 100644
--- a/src/libexpr/include/nix/expr/eval-error.hh
+++ b/src/libexpr/include/nix/expr/eval-error.hh
@@ -60,6 +60,7 @@ struct InvalidPathError : public EvalError
 {
 public:
     Path path;
+
     InvalidPathError(EvalState & state, const Path & path)
         : EvalError(state, "path '%s' is not valid", path)
     {
@@ -119,4 +120,4 @@ public:
     [[gnu::noinline, gnu::noreturn]] void panic();
 };
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval-gc.hh b/src/libexpr/include/nix/expr/eval-gc.hh
index 25144d40c..813c2920d 100644
--- a/src/libexpr/include/nix/expr/eval-gc.hh
+++ b/src/libexpr/include/nix/expr/eval-gc.hh
@@ -3,12 +3,13 @@
 
 #include <cstddef>
 
-// For `NIX_USE_BOEHMGC`, and if that's set, `GC_THREADS`
+// For `NIX_USE_BOEHMGC`
 #include "nix/expr/config.hh"
 
 #if NIX_USE_BOEHMGC
 
 #  define GC_INCLUDE_NEW
+#  define GC_THREADS 1
 
 #  include <gc/gc.h>
 #  include <gc/gc_cpp.h>
diff --git a/src/libexpr/include/nix/expr/eval-inline.hh b/src/libexpr/include/nix/expr/eval-inline.hh
index 7d13d7cc7..749e51537 100644
--- a/src/libexpr/include/nix/expr/eval-inline.hh
+++ b/src/libexpr/include/nix/expr/eval-inline.hh
@@ -6,9 +6,6 @@
 #include "nix/expr/eval-error.hh"
 #include "nix/expr/eval-settings.hh"
 
-// For `NIX_USE_BOEHMGC`, and if that's set, `GC_THREADS`
-#include "nix/expr/config.hh"
-
 namespace nix {
 
 /**
@@ -23,11 +20,11 @@ inline void * allocBytes(size_t n)
 #else
     p = calloc(n, 1);
 #endif
-    if (!p) throw std::bad_alloc();
+    if (!p)
+        throw std::bad_alloc();
     return p;
 }
 
-
 [[gnu::always_inline]]
 Value * EvalState::allocValue()
 {
@@ -38,7 +35,8 @@ Value * EvalState::allocValue()
        have to explicitly clear the first word of every object we take. */
     if (!*valueAllocCache) {
         *valueAllocCache = GC_malloc_many(sizeof(Value));
-        if (!*valueAllocCache) throw std::bad_alloc();
+        if (!*valueAllocCache)
+            throw std::bad_alloc();
     }
 
     /* GC_NEXT is a convenience macro for accessing the first word of an object.
@@ -54,7 +52,6 @@ Value * EvalState::allocValue()
     return (Value *) p;
 }
 
-
 [[gnu::always_inline]]
 Env & EvalState::allocEnv(size_t size)
 {
@@ -68,7 +65,8 @@ Env & EvalState::allocEnv(size_t size)
         /* see allocValue for explanations. */
         if (!*env1AllocCache) {
             *env1AllocCache = GC_malloc_many(sizeof(Env) + sizeof(Value *));
-            if (!*env1AllocCache) throw std::bad_alloc();
+            if (!*env1AllocCache)
+                throw std::bad_alloc();
         }
 
         void * p = *env1AllocCache;
@@ -84,7 +82,6 @@ Env & EvalState::allocEnv(size_t size)
     return *env;
 }
 
-
 [[gnu::always_inline]]
 void EvalState::forceValue(Value & v, const PosIdx pos)
 {
@@ -94,7 +91,7 @@ void EvalState::forceValue(Value & v, const PosIdx pos)
         Expr * expr = v.thunk().expr;
         try {
             v.mkBlackhole();
-            //checkInterrupt();
+            // checkInterrupt();
             if (env) [[likely]]
                 expr->eval(*this, *env, v);
             else
@@ -104,54 +101,47 @@ void EvalState::forceValue(Value & v, const PosIdx pos)
             tryFixupBlackHolePos(v, pos);
             throw;
         }
-    }
-    else if (v.isApp())
+    } else if (v.isApp())
         callFunction(*v.app().left, *v.app().right, v, pos);
 }
 
-
 [[gnu::always_inline]]
 inline void EvalState::forceAttrs(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     forceAttrs(v, [&]() { return pos; }, errorCtx);
 }
 
-
-template <typename Callable>
+template<typename Callable>
 [[gnu::always_inline]]
 inline void EvalState::forceAttrs(Value & v, Callable getPos, std::string_view errorCtx)
 {
     PosIdx pos = getPos();
     forceValue(v, pos);
     if (v.type() != nAttrs) {
-        error<TypeError>(
-            "expected a set but found %1%: %2%",
-            showType(v),
-            ValuePrinter(*this, v, errorPrintOptions)
-        ).withTrace(pos, errorCtx).debugThrow();
+        error<TypeError>("expected a set but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+            .withTrace(pos, errorCtx)
+            .debugThrow();
     }
 }
 
-
 [[gnu::always_inline]]
 inline void EvalState::forceList(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     forceValue(v, pos);
     if (!v.isList()) {
-        error<TypeError>(
-            "expected a list but found %1%: %2%",
-            showType(v),
-            ValuePrinter(*this, v, errorPrintOptions)
-        ).withTrace(pos, errorCtx).debugThrow();
+        error<TypeError>("expected a list but found %1%: %2%", showType(v), ValuePrinter(*this, v, errorPrintOptions))
+            .withTrace(pos, errorCtx)
+            .debugThrow();
     }
 }
 
 [[gnu::always_inline]]
-inline CallDepth EvalState::addCallDepth(const PosIdx pos) {
+inline CallDepth EvalState::addCallDepth(const PosIdx pos)
+{
     if (callDepth > settings.maxCallDepth)
         error<EvalBaseError>("stack overflow; max-call-depth exceeded").atPos(pos).debugThrow();
 
     return CallDepth(callDepth);
 };
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval-profiler-settings.hh b/src/libexpr/include/nix/expr/eval-profiler-settings.hh
index a94cde042..32138e7f1 100644
--- a/src/libexpr/include/nix/expr/eval-profiler-settings.hh
+++ b/src/libexpr/include/nix/expr/eval-profiler-settings.hh
@@ -13,4 +13,4 @@ EvalProfilerMode BaseSetting<EvalProfilerMode>::parse(const std::string & str) c
 template<>
 std::string BaseSetting<EvalProfilerMode>::to_string() const;
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval-profiler.hh b/src/libexpr/include/nix/expr/eval-profiler.hh
index 21629eebc..c632b7c42 100644
--- a/src/libexpr/include/nix/expr/eval-profiler.hh
+++ b/src/libexpr/include/nix/expr/eval-profiler.hh
@@ -111,4 +111,4 @@ public:
 
 ref<EvalProfiler> makeSampleStackProfiler(EvalState & state, std::filesystem::path profileFile, uint64_t frequency);
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval-settings.hh b/src/libexpr/include/nix/expr/eval-settings.hh
index eee3b0f0e..4c9db0c73 100644
--- a/src/libexpr/include/nix/expr/eval-settings.hh
+++ b/src/libexpr/include/nix/expr/eval-settings.hh
@@ -74,7 +74,9 @@ struct EvalSettings : Config
     )"};
 
     Setting<Strings> nixPath{
-        this, {}, "nix-path",
+        this,
+        {},
+        "nix-path",
         R"(
           List of search paths to use for [lookup path](@docroot@/language/constructs/lookup-path.md) resolution.
           This setting determines the value of
@@ -107,10 +109,14 @@ struct EvalSettings : Config
           > If [restricted evaluation](@docroot@/command-ref/conf-file.md#conf-restrict-eval) is enabled, the default value is empty.
           >
           > If [pure evaluation](#conf-pure-eval) is enabled, `builtins.nixPath` *always* evaluates to the empty list `[ ]`.
-        )", {}, false};
+        )",
+        {},
+        false};
 
     Setting<std::string> currentSystem{
-        this, "", "eval-system",
+        this,
+        "",
+        "eval-system",
         R"(
           This option defines
           [`builtins.currentSystem`](@docroot@/language/builtins.md#builtins-currentSystem)
@@ -130,7 +136,9 @@ struct EvalSettings : Config
     const std::string & getCurrentSystem() const;
 
     Setting<bool> restrictEval{
-        this, false, "restrict-eval",
+        this,
+        false,
+        "restrict-eval",
         R"(
           If set to `true`, the Nix evaluator doesn't allow access to any
           files outside of
@@ -139,7 +147,10 @@ struct EvalSettings : Config
           [`allowed-uris`](@docroot@/command-ref/conf-file.md#conf-allowed-uris).
         )"};
 
-    Setting<bool> pureEval{this, false, "pure-eval",
+    Setting<bool> pureEval{
+        this,
+        false,
+        "pure-eval",
         R"(
           Pure evaluation mode ensures that the result of Nix expressions is fully determined by explicitly declared inputs, and not influenced by external state:
 
@@ -149,21 +160,23 @@ struct EvalSettings : Config
             - [`builtins.currentTime`](@docroot@/language/builtins.md#builtins-currentTime)
             - [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath)
             - [`builtins.storePath`](@docroot@/language/builtins.md#builtins-storePath)
-        )"
-        };
+        )"};
 
     Setting<bool> traceImportFromDerivation{
-        this, false, "trace-import-from-derivation",
+        this,
+        false,
+        "trace-import-from-derivation",
         R"(
           By default, Nix allows [Import from Derivation](@docroot@/language/import-from-derivation.md).
 
           When this setting is `true`, Nix logs a warning indicating that it performed such an import.
           This option has no effect if `allow-import-from-derivation` is disabled.
-        )"
-        };
+        )"};
 
     Setting<bool> enableImportFromDerivation{
-        this, true, "allow-import-from-derivation",
+        this,
+        true,
+        "allow-import-from-derivation",
         R"(
           By default, Nix allows [Import from Derivation](@docroot@/language/import-from-derivation.md).
 
@@ -173,7 +186,10 @@ struct EvalSettings : Config
           regardless of the state of the store.
         )"};
 
-    Setting<Strings> allowedUris{this, {}, "allowed-uris",
+    Setting<Strings> allowedUris{
+        this,
+        {},
+        "allowed-uris",
         R"(
           A list of URI prefixes to which access is allowed in restricted
           evaluation mode. For example, when set to
@@ -186,7 +202,10 @@ struct EvalSettings : Config
           - or the prefix is a URI scheme ended by a colon `:` and the URI has the same scheme.
         )"};
 
-    Setting<bool> traceFunctionCalls{this, false, "trace-function-calls",
+    Setting<bool> traceFunctionCalls{
+        this,
+        false,
+        "trace-function-calls",
         R"(
           If set to `true`, the Nix evaluator traces every function call.
           Nix prints a log message at the "vomit" level for every function
@@ -204,7 +223,10 @@ struct EvalSettings : Config
           `flamegraph.pl`.
         )"};
 
-    Setting<EvalProfilerMode> evalProfilerMode{this, EvalProfilerMode::disabled, "eval-profiler",
+    Setting<EvalProfilerMode> evalProfilerMode{
+        this,
+        EvalProfilerMode::disabled,
+        "eval-profiler",
         R"(
           Enables evaluation profiling. The following modes are supported:
 
@@ -215,38 +237,56 @@ struct EvalSettings : Config
           See [Using the `eval-profiler`](@docroot@/advanced-topics/eval-profiler.md).
         )"};
 
-    Setting<Path> evalProfileFile{this, "nix.profile", "eval-profile-file",
+    Setting<Path> evalProfileFile{
+        this,
+        "nix.profile",
+        "eval-profile-file",
         R"(
           Specifies the file where [evaluation profile](#conf-eval-profiler) is saved.
         )"};
 
-    Setting<uint32_t> evalProfilerFrequency{this, 99, "eval-profiler-frequency",
+    Setting<uint32_t> evalProfilerFrequency{
+        this,
+        99,
+        "eval-profiler-frequency",
         R"(
           Specifies the sampling rate in hertz for sampling evaluation profilers.
           Use `0` to sample the stack after each function call.
           See [`eval-profiler`](#conf-eval-profiler).
         )"};
 
-    Setting<bool> useEvalCache{this, true, "eval-cache",
+    Setting<bool> useEvalCache{
+        this,
+        true,
+        "eval-cache",
         R"(
             Whether to use the flake evaluation cache.
             Certain commands won't have to evaluate when invoked for the second time with a particular version of a flake.
             Intermediate results are not cached.
         )"};
 
-    Setting<bool> ignoreExceptionsDuringTry{this, false, "ignore-try",
+    Setting<bool> ignoreExceptionsDuringTry{
+        this,
+        false,
+        "ignore-try",
         R"(
           If set to true, ignore exceptions inside 'tryEval' calls when evaluating Nix expressions in
           debug mode (using the --debugger flag). By default the debugger pauses on all exceptions.
         )"};
 
-    Setting<bool> traceVerbose{this, false, "trace-verbose",
+    Setting<bool> traceVerbose{
+        this,
+        false,
+        "trace-verbose",
         "Whether `builtins.traceVerbose` should trace its first argument when evaluated."};
 
-    Setting<unsigned int> maxCallDepth{this, 10000, "max-call-depth",
-        "The maximum function call depth to allow before erroring."};
+    Setting<unsigned int> maxCallDepth{
+        this, 10000, "max-call-depth", "The maximum function call depth to allow before erroring."};
 
-    Setting<bool> builtinsTraceDebugger{this, false, "debugger-on-trace",
+    Setting<bool> builtinsTraceDebugger{
+        this,
+        false,
+        "debugger-on-trace",
         R"(
           If set to true and the `--debugger` flag is given, the following functions
           enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break):
@@ -259,7 +299,10 @@ struct EvalSettings : Config
           This is useful for debugging warnings in third-party Nix code.
         )"};
 
-    Setting<bool> builtinsDebuggerOnWarn{this, false, "debugger-on-warn",
+    Setting<bool> builtinsDebuggerOnWarn{
+        this,
+        false,
+        "debugger-on-warn",
         R"(
           If set to true and the `--debugger` flag is given, [`builtins.warn`](@docroot@/language/builtins.md#builtins-warn)
           will enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
@@ -269,7 +312,10 @@ struct EvalSettings : Config
           Use [`debugger-on-trace`](#conf-debugger-on-trace) to also enter the debugger on legacy warnings that are logged with [`builtins.trace`](@docroot@/language/builtins.md#builtins-trace).
         )"};
 
-    Setting<bool> builtinsAbortOnWarn{this, false, "abort-on-warn",
+    Setting<bool> builtinsAbortOnWarn{
+        this,
+        false,
+        "abort-on-warn",
         R"(
           If set to true, [`builtins.warn`](@docroot@/language/builtins.md#builtins-warn) throws an error when logging a warning.
 
@@ -281,6 +327,21 @@ struct EvalSettings : Config
 
           This option can be enabled by setting `NIX_ABORT_ON_WARN=1` in the environment.
         )"};
+
+    Setting<bool> warnShortPathLiterals{
+        this,
+        false,
+        "warn-short-path-literals",
+        R"(
+          If set to true, the Nix evaluator will warn when encountering relative path literals
+          that don't start with `./` or `../`.
+
+          For example, with this setting enabled, `foo/bar` would emit a warning
+          suggesting to use `./foo/bar` instead.
+
+          This is useful for improving code readability and making path literals
+          more explicit.
+    )"};
 };
 
 /**
@@ -288,4 +349,4 @@ struct EvalSettings : Config
  */
 Path getNixDefExpr();
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval.hh b/src/libexpr/include/nix/expr/eval.hh
index 27294d114..64f528581 100644
--- a/src/libexpr/include/nix/expr/eval.hh
+++ b/src/libexpr/include/nix/expr/eval.hh
@@ -20,6 +20,8 @@
 // For `NIX_USE_BOEHMGC`, and if that's set, `GC_THREADS`
 #include "nix/expr/config.hh"
 
+#include <boost/unordered/concurrent_flat_map.hpp>
+#include <boost/unordered/unordered_flat_map.hpp>
 #include <map>
 #include <optional>
 #include <functional>
@@ -34,39 +36,46 @@ namespace nix {
 constexpr size_t maxPrimOpArity = 8;
 
 class Store;
+
 namespace fetchers {
 struct Settings;
 struct InputCache;
-}
+} // namespace fetchers
 struct EvalSettings;
 class EvalState;
 class StorePath;
 struct SingleDerivedPath;
 enum RepairFlag : bool;
 struct MemorySourceAccessor;
+
 namespace eval_cache {
-    class EvalCache;
+class EvalCache;
 }
 
 /**
  * Increments a count on construction and decrements on destruction.
  */
-class CallDepth {
-  size_t & count;
+class CallDepth
+{
+    size_t & count;
 
 public:
-  CallDepth(size_t & count) : count(count) {
-    ++count;
-  }
-  ~CallDepth() {
-    --count;
-  }
+    CallDepth(size_t & count)
+        : count(count)
+    {
+        ++count;
+    }
+
+    ~CallDepth()
+    {
+        --count;
+    }
 };
 
 /**
  * Function that implements a primop.
  */
-using PrimOpFun = void(EvalState & state, const PosIdx pos, Value * * args, Value & v);
+using PrimOpFun = void(EvalState & state, const PosIdx pos, Value ** args, Value & v);
 
 /**
  * Info about a primitive operation, and its implementation
@@ -151,9 +160,11 @@ struct Constant
     bool impureOnly = false;
 };
 
-typedef std::map<std::string, Value *, std::less<std::string>, traceable_allocator<std::pair<const std::string, Value *> > > ValMap;
+typedef std::
+    map<std::string, Value *, std::less<std::string>, traceable_allocator<std::pair<const std::string, Value *>>>
+        ValMap;
 
-typedef std::unordered_map<PosIdx, DocComment> DocCommentMap;
+typedef boost::unordered_flat_map<PosIdx, DocComment, std::hash<PosIdx>> DocCommentMap;
 
 struct Env
 {
@@ -161,23 +172,25 @@ struct Env
     Value * values[0];
 };
 
-void printEnvBindings(const EvalState &es, const Expr & expr, const Env & env);
+void printEnvBindings(const EvalState & es, const Expr & expr, const Env & env);
 void printEnvBindings(const SymbolTable & st, const StaticEnv & se, const Env & env, int lvl = 0);
 
 std::unique_ptr<ValMap> mapStaticEnvBindings(const SymbolTable & st, const StaticEnv & se, const Env & env);
 
-void copyContext(const Value & v, NixStringContext & context, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
-
+void copyContext(
+    const Value & v,
+    NixStringContext & context,
+    const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
 std::string printValue(EvalState & state, Value & v);
-std::ostream & operator << (std::ostream & os, const ValueType t);
-
+std::ostream & operator<<(std::ostream & os, const ValueType t);
 
 struct RegexCache;
 
 std::shared_ptr<RegexCache> makeRegexCache();
 
-struct DebugTrace {
+struct DebugTrace
+{
     /* WARNING: Converting PosIdx -> Pos should be done with extra care. This is
        due to the fact that operator[] of PosTable is incredibly expensive. */
     std::variant<Pos, PosIdx> pos;
@@ -202,73 +215,106 @@ struct DebugTrace {
     }
 };
 
+struct StaticEvalSymbols
+{
+    Symbol with, outPath, drvPath, type, meta, name, value, system, overrides, outputs, outputName, ignoreNulls, file,
+        line, column, functor, toString, right, wrong, structuredAttrs, json, allowedReferences, allowedRequisites,
+        disallowedReferences, disallowedRequisites, maxSize, maxClosureSize, builder, args, contentAddressed, impure,
+        outputHash, outputHashAlgo, outputHashMode, recurseForDerivations, description, self, epsilon, startSet,
+        operator_, key, path, prefix, outputSpecified;
+
+    Expr::AstSymbols exprSymbols;
+
+    static constexpr auto preallocate()
+    {
+        StaticSymbolTable alloc;
+
+        StaticEvalSymbols staticSymbols = {
+            .with = alloc.create("<with>"),
+            .outPath = alloc.create("outPath"),
+            .drvPath = alloc.create("drvPath"),
+            .type = alloc.create("type"),
+            .meta = alloc.create("meta"),
+            .name = alloc.create("name"),
+            .value = alloc.create("value"),
+            .system = alloc.create("system"),
+            .overrides = alloc.create("__overrides"),
+            .outputs = alloc.create("outputs"),
+            .outputName = alloc.create("outputName"),
+            .ignoreNulls = alloc.create("__ignoreNulls"),
+            .file = alloc.create("file"),
+            .line = alloc.create("line"),
+            .column = alloc.create("column"),
+            .functor = alloc.create("__functor"),
+            .toString = alloc.create("__toString"),
+            .right = alloc.create("right"),
+            .wrong = alloc.create("wrong"),
+            .structuredAttrs = alloc.create("__structuredAttrs"),
+            .json = alloc.create("__json"),
+            .allowedReferences = alloc.create("allowedReferences"),
+            .allowedRequisites = alloc.create("allowedRequisites"),
+            .disallowedReferences = alloc.create("disallowedReferences"),
+            .disallowedRequisites = alloc.create("disallowedRequisites"),
+            .maxSize = alloc.create("maxSize"),
+            .maxClosureSize = alloc.create("maxClosureSize"),
+            .builder = alloc.create("builder"),
+            .args = alloc.create("args"),
+            .contentAddressed = alloc.create("__contentAddressed"),
+            .impure = alloc.create("__impure"),
+            .outputHash = alloc.create("outputHash"),
+            .outputHashAlgo = alloc.create("outputHashAlgo"),
+            .outputHashMode = alloc.create("outputHashMode"),
+            .recurseForDerivations = alloc.create("recurseForDerivations"),
+            .description = alloc.create("description"),
+            .self = alloc.create("self"),
+            .epsilon = alloc.create(""),
+            .startSet = alloc.create("startSet"),
+            .operator_ = alloc.create("operator"),
+            .key = alloc.create("key"),
+            .path = alloc.create("path"),
+            .prefix = alloc.create("prefix"),
+            .outputSpecified = alloc.create("outputSpecified"),
+            .exprSymbols = {
+                .sub = alloc.create("__sub"),
+                .lessThan = alloc.create("__lessThan"),
+                .mul = alloc.create("__mul"),
+                .div = alloc.create("__div"),
+                .or_ = alloc.create("or"),
+                .findFile = alloc.create("__findFile"),
+                .nixPath = alloc.create("__nixPath"),
+                .body = alloc.create("body"),
+            }};
+
+        return std::pair{staticSymbols, alloc};
+    }
+
+    static consteval StaticEvalSymbols create()
+    {
+        return preallocate().first;
+    }
+
+    static constexpr StaticSymbolTable staticSymbolTable()
+    {
+        return preallocate().second;
+    }
+};
+
 class EvalState : public std::enable_shared_from_this<EvalState>
 {
 public:
+    static constexpr StaticEvalSymbols s = StaticEvalSymbols::create();
+
     const fetchers::Settings & fetchSettings;
     const EvalSettings & settings;
     SymbolTable symbols;
     PosTable positions;
 
-    const Symbol sWith, sOutPath, sDrvPath, sType, sMeta, sName, sValue,
-        sSystem, sOverrides, sOutputs, sOutputName, sIgnoreNulls,
-        sFile, sLine, sColumn, sFunctor, sToString,
-        sRight, sWrong, sStructuredAttrs, sJson,
-        sAllowedReferences, sAllowedRequisites, sDisallowedReferences, sDisallowedRequisites,
-        sMaxSize, sMaxClosureSize,
-        sBuilder, sArgs,
-        sContentAddressed, sImpure,
-        sOutputHash, sOutputHashAlgo, sOutputHashMode,
-        sRecurseForDerivations,
-        sDescription, sSelf, sEpsilon, sStartSet, sOperator, sKey, sPath,
-        sPrefix,
-        sOutputSpecified;
-
-    const Expr::AstSymbols exprSymbols;
-
     /**
      * If set, force copying files to the Nix store even if they
      * already exist there.
      */
     RepairFlag repair;
 
-    Bindings emptyBindings;
-
-    /**
-     * Empty list constant.
-     */
-    Value vEmptyList;
-
-    /**
-     * `null` constant.
-     *
-     * This is _not_ a singleton. Pointer equality is _not_ sufficient.
-     */
-    Value vNull;
-
-    /**
-     * `true` constant.
-     *
-     * This is _not_ a singleton. Pointer equality is _not_ sufficient.
-     */
-    Value vTrue;
-
-    /**
-     * `true` constant.
-     *
-     * This is _not_ a singleton. Pointer equality is _not_ sufficient.
-     */
-    Value vFalse;
-
-    /** `"regular"` */
-    Value vStringRegular;
-    /** `"directory"` */
-    Value vStringDirectory;
-    /** `"symlink"` */
-    Value vStringSymlink;
-    /** `"unknown"` */
-    Value vStringUnknown;
-
     /**
      * The accessor corresponding to `store`.
      */
@@ -309,19 +355,21 @@ public:
     /**
      * Debugger
      */
-    ReplExitStatus (* debugRepl)(ref<EvalState> es, const ValMap & extraEnv);
+    ReplExitStatus (*debugRepl)(ref<EvalState> es, const ValMap & extraEnv);
     bool debugStop;
     bool inDebugger = false;
     int trylevel;
     std::list<DebugTrace> debugTraces;
-    std::map<const Expr*, const std::shared_ptr<const StaticEnv>> exprEnvs;
+    boost::unordered_flat_map<const Expr *, const std::shared_ptr<const StaticEnv>> exprEnvs;
+
     const std::shared_ptr<const StaticEnv> getStaticEnv(const Expr & expr) const
     {
         auto i = exprEnvs.find(&expr);
         if (i != exprEnvs.end())
             return i->second;
         else
-            return std::shared_ptr<const StaticEnv>();;
+            return std::shared_ptr<const StaticEnv>();
+        ;
     }
 
     /** Whether a debug repl can be started. If `false`, `runDebugRepl(error)` will return without starting a repl. */
@@ -340,7 +388,8 @@ public:
 
     template<class T, typename... Args>
     [[nodiscard, gnu::noinline]]
-    EvalErrorBuilder<T> & error(const Args & ... args) {
+    EvalErrorBuilder<T> & error(const Args &... args)
+    {
         // `EvalErrorBuilder::debugThrow` performs the corresponding `delete`.
         return *new EvalErrorBuilder<T>(*this, args...);
     }
@@ -354,29 +403,42 @@ private:
 
     /* Cache for calls to addToStore(); maps source paths to the store
        paths. */
-    Sync<std::unordered_map<SourcePath, StorePath>> srcToStore;
+    boost::concurrent_flat_map<SourcePath, StorePath, std::hash<SourcePath>> srcToStore;
 
     /**
      * A cache from path names to parse trees.
      */
-    typedef std::unordered_map<SourcePath, Expr *, std::hash<SourcePath>, std::equal_to<SourcePath>, traceable_allocator<std::pair<const SourcePath, Expr *>>> FileParseCache;
+    typedef boost::unordered_flat_map<
+        SourcePath,
+        Expr *,
+        std::hash<SourcePath>,
+        std::equal_to<SourcePath>,
+        traceable_allocator<std::pair<const SourcePath, Expr *>>>
+        FileParseCache;
     FileParseCache fileParseCache;
 
     /**
      * A cache from path names to values.
      */
-    typedef std::unordered_map<SourcePath, Value, std::hash<SourcePath>, std::equal_to<SourcePath>, traceable_allocator<std::pair<const SourcePath, Value>>> FileEvalCache;
+    typedef boost::unordered_flat_map<
+        SourcePath,
+        Value,
+        std::hash<SourcePath>,
+        std::equal_to<SourcePath>,
+        traceable_allocator<std::pair<const SourcePath, Value>>>
+        FileEvalCache;
     FileEvalCache fileEvalCache;
 
     /**
      * Associate source positions of certain AST nodes with their preceding doc comment, if they have one.
      * Grouped by file.
      */
-    std::unordered_map<SourcePath, DocCommentMap> positionToDocComment;
+    boost::unordered_flat_map<SourcePath, DocCommentMap, std::hash<SourcePath>> positionToDocComment;
 
     LookupPath lookupPath;
 
-    std::map<std::string, std::optional<SourcePath>> lookupPathResolved;
+    boost::unordered_flat_map<std::string, std::optional<SourcePath>, StringViewHash, std::equal_to<>>
+        lookupPathResolved;
 
     /**
      * Cache used by prim_match().
@@ -405,7 +467,10 @@ public:
         std::shared_ptr<Store> buildStore = nullptr);
     ~EvalState();
 
-    LookupPath getLookupPath() { return lookupPath; }
+    LookupPath getLookupPath()
+    {
+        return lookupPath;
+    }
 
     /**
      * Return a `SourcePath` that refers to `path` in the root
@@ -486,9 +551,7 @@ public:
      *
      * If it is not found, return `std::nullopt`.
      */
-    std::optional<SourcePath> resolveLookupPathPath(
-        const LookupPath::Path & elem,
-        bool initAccessControl = false);
+    std::optional<SourcePath> resolveLookupPathPath(const LookupPath::Path & elem, bool initAccessControl = false);
 
     /**
      * Evaluate an expression to normal form
@@ -530,7 +593,7 @@ public:
 
     void forceAttrs(Value & v, const PosIdx pos, std::string_view errorCtx);
 
-    template <typename Callable>
+    template<typename Callable>
     inline void forceAttrs(Value & v, Callable getPos, std::string_view errorCtx);
 
     inline void forceList(Value & v, const PosIdx pos, std::string_view errorCtx);
@@ -539,20 +602,25 @@ public:
      */
     void forceFunction(Value & v, const PosIdx pos, std::string_view errorCtx);
     std::string_view forceString(Value & v, const PosIdx pos, std::string_view errorCtx);
-    std::string_view forceString(Value & v, NixStringContext & context, const PosIdx pos, std::string_view errorCtx, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+    std::string_view forceString(
+        Value & v,
+        NixStringContext & context,
+        const PosIdx pos,
+        std::string_view errorCtx,
+        const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
     std::string_view forceStringNoCtx(Value & v, const PosIdx pos, std::string_view errorCtx);
 
     /**
      * Get attribute from an attribute set and throw an error if it doesn't exist.
      */
-    Bindings::const_iterator getAttr(Symbol attrSym, const Bindings * attrSet, std::string_view errorCtx);
+    const Attr * getAttr(Symbol attrSym, const Bindings * attrSet, std::string_view errorCtx);
 
     template<typename... Args>
     [[gnu::noinline]]
-    void addErrorTrace(Error & e, const Args & ... formatArgs) const;
+    void addErrorTrace(Error & e, const Args &... formatArgs) const;
     template<typename... Args>
     [[gnu::noinline]]
-    void addErrorTrace(Error & e, const PosIdx pos, const Args & ... formatArgs) const;
+    void addErrorTrace(Error & e, const PosIdx pos, const Args &... formatArgs) const;
 
 public:
     /**
@@ -561,8 +629,8 @@ public:
      */
     bool isDerivation(Value & v);
 
-    std::optional<std::string> tryAttrsToString(const PosIdx pos, Value & v,
-        NixStringContext & context, bool coerceMore = false, bool copyToStore = true);
+    std::optional<std::string> tryAttrsToString(
+        const PosIdx pos, Value & v, NixStringContext & context, bool coerceMore = false, bool copyToStore = true);
 
     /**
      * String coercion.
@@ -572,9 +640,13 @@ public:
      * booleans and lists to a string.  If `copyToStore` is set,
      * referenced paths are copied to the Nix store as a side effect.
      */
-    BackedStringView coerceToString(const PosIdx pos, Value & v, NixStringContext & context,
+    BackedStringView coerceToString(
+        const PosIdx pos,
+        Value & v,
+        NixStringContext & context,
         std::string_view errorCtx,
-        bool coerceMore = false, bool copyToStore = true,
+        bool coerceMore = false,
+        bool copyToStore = true,
         bool canonicalizePath = true);
 
     StorePath copyPathToStore(NixStringContext & context, const SourcePath & path);
@@ -596,7 +668,11 @@ public:
     /**
      * Part of `coerceToSingleDerivedPath()` without any store IO which is exposed for unit testing only.
      */
-    std::pair<SingleDerivedPath, std::string_view> coerceToSingleDerivedPathUnchecked(const PosIdx pos, Value & v, std::string_view errorCtx, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+    std::pair<SingleDerivedPath, std::string_view> coerceToSingleDerivedPathUnchecked(
+        const PosIdx pos,
+        Value & v,
+        std::string_view errorCtx,
+        const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
     /**
      * Coerce to `SingleDerivedPath`.
@@ -636,7 +712,13 @@ public:
     /**
      * Internal primops not exposed to the user.
      */
-    std::unordered_map<std::string, Value *, std::hash<std::string>, std::equal_to<std::string>, traceable_allocator<std::pair<const std::string, Value *>>> internalPrimOps;
+    boost::unordered_flat_map<
+        std::string,
+        Value *,
+        StringViewHash,
+        std::equal_to<>,
+        traceable_allocator<std::pair<const std::string, Value *>>>
+        internalPrimOps;
 
     /**
      * Name and documentation about every constant.
@@ -710,7 +792,8 @@ private:
         std::shared_ptr<StaticEnv> & staticEnv);
 
     /**
-     * Current Nix call stack depth, used with `max-call-depth` setting to throw stack overflow hopefully before we run out of system stack.
+     * Current Nix call stack depth, used with `max-call-depth` setting to throw stack overflow hopefully before we run
+     * out of system stack.
      */
     size_t callDepth = 0;
 
@@ -762,7 +845,7 @@ public:
 
     BindingsBuilder buildBindings(size_t capacity)
     {
-        return BindingsBuilder(*this, allocBindings(capacity));
+        return BindingsBuilder(*this, allocBindings(capacity), capacity);
     }
 
     ListBuilder buildList(size_t size)
@@ -773,7 +856,7 @@ public:
     /**
      * Return a boolean `Value *` without allocating.
      */
-    Value *getBool(bool b);
+    Value * getBool(bool b);
 
     void mkThunk_(Value & v, Expr * expr);
     void mkPos(Value & v, PosIdx pos);
@@ -817,9 +900,7 @@ public:
      *
      * A combination of `mkStorePathString` and `mkOutputString`.
      */
-    void mkSingleDerivedPathString(
-        const SingleDerivedPath & p,
-        Value & v);
+    void mkSingleDerivedPathString(const SingleDerivedPath & p, Value & v);
 
     void concatLists(Value & v, size_t nrLists, Value * const * lists, const PosIdx pos, std::string_view errorCtx);
 
@@ -850,22 +931,22 @@ public:
      * @param[out] maybePaths if not nullptr, all built or referenced store paths will be added to this set
      * @return a mapping from the placeholders used to construct the associated value to their final store path.
      */
-    [[nodiscard]] StringMap realiseContext(const NixStringContext & context, StorePathSet * maybePaths = nullptr, bool isIFD = true);
+    [[nodiscard]] StringMap
+    realiseContext(const NixStringContext & context, StorePathSet * maybePaths = nullptr, bool isIFD = true);
 
     /**
-     * Realise the given string with context, and return the string with outputs instead of downstream output placeholders.
+     * Realise the given string with context, and return the string with outputs instead of downstream output
+     * placeholders.
      * @param[in] str the string to realise
      * @param[out] paths all referenced store paths will be added to this set
      * @return the realised string
      * @throw EvalError if the value is not a string, path or derivation (see `coerceToString`)
      */
-    std::string realiseString(Value & str, StorePathSet * storePathsOutMaybe, bool isIFD = true, const PosIdx pos = noPos);
+    std::string
+    realiseString(Value & str, StorePathSet * storePathsOutMaybe, bool isIFD = true, const PosIdx pos = noPos);
 
     /* Call the binary path filter predicate used builtins.path etc. */
-    bool callPathFilter(
-        Value * filterFun,
-        const SourcePath & path,
-        PosIdx pos);
+    bool callPathFilter(Value * filterFun, const SourcePath & path, PosIdx pos);
 
     DocComment getDocCommentForPos(PosIdx pos);
 
@@ -884,8 +965,7 @@ private:
      * Like `mkSingleDerivedPathStringRaw` but just creates a raw string
      * Value, which would also have a string context.
      */
-    std::string mkSingleDerivedPathStringRaw(
-        const SingleDerivedPath & p);
+    std::string mkSingleDerivedPathStringRaw(const SingleDerivedPath & p);
 
     unsigned long nrEnvs = 0;
     unsigned long nrValuesInEnvs = 0;
@@ -903,10 +983,10 @@ private:
 
     bool countCalls;
 
-    typedef std::map<std::string, size_t> PrimOpCalls;
+    typedef boost::unordered_flat_map<std::string, size_t, StringViewHash, std::equal_to<>> PrimOpCalls;
     PrimOpCalls primOpCalls;
 
-    typedef std::map<ExprLambda *, size_t> FunctionCalls;
+    typedef boost::unordered_flat_map<ExprLambda *, size_t> FunctionCalls;
     FunctionCalls functionCalls;
 
     /** Evaluation/call profiler. */
@@ -914,7 +994,7 @@ private:
 
     void incrFunctionCall(ExprLambda * fun);
 
-    typedef std::map<PosIdx, size_t> AttrSelects;
+    typedef boost::unordered_flat_map<PosIdx, size_t, std::hash<PosIdx>> AttrSelects;
     AttrSelects attrSelects;
 
     friend struct ExprOpUpdate;
@@ -925,20 +1005,23 @@ private:
     friend struct ExprFloat;
     friend struct ExprPath;
     friend struct ExprSelect;
-    friend void prim_getAttr(EvalState & state, const PosIdx pos, Value * * args, Value & v);
-    friend void prim_match(EvalState & state, const PosIdx pos, Value * * args, Value & v);
-    friend void prim_split(EvalState & state, const PosIdx pos, Value * * args, Value & v);
+    friend void prim_getAttr(EvalState & state, const PosIdx pos, Value ** args, Value & v);
+    friend void prim_match(EvalState & state, const PosIdx pos, Value ** args, Value & v);
+    friend void prim_split(EvalState & state, const PosIdx pos, Value ** args, Value & v);
 
     friend struct Value;
     friend class ListBuilder;
 };
 
-struct DebugTraceStacker {
+struct DebugTraceStacker
+{
     DebugTraceStacker(EvalState & evalState, DebugTrace t);
+
     ~DebugTraceStacker()
     {
         evalState.debugTraces.pop_front();
     }
+
     EvalState & evalState;
     DebugTrace trace;
 };
@@ -964,6 +1047,6 @@ SourcePath resolveExprPath(SourcePath path, bool addDefaultNix = true);
  */
 bool isAllowedURI(std::string_view uri, const Strings & allowedPaths);
 
-}
+} // namespace nix
 
 #include "nix/expr/eval-inline.hh"
diff --git a/src/libexpr/include/nix/expr/function-trace.hh b/src/libexpr/include/nix/expr/function-trace.hh
index ed1fc6452..1606d125a 100644
--- a/src/libexpr/include/nix/expr/function-trace.hh
+++ b/src/libexpr/include/nix/expr/function-trace.hh
@@ -22,4 +22,4 @@ public:
     postFunctionCallHook(EvalState & state, const Value & v, std::span<Value *> args, const PosIdx pos) override;
 };
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/gc-small-vector.hh b/src/libexpr/include/nix/expr/gc-small-vector.hh
index ad4503de7..fdd80b2c7 100644
--- a/src/libexpr/include/nix/expr/gc-small-vector.hh
+++ b/src/libexpr/include/nix/expr/gc-small-vector.hh
@@ -9,13 +9,13 @@ namespace nix {
 /**
  * A GC compatible vector that may used a reserved portion of `nItems` on the stack instead of allocating on the heap.
  */
-template <typename T, size_t nItems>
+template<typename T, size_t nItems>
 using SmallVector = boost::container::small_vector<T, nItems, traceable_allocator<T>>;
 
 /**
  * A vector of value pointers. See `SmallVector`.
  */
-template <size_t nItems>
+template<size_t nItems>
 using SmallValueVector = SmallVector<Value *, nItems>;
 
 /**
@@ -23,7 +23,7 @@ using SmallValueVector = SmallVector<Value *, nItems>;
  *
  * See also `SmallValueVector`.
  */
-template <size_t nItems>
+template<size_t nItems>
 using SmallTemporaryValueVector = SmallVector<Value, nItems>;
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/get-drvs.hh b/src/libexpr/include/nix/expr/get-drvs.hh
index 0787c44a8..3d42188bf 100644
--- a/src/libexpr/include/nix/expr/get-drvs.hh
+++ b/src/libexpr/include/nix/expr/get-drvs.hh
@@ -7,7 +7,6 @@
 #include <string>
 #include <map>
 
-
 namespace nix {
 
 /**
@@ -33,7 +32,7 @@ private:
      */
     bool failed = false;
 
-    const Bindings * attrs = nullptr, * meta = nullptr;
+    const Bindings *attrs = nullptr, *meta = nullptr;
 
     const Bindings * getMeta();
 
@@ -45,7 +44,8 @@ public:
      */
     std::string attrPath;
 
-    PackageInfo(EvalState & state) : state(&state) { };
+    PackageInfo(EvalState & state)
+        : state(&state) {};
     PackageInfo(EvalState & state, std::string attrPath, const Bindings * attrs);
     PackageInfo(EvalState & state, ref<Store> store, const std::string & drvPathWithOutputs);
 
@@ -74,28 +74,46 @@ public:
     MetaValue queryMetaInfo(EvalState & state, const string & name) const;
     */
 
-    void setName(const std::string & s) { name = s; }
-    void setDrvPath(StorePath path) { drvPath = {{std::move(path)}}; }
-    void setOutPath(StorePath path) { outPath = {{std::move(path)}}; }
+    void setName(const std::string & s)
+    {
+        name = s;
+    }
 
-    void setFailed() { failed = true; };
-    bool hasFailed() { return failed; };
+    void setDrvPath(StorePath path)
+    {
+        drvPath = {{std::move(path)}};
+    }
+
+    void setOutPath(StorePath path)
+    {
+        outPath = {{std::move(path)}};
+    }
+
+    void setFailed()
+    {
+        failed = true;
+    };
+
+    bool hasFailed()
+    {
+        return failed;
+    };
 };
 
-
 typedef std::list<PackageInfo, traceable_allocator<PackageInfo>> PackageInfos;
 
-
 /**
  * If value `v` denotes a derivation, return a PackageInfo object
  * describing it. Otherwise return nothing.
  */
-std::optional<PackageInfo> getDerivation(EvalState & state,
-    Value & v, bool ignoreAssertionFailures);
+std::optional<PackageInfo> getDerivation(EvalState & state, Value & v, bool ignoreAssertionFailures);
 
-void getDerivations(EvalState & state, Value & v, const std::string & pathPrefix,
-    Bindings & autoArgs, PackageInfos & drvs,
+void getDerivations(
+    EvalState & state,
+    Value & v,
+    const std::string & pathPrefix,
+    Bindings & autoArgs,
+    PackageInfos & drvs,
     bool ignoreAssertionFailures);
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/json-to-value.hh b/src/libexpr/include/nix/expr/json-to-value.hh
index b01d63bfe..2a2913d68 100644
--- a/src/libexpr/include/nix/expr/json-to-value.hh
+++ b/src/libexpr/include/nix/expr/json-to-value.hh
@@ -14,4 +14,4 @@ MakeError(JSONParseError, Error);
 
 void parseJSON(EvalState & state, const std::string_view & s, Value & v);
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/meson.build b/src/libexpr/include/nix/expr/meson.build
index 333490ee4..04f8eaf71 100644
--- a/src/libexpr/include/nix/expr/meson.build
+++ b/src/libexpr/include/nix/expr/meson.build
@@ -1,13 +1,13 @@
 # Public headers directory
 
-include_dirs = [include_directories('../..')]
+include_dirs = [ include_directories('../..') ]
 
 config_pub_h = configure_file(
   configuration : configdata_pub,
   output : 'config.hh',
 )
 
-headers = [config_pub_h] + files(
+headers = [ config_pub_h ] + files(
   'attr-path.hh',
   'attr-set.hh',
   'eval-cache.hh',
diff --git a/src/libexpr/include/nix/expr/nixexpr.hh b/src/libexpr/include/nix/expr/nixexpr.hh
index 6ede91948..414eb5116 100644
--- a/src/libexpr/include/nix/expr/nixexpr.hh
+++ b/src/libexpr/include/nix/expr/nixexpr.hh
@@ -19,7 +19,8 @@ struct StaticEnv;
 struct Value;
 
 /**
- * A documentation comment, in the sense of [RFC 145](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md)
+ * A documentation comment, in the sense of [RFC
+ * 145](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md)
  *
  * Note that this does not implement the following:
  *  - argument attribute names ("formals"): TBD
@@ -34,7 +35,8 @@ struct Value;
  *        `f: g: final: prev: <...>`. The parameters `final` and `prev` are part
  *        of the overlay concept, while distracting from the function's purpose.
  */
-struct DocComment {
+struct DocComment
+{
 
     /**
      * Start of the comment, including the opening, ie `/` and `**`.
@@ -53,10 +55,12 @@ struct DocComment {
      * therefore baking optionality into it is also useful, to avoiding the memory
      * overhead of `std::optional`.
      */
-    operator bool() const { return static_cast<bool>(begin); }
+    operator bool() const
+    {
+        return static_cast<bool>(begin);
+    }
 
     std::string getInnerText(const PosTable & positions) const;
-
 };
 
 /**
@@ -66,52 +70,69 @@ struct AttrName
 {
     Symbol symbol;
     Expr * expr = nullptr;
-    AttrName(Symbol s) : symbol(s) {};
-    AttrName(Expr * e) : expr(e) {};
+    AttrName(Symbol s)
+        : symbol(s) {};
+    AttrName(Expr * e)
+        : expr(e) {};
 };
 
 typedef std::vector<AttrName> AttrPath;
 
 std::string showAttrPath(const SymbolTable & symbols, const AttrPath & attrPath);
 
-
 /* Abstract syntax of Nix expressions. */
 
 struct Expr
 {
-    struct AstSymbols {
+    struct AstSymbols
+    {
         Symbol sub, lessThan, mul, div, or_, findFile, nixPath, body;
     };
 
-
     static unsigned long nrExprs;
-    Expr() {
+
+    Expr()
+    {
         nrExprs++;
     }
-    virtual ~Expr() { };
+
+    virtual ~Expr() {};
     virtual void show(const SymbolTable & symbols, std::ostream & str) const;
     virtual void bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> & env);
     virtual void eval(EvalState & state, Env & env, Value & v);
     virtual Value * maybeThunk(EvalState & state, Env & env);
     virtual void setName(Symbol name);
-    virtual void setDocComment(DocComment docComment) { };
-    virtual PosIdx getPos() const { return noPos; }
+    virtual void setDocComment(DocComment docComment) {};
+
+    virtual PosIdx getPos() const
+    {
+        return noPos;
+    }
 
     // These are temporary methods to be used only in parser.y
-    virtual void resetCursedOr() { };
-    virtual void warnIfCursedOr(const SymbolTable & symbols, const PosTable & positions) { };
+    virtual void resetCursedOr() {};
+    virtual void warnIfCursedOr(const SymbolTable & symbols, const PosTable & positions) {};
 };
 
-#define COMMON_METHODS \
+#define COMMON_METHODS                                                         \
     void show(const SymbolTable & symbols, std::ostream & str) const override; \
-    void eval(EvalState & state, Env & env, Value & v) override; \
+    void eval(EvalState & state, Env & env, Value & v) override;               \
     void bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> & env) override;
 
 struct ExprInt : Expr
 {
     Value v;
-    ExprInt(NixInt n) { v.mkInt(n); };
-    ExprInt(NixInt::Inner n) { v.mkInt(n); };
+
+    ExprInt(NixInt n)
+    {
+        v.mkInt(n);
+    };
+
+    ExprInt(NixInt::Inner n)
+    {
+        v.mkInt(n);
+    };
+
     Value * maybeThunk(EvalState & state, Env & env) override;
     COMMON_METHODS
 };
@@ -119,7 +140,12 @@ struct ExprInt : Expr
 struct ExprFloat : Expr
 {
     Value v;
-    ExprFloat(NixFloat nf) { v.mkFloat(nf); };
+
+    ExprFloat(NixFloat nf)
+    {
+        v.mkFloat(nf);
+    };
+
     Value * maybeThunk(EvalState & state, Env & env) override;
     COMMON_METHODS
 };
@@ -128,7 +154,13 @@ struct ExprString : Expr
 {
     std::string s;
     Value v;
-    ExprString(std::string &&s) : s(std::move(s)) { v.mkString(this->s.data()); };
+
+    ExprString(std::string && s)
+        : s(std::move(s))
+    {
+        v.mkStringNoCopy(this->s.data());
+    };
+
     Value * maybeThunk(EvalState & state, Env & env) override;
     COMMON_METHODS
 };
@@ -138,10 +170,14 @@ struct ExprPath : Expr
     ref<SourceAccessor> accessor;
     std::string s;
     Value v;
-    ExprPath(ref<SourceAccessor> accessor, std::string s) : accessor(accessor), s(std::move(s))
+
+    ExprPath(ref<SourceAccessor> accessor, std::string s)
+        : accessor(accessor)
+        , s(std::move(s))
     {
         v.mkPath(&*accessor, this->s.c_str());
     }
+
     Value * maybeThunk(EvalState & state, Env & env) override;
     COMMON_METHODS
 };
@@ -170,10 +206,18 @@ struct ExprVar : Expr
     Level level = 0;
     Displacement displ = 0;
 
-    ExprVar(Symbol name) : name(name) { };
-    ExprVar(const PosIdx & pos, Symbol name) : pos(pos), name(name) { };
+    ExprVar(Symbol name)
+        : name(name) {};
+    ExprVar(const PosIdx & pos, Symbol name)
+        : pos(pos)
+        , name(name) {};
     Value * maybeThunk(EvalState & state, Env & env) override;
-    PosIdx getPos() const override { return pos; }
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     COMMON_METHODS
 };
 
@@ -184,7 +228,8 @@ struct ExprVar : Expr
  */
 struct ExprInheritFrom : ExprVar
 {
-    ExprInheritFrom(PosIdx pos, Displacement displ): ExprVar(pos, {})
+    ExprInheritFrom(PosIdx pos, Displacement displ)
+        : ExprVar(pos, {})
     {
         this->level = 0;
         this->displ = displ;
@@ -197,11 +242,26 @@ struct ExprInheritFrom : ExprVar
 struct ExprSelect : Expr
 {
     PosIdx pos;
-    Expr * e, * def;
+    Expr *e, *def;
     AttrPath attrPath;
-    ExprSelect(const PosIdx & pos, Expr * e, AttrPath attrPath, Expr * def) : pos(pos), e(e), def(def), attrPath(std::move(attrPath)) { };
-    ExprSelect(const PosIdx & pos, Expr * e, Symbol name) : pos(pos), e(e), def(0) { attrPath.push_back(AttrName(name)); };
-    PosIdx getPos() const override { return pos; }
+    ExprSelect(const PosIdx & pos, Expr * e, AttrPath attrPath, Expr * def)
+        : pos(pos)
+        , e(e)
+        , def(def)
+        , attrPath(std::move(attrPath)) {};
+
+    ExprSelect(const PosIdx & pos, Expr * e, Symbol name)
+        : pos(pos)
+        , e(e)
+        , def(0)
+    {
+        attrPath.push_back(AttrName(name));
+    };
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
 
     /**
      * Evaluate the `a.b.c` part of `a.b.c.d`. This exists mostly for the purpose of :doc in the repl.
@@ -209,7 +269,8 @@ struct ExprSelect : Expr
      * @param[out] attrs The attribute set that should contain the last attribute name (if it exists).
      * @return The last attribute name in `attrPath`
      *
-     * @note This does *not* evaluate the final attribute, and does not fail if that's the only attribute that does not exist.
+     * @note This does *not* evaluate the final attribute, and does not fail if that's the only attribute that does not
+     * exist.
      */
     Symbol evalExceptFinalSelect(EvalState & state, Env & env, Value & attrs);
 
@@ -220,8 +281,15 @@ struct ExprOpHasAttr : Expr
 {
     Expr * e;
     AttrPath attrPath;
-    ExprOpHasAttr(Expr * e, AttrPath attrPath) : e(e), attrPath(std::move(attrPath)) { };
-    PosIdx getPos() const override { return e->getPos(); }
+    ExprOpHasAttr(Expr * e, AttrPath attrPath)
+        : e(e)
+        , attrPath(std::move(attrPath)) {};
+
+    PosIdx getPos() const override
+    {
+        return e->getPos();
+    }
+
     COMMON_METHODS
 };
 
@@ -229,7 +297,9 @@ struct ExprAttrs : Expr
 {
     bool recursive;
     PosIdx pos;
-    struct AttrDef {
+
+    struct AttrDef
+    {
         enum class Kind {
             /** `attr = expr;` */
             Plain,
@@ -244,8 +314,10 @@ struct ExprAttrs : Expr
         PosIdx pos;
         Displacement displ = 0; // displacement
         AttrDef(Expr * e, const PosIdx & pos, Kind kind = Kind::Plain)
-            : kind(kind), e(e), pos(pos) { };
-        AttrDef() { };
+            : kind(kind)
+            , e(e)
+            , pos(pos) {};
+        AttrDef() {};
 
         template<typename T>
         const T & chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const
@@ -261,24 +333,37 @@ struct ExprAttrs : Expr
             }
         }
     };
+
     typedef std::map<Symbol, AttrDef> AttrDefs;
     AttrDefs attrs;
     std::unique_ptr<std::vector<Expr *>> inheritFromExprs;
-    struct DynamicAttrDef {
-        Expr * nameExpr, * valueExpr;
+
+    struct DynamicAttrDef
+    {
+        Expr *nameExpr, *valueExpr;
         PosIdx pos;
         DynamicAttrDef(Expr * nameExpr, Expr * valueExpr, const PosIdx & pos)
-            : nameExpr(nameExpr), valueExpr(valueExpr), pos(pos) { };
+            : nameExpr(nameExpr)
+            , valueExpr(valueExpr)
+            , pos(pos) {};
     };
+
     typedef std::vector<DynamicAttrDef> DynamicAttrDefs;
     DynamicAttrDefs dynamicAttrs;
-    ExprAttrs(const PosIdx &pos) : recursive(false), pos(pos) { };
-    ExprAttrs() : recursive(false) { };
-    PosIdx getPos() const override { return pos; }
+    ExprAttrs(const PosIdx & pos)
+        : recursive(false)
+        , pos(pos) {};
+    ExprAttrs()
+        : recursive(false) {};
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     COMMON_METHODS
 
-    std::shared_ptr<const StaticEnv> bindInheritSources(
-        EvalState & es, const std::shared_ptr<const StaticEnv> & env);
+    std::shared_ptr<const StaticEnv> bindInheritSources(EvalState & es, const std::shared_ptr<const StaticEnv> & env);
     Env * buildInheritFromEnv(EvalState & state, Env & up);
     void showBindings(const SymbolTable & symbols, std::ostream & str) const;
 };
@@ -286,7 +371,7 @@ struct ExprAttrs : Expr
 struct ExprList : Expr
 {
     std::vector<Expr *> elems;
-    ExprList() { };
+    ExprList() {};
     COMMON_METHODS
     Value * maybeThunk(EvalState & state, Env & env) override;
 
@@ -314,19 +399,18 @@ struct Formals
 
     bool has(Symbol arg) const
     {
-        auto it = std::lower_bound(formals.begin(), formals.end(), arg,
-            [] (const Formal & f, const Symbol & sym) { return f.name < sym; });
+        auto it = std::lower_bound(
+            formals.begin(), formals.end(), arg, [](const Formal & f, const Symbol & sym) { return f.name < sym; });
         return it != formals.end() && it->name == arg;
     }
 
     std::vector<Formal> lexicographicOrder(const SymbolTable & symbols) const
     {
         std::vector<Formal> result(formals.begin(), formals.end());
-        std::sort(result.begin(), result.end(),
-            [&] (const Formal & a, const Formal & b) {
-                std::string_view sa = symbols[a.name], sb = symbols[b.name];
-                return sa < sb;
-            });
+        std::sort(result.begin(), result.end(), [&](const Formal & a, const Formal & b) {
+            std::string_view sa = symbols[a.name], sb = symbols[b.name];
+            return sa < sb;
+        });
         return result;
     }
 };
@@ -341,17 +425,31 @@ struct ExprLambda : Expr
     DocComment docComment;
 
     ExprLambda(PosIdx pos, Symbol arg, Formals * formals, Expr * body)
-        : pos(pos), arg(arg), formals(formals), body(body)
-    {
-    };
+        : pos(pos)
+        , arg(arg)
+        , formals(formals)
+        , body(body) {};
+
     ExprLambda(PosIdx pos, Formals * formals, Expr * body)
-        : pos(pos), formals(formals), body(body)
+        : pos(pos)
+        , formals(formals)
+        , body(body)
     {
     }
+
     void setName(Symbol name) override;
     std::string showNamePos(const EvalState & state) const;
-    inline bool hasFormals() const { return formals != nullptr; }
-    PosIdx getPos() const override { return pos; }
+
+    inline bool hasFormals() const
+    {
+        return formals != nullptr;
+    }
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     virtual void setDocComment(DocComment docComment) override;
     COMMON_METHODS
 };
@@ -362,13 +460,28 @@ struct ExprCall : Expr
     std::vector<Expr *> args;
     PosIdx pos;
     std::optional<PosIdx> cursedOrEndPos; // used during parsing to warn about https://github.com/NixOS/nix/issues/11118
+
     ExprCall(const PosIdx & pos, Expr * fun, std::vector<Expr *> && args)
-        : fun(fun), args(args), pos(pos), cursedOrEndPos({})
-    { }
+        : fun(fun)
+        , args(args)
+        , pos(pos)
+        , cursedOrEndPos({})
+    {
+    }
+
     ExprCall(const PosIdx & pos, Expr * fun, std::vector<Expr *> && args, PosIdx && cursedOrEndPos)
-        : fun(fun), args(args), pos(pos), cursedOrEndPos(cursedOrEndPos)
-    { }
-    PosIdx getPos() const override { return pos; }
+        : fun(fun)
+        , args(args)
+        , pos(pos)
+        , cursedOrEndPos(cursedOrEndPos)
+    {
+    }
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     virtual void resetCursedOr() override;
     virtual void warnIfCursedOr(const SymbolTable & symbols, const PosTable & positions) override;
     COMMON_METHODS
@@ -378,73 +491,119 @@ struct ExprLet : Expr
 {
     ExprAttrs * attrs;
     Expr * body;
-    ExprLet(ExprAttrs * attrs, Expr * body) : attrs(attrs), body(body) { };
+    ExprLet(ExprAttrs * attrs, Expr * body)
+        : attrs(attrs)
+        , body(body) {};
     COMMON_METHODS
 };
 
 struct ExprWith : Expr
 {
     PosIdx pos;
-    Expr * attrs, * body;
+    Expr *attrs, *body;
     size_t prevWith;
     ExprWith * parentWith;
-    ExprWith(const PosIdx & pos, Expr * attrs, Expr * body) : pos(pos), attrs(attrs), body(body) { };
-    PosIdx getPos() const override { return pos; }
+    ExprWith(const PosIdx & pos, Expr * attrs, Expr * body)
+        : pos(pos)
+        , attrs(attrs)
+        , body(body) {};
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     COMMON_METHODS
 };
 
 struct ExprIf : Expr
 {
     PosIdx pos;
-    Expr * cond, * then, * else_;
-    ExprIf(const PosIdx & pos, Expr * cond, Expr * then, Expr * else_) : pos(pos), cond(cond), then(then), else_(else_) { };
-    PosIdx getPos() const override { return pos; }
+    Expr *cond, *then, *else_;
+    ExprIf(const PosIdx & pos, Expr * cond, Expr * then, Expr * else_)
+        : pos(pos)
+        , cond(cond)
+        , then(then)
+        , else_(else_) {};
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     COMMON_METHODS
 };
 
 struct ExprAssert : Expr
 {
     PosIdx pos;
-    Expr * cond, * body;
-    ExprAssert(const PosIdx & pos, Expr * cond, Expr * body) : pos(pos), cond(cond), body(body) { };
-    PosIdx getPos() const override { return pos; }
+    Expr *cond, *body;
+    ExprAssert(const PosIdx & pos, Expr * cond, Expr * body)
+        : pos(pos)
+        , cond(cond)
+        , body(body) {};
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     COMMON_METHODS
 };
 
 struct ExprOpNot : Expr
 {
     Expr * e;
-    ExprOpNot(Expr * e) : e(e) { };
-    PosIdx getPos() const override { return e->getPos(); }
+    ExprOpNot(Expr * e)
+        : e(e) {};
+
+    PosIdx getPos() const override
+    {
+        return e->getPos();
+    }
+
     COMMON_METHODS
 };
 
-#define MakeBinOp(name, s) \
-    struct name : Expr \
-    { \
-        PosIdx pos; \
-        Expr * e1, * e2; \
-        name(Expr * e1, Expr * e2) : e1(e1), e2(e2) { }; \
-        name(const PosIdx & pos, Expr * e1, Expr * e2) : pos(pos), e1(e1), e2(e2) { }; \
-        void show(const SymbolTable & symbols, std::ostream & str) const override \
-        { \
-            str << "("; e1->show(symbols, str); str << " " s " "; e2->show(symbols, str); str << ")"; \
-        } \
+#define MakeBinOp(name, s)                                                                   \
+    struct name : Expr                                                                       \
+    {                                                                                        \
+        PosIdx pos;                                                                          \
+        Expr *e1, *e2;                                                                       \
+        name(Expr * e1, Expr * e2)                                                           \
+            : e1(e1)                                                                         \
+            , e2(e2) {};                                                                     \
+        name(const PosIdx & pos, Expr * e1, Expr * e2)                                       \
+            : pos(pos)                                                                       \
+            , e1(e1)                                                                         \
+            , e2(e2) {};                                                                     \
+        void show(const SymbolTable & symbols, std::ostream & str) const override            \
+        {                                                                                    \
+            str << "(";                                                                      \
+            e1->show(symbols, str);                                                          \
+            str << " " s " ";                                                                \
+            e2->show(symbols, str);                                                          \
+            str << ")";                                                                      \
+        }                                                                                    \
         void bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> & env) override \
-        { \
-            e1->bindVars(es, env); e2->bindVars(es, env);    \
-        } \
-        void eval(EvalState & state, Env & env, Value & v) override; \
-        PosIdx getPos() const override { return pos; } \
-    };
+        {                                                                                    \
+            e1->bindVars(es, env);                                                           \
+            e2->bindVars(es, env);                                                           \
+        }                                                                                    \
+        void eval(EvalState & state, Env & env, Value & v) override;                         \
+        PosIdx getPos() const override                                                       \
+        {                                                                                    \
+            return pos;                                                                      \
+        }                                                                                    \
+    }
 
-MakeBinOp(ExprOpEq, "==")
-MakeBinOp(ExprOpNEq, "!=")
-MakeBinOp(ExprOpAnd, "&&")
-MakeBinOp(ExprOpOr, "||")
-MakeBinOp(ExprOpImpl, "->")
-MakeBinOp(ExprOpUpdate, "//")
-MakeBinOp(ExprOpConcatLists, "++")
+MakeBinOp(ExprOpEq, "==");
+MakeBinOp(ExprOpNEq, "!=");
+MakeBinOp(ExprOpAnd, "&&");
+MakeBinOp(ExprOpOr, "||");
+MakeBinOp(ExprOpImpl, "->");
+MakeBinOp(ExprOpUpdate, "//");
+MakeBinOp(ExprOpConcatLists, "++");
 
 struct ExprConcatStrings : Expr
 {
@@ -452,16 +611,29 @@ struct ExprConcatStrings : Expr
     bool forceString;
     std::vector<std::pair<PosIdx, Expr *>> * es;
     ExprConcatStrings(const PosIdx & pos, bool forceString, std::vector<std::pair<PosIdx, Expr *>> * es)
-        : pos(pos), forceString(forceString), es(es) { };
-    PosIdx getPos() const override { return pos; }
+        : pos(pos)
+        , forceString(forceString)
+        , es(es) {};
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     COMMON_METHODS
 };
 
 struct ExprPos : Expr
 {
     PosIdx pos;
-    ExprPos(const PosIdx & pos) : pos(pos) { };
-    PosIdx getPos() const override { return pos; }
+    ExprPos(const PosIdx & pos)
+        : pos(pos) {};
+
+    PosIdx getPos() const override
+    {
+        return pos;
+    }
+
     COMMON_METHODS
 };
 
@@ -469,14 +641,16 @@ struct ExprPos : Expr
 struct ExprBlackHole : Expr
 {
     void show(const SymbolTable & symbols, std::ostream & str) const override {}
+
     void eval(EvalState & state, Env & env, Value & v) override;
+
     void bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> & env) override {}
+
     [[noreturn]] static void throwInfiniteRecursionError(EvalState & state, Value & v);
 };
 
 extern ExprBlackHole eBlackHole;
 
-
 /* Static environments are used to map variable names onto (level,
    displacement) pairs used to obtain the value of the variable at
    runtime. */
@@ -498,8 +672,9 @@ struct StaticEnv
 
     void sort()
     {
-        std::stable_sort(vars.begin(), vars.end(),
-            [](const Vars::value_type & a, const Vars::value_type & b) { return a.first < b.first; });
+        std::stable_sort(vars.begin(), vars.end(), [](const Vars::value_type & a, const Vars::value_type & b) {
+            return a.first < b.first;
+        });
     }
 
     void deduplicate()
@@ -507,7 +682,8 @@ struct StaticEnv
         auto it = vars.begin(), jt = it, end = vars.end();
         while (jt != end) {
             *it = *jt++;
-            while (jt != end && it->first == jt->first) *it = *jt++;
+            while (jt != end && it->first == jt->first)
+                *it = *jt++;
             it++;
         }
         vars.erase(it, end);
@@ -517,10 +693,10 @@ struct StaticEnv
     {
         Vars::value_type key(name, 0);
         auto i = std::lower_bound(vars.begin(), vars.end(), key);
-        if (i != vars.end() && i->first == name) return i;
+        if (i != vars.end() && i->first == name)
+            return i;
         return vars.end();
     }
 };
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/parser-state.hh b/src/libexpr/include/nix/expr/parser-state.hh
index 0505913d0..e689678de 100644
--- a/src/libexpr/include/nix/expr/parser-state.hh
+++ b/src/libexpr/include/nix/expr/parser-state.hh
@@ -17,7 +17,11 @@ struct StringToken
     const char * p;
     size_t l;
     bool hasIndentation;
-    operator std::string_view() const { return {p, l}; }
+
+    operator std::string_view() const
+    {
+        return {p, l};
+    }
 };
 
 // This type must be trivially copyable; see YYLTYPE_IS_TRIVIAL in parser.y.
@@ -29,12 +33,14 @@ struct ParserLocation
     // backup to recover from yyless(0)
     int stashedBeginOffset, stashedEndOffset;
 
-    void stash() {
+    void stash()
+    {
         stashedBeginOffset = beginOffset;
         stashedEndOffset = endOffset;
     }
 
-    void unstash() {
+    void unstash()
+    {
         beginOffset = stashedBeginOffset;
         endOffset = stashedEndOffset;
     }
@@ -65,7 +71,7 @@ struct LexerState
     /**
      * @brief Maps some positions to a DocComment, where the comment is relevant to the location.
      */
-    std::unordered_map<PosIdx, DocComment> & positionToDocComment;
+    DocCommentMap & positionToDocComment;
 
     PosTable & positions;
     PosTable::Origin origin;
@@ -82,37 +88,35 @@ struct ParserState
     SourcePath basePath;
     PosTable::Origin origin;
     const ref<SourceAccessor> rootFS;
-    const Expr::AstSymbols & s;
+    static constexpr Expr::AstSymbols s = StaticEvalSymbols::create().exprSymbols;
     const EvalSettings & settings;
 
     void dupAttr(const AttrPath & attrPath, const PosIdx pos, const PosIdx prevPos);
     void dupAttr(Symbol attr, const PosIdx pos, const PosIdx prevPos);
-    void addAttr(ExprAttrs * attrs, AttrPath && attrPath, const ParserLocation & loc, Expr * e, const ParserLocation & exprLoc);
+    void addAttr(
+        ExprAttrs * attrs, AttrPath && attrPath, const ParserLocation & loc, Expr * e, const ParserLocation & exprLoc);
     void addAttr(ExprAttrs * attrs, AttrPath & attrPath, const Symbol & symbol, ExprAttrs::AttrDef && def);
     Formals * validateFormals(Formals * formals, PosIdx pos = noPos, Symbol arg = {});
-    Expr * stripIndentation(const PosIdx pos,
-        std::vector<std::pair<PosIdx, std::variant<Expr *, StringToken>>> && es);
+    Expr * stripIndentation(const PosIdx pos, std::vector<std::pair<PosIdx, std::variant<Expr *, StringToken>>> && es);
     PosIdx at(const ParserLocation & loc);
 };
 
 inline void ParserState::dupAttr(const AttrPath & attrPath, const PosIdx pos, const PosIdx prevPos)
 {
-    throw ParseError({
-         .msg = HintFmt("attribute '%1%' already defined at %2%",
-             showAttrPath(symbols, attrPath), positions[prevPos]),
-         .pos = positions[pos]
-    });
+    throw ParseError(
+        {.msg = HintFmt("attribute '%1%' already defined at %2%", showAttrPath(symbols, attrPath), positions[prevPos]),
+         .pos = positions[pos]});
 }
 
 inline void ParserState::dupAttr(Symbol attr, const PosIdx pos, const PosIdx prevPos)
 {
-    throw ParseError({
-        .msg = HintFmt("attribute '%1%' already defined at %2%", symbols[attr], positions[prevPos]),
-        .pos = positions[pos]
-    });
+    throw ParseError(
+        {.msg = HintFmt("attribute '%1%' already defined at %2%", symbols[attr], positions[prevPos]),
+         .pos = positions[pos]});
 }
 
-inline void ParserState::addAttr(ExprAttrs * attrs, AttrPath && attrPath, const ParserLocation & loc, Expr * e, const ParserLocation & exprLoc)
+inline void ParserState::addAttr(
+    ExprAttrs * attrs, AttrPath && attrPath, const ParserLocation & loc, Expr * e, const ParserLocation & exprLoc)
 {
     AttrPath::iterator i;
     // All attrpaths have at least one attr
@@ -159,7 +163,8 @@ inline void ParserState::addAttr(ExprAttrs * attrs, AttrPath && attrPath, const
  * Precondition: attrPath is used for error messages and should already contain
  * symbol as its last element.
  */
-inline void ParserState::addAttr(ExprAttrs * attrs, AttrPath & attrPath, const Symbol & symbol, ExprAttrs::AttrDef && def)
+inline void
+ParserState::addAttr(ExprAttrs * attrs, AttrPath & attrPath, const Symbol & symbol, ExprAttrs::AttrDef && def)
 {
     ExprAttrs::AttrDefs::iterator j = attrs->attrs.find(symbol);
     if (j != attrs->attrs.end()) {
@@ -189,12 +194,14 @@ inline void ParserState::addAttr(ExprAttrs * attrs, AttrPath & attrPath, const S
                 attrPath.pop_back();
             }
             ae->attrs.clear();
-            jAttrs->dynamicAttrs.insert(jAttrs->dynamicAttrs.end(),
+            jAttrs->dynamicAttrs.insert(
+                jAttrs->dynamicAttrs.end(),
                 std::make_move_iterator(ae->dynamicAttrs.begin()),
                 std::make_move_iterator(ae->dynamicAttrs.end()));
             ae->dynamicAttrs.clear();
             if (ae->inheritFromExprs) {
-                jAttrs->inheritFromExprs->insert(jAttrs->inheritFromExprs->end(),
+                jAttrs->inheritFromExprs->insert(
+                    jAttrs->inheritFromExprs->end(),
                     std::make_move_iterator(ae->inheritFromExprs->begin()),
                     std::make_move_iterator(ae->inheritFromExprs->end()));
                 ae->inheritFromExprs = nullptr;
@@ -211,10 +218,9 @@ inline void ParserState::addAttr(ExprAttrs * attrs, AttrPath & attrPath, const S
 
 inline Formals * ParserState::validateFormals(Formals * formals, PosIdx pos, Symbol arg)
 {
-    std::sort(formals->formals.begin(), formals->formals.end(),
-        [] (const auto & a, const auto & b) {
-            return std::tie(a.name, a.pos) < std::tie(b.name, b.pos);
-        });
+    std::sort(formals->formals.begin(), formals->formals.end(), [](const auto & a, const auto & b) {
+        return std::tie(a.name, a.pos) < std::tie(b.name, b.pos);
+    });
 
     std::optional<std::pair<Symbol, PosIdx>> duplicate;
     for (size_t i = 0; i + 1 < formals->formals.size(); i++) {
@@ -224,24 +230,22 @@ inline Formals * ParserState::validateFormals(Formals * formals, PosIdx pos, Sym
         duplicate = std::min(thisDup, duplicate.value_or(thisDup));
     }
     if (duplicate)
-        throw ParseError({
-            .msg = HintFmt("duplicate formal function argument '%1%'", symbols[duplicate->first]),
-            .pos = positions[duplicate->second]
-        });
+        throw ParseError(
+            {.msg = HintFmt("duplicate formal function argument '%1%'", symbols[duplicate->first]),
+             .pos = positions[duplicate->second]});
 
     if (arg && formals->has(arg))
-        throw ParseError({
-            .msg = HintFmt("duplicate formal function argument '%1%'", symbols[arg]),
-            .pos = positions[pos]
-        });
+        throw ParseError(
+            {.msg = HintFmt("duplicate formal function argument '%1%'", symbols[arg]), .pos = positions[pos]});
 
     return formals;
 }
 
-inline Expr * ParserState::stripIndentation(const PosIdx pos,
-    std::vector<std::pair<PosIdx, std::variant<Expr *, StringToken>>> && es)
+inline Expr *
+ParserState::stripIndentation(const PosIdx pos, std::vector<std::pair<PosIdx, std::variant<Expr *, StringToken>>> && es)
 {
-    if (es.empty()) return new ExprString("");
+    if (es.empty())
+        return new ExprString("");
 
     /* Figure out the minimum indentation.  Note that by design
        whitespace-only final lines are not taken into account.  (So
@@ -255,7 +259,8 @@ inline Expr * ParserState::stripIndentation(const PosIdx pos,
             /* Anti-quotations and escaped characters end the current start-of-line whitespace. */
             if (atStartOfLine) {
                 atStartOfLine = false;
-                if (curIndent < minIndent) minIndent = curIndent;
+                if (curIndent < minIndent)
+                    minIndent = curIndent;
             }
             continue;
         }
@@ -269,7 +274,8 @@ inline Expr * ParserState::stripIndentation(const PosIdx pos,
                     curIndent = 0;
                 } else {
                     atStartOfLine = false;
-                    if (curIndent < minIndent) minIndent = curIndent;
+                    if (curIndent < minIndent)
+                        minIndent = curIndent;
                 }
             } else if (str->p[j] == '\n') {
                 atStartOfLine = true;
@@ -284,20 +290,19 @@ inline Expr * ParserState::stripIndentation(const PosIdx pos,
     size_t curDropped = 0;
     size_t n = es.size();
     auto i = es.begin();
-    const auto trimExpr = [&] (Expr * e) {
+    const auto trimExpr = [&](Expr * e) {
         atStartOfLine = false;
         curDropped = 0;
         es2->emplace_back(i->first, e);
     };
-    const auto trimString = [&] (const StringToken & t) {
+    const auto trimString = [&](const StringToken & t) {
         std::string s2;
         for (size_t j = 0; j < t.l; ++j) {
             if (atStartOfLine) {
                 if (t.p[j] == ' ') {
                     if (curDropped++ >= minIndent)
                         s2 += t.p[j];
-                }
-                else if (t.p[j] == '\n') {
+                } else if (t.p[j] == '\n') {
                     curDropped = 0;
                     s2 += t.p[j];
                 } else {
@@ -307,7 +312,8 @@ inline Expr * ParserState::stripIndentation(const PosIdx pos,
                 }
             } else {
                 s2 += t.p[j];
-                if (t.p[j] == '\n') atStartOfLine = true;
+                if (t.p[j] == '\n')
+                    atStartOfLine = true;
             }
         }
 
@@ -325,20 +331,20 @@ inline Expr * ParserState::stripIndentation(const PosIdx pos,
         }
     };
     for (; i != es.end(); ++i, --n) {
-        std::visit(overloaded { trimExpr, trimString }, i->second);
+        std::visit(overloaded{trimExpr, trimString}, i->second);
     }
 
     // If there is nothing at all, return the empty string directly.
     // This also ensures that equivalent empty strings result in the same ast, which is helpful when testing formatters.
     if (es2->size() == 0) {
-        auto *const result = new ExprString("");
+        auto * const result = new ExprString("");
         delete es2;
         return result;
     }
 
     /* If this is a single string, then don't do a concatenation. */
     if (es2->size() == 1 && dynamic_cast<ExprString *>((*es2)[0].second)) {
-        auto *const result = (*es2)[0].second;
+        auto * const result = (*es2)[0].second;
         delete es2;
         return result;
     }
@@ -355,4 +361,4 @@ inline PosIdx ParserState::at(const ParserLocation & loc)
     return positions.add(origin, loc.beginOffset);
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/primops.hh b/src/libexpr/include/nix/expr/primops.hh
index 0b4ecdd50..885a53e9a 100644
--- a/src/libexpr/include/nix/expr/primops.hh
+++ b/src/libexpr/include/nix/expr/primops.hh
@@ -49,13 +49,13 @@ struct RegisterPrimOp
 /**
  * Load a ValueInitializer from a DSO and return whatever it initializes
  */
-void prim_importNative(EvalState & state, const PosIdx pos, Value * * args, Value & v);
+void prim_importNative(EvalState & state, const PosIdx pos, Value ** args, Value & v);
 
 /**
  * Execute a program and parse its output
  */
-void prim_exec(EvalState & state, const PosIdx pos, Value * * args, Value & v);
+void prim_exec(EvalState & state, const PosIdx pos, Value ** args, Value & v);
 
 void makePositionThunks(EvalState & state, const PosIdx pos, Value & line, Value & column);
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/print-ambiguous.hh b/src/libexpr/include/nix/expr/print-ambiguous.hh
index 9e5a27e6d..c0d811d4b 100644
--- a/src/libexpr/include/nix/expr/print-ambiguous.hh
+++ b/src/libexpr/include/nix/expr/print-ambiguous.hh
@@ -16,10 +16,6 @@ namespace nix {
  * See: https://github.com/NixOS/nix/issues/9730
  */
 void printAmbiguous(
-    Value &v,
-    const SymbolTable &symbols,
-    std::ostream &str,
-    std::set<const void *> *seen,
-    int depth);
+    Value & v, const SymbolTable & symbols, std::ostream & str, std::set<const void *> * seen, int depth);
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/print-options.hh b/src/libexpr/include/nix/expr/print-options.hh
index 9ad54e532..ffb80abc3 100644
--- a/src/libexpr/include/nix/expr/print-options.hh
+++ b/src/libexpr/include/nix/expr/print-options.hh
@@ -110,7 +110,7 @@ struct PrintOptions
  * `PrintOptions` for unknown and therefore potentially large values in error messages,
  * to avoid printing "too much" output.
  */
-static PrintOptions errorPrintOptions = PrintOptions {
+static PrintOptions errorPrintOptions = PrintOptions{
     .ansiColors = true,
     .maxDepth = 10,
     .maxAttrs = 10,
@@ -118,4 +118,4 @@ static PrintOptions errorPrintOptions = PrintOptions {
     .maxStringLength = 1024,
 };
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/print.hh b/src/libexpr/include/nix/expr/print.hh
index ac9bf23a4..229f7159d 100644
--- a/src/libexpr/include/nix/expr/print.hh
+++ b/src/libexpr/include/nix/expr/print.hh
@@ -26,10 +26,14 @@ struct Value;
  * @param s The logical string
  */
 std::ostream & printLiteralString(std::ostream & o, std::string_view s);
-inline std::ostream & printLiteralString(std::ostream & o, const char * s) {
+
+inline std::ostream & printLiteralString(std::ostream & o, const char * s)
+{
     return printLiteralString(o, std::string_view(s));
 }
-inline std::ostream & printLiteralString(std::ostream & o, const std::string & s) {
+
+inline std::ostream & printLiteralString(std::ostream & o, const std::string & s)
+{
     return printLiteralString(o, std::string_view(s));
 }
 
@@ -60,27 +64,31 @@ bool isReservedKeyword(const std::string_view str);
  */
 std::ostream & printIdentifier(std::ostream & o, std::string_view s);
 
-void printValue(EvalState & state, std::ostream & str, Value & v, PrintOptions options = PrintOptions {});
+void printValue(EvalState & state, std::ostream & str, Value & v, PrintOptions options = PrintOptions{});
 
 /**
  * A partially-applied form of `printValue` which can be formatted using `<<`
  * without allocating an intermediate string.
  */
-class ValuePrinter {
-    friend std::ostream & operator << (std::ostream & output, const ValuePrinter & printer);
+class ValuePrinter
+{
+    friend std::ostream & operator<<(std::ostream & output, const ValuePrinter & printer);
 private:
     EvalState & state;
     Value & value;
     PrintOptions options;
 
 public:
-    ValuePrinter(EvalState & state, Value & value, PrintOptions options = PrintOptions {})
-        : state(state), value(value), options(options) { }
+    ValuePrinter(EvalState & state, Value & value, PrintOptions options = PrintOptions{})
+        : state(state)
+        , value(value)
+        , options(options)
+    {
+    }
 };
 
 std::ostream & operator<<(std::ostream & output, const ValuePrinter & printer);
 
-
 /**
  * `ValuePrinter` does its own ANSI formatting, so we don't color it
  * magenta.
@@ -88,4 +96,4 @@ std::ostream & operator<<(std::ostream & output, const ValuePrinter & printer);
 template<>
 HintFmt & HintFmt::operator%(const ValuePrinter & value);
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/repl-exit-status.hh b/src/libexpr/include/nix/expr/repl-exit-status.hh
index 08299ff61..5437e1541 100644
--- a/src/libexpr/include/nix/expr/repl-exit-status.hh
+++ b/src/libexpr/include/nix/expr/repl-exit-status.hh
@@ -17,4 +17,4 @@ enum class ReplExitStatus {
     Continue,
 };
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/search-path.hh b/src/libexpr/include/nix/expr/search-path.hh
index 202527fd2..7d7664e8e 100644
--- a/src/libexpr/include/nix/expr/search-path.hh
+++ b/src/libexpr/include/nix/expr/search-path.hh
@@ -105,4 +105,4 @@ struct LookupPath::Elem
     static LookupPath::Elem parse(std::string_view rawElem);
 };
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/symbol-table.hh b/src/libexpr/include/nix/expr/symbol-table.hh
index 20a05a09d..5f2b47dd6 100644
--- a/src/libexpr/include/nix/expr/symbol-table.hh
+++ b/src/libexpr/include/nix/expr/symbol-table.hh
@@ -7,12 +7,7 @@
 #include "nix/util/error.hh"
 
 #include <boost/version.hpp>
-#define USE_FLAT_SYMBOL_SET (BOOST_VERSION >= 108100)
-#if USE_FLAT_SYMBOL_SET
-#  include <boost/unordered/unordered_flat_set.hpp>
-#else
-#  include <boost/unordered/unordered_set.hpp>
-#endif
+#include <boost/unordered/unordered_flat_set.hpp>
 
 namespace nix {
 
@@ -33,6 +28,8 @@ public:
     }
 };
 
+class StaticSymbolTable;
+
 /**
  * Symbols have the property that they can be compared efficiently
  * (using an equality test), because the symbol table stores only one
@@ -42,20 +39,38 @@ class Symbol
 {
     friend class SymbolStr;
     friend class SymbolTable;
+    friend class StaticSymbolTable;
 
 private:
     uint32_t id;
 
-    explicit Symbol(uint32_t id) noexcept : id(id) {}
+    explicit constexpr Symbol(uint32_t id) noexcept
+        : id(id)
+    {
+    }
 
 public:
-    Symbol() noexcept : id(0) {}
+    constexpr Symbol() noexcept
+        : id(0)
+    {
+    }
 
     [[gnu::always_inline]]
-    explicit operator bool() const noexcept { return id > 0; }
+    constexpr explicit operator bool() const noexcept
+    {
+        return id > 0;
+    }
 
-    auto operator<=>(const Symbol other) const noexcept { return id <=> other.id; }
-    bool operator==(const Symbol other) const noexcept { return id == other.id; }
+    /**
+     * The ID is a private implementation detail that should generally not be observed. However, we expose here just for
+     * sake of `switch...case`, which needs to dispatch on numbers. */
+    [[gnu::always_inline]]
+    constexpr uint32_t getId() const noexcept
+    {
+        return id;
+    }
+
+    constexpr auto operator<=>(const Symbol & other) const noexcept = default;
 
     friend class std::hash<Symbol>;
 };
@@ -87,11 +102,16 @@ class SymbolStr
             : store(store)
             , s(s)
             , hash(HashType{}(s))
-            , alloc(stringAlloc) {}
+            , alloc(stringAlloc)
+        {
+        }
     };
 
 public:
-    SymbolStr(const SymbolValue & s) noexcept : s(&s) {}
+    SymbolStr(const SymbolValue & s) noexcept
+        : s(&s)
+    {
+    }
 
     SymbolStr(const Key & key)
     {
@@ -102,19 +122,19 @@ public:
         // for multi-threaded implementations: lock store and allocator here
         const auto & [v, idx] = key.store.add(SymbolValue{});
         if (size == 0) {
-            v.mkString("", nullptr);
+            v.mkStringNoCopy("", nullptr);
         } else {
             auto s = key.alloc.allocate(size + 1);
             memcpy(s, key.s.data(), size);
             s[size] = '\0';
-            v.mkString(s, nullptr);
+            v.mkStringNoCopy(s, nullptr);
         }
         v.size_ = size;
         v.idx = idx;
         this->s = &v;
     }
 
-    bool operator == (std::string_view s2) const noexcept
+    bool operator==(std::string_view s2) const noexcept
     {
         return *s == s2;
     }
@@ -125,13 +145,12 @@ public:
         return s->c_str();
     }
 
-    [[gnu::always_inline]]
-    operator std::string_view () const noexcept
+    [[gnu::always_inline]] operator std::string_view() const noexcept
     {
         return *s;
     }
 
-    friend std::ostream & operator <<(std::ostream & os, const SymbolStr & symbol);
+    friend std::ostream & operator<<(std::ostream & os, const SymbolStr & symbol);
 
     [[gnu::always_inline]]
     bool empty() const noexcept
@@ -195,6 +214,39 @@ public:
     };
 };
 
+class SymbolTable;
+
+/**
+ * Convenience class to statically assign symbol identifiers at compile-time.
+ */
+class StaticSymbolTable
+{
+    static constexpr std::size_t maxSize = 1024;
+
+    struct StaticSymbolInfo
+    {
+        std::string_view str;
+        Symbol sym;
+    };
+
+    std::array<StaticSymbolInfo, maxSize> symbols;
+    std::size_t size = 0;
+
+public:
+    constexpr StaticSymbolTable() = default;
+
+    constexpr Symbol create(std::string_view str)
+    {
+        /* No need to check bounds because out of bounds access is
+           a compilation error. */
+        auto sym = Symbol(size + 1); //< +1 because Symbol with id = 0 is reserved
+        symbols[size++] = {str, sym};
+        return sym;
+    }
+
+    void copyIntoSymbolTable(SymbolTable & symtab) const;
+};
+
 /**
  * Symbol table used by the parser and evaluator to represent and look
  * up identifiers and attributes efficiently.
@@ -214,35 +266,23 @@ private:
      * Transparent lookup of string view for a pointer to a ChunkedVector entry -> return offset into the store.
      * ChunkedVector references are never invalidated.
      */
-#if USE_FLAT_SYMBOL_SET
     boost::unordered_flat_set<SymbolStr, SymbolStr::Hash, SymbolStr::Equal> symbols{SymbolStr::chunkSize};
-#else
-    using SymbolValueAlloc = std::pmr::polymorphic_allocator<SymbolStr>;
-    boost::unordered_set<SymbolStr, SymbolStr::Hash, SymbolStr::Equal, SymbolValueAlloc> symbols{SymbolStr::chunkSize, {&buffer}};
-#endif
 
 public:
+    SymbolTable(const StaticSymbolTable & staticSymtab)
+    {
+        staticSymtab.copyIntoSymbolTable(*this);
+    }
 
     /**
      * Converts a string into a symbol.
      */
-    Symbol create(std::string_view s) {
+    Symbol create(std::string_view s)
+    {
         // Most symbols are looked up more than once, so we trade off insertion performance
         // for lookup performance.
         // FIXME: make this thread-safe.
-        return [&]<typename T>(T && key) -> Symbol {
-            if constexpr (requires { symbols.insert<T>(key); }) {
-                auto [it, _] = symbols.insert<T>(key);
-                return Symbol(*it);
-            } else {
-                auto it = symbols.find<T>(key);
-                if (it != symbols.end())
-                    return Symbol(*it);
-
-                it = symbols.emplace(key).first;
-                return Symbol(*it);
-            }
-        }(SymbolStr::Key{store, s, stringAlloc});
+        return Symbol(*symbols.insert(SymbolStr::Key{store, s, stringAlloc}).first);
     }
 
     std::vector<SymbolStr> resolve(const std::vector<Symbol> & symbols) const
@@ -277,8 +317,18 @@ public:
     }
 };
 
+inline void StaticSymbolTable::copyIntoSymbolTable(SymbolTable & symtab) const
+{
+    for (std::size_t i = 0; i < size; ++i) {
+        auto [str, staticSym] = symbols[i];
+        auto sym = symtab.create(str);
+        if (sym != staticSym) [[unlikely]]
+            unreachable();
+    }
 }
 
+} // namespace nix
+
 template<>
 struct std::hash<nix::Symbol>
 {
@@ -287,5 +337,3 @@ struct std::hash<nix::Symbol>
         return std::hash<decltype(s.id)>{}(s.id);
     }
 };
-
-#undef USE_FLAT_SYMBOL_SET
diff --git a/src/libexpr/include/nix/expr/value-to-json.hh b/src/libexpr/include/nix/expr/value-to-json.hh
index 1a6911347..b19c16726 100644
--- a/src/libexpr/include/nix/expr/value-to-json.hh
+++ b/src/libexpr/include/nix/expr/value-to-json.hh
@@ -10,13 +10,18 @@
 
 namespace nix {
 
-nlohmann::json printValueAsJSON(EvalState & state, bool strict,
-    Value & v, const PosIdx pos, NixStringContext & context, bool copyToStore = true);
-
-void printValueAsJSON(EvalState & state, bool strict,
-    Value & v, const PosIdx pos, std::ostream & str, NixStringContext & context, bool copyToStore = true);
+nlohmann::json printValueAsJSON(
+    EvalState & state, bool strict, Value & v, const PosIdx pos, NixStringContext & context, bool copyToStore = true);
 
+void printValueAsJSON(
+    EvalState & state,
+    bool strict,
+    Value & v,
+    const PosIdx pos,
+    std::ostream & str,
+    NixStringContext & context,
+    bool copyToStore = true);
 
 MakeError(JSONSerializationError, Error);
 
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/value-to-xml.hh b/src/libexpr/include/nix/expr/value-to-xml.hh
index e22325de5..50a7c43cc 100644
--- a/src/libexpr/include/nix/expr/value-to-xml.hh
+++ b/src/libexpr/include/nix/expr/value-to-xml.hh
@@ -9,7 +9,13 @@
 
 namespace nix {
 
-void printValueAsXML(EvalState & state, bool strict, bool location,
-    Value & v, std::ostream & out, NixStringContext & context, const PosIdx pos);
+void printValueAsXML(
+    EvalState & state,
+    bool strict,
+    bool location,
+    Value & v,
+    std::ostream & out,
+    NixStringContext & context,
+    const PosIdx pos);
 
 }
diff --git a/src/libexpr/include/nix/expr/value.hh b/src/libexpr/include/nix/expr/value.hh
index 098effa29..e526fcde0 100644
--- a/src/libexpr/include/nix/expr/value.hh
+++ b/src/libexpr/include/nix/expr/value.hh
@@ -12,6 +12,7 @@
 #include "nix/expr/print-options.hh"
 #include "nix/util/checked-arithmetic.hh"
 
+#include <boost/unordered/unordered_flat_map_fwd.hpp>
 #include <nlohmann/json_fwd.hpp>
 
 namespace nix {
@@ -176,6 +177,7 @@ public:
     {
         return &elems[0];
     }
+
     iterator end()
     {
         return &elems[size];
@@ -306,7 +308,7 @@ NIX_VALUE_STORAGE_FOR_EACH_FIELD(NIX_VALUE_PAYLOAD_TYPE)
 template<typename T>
 inline constexpr InternalType payloadTypeToInternalType = PayloadTypeToInternalType<T>::value;
 
-}
+} // namespace detail
 
 /**
  * Discriminated union of types stored in the value.
@@ -368,7 +370,7 @@ namespace detail {
 /* Whether to use a specialization of ValueStorage that does bitpacking into
    alignment niches. */
 template<std::size_t ptrSize>
-inline constexpr bool useBitPackedValueStorage = (ptrSize == 8) && (__STDCPP_DEFAULT_NEW_ALIGNMENT__ >= 8);
+inline constexpr bool useBitPackedValueStorage = (ptrSize == 8) && (__STDCPP_DEFAULT_NEW_ALIGNMENT__ >= 16);
 
 } // namespace detail
 
@@ -377,7 +379,8 @@ inline constexpr bool useBitPackedValueStorage = (ptrSize == 8) && (__STDCPP_DEF
  * Packs discriminator bits into the pointer alignment niches.
  */
 template<std::size_t ptrSize>
-class ValueStorage<ptrSize, std::enable_if_t<detail::useBitPackedValueStorage<ptrSize>>> : public detail::ValueBase
+class alignas(16) ValueStorage<ptrSize, std::enable_if_t<detail::useBitPackedValueStorage<ptrSize>>>
+    : public detail::ValueBase
 {
     /* Needs a dependent type name in order for member functions (and
      * potentially ill-formed bit casts) to be SFINAE'd out.
@@ -831,6 +834,35 @@ struct Value : public ValueStorage<sizeof(void *)>
 {
     friend std::string showType(const Value & v);
 
+    /**
+     * Empty list constant.
+     *
+     * This is _not_ a singleton. Pointer equality is _not_ sufficient.
+     */
+    static Value vEmptyList;
+
+    /**
+     * `null` constant.
+     *
+     * This is _not_ a singleton. Pointer equality is _not_ sufficient.
+     */
+    static Value vNull;
+
+    /**
+     * `true` constant.
+     *
+     * This is _not_ a singleton. Pointer equality is _not_ sufficient.
+     */
+    static Value vTrue;
+
+    /**
+     * `true` constant.
+     *
+     * This is _not_ a singleton. Pointer equality is _not_ sufficient.
+     */
+    static Value vFalse;
+
+private:
     template<InternalType... discriminator>
     bool isa() const noexcept
     {
@@ -865,10 +897,12 @@ public:
     {
         return isa<tThunk>();
     };
+
     inline bool isApp() const
     {
         return isa<tApp>();
     };
+
     inline bool isBlackhole() const;
 
     // type() == nFunction
@@ -876,10 +910,12 @@ public:
     {
         return isa<tLambda>();
     };
+
     inline bool isPrimOp() const
     {
         return isa<tPrimOp>();
     };
+
     inline bool isPrimOpApp() const
     {
         return isa<tPrimOpApp>();
@@ -955,7 +991,7 @@ public:
         setStorage(b);
     }
 
-    inline void mkString(const char * s, const char ** context = 0) noexcept
+    void mkStringNoCopy(const char * s, const char ** context = 0) noexcept
     {
         setStorage(StringWithContext{.c_str = s, .context = context});
     }
@@ -967,7 +1003,6 @@ public:
     void mkStringMove(const char * s, const NixStringContext & context);
 
     void mkPath(const SourcePath & path);
-    void mkPath(std::string_view path);
 
     inline void mkPath(SourceAccessor * accessor, const char * path) noexcept
     {
@@ -988,12 +1023,20 @@ public:
 
     void mkList(const ListBuilder & builder) noexcept
     {
-        if (builder.size == 1)
+        switch (builder.size) {
+        case 0:
+            setStorage(List{.size = 0, .elems = nullptr});
+            break;
+        case 1:
             setStorage(std::array<Value *, 2>{builder.inlineElems[0], nullptr});
-        else if (builder.size == 2)
+            break;
+        case 2:
             setStorage(std::array<Value *, 2>{builder.inlineElems[0], builder.inlineElems[1]});
-        else
+            break;
+        default:
             setStorage(List{.size = builder.size, .elems = builder.elems});
+            break;
+        }
     }
 
     inline void mkThunk(Env * e, Expr * ex) noexcept
@@ -1153,7 +1196,7 @@ void Value::mkBlackhole()
 }
 
 typedef std::vector<Value *, traceable_allocator<Value *>> ValueVector;
-typedef std::unordered_map<
+typedef boost::unordered_flat_map<
     Symbol,
     Value *,
     std::hash<Symbol>,
@@ -1171,4 +1214,4 @@ typedef std::shared_ptr<Value *> RootValue;
 RootValue allocRootValue(Value * v);
 
 void forceNoNullByte(std::string_view s, std::function<Pos()> = nullptr);
-}
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/value/context.hh b/src/libexpr/include/nix/expr/value/context.hh
index f2de184ea..dcfacbb21 100644
--- a/src/libexpr/include/nix/expr/value/context.hh
+++ b/src/libexpr/include/nix/expr/value/context.hh
@@ -15,7 +15,7 @@ public:
     std::string_view raw;
 
     template<typename... Args>
-    BadNixStringContextElem(std::string_view raw_, const Args & ... args)
+    BadNixStringContextElem(std::string_view raw_, const Args &... args)
         : Error("")
     {
         raw = raw_;
@@ -24,7 +24,8 @@ public:
     }
 };
 
-struct NixStringContextElem {
+struct NixStringContextElem
+{
     /**
      * Plain opaque path to some store object.
      *
@@ -41,7 +42,8 @@ struct NixStringContextElem {
      *
      * Encoded in the form `=<drvPath>`.
      */
-    struct DrvDeep {
+    struct DrvDeep
+    {
         StorePath drvPath;
 
         GENERATE_CMP(DrvDeep, me->drvPath);
@@ -54,11 +56,7 @@ struct NixStringContextElem {
      */
     using Built = SingleDerivedPath::Built;
 
-    using Raw = std::variant<
-        Opaque,
-        DrvDeep,
-        Built
-    >;
+    using Raw = std::variant<Opaque, DrvDeep, Built>;
 
     Raw raw;
 
@@ -74,12 +72,11 @@ struct NixStringContextElem {
      *
      * @param xpSettings Stop-gap to avoid globals during unit tests.
      */
-    static NixStringContextElem parse(
-        std::string_view s,
-        const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+    static NixStringContextElem
+    parse(std::string_view s, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
     std::string to_string() const;
 };
 
 typedef std::set<NixStringContextElem> NixStringContext;
 
-}
+} // namespace nix
diff --git a/src/libexpr/json-to-value.cc b/src/libexpr/json-to-value.cc
index e38ac7db4..9c645e7fd 100644
--- a/src/libexpr/json-to-value.cc
+++ b/src/libexpr/json-to-value.cc
@@ -12,8 +12,10 @@ namespace nix {
 
 // for more information, refer to
 // https://github.com/nlohmann/json/blob/master/include/nlohmann/detail/input/json_sax.hpp
-class JSONSax : nlohmann::json_sax<json> {
-    class JSONState {
+class JSONSax : nlohmann::json_sax<json>
+{
+    class JSONState
+    {
     protected:
         std::unique_ptr<JSONState> parent;
         RootValue v;
@@ -22,22 +24,36 @@ class JSONSax : nlohmann::json_sax<json> {
         {
             throw std::logic_error("tried to close toplevel json parser state");
         }
-        explicit JSONState(std::unique_ptr<JSONState> && p) : parent(std::move(p)) {}
-        explicit JSONState(Value * v) : v(allocRootValue(v)) {}
+
+        explicit JSONState(std::unique_ptr<JSONState> && p)
+            : parent(std::move(p))
+        {
+        }
+
+        explicit JSONState(Value * v)
+            : v(allocRootValue(v))
+        {
+        }
+
         JSONState(JSONState & p) = delete;
+
         Value & value(EvalState & state)
         {
             if (!v)
                 v = allocRootValue(state.allocValue());
             return **v;
         }
+
         virtual ~JSONState() {}
+
         virtual void add() {}
     };
 
-    class JSONObjectState : public JSONState {
+    class JSONObjectState : public JSONState
+    {
         using JSONState::JSONState;
         ValueMap attrs;
+
         std::unique_ptr<JSONState> resolve(EvalState & state) override
         {
             auto attrs2 = state.buildBindings(attrs.size());
@@ -46,7 +62,11 @@ class JSONSax : nlohmann::json_sax<json> {
             parent->value(state).mkAttrs(attrs2);
             return std::move(parent);
         }
-        void add() override { v = nullptr; }
+
+        void add() override
+        {
+            v = nullptr;
+        }
     public:
         void key(string_t & name, EvalState & state)
         {
@@ -55,8 +75,10 @@ class JSONSax : nlohmann::json_sax<json> {
         }
     };
 
-    class JSONListState : public JSONState {
+    class JSONListState : public JSONState
+    {
         ValueVector values;
+
         std::unique_ptr<JSONState> resolve(EvalState & state) override
         {
             auto list = state.buildList(values.size());
@@ -65,12 +87,15 @@ class JSONSax : nlohmann::json_sax<json> {
             parent->value(state).mkList(list);
             return std::move(parent);
         }
-        void add() override {
+
+        void add() override
+        {
             values.push_back(*v);
             v = nullptr;
         }
     public:
-        JSONListState(std::unique_ptr<JSONState> && p, std::size_t reserve) : JSONState(std::move(p))
+        JSONListState(std::unique_ptr<JSONState> && p, std::size_t reserve)
+            : JSONState(std::move(p))
         {
             values.reserve(reserve);
         }
@@ -80,7 +105,9 @@ class JSONSax : nlohmann::json_sax<json> {
     std::unique_ptr<JSONState> rs;
 
 public:
-    JSONSax(EvalState & state, Value & v) : state(state), rs(new JSONState(&v)) {};
+    JSONSax(EvalState & state, Value & v)
+        : state(state)
+        , rs(new JSONState(&v)) {};
 
     bool null() override
     {
@@ -130,7 +157,7 @@ public:
     }
 
 #if NLOHMANN_JSON_VERSION_MAJOR >= 3 && NLOHMANN_JSON_VERSION_MINOR >= 8
-    bool binary(binary_t&) override
+    bool binary(binary_t &) override
     {
         // This function ought to be unreachable
         assert(false);
@@ -146,27 +173,30 @@ public:
 
     bool key(string_t & name) override
     {
-        dynamic_cast<JSONObjectState*>(rs.get())->key(name, state);
+        dynamic_cast<JSONObjectState *>(rs.get())->key(name, state);
         return true;
     }
 
-    bool end_object() override {
+    bool end_object() override
+    {
         rs = rs->resolve(state);
         rs->add();
         return true;
     }
 
-    bool end_array() override {
+    bool end_array() override
+    {
         return end_object();
     }
 
-    bool start_array(size_t len) override {
-        rs = std::make_unique<JSONListState>(std::move(rs),
-            len != std::numeric_limits<size_t>::max() ? len : 128);
+    bool start_array(size_t len) override
+    {
+        rs = std::make_unique<JSONListState>(std::move(rs), len != std::numeric_limits<size_t>::max() ? len : 128);
         return true;
     }
 
-    bool parse_error(std::size_t, const std::string&, const nlohmann::detail::exception& ex) override {
+    bool parse_error(std::size_t, const std::string &, const nlohmann::detail::exception & ex) override
+    {
         throw JSONParseError("%s", ex.what());
     }
 };
@@ -179,4 +209,4 @@ void parseJSON(EvalState & state, const std::string_view & s_, Value & v)
         throw JSONParseError("Invalid JSON Value");
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/lexer-helpers.hh b/src/libexpr/lexer-helpers.hh
index 225eb157a..49865f794 100644
--- a/src/libexpr/lexer-helpers.hh
+++ b/src/libexpr/lexer-helpers.hh
@@ -14,4 +14,4 @@ void initLoc(YYLTYPE * loc);
 
 void adjustLoc(yyscan_t yyscanner, YYLTYPE * loc, const char * s, size_t len);
 
-} // namespace nix::lexer
+} // namespace nix::lexer::internal
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index f5adafae0..40d3f390b 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -1,7 +1,9 @@
-project('nix-expr', 'cpp',
+project(
+  'nix-expr',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -17,8 +19,7 @@ subdir('nix-meson-build-support/deps-lists')
 configdata_pub = configuration_data()
 configdata_priv = configuration_data()
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
@@ -39,8 +40,11 @@ endforeach
 
 boost = dependency(
   'boost',
-  modules : ['container', 'context'],
-  include_type: 'system',
+  modules : [
+    'container',
+    'context',
+  ],
+  include_type : 'system',
 )
 # boost is a public dependency, but not a pkg-config dependency unfortunately, so we
 # put in `deps_other`.
@@ -60,8 +64,6 @@ if bdw_gc.found()
     define_value = cxx.has_function(funcspec).to_int()
     configdata_priv.set(define_name, define_value)
   endforeach
-  # Affects ABI, because it changes what bdw_gc itself does!
-  configdata_pub.set('GC_THREADS', 1)
 endif
 # Used in public header. Affects ABI!
 configdata_pub.set('NIX_USE_BOEHMGC', bdw_gc.found().to_int())
@@ -70,8 +72,14 @@ toml11 = dependency(
   'toml11',
   version : '>=3.7.0',
   method : 'cmake',
-  include_type: 'system',
+  include_type : 'system',
 )
+
+configdata_priv.set(
+  'HAVE_TOML11_4',
+  toml11.version().version_compare('>= 4.0.0').to_int(),
+)
+
 deps_other += toml11
 
 config_priv_h = configure_file(
@@ -113,8 +121,7 @@ lexer_tab = custom_target(
   command : [
     'flex',
     '-Cf', # Use full scanner tables
-    '--outfile',
-    '@OUTPUT0@',
+    '--outfile', '@OUTPUT0@',
     '--header-file=' + '@OUTPUT1@',
     '@INPUT0@',
   ],
@@ -156,6 +163,7 @@ sources = files(
   'search-path.cc',
   'value-to-json.cc',
   'value-to-xml.cc',
+  'value.cc',
   'value/context.cc',
 )
 
@@ -175,9 +183,10 @@ this_library = library(
   generated_headers,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 install_headers(headers, subdir : 'nix/expr', preserve_path : true)
diff --git a/src/libexpr/meson.options b/src/libexpr/meson.options
index 242d30ea7..847bb211d 100644
--- a/src/libexpr/meson.options
+++ b/src/libexpr/meson.options
@@ -1,3 +1,5 @@
-option('gc', type : 'feature',
+option(
+  'gc',
+  type : 'feature',
   description : 'enable garbage collection in the Nix expression evaluator (requires Boehm GC)',
 )
diff --git a/src/libexpr/nixexpr.cc b/src/libexpr/nixexpr.cc
index 92071b22d..c0a25d1d4 100644
--- a/src/libexpr/nixexpr.cc
+++ b/src/libexpr/nixexpr.cc
@@ -17,7 +17,7 @@ ExprBlackHole eBlackHole;
 
 // FIXME: remove, because *symbols* are abstract and do not have a single
 //        textual representation; see printIdentifier()
-std::ostream & operator <<(std::ostream & str, const SymbolStr & symbol)
+std::ostream & operator<<(std::ostream & str, const SymbolStr & symbol)
 {
     std::string_view s = symbol;
     return printIdentifier(str, s);
@@ -76,7 +76,8 @@ void ExprAttrs::showBindings(const SymbolTable & symbols, std::ostream & str) co
 {
     typedef const decltype(attrs)::value_type * Attr;
     std::vector<Attr> sorted;
-    for (auto & i : attrs) sorted.push_back(&i);
+    for (auto & i : attrs)
+        sorted.push_back(&i);
     std::sort(sorted.begin(), sorted.end(), [&](Attr a, Attr b) {
         std::string_view sa = symbols[a->first], sb = symbols[b->first];
         return sa < sb;
@@ -102,14 +103,16 @@ void ExprAttrs::showBindings(const SymbolTable & symbols, std::ostream & str) co
     }
     if (!inherits.empty()) {
         str << "inherit";
-        for (auto sym : inherits) str << " " << symbols[sym];
+        for (auto sym : inherits)
+            str << " " << symbols[sym];
         str << "; ";
     }
     for (const auto & [from, syms] : inheritsFrom) {
         str << "inherit (";
         (*inheritFromExprs)[from]->show(symbols, str);
         str << ")";
-        for (auto sym : syms) str << " " << symbols[sym];
+        for (auto sym : syms)
+            str << " " << symbols[sym];
         str << "; ";
     }
     for (auto & i : sorted) {
@@ -130,7 +133,8 @@ void ExprAttrs::showBindings(const SymbolTable & symbols, std::ostream & str) co
 
 void ExprAttrs::show(const SymbolTable & symbols, std::ostream & str) const
 {
-    if (recursive) str << "rec ";
+    if (recursive)
+        str << "rec ";
     str << "{ ";
     showBindings(symbols, str);
     str << "}";
@@ -157,7 +161,10 @@ void ExprLambda::show(const SymbolTable & symbols, std::ostream & str) const
         // same expression being printed in two different ways depending on its
         // context. always use lexicographic ordering to avoid this.
         for (auto & i : formals->lexicographicOrder(symbols)) {
-            if (first) first = false; else str << ", ";
+            if (first)
+                first = false;
+            else
+                str << ", ";
             str << symbols[i.name];
             if (i.def) {
                 str << " ? ";
@@ -165,13 +172,16 @@ void ExprLambda::show(const SymbolTable & symbols, std::ostream & str) const
             }
         }
         if (formals->ellipsis) {
-            if (!first) str << ", ";
+            if (!first)
+                str << ", ";
             str << "...";
         }
         str << " }";
-        if (arg) str << " @ ";
+        if (arg)
+            str << " @ ";
     }
-    if (arg) str << symbols[arg];
+    if (arg)
+        str << symbols[arg];
     str << ": ";
     body->show(symbols, str);
     str << ")";
@@ -182,7 +192,7 @@ void ExprCall::show(const SymbolTable & symbols, std::ostream & str) const
     str << '(';
     fun->show(symbols, str);
     for (auto e : args) {
-        str <<  ' ';
+        str << ' ';
         e->show(symbols, str);
     }
     str << ')';
@@ -237,7 +247,10 @@ void ExprConcatStrings::show(const SymbolTable & symbols, std::ostream & str) co
     bool first = true;
     str << "(";
     for (auto & i : *es) {
-        if (first) first = false; else str << " + ";
+        if (first)
+            first = false;
+        else
+            str << " + ";
         i.second->show(symbols, str);
     }
     str << ")";
@@ -248,13 +261,15 @@ void ExprPos::show(const SymbolTable & symbols, std::ostream & str) const
     str << "__curPos";
 }
 
-
 std::string showAttrPath(const SymbolTable & symbols, const AttrPath & attrPath)
 {
     std::ostringstream out;
     bool first = true;
     for (auto & i : attrPath) {
-        if (!first) out << '.'; else first = false;
+        if (!first)
+            out << '.';
+        else
+            first = false;
         if (i.symbol)
             out << symbols[i.symbol];
         else {
@@ -266,7 +281,6 @@ std::string showAttrPath(const SymbolTable & symbols, const AttrPath & attrPath)
     return out.str();
 }
 
-
 /* Computing levels/displacements for variables. */
 
 void Expr::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> & env)
@@ -312,7 +326,8 @@ void ExprVar::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> &
     int withLevel = -1;
     for (curEnv = env.get(), level = 0; curEnv; curEnv = curEnv->up.get(), level++) {
         if (curEnv->isWith) {
-            if (withLevel == -1) withLevel = level;
+            if (withLevel == -1)
+                withLevel = level;
         } else {
             auto i = curEnv->find(name);
             if (i != curEnv->vars.end()) {
@@ -327,10 +342,7 @@ void ExprVar::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> &
        enclosing `with'.  If there is no `with', then we can issue an
        "undefined variable" error now. */
     if (withLevel == -1)
-        es.error<UndefinedVarError>(
-            "undefined variable '%1%'",
-            es.symbols[name]
-        ).atPos(pos).debugThrow();
+        es.error<UndefinedVarError>("undefined variable '%1%'", es.symbols[name]).atPos(pos).debugThrow();
     for (auto * e = env.get(); e && !fromWith; e = e->up.get())
         fromWith = e->isWith;
     this->level = withLevel;
@@ -348,7 +360,8 @@ void ExprSelect::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv>
         es.exprEnvs.insert(std::make_pair(this, env));
 
     e->bindVars(es, env);
-    if (def) def->bindVars(es, env);
+    if (def)
+        def->bindVars(es, env);
     for (auto & i : attrPath)
         if (!i.symbol)
             i.expr->bindVars(es, env);
@@ -365,8 +378,8 @@ void ExprOpHasAttr::bindVars(EvalState & es, const std::shared_ptr<const StaticE
             i.expr->bindVars(es, env);
 }
 
-std::shared_ptr<const StaticEnv> ExprAttrs::bindInheritSources(
-    EvalState & es, const std::shared_ptr<const StaticEnv> & env)
+std::shared_ptr<const StaticEnv>
+ExprAttrs::bindInheritSources(EvalState & es, const std::shared_ptr<const StaticEnv> & env)
 {
     if (!inheritFromExprs)
         return nullptr;
@@ -392,7 +405,7 @@ void ExprAttrs::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv>
         es.exprEnvs.insert(std::make_pair(this, env));
 
     if (recursive) {
-        auto newEnv = [&] () -> std::shared_ptr<const StaticEnv> {
+        auto newEnv = [&]() -> std::shared_ptr<const StaticEnv> {
             auto newEnv = std::make_shared<StaticEnv>(nullptr, env, attrs.size());
 
             Displacement displ = 0;
@@ -411,8 +424,7 @@ void ExprAttrs::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv>
             i.nameExpr->bindVars(es, newEnv);
             i.valueExpr->bindVars(es, newEnv);
         }
-    }
-    else {
+    } else {
         auto inheritFromEnv = bindInheritSources(es, env);
 
         for (auto & i : attrs)
@@ -439,14 +451,13 @@ void ExprLambda::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv>
     if (es.debugRepl)
         es.exprEnvs.insert(std::make_pair(this, env));
 
-    auto newEnv = std::make_shared<StaticEnv>(
-        nullptr, env,
-        (hasFormals() ? formals->formals.size() : 0) +
-        (!arg ? 0 : 1));
+    auto newEnv =
+        std::make_shared<StaticEnv>(nullptr, env, (hasFormals() ? formals->formals.size() : 0) + (!arg ? 0 : 1));
 
     Displacement displ = 0;
 
-    if (arg) newEnv->vars.emplace_back(arg, displ++);
+    if (arg)
+        newEnv->vars.emplace_back(arg, displ++);
 
     if (hasFormals()) {
         for (auto & i : formals->formals)
@@ -455,7 +466,8 @@ void ExprLambda::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv>
         newEnv->sort();
 
         for (auto & i : formals->formals)
-            if (i.def) i.def->bindVars(es, newEnv);
+            if (i.def)
+                i.def->bindVars(es, newEnv);
     }
 
     body->bindVars(es, newEnv);
@@ -473,7 +485,7 @@ void ExprCall::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> &
 
 void ExprLet::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> & env)
 {
-    auto newEnv = [&] () -> std::shared_ptr<const StaticEnv> {
+    auto newEnv = [&]() -> std::shared_ptr<const StaticEnv> {
         auto newEnv = std::make_shared<StaticEnv>(nullptr, env, attrs->attrs.size());
 
         Displacement displ = 0;
@@ -562,13 +574,9 @@ void ExprPos::bindVars(EvalState & es, const std::shared_ptr<const StaticEnv> &
         es.exprEnvs.insert(std::make_pair(this, env));
 }
 
-
 /* Storing function names. */
 
-void Expr::setName(Symbol name)
-{
-}
-
+void Expr::setName(Symbol name) {}
 
 void ExprLambda::setName(Symbol name)
 {
@@ -576,16 +584,14 @@ void ExprLambda::setName(Symbol name)
     body->setName(name);
 }
 
-
 std::string ExprLambda::showNamePos(const EvalState & state) const
 {
-    std::string id(name
-        ? concatStrings("'", state.symbols[name], "'")
-        : "anonymous function");
+    std::string id(name ? concatStrings("'", state.symbols[name], "'") : "anonymous function");
     return fmt("%1% at %2%", id, state.positions[pos]);
 }
 
-void ExprLambda::setDocComment(DocComment docComment) {
+void ExprLambda::setDocComment(DocComment docComment)
+{
     // RFC 145 specifies that the innermost doc comment wins.
     // See https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md#ambiguous-placement
     if (!this->docComment) {
@@ -606,11 +612,12 @@ void ExprLambda::setDocComment(DocComment docComment) {
 size_t SymbolTable::totalSize() const
 {
     size_t n = 0;
-    dump([&] (SymbolStr s) { n += s.size(); });
+    dump([&](SymbolStr s) { n += s.size(); });
     return n;
 }
 
-std::string DocComment::getInnerText(const PosTable & positions) const {
+std::string DocComment::getInnerText(const PosTable & positions) const
+{
     auto beginPos = positions[begin];
     auto endPos = positions[end];
     auto docCommentStr = beginPos.getSnippetUpTo(endPos).value_or("");
@@ -628,8 +635,6 @@ std::string DocComment::getInnerText(const PosTable & positions) const {
     return docStr;
 }
 
-
-
 /* ‘Cursed or’ handling.
  *
  * In parser.y, every use of expr_select in a production must call one of the
@@ -647,13 +652,16 @@ void ExprCall::warnIfCursedOr(const SymbolTable & symbols, const PosTable & posi
 {
     if (cursedOrEndPos.has_value()) {
         std::ostringstream out;
-        out << "at " << positions[pos] << ": "
+        out << "at " << positions[pos]
+            << ": "
                "This expression uses `or` as an identifier in a way that will change in a future Nix release.\n"
                "Wrap this entire expression in parentheses to preserve its current meaning:\n"
-               "    (" << positions[pos].getSnippetUpTo(positions[*cursedOrEndPos]).value_or("could not read expression") << ")\n"
+               "    ("
+            << positions[pos].getSnippetUpTo(positions[*cursedOrEndPos]).value_or("could not read expression")
+            << ")\n"
                "Give feedback at https://github.com/NixOS/nix/pull/11121";
         warn(out.str());
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
index 50161c58b..a67a8cc49 100644
--- a/src/libexpr/package.nix
+++ b/src/libexpr/package.nix
@@ -70,13 +70,15 @@ mkMesonLibrary (finalAttrs: {
     nix-util
     nix-store
     nix-fetchers
-  ] ++ finalAttrs.passthru.externalPropagatedBuildInputs;
+  ]
+  ++ finalAttrs.passthru.externalPropagatedBuildInputs;
 
   # Hack for sake of the dev shell
   passthru.externalPropagatedBuildInputs = [
     boost
     nlohmann_json
-  ] ++ lib.optional enableGC boehmgc;
+  ]
+  ++ lib.optional enableGC boehmgc;
 
   mesonFlags = [
     (lib.mesonEnable "gc" enableGC)
diff --git a/src/libexpr/parser.y b/src/libexpr/parser.y
index 8878b86c2..89da001ef 100644
--- a/src/libexpr/parser.y
+++ b/src/libexpr/parser.y
@@ -57,7 +57,7 @@
 
 namespace nix {
 
-typedef std::unordered_map<PosIdx, DocComment> DocCommentMap;
+typedef boost::unordered_flat_map<PosIdx, DocComment, std::hash<PosIdx>> DocCommentMap;
 
 Expr * parseExprFromBuf(
     char * text,
@@ -68,8 +68,7 @@ Expr * parseExprFromBuf(
     const EvalSettings & settings,
     PosTable & positions,
     DocCommentMap & docComments,
-    const ref<SourceAccessor> rootFS,
-    const Expr::AstSymbols & astSymbols);
+    const ref<SourceAccessor> rootFS);
 
 }
 
@@ -365,6 +364,15 @@ string_parts_interpolated
 path_start
   : PATH {
     std::string_view literal({$1.p, $1.l});
+
+    /* check for short path literals */
+    if (state->settings.warnShortPathLiterals && literal.front() != '/' && literal.front() != '.') {
+        logWarning({
+            .msg = HintFmt("relative path literal '%s' should be prefixed with '.' for clarity: './%s'. (" ANSI_BOLD "warn-short-path-literals" ANSI_NORMAL " = true)", literal, literal),
+            .pos = state->positions[CUR_POS]
+        });
+    }
+
     Path path(absPath(literal, state->basePath.path.abs()));
     /* add back in the trailing '/' to the first segment */
     if (literal.size() > 1 && literal.back() == '/')
@@ -533,8 +541,7 @@ Expr * parseExprFromBuf(
     const EvalSettings & settings,
     PosTable & positions,
     DocCommentMap & docComments,
-    const ref<SourceAccessor> rootFS,
-    const Expr::AstSymbols & astSymbols)
+    const ref<SourceAccessor> rootFS)
 {
     yyscan_t scanner;
     LexerState lexerState {
@@ -549,7 +556,6 @@ Expr * parseExprFromBuf(
         .basePath = basePath,
         .origin = lexerState.origin,
         .rootFS = rootFS,
-        .s = astSymbols,
         .settings = settings,
     };
 
diff --git a/src/libexpr/paths.cc b/src/libexpr/paths.cc
index c5107de3a..f90bc37df 100644
--- a/src/libexpr/paths.cc
+++ b/src/libexpr/paths.cc
@@ -18,4 +18,4 @@ SourcePath EvalState::storePath(const StorePath & path)
     return {rootFS, CanonPath{store->printStorePath(path)}};
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/pch/precompiled-headers.hh b/src/libexpr/pch/precompiled-headers.hh
new file mode 100644
index 000000000..1c9417b37
--- /dev/null
+++ b/src/libexpr/pch/precompiled-headers.hh
@@ -0,0 +1 @@
+#include "nix/expr/eval.hh"
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index f9f834a62..a046a2c28 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -5,6 +5,7 @@
 #include "nix/expr/eval-settings.hh"
 #include "nix/expr/gc-small-vector.hh"
 #include "nix/expr/json-to-value.hh"
+#include "nix/store/globals.hh"
 #include "nix/store/names.hh"
 #include "nix/store/path-references.hh"
 #include "nix/store/store-api.hh"
@@ -17,6 +18,8 @@
 #include "nix/util/sort.hh"
 
 #include <boost/container/small_vector.hpp>
+#include <boost/unordered/concurrent_flat_map.hpp>
+#include <boost/unordered/unordered_flat_map.hpp>
 #include <nlohmann/json.hpp>
 
 #include <sys/types.h>
@@ -29,14 +32,13 @@
 #include <regex>
 
 #ifndef _WIN32
-# include <dlfcn.h>
+#  include <dlfcn.h>
 #endif
 
 #include <cmath>
 
 namespace nix {
 
-
 /*************************************************************
  * Miscellaneous
  *************************************************************/
@@ -67,48 +69,50 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
             if (!store->isValidPath(p))
                 error<InvalidPathError>(store->printStorePath(p)).debugThrow();
         };
-        std::visit(overloaded {
-            [&](const NixStringContextElem::Built & b) {
-                drvs.push_back(DerivedPath::Built {
-                    .drvPath = b.drvPath,
-                    .outputs = OutputsSpec::Names { b.output },
-                });
-                ensureValid(b.drvPath->getBaseStorePath());
+        std::visit(
+            overloaded{
+                [&](const NixStringContextElem::Built & b) {
+                    drvs.push_back(
+                        DerivedPath::Built{
+                            .drvPath = b.drvPath,
+                            .outputs = OutputsSpec::Names{b.output},
+                        });
+                    ensureValid(b.drvPath->getBaseStorePath());
+                },
+                [&](const NixStringContextElem::Opaque & o) {
+                    ensureValid(o.path);
+                    if (maybePathsOut)
+                        maybePathsOut->emplace(o.path);
+                },
+                [&](const NixStringContextElem::DrvDeep & d) {
+                    /* Treat same as Opaque */
+                    ensureValid(d.drvPath);
+                    if (maybePathsOut)
+                        maybePathsOut->emplace(d.drvPath);
+                },
             },
-            [&](const NixStringContextElem::Opaque & o) {
-                ensureValid(o.path);
-                if (maybePathsOut)
-                    maybePathsOut->emplace(o.path);
-            },
-            [&](const NixStringContextElem::DrvDeep & d) {
-                /* Treat same as Opaque */
-                ensureValid(d.drvPath);
-                if (maybePathsOut)
-                    maybePathsOut->emplace(d.drvPath);
-            },
-        }, c.raw);
+            c.raw);
     }
 
-    if (drvs.empty()) return {};
+    if (drvs.empty())
+        return {};
 
     if (isIFD) {
         if (!settings.enableImportFromDerivation)
             error<IFDError>(
                 "cannot build '%1%' during evaluation because the option 'allow-import-from-derivation' is disabled",
-                drvs.begin()->to_string(*store)
-            ).debugThrow();
+                drvs.begin()->to_string(*store))
+                .debugThrow();
 
         if (settings.traceImportFromDerivation)
-            warn(
-                "built '%1%' during evaluation due to an import from derivation",
-                drvs.begin()->to_string(*store)
-            );
+            warn("built '%1%' during evaluation due to an import from derivation", drvs.begin()->to_string(*store));
     }
 
     /* Build/substitute the context. */
     std::vector<DerivedPath> buildReqs;
     buildReqs.reserve(drvs.size());
-    for (auto & d : drvs) buildReqs.emplace_back(DerivedPath { d });
+    for (auto & d : drvs)
+        buildReqs.emplace_back(DerivedPath{d});
     buildStore->buildPaths(buildReqs, bmNormal, store);
 
     StorePathSet outputsToCopyAndAllow;
@@ -124,17 +128,18 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
             if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
                 res.insert_or_assign(
                     DownstreamPlaceholder::fromSingleDerivedPathBuilt(
-                        SingleDerivedPath::Built {
+                        SingleDerivedPath::Built{
                             .drvPath = drv.drvPath,
                             .output = outputName,
-                        }).render(),
-                    buildStore->printStorePath(outputPath)
-                );
+                        })
+                        .render(),
+                    buildStore->printStorePath(outputPath));
             }
         }
     }
 
-    if (store != buildStore) copyClosure(*buildStore, *store, outputsToCopyAndAllow);
+    if (store != buildStore)
+        copyClosure(*buildStore, *store, outputsToCopyAndAllow);
 
     if (isIFD) {
         /* Allow access to the output closures of this derivation. */
@@ -145,7 +150,11 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
     return res;
 }
 
-static SourcePath realisePath(EvalState & state, const PosIdx pos, Value & v, std::optional<SymlinkResolution> resolveSymlinks = SymlinkResolution::Full)
+static SourcePath realisePath(
+    EvalState & state,
+    const PosIdx pos,
+    Value & v,
+    std::optional<SymlinkResolution> resolveSymlinks = SymlinkResolution::Full)
 {
     NixStringContext context;
 
@@ -185,7 +194,7 @@ static void mkOutputString(
 {
     state.mkOutputString(
         attrs.alloc(o.first),
-        SingleDerivedPath::Built {
+        SingleDerivedPath::Built{
             .drvPath = makeConstantStorePathRef(drvPath),
             .output = o.first,
         },
@@ -201,33 +210,41 @@ static void mkOutputString(
  * @param storePath The path to the `.drv` to import.
  * @param v Return value
  */
-void derivationToValue(EvalState & state, const PosIdx pos, const SourcePath & path, const StorePath & storePath, Value & v) {
+void derivationToValue(
+    EvalState & state, const PosIdx pos, const SourcePath & path, const StorePath & storePath, Value & v)
+{
     auto path2 = path.path.abs();
     Derivation drv = state.store->readDerivation(storePath);
     auto attrs = state.buildBindings(3 + drv.outputs.size());
-    attrs.alloc(state.sDrvPath).mkString(path2, {
-        NixStringContextElem::DrvDeep { .drvPath = storePath },
-    });
-    attrs.alloc(state.sName).mkString(drv.env["name"]);
+    attrs.alloc(state.s.drvPath)
+        .mkString(
+            path2,
+            {
+                NixStringContextElem::DrvDeep{.drvPath = storePath},
+            });
+    attrs.alloc(state.s.name).mkString(drv.env["name"]);
 
     auto list = state.buildList(drv.outputs.size());
     for (const auto & [i, o] : enumerate(drv.outputs)) {
         mkOutputString(state, attrs, storePath, o);
         (list[i] = state.allocValue())->mkString(o.first);
     }
-    attrs.alloc(state.sOutputs).mkList(list);
+    attrs.alloc(state.s.outputs).mkList(list);
 
     auto w = state.allocValue();
     w->mkAttrs(attrs);
 
     if (!state.vImportedDrvToDerivation) {
         state.vImportedDrvToDerivation = allocRootValue(state.allocValue());
-        state.eval(state.parseExprFromString(
-            #include "imported-drv-to-derivation.nix.gen.hh"
-            , state.rootPath(CanonPath::root)), **state.vImportedDrvToDerivation);
+        state.eval(
+            state.parseExprFromString(
+#include "imported-drv-to-derivation.nix.gen.hh"
+                , state.rootPath(CanonPath::root)),
+            **state.vImportedDrvToDerivation);
     }
 
-    state.forceFunction(**state.vImportedDrvToDerivation, pos, "while evaluating imported-drv-to-derivation.nix.gen.hh");
+    state.forceFunction(
+        **state.vImportedDrvToDerivation, pos, "while evaluating imported-drv-to-derivation.nix.gen.hh");
     v.mkApp(*state.vImportedDrvToDerivation, w);
     state.forceAttrs(v, pos, "while calling imported-drv-to-derivation.nix.gen.hh");
 }
@@ -241,7 +258,8 @@ void derivationToValue(EvalState & state, const PosIdx pos, const SourcePath & p
  * @param vScope The base scope to use for the import.
  * @param v Return value
  */
-static void scopedImport(EvalState & state, const PosIdx pos, SourcePath & path, Value * vScope, Value & v) {
+static void scopedImport(EvalState & state, const PosIdx pos, SourcePath & path, Value * vScope, Value & v)
+{
     state.forceAttrs(*vScope, pos, "while evaluating the first argument passed to builtins.scopedImport");
 
     Env * env = &state.allocEnv(vScope->attrs()->size());
@@ -283,29 +301,24 @@ static void import(EvalState & state, const PosIdx pos, Value & vPath, Value * v
 
     if (auto storePath = isValidDerivationInStore()) {
         derivationToValue(state, pos, path, *storePath, v);
-    }
-    else if (vScope) {
+    } else if (vScope) {
         scopedImport(state, pos, path, vScope, v);
-    }
-    else {
+    } else {
         state.evalFile(path, v);
     }
 }
 
-static RegisterPrimOp primop_scopedImport(PrimOp {
-    .name = "scopedImport",
-    .arity = 2,
-    .fun = [](EvalState & state, const PosIdx pos, Value * * args, Value & v)
-    {
-        import(state, pos, *args[1], args[0], v);
-    }
-});
+static RegisterPrimOp primop_scopedImport(
+    PrimOp{
+        .name = "scopedImport", .arity = 2, .fun = [](EvalState & state, const PosIdx pos, Value ** args, Value & v) {
+            import(state, pos, *args[1], args[0], v);
+        }});
 
-static RegisterPrimOp primop_import({
-    .name = "import",
-    .args = {"path"},
-    // TODO turn "normal path values" into link below
-    .doc = R"(
+static RegisterPrimOp primop_import(
+    {.name = "import",
+     .args = {"path"},
+     // TODO turn "normal path values" into link below
+     .doc = R"(
       Load, parse, and return the Nix expression in the file *path*.
 
       > **Note**
@@ -372,11 +385,9 @@ static RegisterPrimOp primop_import({
       >
       >  The function argument doesn’t have to be called `x` in `foo.nix`; any name would work.
     )",
-    .fun = [](EvalState & state, const PosIdx pos, Value * * args, Value & v)
-    {
-        import(state, pos, *args[0], nullptr, v);
-    }
-});
+     .fun = [](EvalState & state, const PosIdx pos, Value ** args, Value & v) {
+         import(state, pos, *args[0], nullptr, v);
+     }});
 
 #ifndef _WIN32 // TODO implement via DLL loading on Windows
 
@@ -385,24 +396,28 @@ static RegisterPrimOp primop_import({
 extern "C" typedef void (*ValueInitializer)(EvalState & state, Value & v);
 
 /* Load a ValueInitializer from a DSO and return whatever it initializes */
-void prim_importNative(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+void prim_importNative(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto path = realisePath(state, pos, *args[0]);
 
-    std::string sym(state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument passed to builtins.importNative"));
+    std::string sym(
+        state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument passed to builtins.importNative"));
 
-    void *handle = dlopen(path.path.c_str(), RTLD_LAZY | RTLD_LOCAL);
+    void * handle = dlopen(path.path.c_str(), RTLD_LAZY | RTLD_LOCAL);
     if (!handle)
         state.error<EvalError>("could not open '%1%': %2%", path, dlerror()).debugThrow();
 
     dlerror();
     ValueInitializer func = (ValueInitializer) dlsym(handle, sym.c_str());
-    if(!func) {
-        char *message = dlerror();
+    if (!func) {
+        char * message = dlerror();
         if (message)
             state.error<EvalError>("could not load symbol '%1%' from '%2%': %3%", sym, path, message).debugThrow();
         else
-            state.error<EvalError>("symbol '%1%' from '%2%' resolved to NULL when a function pointer was expected", sym, path).debugThrow();
+            state
+                .error<EvalError>(
+                    "symbol '%1%' from '%2%' resolved to NULL when a function pointer was expected", sym, path)
+                .debugThrow();
     }
 
     (func)(state, v);
@@ -410,9 +425,8 @@ void prim_importNative(EvalState & state, const PosIdx pos, Value * * args, Valu
     /* We don't dlclose because v may be a primop referencing a function in the shared object file */
 }
 
-
 /* Execute a program and parse its output */
-void prim_exec(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+void prim_exec(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to builtins.exec");
     auto elems = args[0]->listView();
@@ -420,20 +434,33 @@ void prim_exec(EvalState & state, const PosIdx pos, Value * * args, Value & v)
     if (count == 0)
         state.error<EvalError>("at least one argument to 'exec' required").atPos(pos).debugThrow();
     NixStringContext context;
-    auto program = state.coerceToString(pos, *elems[0], context,
-            "while evaluating the first element of the argument passed to builtins.exec",
-            false, false).toOwned();
+    auto program = state
+                       .coerceToString(
+                           pos,
+                           *elems[0],
+                           context,
+                           "while evaluating the first element of the argument passed to builtins.exec",
+                           false,
+                           false)
+                       .toOwned();
     Strings commandArgs;
     for (size_t i = 1; i < count; ++i) {
-        commandArgs.push_back(
-                state.coerceToString(pos, *elems[i], context,
-                        "while evaluating an element of the argument passed to builtins.exec",
-                        false, false).toOwned());
+        commandArgs.push_back(state
+                                  .coerceToString(
+                                      pos,
+                                      *elems[i],
+                                      context,
+                                      "while evaluating an element of the argument passed to builtins.exec",
+                                      false,
+                                      false)
+                                  .toOwned());
     }
     try {
         auto _ = state.realiseContext(context); // FIXME: Handle CA derivations
     } catch (InvalidPathError & e) {
-        state.error<EvalError>("cannot execute '%1%', since path '%2%' is not valid", program, e.path).atPos(pos).debugThrow();
+        state.error<EvalError>("cannot execute '%1%', since path '%2%' is not valid", program, e.path)
+            .atPos(pos)
+            .debugThrow();
     }
 
     auto output = runProgram(program, true, commandArgs);
@@ -455,26 +482,43 @@ void prim_exec(EvalState & state, const PosIdx pos, Value * * args, Value & v)
 #endif
 
 /* Return a string representing the type of the expression. */
-static void prim_typeOf(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_typeOf(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
-    std::string t;
     switch (args[0]->type()) {
-        case nInt: t = "int"; break;
-        case nBool: t = "bool"; break;
-        case nString: t = "string"; break;
-        case nPath: t = "path"; break;
-        case nNull: t = "null"; break;
-        case nAttrs: t = "set"; break;
-        case nList: t = "list"; break;
-        case nFunction: t = "lambda"; break;
-        case nExternal:
-            t = args[0]->external()->typeOf();
-            break;
-        case nFloat: t = "float"; break;
-        case nThunk: unreachable();
+    case nInt:
+        v.mkStringNoCopy("int");
+        break;
+    case nBool:
+        v.mkStringNoCopy("bool");
+        break;
+    case nString:
+        v.mkStringNoCopy("string");
+        break;
+    case nPath:
+        v.mkStringNoCopy("path");
+        break;
+    case nNull:
+        v.mkStringNoCopy("null");
+        break;
+    case nAttrs:
+        v.mkStringNoCopy("set");
+        break;
+    case nList:
+        v.mkStringNoCopy("list");
+        break;
+    case nFunction:
+        v.mkStringNoCopy("lambda");
+        break;
+    case nExternal:
+        v.mkString(args[0]->external()->typeOf());
+        break;
+    case nFloat:
+        v.mkStringNoCopy("float");
+        break;
+    case nThunk:
+        unreachable();
     }
-    v.mkString(t);
 }
 
 static RegisterPrimOp primop_typeOf({
@@ -489,7 +533,7 @@ static RegisterPrimOp primop_typeOf({
 });
 
 /* Determine whether the argument is the null value. */
-static void prim_isNull(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isNull(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nNull);
@@ -507,7 +551,7 @@ static RegisterPrimOp primop_isNull({
 });
 
 /* Determine whether the argument is a function. */
-static void prim_isFunction(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isFunction(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nFunction);
@@ -523,7 +567,7 @@ static RegisterPrimOp primop_isFunction({
 });
 
 /* Determine whether the argument is an integer. */
-static void prim_isInt(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isInt(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nInt);
@@ -539,7 +583,7 @@ static RegisterPrimOp primop_isInt({
 });
 
 /* Determine whether the argument is a float. */
-static void prim_isFloat(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isFloat(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nFloat);
@@ -555,7 +599,7 @@ static RegisterPrimOp primop_isFloat({
 });
 
 /* Determine whether the argument is a string. */
-static void prim_isString(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isString(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nString);
@@ -571,7 +615,7 @@ static RegisterPrimOp primop_isString({
 });
 
 /* Determine whether the argument is a Boolean. */
-static void prim_isBool(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isBool(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nBool);
@@ -587,7 +631,7 @@ static RegisterPrimOp primop_isBool({
 });
 
 /* Determine whether the argument is a path. */
-static void prim_isPath(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isPath(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nPath);
@@ -603,14 +647,11 @@ static RegisterPrimOp primop_isPath({
 });
 
 template<typename Callable>
- static inline void withExceptionContext(Trace trace, Callable&& func)
+static inline void withExceptionContext(Trace trace, Callable && func)
 {
-    try
-    {
+    try {
         func();
-    }
-    catch(Error & e)
-    {
+    } catch (Error & e) {
         e.pushTrace(trace);
         throw;
     }
@@ -622,14 +663,17 @@ struct CompareValues
     const PosIdx pos;
     const std::string_view errorCtx;
 
-    CompareValues(EvalState & state, const PosIdx pos, const std::string_view && errorCtx) : state(state), pos(pos), errorCtx(errorCtx) { };
+    CompareValues(EvalState & state, const PosIdx pos, const std::string_view && errorCtx)
+        : state(state)
+        , pos(pos)
+        , errorCtx(errorCtx) {};
 
-    bool operator () (Value * v1, Value * v2) const
+    bool operator()(Value * v1, Value * v2) const
     {
         return (*this)(v1, v2, errorCtx);
     }
 
-    bool operator () (Value * v1, Value * v2, std::string_view errorCtx) const
+    bool operator()(Value * v1, Value * v2, std::string_view errorCtx) const
     {
         try {
             if (v1->type() == nFloat && v2->type() == nInt)
@@ -638,35 +682,38 @@ struct CompareValues
                 return v1->integer().value < v2->fpoint();
             if (v1->type() != v2->type())
                 state.error<EvalError>("cannot compare %s with %s", showType(*v1), showType(*v2)).debugThrow();
-            // Allow selecting a subset of enum values
-            #pragma GCC diagnostic push
-            #pragma GCC diagnostic ignored "-Wswitch-enum"
+// Allow selecting a subset of enum values
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch-enum"
             switch (v1->type()) {
-                case nInt:
-                    return v1->integer() < v2->integer();
-                case nFloat:
-                    return v1->fpoint() < v2->fpoint();
-                case nString:
-                    return strcmp(v1->c_str(), v2->c_str()) < 0;
-                case nPath:
-                    // Note: we don't take the accessor into account
-                    // since it's not obvious how to compare them in a
-                    // reproducible way.
-                    return strcmp(v1->pathStr(), v2->pathStr()) < 0;
-                case nList:
-                    // Lexicographic comparison
-                    for (size_t i = 0;; i++) {
-                        if (i == v2->listSize()) {
-                            return false;
-                        } else if (i == v1->listSize()) {
-                            return true;
-                        } else if (!state.eqValues(*v1->listView()[i], *v2->listView()[i], pos, errorCtx)) {
-                            return (*this)(v1->listView()[i], v2->listView()[i], "while comparing two list elements");
-                        }
+            case nInt:
+                return v1->integer() < v2->integer();
+            case nFloat:
+                return v1->fpoint() < v2->fpoint();
+            case nString:
+                return strcmp(v1->c_str(), v2->c_str()) < 0;
+            case nPath:
+                // Note: we don't take the accessor into account
+                // since it's not obvious how to compare them in a
+                // reproducible way.
+                return strcmp(v1->pathStr(), v2->pathStr()) < 0;
+            case nList:
+                // Lexicographic comparison
+                for (size_t i = 0;; i++) {
+                    if (i == v2->listSize()) {
+                        return false;
+                    } else if (i == v1->listSize()) {
+                        return true;
+                    } else if (!state.eqValues(*v1->listView()[i], *v2->listView()[i], pos, errorCtx)) {
+                        return (*this)(v1->listView()[i], v2->listView()[i], "while comparing two list elements");
                     }
-                default:
-                    state.error<EvalError>("cannot compare %s with %s; values of that type are incomparable", showType(*v1), showType(*v2)).debugThrow();
-            #pragma GCC diagnostic pop
+                }
+            default:
+                state
+                    .error<EvalError>(
+                        "cannot compare %s with %s; values of that type are incomparable", showType(*v1), showType(*v2))
+                    .debugThrow();
+#pragma GCC diagnostic pop
             }
         } catch (Error & e) {
             if (!errorCtx.empty())
@@ -676,17 +723,20 @@ struct CompareValues
     }
 };
 
-
 typedef std::list<Value *, gc_allocator<Value *>> ValueList;
 
-static void prim_genericClosure(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_genericClosure(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], noPos, "while evaluating the first argument passed to builtins.genericClosure");
 
     /* Get the start set. */
-    auto startSet = state.getAttr(state.sStartSet, args[0]->attrs(), "in the attrset passed as argument to builtins.genericClosure");
+    auto startSet = state.getAttr(
+        state.s.startSet, args[0]->attrs(), "in the attrset passed as argument to builtins.genericClosure");
 
-    state.forceList(*startSet->value, noPos, "while evaluating the 'startSet' attribute passed as argument to builtins.genericClosure");
+    state.forceList(
+        *startSet->value,
+        noPos,
+        "while evaluating the 'startSet' attribute passed as argument to builtins.genericClosure");
 
     ValueList workSet;
     for (auto elem : startSet->value->listView())
@@ -698,8 +748,10 @@ static void prim_genericClosure(EvalState & state, const PosIdx pos, Value * * a
     }
 
     /* Get the operator. */
-    auto op = state.getAttr(state.sOperator, args[0]->attrs(), "in the attrset passed as argument to builtins.genericClosure");
-    state.forceFunction(*op->value, noPos, "while evaluating the 'operator' attribute passed as argument to builtins.genericClosure");
+    auto op = state.getAttr(
+        state.s.operator_, args[0]->attrs(), "in the attrset passed as argument to builtins.genericClosure");
+    state.forceFunction(
+        *op->value, noPos, "while evaluating the 'operator' attribute passed as argument to builtins.genericClosure");
 
     /* Construct the closure by applying the operator to elements of
        `workSet', adding the result to `workSet', continuing until
@@ -713,22 +765,33 @@ static void prim_genericClosure(EvalState & state, const PosIdx pos, Value * * a
         Value * e = *(workSet.begin());
         workSet.pop_front();
 
-        state.forceAttrs(*e, noPos, "while evaluating one of the elements generated by (or initially passed to) builtins.genericClosure");
+        state.forceAttrs(
+            *e,
+            noPos,
+            "while evaluating one of the elements generated by (or initially passed to) builtins.genericClosure");
 
-        auto key = state.getAttr(state.sKey, e->attrs(), "in one of the attrsets generated by (or initially passed to) builtins.genericClosure");
+        auto key = state.getAttr(
+            state.s.key,
+            e->attrs(),
+            "in one of the attrsets generated by (or initially passed to) builtins.genericClosure");
         state.forceValue(*key->value, noPos);
 
-        if (!doneKeys.insert(key->value).second) continue;
+        if (!doneKeys.insert(key->value).second)
+            continue;
         res.push_back(e);
 
         /* Call the `operator' function with `e' as argument. */
         Value newElements;
         state.callFunction(*op->value, {&e, 1}, newElements, noPos);
-        state.forceList(newElements, noPos, "while evaluating the return value of the `operator` passed to builtins.genericClosure");
+        state.forceList(
+            newElements,
+            noPos,
+            "while evaluating the return value of the `operator` passed to builtins.genericClosure");
 
         /* Add the values returned by the operator to the work set. */
         for (auto elem : newElements.listView()) {
-            state.forceValue(*elem, noPos); // "while evaluating one one of the elements returned by the `operator` passed to builtins.genericClosure");
+            state.forceValue(*elem, noPos); // "while evaluating one one of the elements returned by the `operator`
+                                            // passed to builtins.genericClosure");
             workSet.push_back(elem);
         }
     }
@@ -740,11 +803,12 @@ static void prim_genericClosure(EvalState & state, const PosIdx pos, Value * * a
     v.mkList(list);
 }
 
-static RegisterPrimOp primop_genericClosure(PrimOp {
-    .name = "__genericClosure",
-    .args = {"attrset"},
-    .arity = 1,
-    .doc = R"(
+static RegisterPrimOp primop_genericClosure(
+    PrimOp{
+        .name = "__genericClosure",
+        .args = {"attrset"},
+        .arity = 1,
+        .doc = R"(
       `builtins.genericClosure` iteratively computes the transitive closure over an arbitrary relation defined by a function.
 
       It takes *attrset* with two attributes named `startSet` and `operator`, and returns a list of attribute sets:
@@ -794,95 +858,100 @@ static RegisterPrimOp primop_genericClosure(PrimOp {
       > [ { key = 5; } { key = 16; } { key = 8; } { key = 4; } { key = 2; } { key = 1; } ]
       > ```
       )",
-    .fun = prim_genericClosure,
-});
+        .fun = prim_genericClosure,
+    });
 
-
-static RegisterPrimOp primop_break({
-    .name = "break",
-    .args = {"v"},
-    .doc = R"(
+static RegisterPrimOp primop_break(
+    {.name = "break",
+     .args = {"v"},
+     .doc = R"(
       In debug mode (enabled using `--debugger`), pause Nix expression evaluation and enter the REPL.
       Otherwise, return the argument `v`.
     )",
-    .fun = [](EvalState & state, const PosIdx pos, Value * * args, Value & v)
-    {
-        if (state.canDebug()) {
-            auto error = Error(ErrorInfo {
-                .level = lvlInfo,
-                .msg = HintFmt("breakpoint reached"),
-                .pos = state.positions[pos],
-            });
+     .fun = [](EvalState & state, const PosIdx pos, Value ** args, Value & v) {
+         if (state.canDebug()) {
+             auto error = Error(
+                 ErrorInfo{
+                     .level = lvlInfo,
+                     .msg = HintFmt("breakpoint reached"),
+                     .pos = state.positions[pos],
+                 });
 
-            state.runDebugRepl(&error);
-        }
+             state.runDebugRepl(&error);
+         }
 
-        // Return the value we were passed.
-        v = *args[0];
-    }
-});
+         // Return the value we were passed.
+         v = *args[0];
+     }});
 
-static RegisterPrimOp primop_abort({
-    .name = "abort",
-    .args = {"s"},
-    .doc = R"(
+static RegisterPrimOp primop_abort(
+    {.name = "abort",
+     .args = {"s"},
+     .doc = R"(
       Abort Nix expression evaluation and print the error message *s*.
     )",
-    .fun = [](EvalState & state, const PosIdx pos, Value * * args, Value & v)
-    {
-        NixStringContext context;
-        auto s = state.coerceToString(pos, *args[0], context,
-                "while evaluating the error message passed to builtins.abort").toOwned();
-        state.error<Abort>("evaluation aborted with the following error message: '%1%'", s).setIsFromExpr().debugThrow();
-    }
-});
+     .fun = [](EvalState & state, const PosIdx pos, Value ** args, Value & v) {
+         NixStringContext context;
+         auto s =
+             state.coerceToString(pos, *args[0], context, "while evaluating the error message passed to builtins.abort")
+                 .toOwned();
+         state.error<Abort>("evaluation aborted with the following error message: '%1%'", s)
+             .setIsFromExpr()
+             .debugThrow();
+     }});
 
-static RegisterPrimOp primop_throw({
-    .name = "throw",
-    .args = {"s"},
-    .doc = R"(
+static RegisterPrimOp primop_throw(
+    {.name = "throw",
+     .args = {"s"},
+     .doc = R"(
       Throw an error message *s*. This usually aborts Nix expression
       evaluation, but in `nix-env -qa` and other commands that try to
       evaluate a set of derivations to get information about those
       derivations, a derivation that throws an error is silently skipped
       (which is not the case for `abort`).
     )",
-    .fun = [](EvalState & state, const PosIdx pos, Value * * args, Value & v)
-    {
-      NixStringContext context;
-      auto s = state.coerceToString(pos, *args[0], context,
-              "while evaluating the error message passed to builtin.throw").toOwned();
-      state.error<ThrownError>(s).setIsFromExpr().debugThrow();
-    }
-});
+     .fun = [](EvalState & state, const PosIdx pos, Value ** args, Value & v) {
+         NixStringContext context;
+         auto s =
+             state.coerceToString(pos, *args[0], context, "while evaluating the error message passed to builtin.throw")
+                 .toOwned();
+         state.error<ThrownError>(s).setIsFromExpr().debugThrow();
+     }});
 
-static void prim_addErrorContext(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_addErrorContext(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     try {
         state.forceValue(*args[1], pos);
         v = *args[1];
     } catch (Error & e) {
         NixStringContext context;
-        auto message = state.coerceToString(pos, *args[0], context,
-                "while evaluating the error message passed to builtins.addErrorContext",
-                false, false).toOwned();
+        auto message = state
+                           .coerceToString(
+                               pos,
+                               *args[0],
+                               context,
+                               "while evaluating the error message passed to builtins.addErrorContext",
+                               false,
+                               false)
+                           .toOwned();
         e.addTrace(nullptr, HintFmt(message), TracePrint::Always);
         throw;
     }
 }
 
-static RegisterPrimOp primop_addErrorContext(PrimOp {
-    .name = "__addErrorContext",
-    .arity = 2,
-    // The normal trace item is redundant
-    .addTrace = false,
-    .fun = prim_addErrorContext,
-});
+static RegisterPrimOp primop_addErrorContext(
+    PrimOp{
+        .name = "__addErrorContext",
+        .arity = 2,
+        // The normal trace item is redundant
+        .addTrace = false,
+        .fun = prim_addErrorContext,
+    });
 
-static void prim_ceil(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_ceil(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto value = state.forceFloat(*args[0], args[0]->determinePos(pos),
-            "while evaluating the first argument passed to builtins.ceil");
+    auto value = state.forceFloat(
+        *args[0], args[0]->determinePos(pos), "while evaluating the first argument passed to builtins.ceil");
     auto ceilValue = ceil(value);
     bool isInt = args[0]->type() == nInt;
     constexpr NixFloat int_min = std::numeric_limits<NixInt::Inner>::min(); // power of 2, so that no rounding occurs
@@ -890,16 +959,29 @@ static void prim_ceil(EvalState & state, const PosIdx pos, Value * * args, Value
         v.mkInt(ceilValue);
     } else if (isInt) {
         // a NixInt, e.g. INT64_MAX, can be rounded to -int_min due to the cast to NixFloat
-        state.error<EvalError>("Due to a bug (see https://github.com/NixOS/nix/issues/12899) the NixInt argument %1% caused undefined behavior in previous Nix versions.\n\tFuture Nix versions might implement the correct behavior.", args[0]->integer().value).atPos(pos).debugThrow();
+        state
+            .error<EvalError>(
+                "Due to a bug (see https://github.com/NixOS/nix/issues/12899) the NixInt argument %1% caused undefined behavior in previous Nix versions.\n\tFuture Nix versions might implement the correct behavior.",
+                args[0]->integer().value)
+            .atPos(pos)
+            .debugThrow();
     } else {
-        state.error<EvalError>("NixFloat argument %1% is not in the range of NixInt", args[0]->fpoint()).atPos(pos).debugThrow();
+        state.error<EvalError>("NixFloat argument %1% is not in the range of NixInt", args[0]->fpoint())
+            .atPos(pos)
+            .debugThrow();
     }
     // `forceFloat` casts NixInt to NixFloat, but instead NixInt args shall be returned unmodified
     if (isInt) {
         auto arg = args[0]->integer();
         auto res = v.integer();
         if (arg != res) {
-            state.error<EvalError>("Due to a bug (see https://github.com/NixOS/nix/issues/12899) a loss of precision occurred in previous Nix versions because the NixInt argument %1% was rounded to %2%.\n\tFuture Nix versions might implement the correct behavior.", arg, res).atPos(pos).debugThrow();
+            state
+                .error<EvalError>(
+                    "Due to a bug (see https://github.com/NixOS/nix/issues/12899) a loss of precision occurred in previous Nix versions because the NixInt argument %1% was rounded to %2%.\n\tFuture Nix versions might implement the correct behavior.",
+                    arg,
+                    res)
+                .atPos(pos)
+                .debugThrow();
         }
     }
 }
@@ -921,9 +1003,10 @@ static RegisterPrimOp primop_ceil({
     .fun = prim_ceil,
 });
 
-static void prim_floor(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_floor(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto value = state.forceFloat(*args[0], args[0]->determinePos(pos), "while evaluating the first argument passed to builtins.floor");
+    auto value = state.forceFloat(
+        *args[0], args[0]->determinePos(pos), "while evaluating the first argument passed to builtins.floor");
     auto floorValue = floor(value);
     bool isInt = args[0]->type() == nInt;
     constexpr NixFloat int_min = std::numeric_limits<NixInt::Inner>::min(); // power of 2, so that no rounding occurs
@@ -931,16 +1014,29 @@ static void prim_floor(EvalState & state, const PosIdx pos, Value * * args, Valu
         v.mkInt(floorValue);
     } else if (isInt) {
         // a NixInt, e.g. INT64_MAX, can be rounded to -int_min due to the cast to NixFloat
-        state.error<EvalError>("Due to a bug (see https://github.com/NixOS/nix/issues/12899) the NixInt argument %1% caused undefined behavior in previous Nix versions.\n\tFuture Nix versions might implement the correct behavior.", args[0]->integer().value).atPos(pos).debugThrow();
+        state
+            .error<EvalError>(
+                "Due to a bug (see https://github.com/NixOS/nix/issues/12899) the NixInt argument %1% caused undefined behavior in previous Nix versions.\n\tFuture Nix versions might implement the correct behavior.",
+                args[0]->integer().value)
+            .atPos(pos)
+            .debugThrow();
     } else {
-        state.error<EvalError>("NixFloat argument %1% is not in the range of NixInt", args[0]->fpoint()).atPos(pos).debugThrow();
+        state.error<EvalError>("NixFloat argument %1% is not in the range of NixInt", args[0]->fpoint())
+            .atPos(pos)
+            .debugThrow();
     }
     // `forceFloat` casts NixInt to NixFloat, but instead NixInt args shall be returned unmodified
     if (isInt) {
         auto arg = args[0]->integer();
         auto res = v.integer();
         if (arg != res) {
-            state.error<EvalError>("Due to a bug (see https://github.com/NixOS/nix/issues/12899) a loss of precision occurred in previous Nix versions because the NixInt argument %1% was rounded to %2%.\n\tFuture Nix versions might implement the correct behavior.", arg, res).atPos(pos).debugThrow();
+            state
+                .error<EvalError>(
+                    "Due to a bug (see https://github.com/NixOS/nix/issues/12899) a loss of precision occurred in previous Nix versions because the NixInt argument %1% was rounded to %2%.\n\tFuture Nix versions might implement the correct behavior.",
+                    arg,
+                    res)
+                .atPos(pos)
+                .debugThrow();
         }
     }
 }
@@ -964,16 +1060,15 @@ static RegisterPrimOp primop_floor({
 
 /* Try evaluating the argument. Success => {success=true; value=something;},
  * else => {success=false; value=false;} */
-static void prim_tryEval(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_tryEval(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto attrs = state.buildBindings(2);
 
     /* increment state.trylevel, and decrement it when this function returns. */
     MaintainCount trylevel(state.trylevel);
 
-    ReplExitStatus (* savedDebugRepl)(ref<EvalState> es, const ValMap & extraEnv) = nullptr;
-    if (state.debugRepl && state.settings.ignoreExceptionsDuringTry)
-    {
+    ReplExitStatus (*savedDebugRepl)(ref<EvalState> es, const ValMap & extraEnv) = nullptr;
+    if (state.debugRepl && state.settings.ignoreExceptionsDuringTry) {
         /* to prevent starting the repl from exceptions within a tryEval, null it. */
         savedDebugRepl = state.debugRepl;
         state.debugRepl = nullptr;
@@ -981,12 +1076,12 @@ static void prim_tryEval(EvalState & state, const PosIdx pos, Value * * args, Va
 
     try {
         state.forceValue(*args[0], pos);
-        attrs.insert(state.sValue, args[0]);
-        attrs.insert(state.symbols.create("success"), &state.vTrue);
+        attrs.insert(state.s.value, args[0]);
+        attrs.insert(state.symbols.create("success"), &Value::vTrue);
     } catch (AssertionError & e) {
         // `value = false;` is unfortunate but removing it is a breaking change.
-        attrs.insert(state.sValue, &state.vFalse);
-        attrs.insert(state.symbols.create("success"), &state.vFalse);
+        attrs.insert(state.s.value, &Value::vFalse);
+        attrs.insert(state.symbols.create("success"), &Value::vFalse);
     }
 
     // restore the debugRepl pointer if we saved it earlier.
@@ -1021,9 +1116,10 @@ static RegisterPrimOp primop_tryEval({
 });
 
 /* Return an environment variable.  Use with care. */
-static void prim_getEnv(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_getEnv(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    std::string name(state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.getEnv"));
+    std::string name(
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.getEnv"));
     v.mkString(state.settings.restrictEval || state.settings.pureEval ? "" : getEnv(name).value_or(""));
 }
 
@@ -1045,7 +1141,7 @@ static RegisterPrimOp primop_getEnv({
 });
 
 /* Evaluate the first argument, then return the second argument. */
-static void prim_seq(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_seq(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     state.forceValue(*args[1], pos);
@@ -1064,7 +1160,7 @@ static RegisterPrimOp primop_seq({
 
 /* Evaluate the first argument deeply (i.e. recursing into lists and
    attrsets), then return the second argument. */
-static void prim_deepSeq(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_deepSeq(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValueDeep(*args[0]);
     state.forceValue(*args[1], pos);
@@ -1084,7 +1180,7 @@ static RegisterPrimOp primop_deepSeq({
 
 /* Evaluate the first expression and print it on standard error.  Then
    return the second expression.  Useful for debugging. */
-static void prim_trace(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_trace(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     if (args[0]->type() == nString)
@@ -1115,11 +1211,12 @@ static RegisterPrimOp primop_trace({
     .fun = prim_trace,
 });
 
-static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_warn(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     // We only accept a string argument for now. The use case for pretty printing a value is covered by `trace`.
     // By rejecting non-strings we allow future versions to add more features without breaking existing code.
-    auto msgStr = state.forceString(*args[0], pos, "while evaluating the first argument; the message passed to builtins.warn");
+    auto msgStr =
+        state.forceString(*args[0], pos, "while evaluating the first argument; the message passed to builtins.warn");
 
     {
         BaseError msg(std::string{msgStr});
@@ -1132,7 +1229,9 @@ static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value
 
     if (state.settings.builtinsAbortOnWarn) {
         // Not an EvalError or subclass, which would cause the error to be stored in the eval cache.
-        state.error<EvalBaseError>("aborting to reveal stack trace of warning, as abort-on-warn is set").setIsFromExpr().debugThrow();
+        state.error<EvalBaseError>("aborting to reveal stack trace of warning, as abort-on-warn is set")
+            .setIsFromExpr()
+            .debugThrow();
     }
     if (state.settings.builtinsTraceDebugger || state.settings.builtinsDebuggerOnWarn) {
         state.runDebugRepl(nullptr);
@@ -1164,11 +1263,10 @@ static RegisterPrimOp primop_warn({
     .fun = prim_warn,
 });
 
-
 /* Takes two arguments and evaluates to the second one. Used as the
  * builtins.traceVerbose implementation when --trace-verbose is not enabled
  */
-static void prim_second(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_second(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[1], pos);
     v = *args[1];
@@ -1178,11 +1276,7 @@ static void prim_second(EvalState & state, const PosIdx pos, Value * * args, Val
  * Derivations
  *************************************************************/
 
-static void derivationStrictInternal(
-    EvalState & state,
-    std::string_view name,
-    const Bindings * attrs,
-    Value & v);
+static void derivationStrictInternal(EvalState & state, std::string_view name, const Bindings * attrs, Value & v);
 
 /* Construct (as a unobservable side effect) a Nix derivation
    expression that performs the derivation described by the argument
@@ -1191,18 +1285,20 @@ static void derivationStrictInternal(
    derivation; `drvPath' containing the path of the Nix expression;
    and `type' set to `derivation' to indicate that this is a
    derivation. */
-static void prim_derivationStrict(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_derivationStrict(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], pos, "while evaluating the argument passed to builtins.derivationStrict");
 
     auto attrs = args[0]->attrs();
 
     /* Figure out the name first (for stack backtraces). */
-    auto nameAttr = state.getAttr(state.sName, attrs, "in the attrset passed as argument to builtins.derivationStrict");
+    auto nameAttr =
+        state.getAttr(state.s.name, attrs, "in the attrset passed as argument to builtins.derivationStrict");
 
     std::string_view drvName;
     try {
-        drvName = state.forceStringNoCtx(*nameAttr->value, pos, "while evaluating the `name` attribute passed to builtins.derivationStrict");
+        drvName = state.forceStringNoCtx(
+            *nameAttr->value, pos, "while evaluating the `name` attribute passed to builtins.derivationStrict");
     } catch (Error & e) {
         e.addTrace(state.positions[nameAttr->pos], "while evaluating the derivation attribute 'name'");
         throw;
@@ -1229,10 +1325,13 @@ static void prim_derivationStrict(EvalState & state, const PosIdx pos, Value * *
          * often results from the composition of several functions
          * (derivationStrict, derivation, mkDerivation, mkPythonModule, etc.)
          */
-        e.addTrace(nullptr, HintFmt(
+        e.addTrace(
+            nullptr,
+            HintFmt(
                 "while evaluating derivation '%s'\n"
                 "  whose name attribute is located at %s",
-                drvName, pos));
+                drvName,
+                pos));
         throw;
     }
 }
@@ -1253,34 +1352,39 @@ static void checkDerivationName(EvalState & state, std::string_view drvName)
         //     is optional.
         // Note that Nixpkgs generally won't trigger this, because `mkDerivation`
         // sanitizes the name.
-        state.error<EvalError>("invalid derivation name: %s. Please pass a different '%s'.", Uncolored(e.message()), "name").debugThrow();
+        state
+            .error<EvalError>(
+                "invalid derivation name: %s. Please pass a different '%s'.", Uncolored(e.message()), "name")
+            .debugThrow();
     }
 }
 
-static void derivationStrictInternal(
-    EvalState & state,
-    std::string_view drvName,
-    const Bindings * attrs,
-    Value & v)
+static void derivationStrictInternal(EvalState & state, std::string_view drvName, const Bindings * attrs, Value & v)
 {
     checkDerivationName(state, drvName);
 
     /* Check whether attributes should be passed as a JSON file. */
     using nlohmann::json;
-    std::optional<json> jsonObject;
+    std::optional<StructuredAttrs> jsonObject;
     auto pos = v.determinePos(noPos);
-    auto attr = attrs->find(state.sStructuredAttrs);
-    if (attr != attrs->end() &&
-        state.forceBool(*attr->value, pos,
-                        "while evaluating the `__structuredAttrs` "
-                        "attribute passed to builtins.derivationStrict"))
-        jsonObject = json::object();
+    auto attr = attrs->get(state.s.structuredAttrs);
+    if (attr
+        && state.forceBool(
+            *attr->value,
+            pos,
+            "while evaluating the `__structuredAttrs` "
+            "attribute passed to builtins.derivationStrict"))
+        jsonObject = StructuredAttrs{.structuredAttrs = json::object()};
 
     /* Check whether null attributes should be ignored. */
     bool ignoreNulls = false;
-    attr = attrs->find(state.sIgnoreNulls);
-    if (attr != attrs->end())
-        ignoreNulls = state.forceBool(*attr->value, pos, "while evaluating the `__ignoreNulls` attribute " "passed to builtins.derivationStrict");
+    attr = attrs->get(state.s.ignoreNulls);
+    if (attr)
+        ignoreNulls = state.forceBool(
+            *attr->value,
+            pos,
+            "while evaluating the `__ignoreNulls` attribute "
+            "passed to builtins.derivationStrict");
 
     /* Build the derivation expression by processing the attributes. */
     Derivation drv;
@@ -1298,7 +1402,8 @@ static void derivationStrictInternal(
     outputs.insert("out");
 
     for (auto & i : attrs->lexicographicOrder(state.symbols)) {
-        if (i->name == state.sIgnoreNulls) continue;
+        if (i->name == state.s.ignoreNulls)
+            continue;
         auto key = state.symbols[i->name];
         vomit("processing attribute '%1%'", key);
 
@@ -1306,13 +1411,14 @@ static void derivationStrictInternal(
             if (s == "recursive") {
                 // back compat, new name is "nar"
                 ingestionMethod = ContentAddressMethod::Raw::NixArchive;
-            } else try {
-                ingestionMethod = ContentAddressMethod::parse(s);
-            } catch (UsageError &) {
-                state.error<EvalError>(
-                    "invalid value '%s' for 'outputHashMode' attribute", s
-                ).atPos(v).debugThrow();
-            }
+            } else
+                try {
+                    ingestionMethod = ContentAddressMethod::parse(s);
+                } catch (UsageError &) {
+                    state.error<EvalError>("invalid value '%s' for 'outputHashMode' attribute", s)
+                        .atPos(v)
+                        .debugThrow();
+                }
             if (ingestionMethod == ContentAddressMethod::Raw::Text)
                 experimentalFeatureSettings.require(Xp::DynamicDerivations);
             if (ingestionMethod == ContentAddressMethod::Raw::Git)
@@ -1323,24 +1429,18 @@ static void derivationStrictInternal(
             outputs.clear();
             for (auto & j : ss) {
                 if (outputs.find(j) != outputs.end())
-                    state.error<EvalError>("duplicate derivation output '%1%'", j)
-                        .atPos(v)
-                        .debugThrow();
+                    state.error<EvalError>("duplicate derivation output '%1%'", j).atPos(v).debugThrow();
                 /* !!! Check whether j is a valid attribute
                    name. */
                 /* Derivations cannot be named ‘drvPath’, because
                    we already have an attribute ‘drvPath’ in
                    the resulting set (see state.sDrvPath). */
                 if (j == "drvPath")
-                    state.error<EvalError>("invalid derivation output name 'drvPath'")
-                        .atPos(v)
-                        .debugThrow();
+                    state.error<EvalError>("invalid derivation output name 'drvPath'").atPos(v).debugThrow();
                 outputs.insert(j);
             }
             if (outputs.empty())
-                state.error<EvalError>("derivation cannot have an empty set of outputs")
-                    .atPos(v)
-                    .debugThrow();
+                state.error<EvalError>("derivation cannot have an empty set of outputs").atPos(v).debugThrow();
         };
 
         try {
@@ -1350,153 +1450,207 @@ static void derivationStrictInternal(
 
             if (ignoreNulls) {
                 state.forceValue(*i->value, pos);
-                if (i->value->type() == nNull) continue;
-            }
-
-            if (i->name == state.sContentAddressed && state.forceBool(*i->value, pos, context_below)) {
-                contentAddressed = true;
-                experimentalFeatureSettings.require(Xp::CaDerivations);
-            }
-
-            else if (i->name == state.sImpure && state.forceBool(*i->value, pos, context_below)) {
-                isImpure = true;
-                experimentalFeatureSettings.require(Xp::ImpureDerivations);
+                if (i->value->type() == nNull)
+                    continue;
             }
 
+            switch (i->name.getId()) {
+            case EvalState::s.contentAddressed.getId():
+                if (state.forceBool(*i->value, pos, context_below)) {
+                    contentAddressed = true;
+                    experimentalFeatureSettings.require(Xp::CaDerivations);
+                }
+                break;
+            case EvalState::s.impure.getId():
+                if (state.forceBool(*i->value, pos, context_below)) {
+                    isImpure = true;
+                    experimentalFeatureSettings.require(Xp::ImpureDerivations);
+                }
+                break;
             /* The `args' attribute is special: it supplies the
                command-line arguments to the builder. */
-            else if (i->name == state.sArgs) {
+            case EvalState::s.args.getId():
                 state.forceList(*i->value, pos, context_below);
                 for (auto elem : i->value->listView()) {
-                    auto s = state.coerceToString(pos, *elem, context,
-                            "while evaluating an element of the argument list",
-                            true).toOwned();
+                    auto s = state
+                                 .coerceToString(
+                                     pos, *elem, context, "while evaluating an element of the argument list", true)
+                                 .toOwned();
                     drv.args.push_back(s);
                 }
-            }
-
+                break;
             /* All other attributes are passed to the builder through
                the environment. */
-            else {
+            default:
 
                 if (jsonObject) {
 
-                    if (i->name == state.sStructuredAttrs) continue;
+                    if (i->name == state.s.structuredAttrs)
+                        continue;
 
-                    jsonObject->emplace(key, printValueAsJSON(state, true, *i->value, pos, context));
+                    jsonObject->structuredAttrs.emplace(key, printValueAsJSON(state, true, *i->value, pos, context));
 
-                    if (i->name == state.sBuilder)
+                    switch (i->name.getId()) {
+                    case EvalState::s.builder.getId():
                         drv.builder = state.forceString(*i->value, context, pos, context_below);
-                    else if (i->name == state.sSystem)
+                        break;
+                    case EvalState::s.system.getId():
                         drv.platform = state.forceStringNoCtx(*i->value, pos, context_below);
-                    else if (i->name == state.sOutputHash)
+                        break;
+                    case EvalState::s.outputHash.getId():
                         outputHash = state.forceStringNoCtx(*i->value, pos, context_below);
-                    else if (i->name == state.sOutputHashAlgo)
+                        break;
+                    case EvalState::s.outputHashAlgo.getId():
                         outputHashAlgo = parseHashAlgoOpt(state.forceStringNoCtx(*i->value, pos, context_below));
-                    else if (i->name == state.sOutputHashMode)
+                        break;
+                    case EvalState::s.outputHashMode.getId():
                         handleHashMode(state.forceStringNoCtx(*i->value, pos, context_below));
-                    else if (i->name == state.sOutputs) {
-                        /* Require ‘outputs’ to be a list of strings. */
+                        break;
+                    case EvalState::s.outputs.getId(): {
+                        /* Require 'outputs' to be a list of strings. */
                         state.forceList(*i->value, pos, context_below);
                         Strings ss;
                         for (auto elem : i->value->listView())
                             ss.emplace_back(state.forceStringNoCtx(*elem, pos, context_below));
                         handleOutputs(ss);
+                        break;
+                    }
+                    default:
+                        break;
                     }
 
-                    if (i->name == state.sAllowedReferences)
-                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedReferences'; use 'outputChecks.<output>.allowedReferences' instead", drvName);
-                    if (i->name == state.sAllowedRequisites)
-                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedRequisites'; use 'outputChecks.<output>.allowedRequisites' instead", drvName);
-                    if (i->name == state.sDisallowedReferences)
-                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedReferences'; use 'outputChecks.<output>.disallowedReferences' instead", drvName);
-                    if (i->name == state.sDisallowedRequisites)
-                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead", drvName);
-                    if (i->name == state.sMaxSize)
-                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxSize'; use 'outputChecks.<output>.maxSize' instead", drvName);
-                    if (i->name == state.sMaxClosureSize)
-                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxClosureSize'; use 'outputChecks.<output>.maxClosureSize' instead", drvName);
-
+                    switch (i->name.getId()) {
+                    case EvalState::s.allowedReferences.getId():
+                        warn(
+                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedReferences'; use 'outputChecks.<output>.allowedReferences' instead",
+                            drvName);
+                        break;
+                    case EvalState::s.allowedRequisites.getId():
+                        warn(
+                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedRequisites'; use 'outputChecks.<output>.allowedRequisites' instead",
+                            drvName);
+                        break;
+                    case EvalState::s.disallowedReferences.getId():
+                        warn(
+                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedReferences'; use 'outputChecks.<output>.disallowedReferences' instead",
+                            drvName);
+                        break;
+                    case EvalState::s.disallowedRequisites.getId():
+                        warn(
+                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead",
+                            drvName);
+                        break;
+                    case EvalState::s.maxSize.getId():
+                        warn(
+                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxSize'; use 'outputChecks.<output>.maxSize' instead",
+                            drvName);
+                        break;
+                    case EvalState::s.maxClosureSize.getId():
+                        warn(
+                            "In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxClosureSize'; use 'outputChecks.<output>.maxClosureSize' instead",
+                            drvName);
+                        break;
+                    default:
+                        break;
+                    }
 
                 } else {
                     auto s = state.coerceToString(pos, *i->value, context, context_below, true).toOwned();
-                    drv.env.emplace(key, s);
-                    if (i->name == state.sBuilder) drv.builder = std::move(s);
-                    else if (i->name == state.sSystem) drv.platform = std::move(s);
-                    else if (i->name == state.sOutputHash) outputHash = std::move(s);
-                    else if (i->name == state.sOutputHashAlgo) outputHashAlgo = parseHashAlgoOpt(s);
-                    else if (i->name == state.sOutputHashMode) handleHashMode(s);
-                    else if (i->name == state.sOutputs)
-                        handleOutputs(tokenizeString<Strings>(s));
-                    else if (i->name == state.sJson)
-                        warn("In derivation '%s': setting structured attributes via '__json' is deprecated, and may be disallowed in future versions of Nix. Set '__structuredAttrs = true' instead.", drvName);
+                    if (i->name == state.s.json) {
+                        warn(
+                            "In derivation '%s': setting structured attributes via '__json' is deprecated, and may be disallowed in future versions of Nix. Set '__structuredAttrs = true' instead.",
+                            drvName);
+                        drv.structuredAttrs = StructuredAttrs::parse(s);
+                    } else {
+                        drv.env.emplace(key, s);
+                        switch (i->name.getId()) {
+                        case EvalState::s.builder.getId():
+                            drv.builder = std::move(s);
+                            break;
+                        case EvalState::s.system.getId():
+                            drv.platform = std::move(s);
+                            break;
+                        case EvalState::s.outputHash.getId():
+                            outputHash = std::move(s);
+                            break;
+                        case EvalState::s.outputHashAlgo.getId():
+                            outputHashAlgo = parseHashAlgoOpt(s);
+                            break;
+                        case EvalState::s.outputHashMode.getId():
+                            handleHashMode(s);
+                            break;
+                        case EvalState::s.outputs.getId():
+                            handleOutputs(tokenizeString<Strings>(s));
+                            break;
+                        default:
+                            break;
+                        }
+                    }
                 }
-
+                break;
             }
 
         } catch (Error & e) {
-            e.addTrace(state.positions[i->pos],
-                HintFmt("while evaluating attribute '%1%' of derivation '%2%'", key, drvName));
+            e.addTrace(
+                state.positions[i->pos], HintFmt("while evaluating attribute '%1%' of derivation '%2%'", key, drvName));
             throw;
         }
     }
 
     if (jsonObject) {
-        drv.env.emplace("__json", jsonObject->dump());
-        jsonObject.reset();
+        /* The only other way `drv.structuredAttrs` can be set is when
+           `jsonObject` is not set. */
+        assert(!drv.structuredAttrs);
+        drv.structuredAttrs = std::move(*jsonObject);
     }
 
     /* Everything in the context of the strings in the derivation
        attributes should be added as dependencies of the resulting
        derivation. */
     for (auto & c : context) {
-        std::visit(overloaded {
-            /* Since this allows the builder to gain access to every
-               path in the dependency graph of the derivation (including
-               all outputs), all paths in the graph must be added to
-               this derivation's list of inputs to ensure that they are
-               available when the builder runs. */
-            [&](const NixStringContextElem::DrvDeep & d) {
-                /* !!! This doesn't work if readOnlyMode is set. */
-                StorePathSet refs;
-                state.store->computeFSClosure(d.drvPath, refs);
-                for (auto & j : refs) {
-                    drv.inputSrcs.insert(j);
-                    if (j.isDerivation()) {
-                        drv.inputDrvs.map[j].value = state.store->readDerivation(j).outputNames();
+        std::visit(
+            overloaded{
+                /* Since this allows the builder to gain access to every
+                   path in the dependency graph of the derivation (including
+                   all outputs), all paths in the graph must be added to
+                   this derivation's list of inputs to ensure that they are
+                   available when the builder runs. */
+                [&](const NixStringContextElem::DrvDeep & d) {
+                    /* !!! This doesn't work if readOnlyMode is set. */
+                    StorePathSet refs;
+                    state.store->computeFSClosure(d.drvPath, refs);
+                    for (auto & j : refs) {
+                        drv.inputSrcs.insert(j);
+                        if (j.isDerivation()) {
+                            drv.inputDrvs.map[j].value = state.store->readDerivation(j).outputNames();
+                        }
                     }
-                }
+                },
+                [&](const NixStringContextElem::Built & b) {
+                    drv.inputDrvs.ensureSlot(*b.drvPath).value.insert(b.output);
+                },
+                [&](const NixStringContextElem::Opaque & o) { drv.inputSrcs.insert(o.path); },
             },
-            [&](const NixStringContextElem::Built & b) {
-                drv.inputDrvs.ensureSlot(*b.drvPath).value.insert(b.output);
-            },
-            [&](const NixStringContextElem::Opaque & o) {
-                drv.inputSrcs.insert(o.path);
-            },
-        }, c.raw);
+            c.raw);
     }
 
     /* Do we have all required attributes? */
     if (drv.builder == "")
-        state.error<EvalError>("required attribute 'builder' missing")
-            .atPos(v)
-            .debugThrow();
+        state.error<EvalError>("required attribute 'builder' missing").atPos(v).debugThrow();
 
     if (drv.platform == "")
-        state.error<EvalError>("required attribute 'system' missing")
-            .atPos(v)
-            .debugThrow();
+        state.error<EvalError>("required attribute 'system' missing").atPos(v).debugThrow();
 
     /* Check whether the derivation name is valid. */
-    if (isDerivation(drvName) &&
-        !(ingestionMethod == ContentAddressMethod::Raw::Text &&
-          outputs.size() == 1 &&
-          *(outputs.begin()) == "out"))
-    {
-        state.error<EvalError>(
-            "derivation names are allowed to end in '%s' only if they produce a single derivation file",
-            drvExtension
-        ).atPos(v).debugThrow();
+    if (isDerivation(drvName)
+        && !(
+            ingestionMethod == ContentAddressMethod::Raw::Text && outputs.size() == 1 && *(outputs.begin()) == "out")) {
+        state
+            .error<EvalError>(
+                "derivation names are allowed to end in '%s' only if they produce a single derivation file",
+                drvExtension)
+            .atPos(v)
+            .debugThrow();
     }
 
     if (outputHash) {
@@ -1505,19 +1659,20 @@ static void derivationStrictInternal(
            Ignore `__contentAddressed` because fixed output derivations are
            already content addressed. */
         if (outputs.size() != 1 || *(outputs.begin()) != "out")
-            state.error<EvalError>(
-                "multiple outputs are not supported in fixed-output derivations"
-            ).atPos(v).debugThrow();
+            state.error<EvalError>("multiple outputs are not supported in fixed-output derivations")
+                .atPos(v)
+                .debugThrow();
 
         auto h = newHashAllowEmpty(*outputHash, outputHashAlgo);
 
         auto method = ingestionMethod.value_or(ContentAddressMethod::Raw::Flat);
 
-        DerivationOutput::CAFixed dof {
-            .ca = ContentAddress {
-                .method = std::move(method),
-                .hash = std::move(h),
-            },
+        DerivationOutput::CAFixed dof{
+            .ca =
+                ContentAddress{
+                    .method = std::move(method),
+                    .hash = std::move(h),
+                },
         };
 
         drv.env["out"] = state.store->printStorePath(dof.path(*state.store, drvName, "out"));
@@ -1526,8 +1681,7 @@ static void derivationStrictInternal(
 
     else if (contentAddressed || isImpure) {
         if (contentAddressed && isImpure)
-            state.error<EvalError>("derivation cannot be both content-addressed and impure")
-                .atPos(v).debugThrow();
+            state.error<EvalError>("derivation cannot be both content-addressed and impure").atPos(v).debugThrow();
 
         auto ha = outputHashAlgo.value_or(HashAlgorithm::SHA256);
         auto method = ingestionMethod.value_or(ContentAddressMethod::Raw::NixArchive);
@@ -1535,14 +1689,16 @@ static void derivationStrictInternal(
         for (auto & i : outputs) {
             drv.env[i] = hashPlaceholder(i);
             if (isImpure)
-                drv.outputs.insert_or_assign(i,
-                    DerivationOutput::Impure {
+                drv.outputs.insert_or_assign(
+                    i,
+                    DerivationOutput::Impure{
                         .method = method,
                         .hashAlgo = ha,
                     });
             else
-                drv.outputs.insert_or_assign(i,
-                    DerivationOutput::CAFloating {
+                drv.outputs.insert_or_assign(
+                    i,
+                    DerivationOutput::CAFloating{
                         .method = method,
                         .hashAlgo = ha,
                     });
@@ -1558,8 +1714,7 @@ static void derivationStrictInternal(
            the hash. */
         for (auto & i : outputs) {
             drv.env[i] = "";
-            drv.outputs.insert_or_assign(i,
-                DerivationOutput::Deferred { });
+            drv.outputs.insert_or_assign(i, DerivationOutput::Deferred{});
         }
 
         auto hashModulo = hashDerivationModulo(*state.store, Derivation(drv), true);
@@ -1568,15 +1723,12 @@ static void derivationStrictInternal(
             for (auto & i : outputs) {
                 auto h = get(hashModulo.hashes, i);
                 if (!h)
-                    state.error<AssertionError>(
-                        "derivation produced no hash for output '%s'",
-                        i
-                    ).atPos(v).debugThrow();
+                    state.error<AssertionError>("derivation produced no hash for output '%s'", i).atPos(v).debugThrow();
                 auto outPath = state.store->makeOutputPath(i, *h, drvName);
                 drv.env[i] = state.store->printStorePath(outPath);
                 drv.outputs.insert_or_assign(
                     i,
-                    DerivationOutput::InputAddressed {
+                    DerivationOutput::InputAddressed{
                         .path = std::move(outPath),
                     });
             }
@@ -1584,7 +1736,7 @@ static void derivationStrictInternal(
             ;
         case DrvHash::Kind::Deferred:
             for (auto & i : outputs) {
-                drv.outputs.insert_or_assign(i, DerivationOutput::Deferred {});
+                drv.outputs.insert_or_assign(i, DerivationOutput::Deferred{});
             }
         }
     }
@@ -1600,24 +1752,28 @@ static void derivationStrictInternal(
        read them later. */
     {
         auto h = hashDerivationModulo(*state.store, drv, false);
-        drvHashes.lock()->insert_or_assign(drvPath, h);
+        drvHashes.insert_or_assign(drvPath, std::move(h));
     }
 
     auto result = state.buildBindings(1 + drv.outputs.size());
-    result.alloc(state.sDrvPath).mkString(drvPathS, {
-        NixStringContextElem::DrvDeep { .drvPath = drvPath },
-    });
+    result.alloc(state.s.drvPath)
+        .mkString(
+            drvPathS,
+            {
+                NixStringContextElem::DrvDeep{.drvPath = drvPath},
+            });
     for (auto & i : drv.outputs)
         mkOutputString(state, result, drvPath, i);
 
     v.mkAttrs(result);
 }
 
-static RegisterPrimOp primop_derivationStrict(PrimOp {
-    .name = "derivationStrict",
-    .arity = 1,
-    .fun = prim_derivationStrict,
-});
+static RegisterPrimOp primop_derivationStrict(
+    PrimOp{
+        .name = "derivationStrict",
+        .arity = 1,
+        .fun = prim_derivationStrict,
+    });
 
 /* Return a placeholder string for the specified output that will be
    substituted by the corresponding output path at build time. For
@@ -1626,9 +1782,10 @@ static RegisterPrimOp primop_derivationStrict(PrimOp {
    time, any occurrence of this string in an derivation attribute will
    be replaced with the concrete path in the Nix store of the output
    ‘out’. */
-static void prim_placeholder(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_placeholder(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    v.mkString(hashPlaceholder(state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.placeholder")));
+    v.mkString(hashPlaceholder(
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.placeholder")));
 }
 
 static RegisterPrimOp primop_placeholder({
@@ -1646,18 +1803,17 @@ static RegisterPrimOp primop_placeholder({
     .fun = prim_placeholder,
 });
 
-
 /*************************************************************
  * Paths
  *************************************************************/
 
-
 /* Convert the argument to a path and then to a string (confusing,
    eh?).  !!! obsolete? */
-static void prim_toPath(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_toPath(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto path = state.coerceToPath(pos, *args[0], context, "while evaluating the first argument passed to builtins.toPath");
+    auto path =
+        state.coerceToPath(pos, *args[0], context, "while evaluating the first argument passed to builtins.toPath");
     v.mkString(path.path.abs(), context);
 }
 
@@ -1679,28 +1835,28 @@ static RegisterPrimOp primop_toPath({
    /nix/store/newhash-oldhash-oldname.  In the past, `toPath' had
    special case behaviour for store paths, but that created weird
    corner cases. */
-static void prim_storePath(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_storePath(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     if (state.settings.pureEval)
-        state.error<EvalError>(
-            "'%s' is not allowed in pure evaluation mode",
-            "builtins.storePath"
-        ).atPos(pos).debugThrow();
+        state.error<EvalError>("'%s' is not allowed in pure evaluation mode", "builtins.storePath")
+            .atPos(pos)
+            .debugThrow();
 
     NixStringContext context;
-    auto path = state.coerceToPath(pos, *args[0], context, "while evaluating the first argument passed to 'builtins.storePath'").path;
+    auto path =
+        state.coerceToPath(pos, *args[0], context, "while evaluating the first argument passed to 'builtins.storePath'")
+            .path;
     /* Resolve symlinks in ‘path’, unless ‘path’ itself is a symlink
        directly in the store.  The latter condition is necessary so
        e.g. nix-push does the right thing. */
     if (!state.store->isStorePath(path.abs()))
         path = CanonPath(canonPath(path.abs(), true));
     if (!state.store->isInStore(path.abs()))
-        state.error<EvalError>("path '%1%' is not in the Nix store", path)
-            .atPos(pos).debugThrow();
+        state.error<EvalError>("path '%1%' is not in the Nix store", path).atPos(pos).debugThrow();
     auto path2 = state.store->toStorePath(path.abs()).first;
     if (!settings.readOnlyMode)
         state.store->ensurePath(path2);
-    context.insert(NixStringContextElem::Opaque { .path = path2 });
+    context.insert(NixStringContextElem::Opaque{.path = path2});
     v.mkString(path.abs(), context);
 }
 
@@ -1724,19 +1880,17 @@ static RegisterPrimOp primop_storePath({
     .fun = prim_storePath,
 });
 
-static void prim_pathExists(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_pathExists(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     try {
         auto & arg = *args[0];
 
         /* SourcePath doesn't know about trailing slash. */
         state.forceValue(arg, pos);
-        auto mustBeDir = arg.type() == nString
-            && (arg.string_view().ends_with("/")
-                || arg.string_view().ends_with("/."));
+        auto mustBeDir =
+            arg.type() == nString && (arg.string_view().ends_with("/") || arg.string_view().ends_with("/."));
 
-        auto symlinkResolution =
-            mustBeDir ? SymlinkResolution::Full : SymlinkResolution::Ancestors;
+        auto symlinkResolution = mustBeDir ? SymlinkResolution::Full : SymlinkResolution::Ancestors;
         auto path = realisePath(state, pos, arg, symlinkResolution);
 
         auto st = path.maybeLstat();
@@ -1779,12 +1933,13 @@ static std::string_view legacyBaseNameOf(std::string_view path)
 
 /* Return the base name of the given string, i.e., everything
    following the last slash. */
-static void prim_baseNameOf(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_baseNameOf(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    v.mkString(legacyBaseNameOf(*state.coerceToString(pos, *args[0], context,
-            "while evaluating the first argument passed to builtins.baseNameOf",
-            false, false)), context);
+    v.mkString(
+        legacyBaseNameOf(*state.coerceToString(
+            pos, *args[0], context, "while evaluating the first argument passed to builtins.baseNameOf", false, false)),
+        context);
 }
 
 static RegisterPrimOp primop_baseNameOf({
@@ -1808,7 +1963,7 @@ static RegisterPrimOp primop_baseNameOf({
 /* Return the directory of the given path, i.e., everything before the
    last slash.  Return either a path or a string depending on the type
    of the argument. */
-static void prim_dirOf(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_dirOf(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     if (args[0]->type() == nPath) {
@@ -1816,9 +1971,8 @@ static void prim_dirOf(EvalState & state, const PosIdx pos, Value * * args, Valu
         v.mkPath(path.path.isRoot() ? path : path.parent());
     } else {
         NixStringContext context;
-        auto path = state.coerceToString(pos, *args[0], context,
-            "while evaluating the first argument passed to 'builtins.dirOf'",
-            false, false);
+        auto path = state.coerceToString(
+            pos, *args[0], context, "while evaluating the first argument passed to 'builtins.dirOf'", false, false);
         auto dir = dirOf(*path);
         v.mkString(dir, context);
     }
@@ -1836,15 +1990,14 @@ static RegisterPrimOp primop_dirOf({
 });
 
 /* Return the contents of a file as a string. */
-static void prim_readFile(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_readFile(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto path = realisePath(state, pos, *args[0]);
     auto s = path.readFile();
     if (s.find((char) 0) != std::string::npos)
-        state.error<EvalError>(
-            "the contents of the file '%1%' cannot be represented as a Nix string",
-            path
-        ).atPos(pos).debugThrow();
+        state.error<EvalError>("the contents of the file '%1%' cannot be represented as a Nix string", path)
+            .atPos(pos)
+            .debugThrow();
     StorePathSet refs;
     if (state.store->isInStore(path.path.abs())) {
         try {
@@ -1858,9 +2011,10 @@ static void prim_readFile(EvalState & state, const PosIdx pos, Value * * args, V
     }
     NixStringContext context;
     for (auto && p : std::move(refs)) {
-        context.insert(NixStringContextElem::Opaque {
-            .path = std::move((StorePath &&)p),
-        });
+        context.insert(
+            NixStringContextElem::Opaque{
+                .path = std::move((StorePath &&) p),
+            });
     }
     v.mkString(s, context);
 }
@@ -1876,7 +2030,7 @@ static RegisterPrimOp primop_readFile({
 
 /* Find a file in the Nix search path. Used to implement <x> paths,
    which are desugared to 'findFile __nixPath "x"'. */
-static void prim_findFile(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_findFile(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to builtins.findFile");
 
@@ -1886,43 +2040,54 @@ static void prim_findFile(EvalState & state, const PosIdx pos, Value * * args, V
         state.forceAttrs(*v2, pos, "while evaluating an element of the list passed to builtins.findFile");
 
         std::string prefix;
-        auto i = v2->attrs()->find(state.sPrefix);
-        if (i != v2->attrs()->end())
-            prefix = state.forceStringNoCtx(*i->value, pos, "while evaluating the `prefix` attribute of an element of the list passed to builtins.findFile");
+        auto i = v2->attrs()->get(state.s.prefix);
+        if (i)
+            prefix = state.forceStringNoCtx(
+                *i->value,
+                pos,
+                "while evaluating the `prefix` attribute of an element of the list passed to builtins.findFile");
 
-        i = state.getAttr(state.sPath, v2->attrs(), "in an element of the __nixPath");
+        i = state.getAttr(state.s.path, v2->attrs(), "in an element of the __nixPath");
 
         NixStringContext context;
-        auto path = state.coerceToString(pos, *i->value, context,
-                "while evaluating the `path` attribute of an element of the list passed to builtins.findFile",
-                false, false).toOwned();
+        auto path =
+            state
+                .coerceToString(
+                    pos,
+                    *i->value,
+                    context,
+                    "while evaluating the `path` attribute of an element of the list passed to builtins.findFile",
+                    false,
+                    false)
+                .toOwned();
 
         try {
             auto rewrites = state.realiseContext(context);
             path = rewriteStrings(std::move(path), rewrites);
         } catch (InvalidPathError & e) {
-            state.error<EvalError>(
-                "cannot find '%1%', since path '%2%' is not valid",
-                path,
-                e.path
-            ).atPos(pos).debugThrow();
+            state.error<EvalError>("cannot find '%1%', since path '%2%' is not valid", path, e.path)
+                .atPos(pos)
+                .debugThrow();
         }
 
-        lookupPath.elements.emplace_back(LookupPath::Elem {
-            .prefix = LookupPath::Prefix { .s = std::move(prefix) },
-            .path = LookupPath::Path { .s = std::move(path) },
-        });
+        lookupPath.elements.emplace_back(
+            LookupPath::Elem{
+                .prefix = LookupPath::Prefix{.s = std::move(prefix)},
+                .path = LookupPath::Path{.s = std::move(path)},
+            });
     }
 
-    auto path = state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument passed to builtins.findFile");
+    auto path =
+        state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument passed to builtins.findFile");
 
     v.mkPath(state.findFile(lookupPath, path, pos));
 }
 
-static RegisterPrimOp primop_findFile(PrimOp {
-    .name = "__findFile",
-    .args = {"search-path", "lookup-path"},
-    .doc = R"(
+static RegisterPrimOp primop_findFile(
+    PrimOp{
+        .name = "__findFile",
+        .args = {"search-path", "lookup-path"},
+        .doc = R"(
       Find *lookup-path* in *search-path*.
 
       [Lookup path](@docroot@/language/constructs/lookup-path.md) expressions are [desugared](https://en.wikipedia.org/wiki/Syntactic_sugar) using this and [`builtins.nixPath`](#builtins-nixPath):
@@ -2050,13 +2215,14 @@ static RegisterPrimOp primop_findFile(PrimOp {
       >
       > makes `<nixpkgs>` refer to a particular branch of the `NixOS/nixpkgs` repository on GitHub.
     )",
-    .fun = prim_findFile,
-});
+        .fun = prim_findFile,
+    });
 
 /* Return the cryptographic hash of a file in base-16. */
-static void prim_hashFile(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_hashFile(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto algo = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.hashFile");
+    auto algo =
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.hashFile");
     std::optional<HashAlgorithm> ha = parseHashAlgo(algo);
     if (!ha)
         state.error<EvalError>("unknown hash algorithm '%1%'", algo).atPos(pos).debugThrow();
@@ -2077,20 +2243,45 @@ static RegisterPrimOp primop_hashFile({
     .fun = prim_hashFile,
 });
 
-static Value * fileTypeToString(EvalState & state, SourceAccessor::Type type)
+static const Value & fileTypeToString(EvalState & state, SourceAccessor::Type type)
 {
-    return
-        type == SourceAccessor::Type::tRegular ? &state.vStringRegular :
-        type == SourceAccessor::Type::tDirectory ? &state.vStringDirectory :
-        type == SourceAccessor::Type::tSymlink ? &state.vStringSymlink :
-        &state.vStringUnknown;
+    struct Constants
+    {
+        Value regular;
+        Value directory;
+        Value symlink;
+        Value unknown;
+    };
+
+    static const Constants stringValues = []() {
+        Constants res;
+        res.regular.mkStringNoCopy("regular");
+        res.directory.mkStringNoCopy("directory");
+        res.symlink.mkStringNoCopy("symlink");
+        res.unknown.mkStringNoCopy("unknown");
+        return res;
+    }();
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch-enum"
+    using enum SourceAccessor::Type;
+    switch (type) {
+    case tRegular:
+        return stringValues.regular;
+    case tDirectory:
+        return stringValues.directory;
+    case tSymlink:
+        return stringValues.symlink;
+    default:
+        return stringValues.unknown;
+    }
 }
 
-static void prim_readFileType(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_readFileType(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto path = realisePath(state, pos, *args[0], std::nullopt);
     /* Retrieve the directory entry type and stringize it. */
-    v = *fileTypeToString(state, path.lstat().type);
+    v = fileTypeToString(state, path.lstat().type);
 }
 
 static RegisterPrimOp primop_readFileType({
@@ -2104,7 +2295,7 @@ static RegisterPrimOp primop_readFileType({
 });
 
 /* Read a directory (without . or ..) */
-static void prim_readDir(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_readDir(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto path = realisePath(state, pos, *args[0]);
 
@@ -2134,7 +2325,9 @@ static void prim_readDir(EvalState & state, const PosIdx pos, Value * * args, Va
         } else {
             // This branch of the conditional is much more likely.
             // Here we just stringize the directory entry type.
-            attrs.insert(state.symbols.create(name), fileTypeToString(state, *type));
+            // N.B. const_cast here is ok, because these values will never be modified, since
+            // only thunks are mutable - other types do not change once constructed.
+            attrs.insert(state.symbols.create(name), const_cast<Value *>(&fileTypeToString(state, *type)));
         }
     }
 
@@ -2161,16 +2354,18 @@ static RegisterPrimOp primop_readDir({
 });
 
 /* Extend single element string context with another output. */
-static void prim_outputOf(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_outputOf(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    SingleDerivedPath drvPath = state.coerceToSingleDerivedPath(pos, *args[0], "while evaluating the first argument to builtins.outputOf");
+    SingleDerivedPath drvPath =
+        state.coerceToSingleDerivedPath(pos, *args[0], "while evaluating the first argument to builtins.outputOf");
 
-    OutputNameView outputName = state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument to builtins.outputOf");
+    OutputNameView outputName =
+        state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument to builtins.outputOf");
 
     state.mkSingleDerivedPathString(
-        SingleDerivedPath::Built {
+        SingleDerivedPath::Built{
             .drvPath = make_ref<SingleDerivedPath>(drvPath),
-            .output = std::string { outputName },
+            .output = std::string{outputName},
         },
         v);
 }
@@ -2209,11 +2404,10 @@ static RegisterPrimOp primop_outputOf({
  * Creating files
  *************************************************************/
 
-
 /* Convert the argument (which can be any Nix expression) to an XML
    representation returned in a string.  Not all Nix expressions can
    be sensibly or completely represented (e.g., functions). */
-static void prim_toXML(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_toXML(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     std::ostringstream out;
     NixStringContext context;
@@ -2321,7 +2515,7 @@ static RegisterPrimOp primop_toXML({
 /* Convert the argument (which can be any Nix expression) to a JSON
    string.  Not all Nix expressions can be sensibly or completely
    represented (e.g., functions). */
-static void prim_toJSON(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_toJSON(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     std::ostringstream out;
     NixStringContext context;
@@ -2344,12 +2538,12 @@ static RegisterPrimOp primop_toJSON({
 });
 
 /* Parse a JSON string to a value. */
-static void prim_fromJSON(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_fromJSON(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto s = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.fromJSON");
     try {
         parseJSON(state, s, v);
-    } catch (JSONParseError &e) {
+    } catch (JSONParseError & e) {
         e.addTrace(state.positions[pos], "while decoding a JSON string");
         throw;
     }
@@ -2372,11 +2566,12 @@ static RegisterPrimOp primop_fromJSON({
 
 /* Store a string in the Nix store as a source file that can be used
    as an input by derivations. */
-static void prim_toFile(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_toFile(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
     auto name = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.toFile");
-    auto contents = state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.toFile");
+    auto contents =
+        state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.toFile");
 
     StorePathSet refs;
 
@@ -2384,23 +2579,33 @@ static void prim_toFile(EvalState & state, const PosIdx pos, Value * * args, Val
         if (auto p = std::get_if<NixStringContextElem::Opaque>(&c.raw))
             refs.insert(p->path);
         else
-            state.error<EvalError>(
-                "files created by %1% may not reference derivations, but %2% references %3%",
-                "builtins.toFile",
-                name,
-                c.to_string()
-            ).atPos(pos).debugThrow();
+            state
+                .error<EvalError>(
+                    "files created by %1% may not reference derivations, but %2% references %3%",
+                    "builtins.toFile",
+                    name,
+                    c.to_string())
+                .atPos(pos)
+                .debugThrow();
     }
 
-    auto storePath = settings.readOnlyMode
-        ? state.store->makeFixedOutputPathFromCA(name, TextInfo {
-            .hash = hashString(HashAlgorithm::SHA256, contents),
-            .references = std::move(refs),
-        })
-        : ({
-            StringSource s { contents };
-            state.store->addToStoreFromDump(s, name, FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, refs, state.repair);
-        });
+    auto storePath = settings.readOnlyMode ? state.store->makeFixedOutputPathFromCA(
+                                                 name,
+                                                 TextInfo{
+                                                     .hash = hashString(HashAlgorithm::SHA256, contents),
+                                                     .references = std::move(refs),
+                                                 })
+                                           : ({
+                                                 StringSource s{contents};
+                                                 state.store->addToStoreFromDump(
+                                                     s,
+                                                     name,
+                                                     FileSerialisationMethod::Flat,
+                                                     ContentAddressMethod::Raw::Text,
+                                                     HashAlgorithm::SHA256,
+                                                     refs,
+                                                     state.repair);
+                                             });
 
     /* Note: we don't need to add `context' to the context of the
        result, since `storePath' itself has references to the paths
@@ -2487,10 +2692,7 @@ static RegisterPrimOp primop_toFile({
     .fun = prim_toFile,
 });
 
-bool EvalState::callPathFilter(
-    Value * filterFun,
-    const SourcePath & path,
-    PosIdx pos)
+bool EvalState::callPathFilter(Value * filterFun, const SourcePath & path, PosIdx pos)
 {
     auto st = path.lstat();
 
@@ -2500,7 +2702,7 @@ bool EvalState::callPathFilter(
     arg1.mkString(path.path.abs());
 
     // assert that type is not "unknown"
-    Value * args []{&arg1, fileTypeToString(*this, st.type)};
+    Value * args[]{&arg1, const_cast<Value *>(&fileTypeToString(*this, st.type))};
     Value res;
     callFunction(*filterFun, args, res, pos);
 
@@ -2535,10 +2737,8 @@ static void addPath(
 
         std::optional<StorePath> expectedStorePath;
         if (expectedHash)
-            expectedStorePath = state.store->makeFixedOutputPathFromCA(name, ContentAddressWithReferences::fromParts(
-                method,
-                *expectedHash,
-                {}));
+            expectedStorePath = state.store->makeFixedOutputPathFromCA(
+                name, ContentAddressWithReferences::fromParts(method, *expectedHash, {}));
 
         if (!expectedHash || !state.store->isValidPath(*expectedStorePath)) {
             auto dstPath = fetchToStore(
@@ -2551,10 +2751,9 @@ static void addPath(
                 filter.get(),
                 state.repair);
             if (expectedHash && expectedStorePath != dstPath)
-                state.error<EvalError>(
-                    "store path mismatch in (possibly filtered) path added from '%s'",
-                    path
-                ).atPos(pos).debugThrow();
+                state.error<EvalError>("store path mismatch in (possibly filtered) path added from '%s'", path)
+                    .atPos(pos)
+                    .debugThrow();
             state.allowAndSetStorePathString(dstPath, v);
         } else
             state.allowAndSetStorePathString(*expectedStorePath, v);
@@ -2564,15 +2763,18 @@ static void addPath(
     }
 }
 
-
-static void prim_filterSource(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_filterSource(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto path = state.coerceToPath(pos, *args[1], context,
+    auto path = state.coerceToPath(
+        pos,
+        *args[1],
+        context,
         "while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'");
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.filterSource");
 
-    addPath(state, pos, path.baseName(), path, args[0], ContentAddressMethod::Raw::NixArchive, std::nullopt, v, context);
+    addPath(
+        state, pos, path.baseName(), path, args[0], ContentAddressMethod::Raw::NixArchive, std::nullopt, v, context);
 }
 
 static RegisterPrimOp primop_filterSource({
@@ -2630,7 +2832,7 @@ static RegisterPrimOp primop_filterSource({
     .fun = prim_filterSource,
 });
 
-static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_path(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     std::optional<SourcePath> path;
     std::string_view name;
@@ -2644,27 +2846,33 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
     for (auto & attr : *args[0]->attrs()) {
         auto n = state.symbols[attr.name];
         if (n == "path")
-            path.emplace(state.coerceToPath(attr.pos, *attr.value, context, "while evaluating the 'path' attribute passed to 'builtins.path'"));
-        else if (attr.name == state.sName)
-            name = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `name` attribute passed to builtins.path");
+            path.emplace(state.coerceToPath(
+                attr.pos, *attr.value, context, "while evaluating the 'path' attribute passed to 'builtins.path'"));
+        else if (attr.name == state.s.name)
+            name = state.forceStringNoCtx(
+                *attr.value, attr.pos, "while evaluating the `name` attribute passed to builtins.path");
         else if (n == "filter")
-            state.forceFunction(*(filterFun = attr.value), attr.pos, "while evaluating the `filter` parameter passed to builtins.path");
+            state.forceFunction(
+                *(filterFun = attr.value), attr.pos, "while evaluating the `filter` parameter passed to builtins.path");
         else if (n == "recursive")
-            method = state.forceBool(*attr.value, attr.pos, "while evaluating the `recursive` attribute passed to builtins.path")
-                ? ContentAddressMethod::Raw::NixArchive
-                : ContentAddressMethod::Raw::Flat;
+            method = state.forceBool(
+                         *attr.value, attr.pos, "while evaluating the `recursive` attribute passed to builtins.path")
+                         ? ContentAddressMethod::Raw::NixArchive
+                         : ContentAddressMethod::Raw::Flat;
         else if (n == "sha256")
-            expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `sha256` attribute passed to builtins.path"), HashAlgorithm::SHA256);
+            expectedHash = newHashAllowEmpty(
+                state.forceStringNoCtx(
+                    *attr.value, attr.pos, "while evaluating the `sha256` attribute passed to builtins.path"),
+                HashAlgorithm::SHA256);
         else
-            state.error<EvalError>(
-                "unsupported argument '%1%' to 'builtins.path'",
-                state.symbols[attr.name]
-            ).atPos(attr.pos).debugThrow();
+            state.error<EvalError>("unsupported argument '%1%' to 'builtins.path'", state.symbols[attr.name])
+                .atPos(attr.pos)
+                .debugThrow();
     }
     if (!path)
-        state.error<EvalError>(
-            "missing required 'path' attribute in the first argument to 'builtins.path'"
-        ).atPos(pos).debugThrow();
+        state.error<EvalError>("missing required 'path' attribute in the first argument to 'builtins.path'")
+            .atPos(pos)
+            .debugThrow();
     if (name.empty())
         name = path->baseName();
 
@@ -2706,15 +2914,13 @@ static RegisterPrimOp primop_path({
     .fun = prim_path,
 });
 
-
 /*************************************************************
  * Sets
  *************************************************************/
 
-
 /* Return the names of the attributes in a set as a sorted list of
    strings. */
-static void prim_attrNames(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_attrNames(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], pos, "while evaluating the argument passed to builtins.attrNames");
 
@@ -2723,8 +2929,7 @@ static void prim_attrNames(EvalState & state, const PosIdx pos, Value * * args,
     for (const auto & [n, i] : enumerate(*args[0]->attrs()))
         list[n] = Value::toPtr(state.symbols[i.name]);
 
-    std::sort(list.begin(), list.end(),
-              [](Value * v1, Value * v2) { return strcmp(v1->c_str(), v2->c_str()) < 0; });
+    std::sort(list.begin(), list.end(), [](Value * v1, Value * v2) { return strcmp(v1->c_str(), v2->c_str()) < 0; });
 
     v.mkList(list);
 }
@@ -2742,7 +2947,7 @@ static RegisterPrimOp primop_attrNames({
 
 /* Return the values of the attributes in a set as a list, in the same
    order as attrNames. */
-static void prim_attrValues(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_attrValues(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], pos, "while evaluating the argument passed to builtins.attrValues");
 
@@ -2751,12 +2956,10 @@ static void prim_attrValues(EvalState & state, const PosIdx pos, Value * * args,
     for (const auto & [n, i] : enumerate(*args[0]->attrs()))
         list[n] = (Value *) &i;
 
-    std::sort(list.begin(), list.end(),
-        [&](Value * v1, Value * v2) {
-            std::string_view s1 = state.symbols[((Attr *) v1)->name],
-                s2 = state.symbols[((Attr *) v2)->name];
-            return s1 < s2;
-        });
+    std::sort(list.begin(), list.end(), [&](Value * v1, Value * v2) {
+        std::string_view s1 = state.symbols[((Attr *) v1)->name], s2 = state.symbols[((Attr *) v2)->name];
+        return s1 < s2;
+    });
 
     for (auto & v : list)
         v = ((Attr *) v)->value;
@@ -2775,17 +2978,14 @@ static RegisterPrimOp primop_attrValues({
 });
 
 /* Dynamic version of the `.' operator. */
-void prim_getAttr(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+void prim_getAttr(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto attr = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.getAttr");
     state.forceAttrs(*args[1], pos, "while evaluating the second argument passed to builtins.getAttr");
-    auto i = state.getAttr(
-        state.symbols.create(attr),
-        args[1]->attrs(),
-        "in the attribute set under consideration"
-    );
+    auto i = state.getAttr(state.symbols.create(attr), args[1]->attrs(), "in the attribute set under consideration");
     // !!! add to stack trace?
-    if (state.countCalls && i->pos) state.attrSelects[i->pos]++;
+    if (state.countCalls && i->pos)
+        state.attrSelects[i->pos]++;
     state.forceValue(*i->value, pos);
     v = *i->value;
 }
@@ -2803,28 +3003,30 @@ static RegisterPrimOp primop_getAttr({
 });
 
 /* Return position information of the specified attribute. */
-static void prim_unsafeGetAttrPos(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_unsafeGetAttrPos(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto attr = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.unsafeGetAttrPos");
+    auto attr = state.forceStringNoCtx(
+        *args[0], pos, "while evaluating the first argument passed to builtins.unsafeGetAttrPos");
     state.forceAttrs(*args[1], pos, "while evaluating the second argument passed to builtins.unsafeGetAttrPos");
-    auto i = args[1]->attrs()->find(state.symbols.create(attr));
-    if (i == args[1]->attrs()->end())
+    auto i = args[1]->attrs()->get(state.symbols.create(attr));
+    if (!i)
         v.mkNull();
     else
         state.mkPos(v, i->pos);
 }
 
-static RegisterPrimOp primop_unsafeGetAttrPos(PrimOp {
-    .name = "__unsafeGetAttrPos",
-    .args = {"s", "set"},
-    .arity = 2,
-    .doc = R"(
+static RegisterPrimOp primop_unsafeGetAttrPos(
+    PrimOp{
+        .name = "__unsafeGetAttrPos",
+        .args = {"s", "set"},
+        .arity = 2,
+        .doc = R"(
       `unsafeGetAttrPos` returns the position of the attribute named *s*
       from *set*. This is used by Nixpkgs to provide location information
       in error messages.
     )",
-    .fun = prim_unsafeGetAttrPos,
-});
+        .fun = prim_unsafeGetAttrPos,
+    });
 
 // access to exact position information (ie, line and column numbers) is deferred
 // due to the cost associated with calculating that information and how rarely
@@ -2838,19 +3040,14 @@ static RegisterPrimOp primop_unsafeGetAttrPos(PrimOp {
 // but each type of thunk has an associated runtime cost in the current evaluator.
 // as with black holes this cost is too high to justify another thunk type to check
 // for in the very hot path that is forceValue.
-static struct LazyPosAccessors {
-    PrimOp primop_lineOfPos{
-        .arity = 1,
-        .fun = [] (EvalState & state, PosIdx pos, Value * * args, Value & v) {
-            v.mkInt(state.positions[PosIdx(args[0]->integer().value)].line);
-        }
-    };
-    PrimOp primop_columnOfPos{
-        .arity = 1,
-        .fun = [] (EvalState & state, PosIdx pos, Value * * args, Value & v) {
-            v.mkInt(state.positions[PosIdx(args[0]->integer().value)].column);
-        }
-    };
+static struct LazyPosAccessors
+{
+    PrimOp primop_lineOfPos{.arity = 1, .fun = [](EvalState & state, PosIdx pos, Value ** args, Value & v) {
+                                v.mkInt(state.positions[PosIdx(args[0]->integer().value)].line);
+                            }};
+    PrimOp primop_columnOfPos{.arity = 1, .fun = [](EvalState & state, PosIdx pos, Value ** args, Value & v) {
+                                  v.mkInt(state.positions[PosIdx(args[0]->integer().value)].column);
+                              }};
 
     Value lineOfPos, columnOfPos;
 
@@ -2875,11 +3072,11 @@ void makePositionThunks(EvalState & state, const PosIdx pos, Value & line, Value
 }
 
 /* Dynamic version of the `?' operator. */
-static void prim_hasAttr(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_hasAttr(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto attr = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.hasAttr");
     state.forceAttrs(*args[1], pos, "while evaluating the second argument passed to builtins.hasAttr");
-    v.mkBool(args[1]->attrs()->find(state.symbols.create(attr)) != args[1]->attrs()->end());
+    v.mkBool(args[1]->attrs()->get(state.symbols.create(attr)));
 }
 
 static RegisterPrimOp primop_hasAttr({
@@ -2894,7 +3091,7 @@ static RegisterPrimOp primop_hasAttr({
 });
 
 /* Determine whether the argument is a set. */
-static void prim_isAttrs(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isAttrs(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nAttrs);
@@ -2909,7 +3106,7 @@ static RegisterPrimOp primop_isAttrs({
     .fun = prim_isAttrs,
 });
 
-static void prim_removeAttrs(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_removeAttrs(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], pos, "while evaluating the first argument passed to builtins.removeAttrs");
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.removeAttrs");
@@ -2921,7 +3118,8 @@ static void prim_removeAttrs(EvalState & state, const PosIdx pos, Value * * args
     boost::container::small_vector<Attr, 64> names;
     names.reserve(args[1]->listSize());
     for (auto elem : args[1]->listView()) {
-        state.forceStringNoCtx(*elem, pos, "while evaluating the values of the second argument passed to builtins.removeAttrs");
+        state.forceStringNoCtx(
+            *elem, pos, "while evaluating the values of the second argument passed to builtins.removeAttrs");
         names.emplace_back(state.symbols.create(elem->string_view()), nullptr);
     }
     std::sort(names.begin(), names.end());
@@ -2931,9 +3129,7 @@ static void prim_removeAttrs(EvalState & state, const PosIdx pos, Value * * args
        vector. */
     auto attrs = state.buildBindings(args[0]->attrs()->size());
     std::set_difference(
-        args[0]->attrs()->begin(), args[0]->attrs()->end(),
-        names.begin(), names.end(),
-        std::back_inserter(attrs));
+        args[0]->attrs()->begin(), args[0]->attrs()->end(), names.begin(), names.end(), std::back_inserter(attrs));
     v.mkAttrs(attrs.alreadySorted());
 }
 
@@ -2958,7 +3154,7 @@ static RegisterPrimOp primop_removeAttrs({
    "nameN"; value = valueN;}] is transformed to {name1 = value1;
    ... nameN = valueN;}.  In case of duplicate occurrences of the same
    name, the first takes precedence. */
-static void prim_listToAttrs(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_listToAttrs(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the argument passed to builtins.listToAttrs");
 
@@ -2971,9 +3167,12 @@ static void prim_listToAttrs(EvalState & state, const PosIdx pos, Value * * args
     for (const auto & [n, v2] : enumerate(listView)) {
         state.forceAttrs(*v2, pos, "while evaluating an element of the list passed to builtins.listToAttrs");
 
-        auto j = state.getAttr(state.sName, v2->attrs(), "in a {name=...; value=...;} pair");
+        auto j = state.getAttr(state.s.name, v2->attrs(), "in a {name=...; value=...;} pair");
 
-        auto name = state.forceStringNoCtx(*j->value, j->pos, "while evaluating the `name` attribute of an element of the list passed to builtins.listToAttrs");
+        auto name = state.forceStringNoCtx(
+            *j->value,
+            j->pos,
+            "while evaluating the `name` attribute of an element of the list passed to builtins.listToAttrs");
         auto sym = state.symbols.create(name);
 
         // (ab)use Attr to store a Value * * instead of a Value *, so that we can stabilize the sort using the Value * *
@@ -2995,7 +3194,7 @@ static void prim_listToAttrs(EvalState & state, const PosIdx pos, Value * * args
         // Note that .value is actually a Value * *; see earlier comments
         Value * v2 = *std::bit_cast<ElemPtr>(attr.value);
 
-        auto j = state.getAttr(state.sValue, v2->attrs(), "in a {name=...; value=...;} pair");
+        auto j = state.getAttr(state.s.value, v2->attrs(), "in a {name=...; value=...;} pair");
         prev = attr.name;
         bindings.push_back({prev, j->value, j->pos});
     }
@@ -3037,7 +3236,7 @@ static RegisterPrimOp primop_listToAttrs({
     .fun = prim_listToAttrs,
 });
 
-static void prim_intersectAttrs(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_intersectAttrs(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], pos, "while evaluating the first argument passed to builtins.intersectAttrs");
     state.forceAttrs(*args[1], pos, "while evaluating the second argument passed to builtins.intersectAttrs");
@@ -3087,15 +3286,14 @@ static void prim_intersectAttrs(EvalState & state, const PosIdx pos, Value * * a
 
     if (left.size() < right.size()) {
         for (auto & l : left) {
-            auto r = right.find(l.name);
-            if (r != right.end())
+            auto r = right.get(l.name);
+            if (r)
                 attrs.insert(*r);
         }
-    }
-    else {
+    } else {
         for (auto & r : right) {
-            auto l = left.find(r.name);
-            if (l != left.end())
+            auto l = left.get(r.name);
+            if (l)
                 attrs.insert(r);
         }
     }
@@ -3115,16 +3313,18 @@ static RegisterPrimOp primop_intersectAttrs({
     .fun = prim_intersectAttrs,
 });
 
-static void prim_catAttrs(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_catAttrs(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto attrName = state.symbols.create(state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.catAttrs"));
+    auto attrName = state.symbols.create(
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.catAttrs"));
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.catAttrs");
 
     SmallValueVector<nonRecursiveStackReservation> res(args[1]->listSize());
     size_t found = 0;
 
     for (auto v2 : args[1]->listView()) {
-        state.forceAttrs(*v2, pos, "while evaluating an element in the list passed as second argument to builtins.catAttrs");
+        state.forceAttrs(
+            *v2, pos, "while evaluating an element in the list passed as second argument to builtins.catAttrs");
         if (auto i = v2->attrs()->get(attrName))
             res[found++] = i->value;
     }
@@ -3152,22 +3352,22 @@ static RegisterPrimOp primop_catAttrs({
     .fun = prim_catAttrs,
 });
 
-static void prim_functionArgs(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_functionArgs(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     if (args[0]->isPrimOpApp() || args[0]->isPrimOp()) {
-        v.mkAttrs(&state.emptyBindings);
+        v.mkAttrs(&Bindings::emptyBindings);
         return;
     }
     if (!args[0]->isLambda())
         state.error<TypeError>("'functionArgs' requires a function").atPos(pos).debugThrow();
 
     if (!args[0]->lambda().fun->hasFormals()) {
-        v.mkAttrs(&state.emptyBindings);
+        v.mkAttrs(&Bindings::emptyBindings);
         return;
     }
 
-    const auto &formals = args[0]->lambda().fun->formals->formals;
+    const auto & formals = args[0]->lambda().fun->formals->formals;
     auto attrs = state.buildBindings(formals.size());
     for (auto & i : formals)
         attrs.insert(i.name, state.getBool(i.def), i.pos);
@@ -3197,7 +3397,7 @@ static RegisterPrimOp primop_functionArgs({
 });
 
 /*  */
-static void prim_mapAttrs(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_mapAttrs(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[1], pos, "while evaluating the second argument passed to builtins.mapAttrs");
 
@@ -3228,7 +3428,7 @@ static RegisterPrimOp primop_mapAttrs({
     .fun = prim_mapAttrs,
 });
 
-static void prim_zipAttrsWith(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_zipAttrsWith(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     // we will first count how many values are present for each given key.
     // we then allocate a single attrset and pre-populate it with lists of
@@ -3251,7 +3451,8 @@ static void prim_zipAttrsWith(EvalState & state, const PosIdx pos, Value * * arg
     const auto listItems = args[1]->listView();
 
     for (auto & vElem : listItems) {
-        state.forceAttrs(*vElem, noPos, "while evaluating a value of the list passed as second argument to builtins.zipAttrsWith");
+        state.forceAttrs(
+            *vElem, noPos, "while evaluating a value of the list passed as second argument to builtins.zipAttrsWith");
         for (auto & attr : *vElem->attrs())
             attrsSeen.try_emplace(attr.name).first->second.size++;
     }
@@ -3314,14 +3515,12 @@ static RegisterPrimOp primop_zipAttrsWith({
     .fun = prim_zipAttrsWith,
 });
 
-
 /*************************************************************
  * Lists
  *************************************************************/
 
-
 /* Determine whether the argument is a list. */
-static void prim_isList(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_isList(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     v.mkBool(args[0]->type() == nList);
@@ -3337,16 +3536,15 @@ static RegisterPrimOp primop_isList({
 });
 
 /* Return the n-1'th element of a list. */
-static void prim_elemAt(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_elemAt(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    NixInt::Inner n = state.forceInt(*args[1], pos, "while evaluating the second argument passed to 'builtins.elemAt'").value;
+    NixInt::Inner n =
+        state.forceInt(*args[1], pos, "while evaluating the second argument passed to 'builtins.elemAt'").value;
     state.forceList(*args[0], pos, "while evaluating the first argument passed to 'builtins.elemAt'");
     if (n < 0 || std::make_unsigned_t<NixInt::Inner>(n) >= args[0]->listSize())
-        state.error<EvalError>(
-            "'builtins.elemAt' called with index %d on a list of size %d",
-            n,
-            args[0]->listSize()
-        ).atPos(pos).debugThrow();
+        state.error<EvalError>("'builtins.elemAt' called with index %d on a list of size %d", n, args[0]->listSize())
+            .atPos(pos)
+            .debugThrow();
     state.forceValue(*args[0]->listView()[n], pos);
     v = *args[0]->listView()[n];
 }
@@ -3362,13 +3560,11 @@ static RegisterPrimOp primop_elemAt({
 });
 
 /* Return the first element of a list. */
-static void prim_head(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_head(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to 'builtins.head'");
     if (args[0]->listSize() == 0)
-        state.error<EvalError>(
-            "'builtins.head' called on an empty list"
-        ).atPos(pos).debugThrow();
+        state.error<EvalError>("'builtins.head' called on an empty list").atPos(pos).debugThrow();
     state.forceValue(*args[0]->listView()[0], pos);
     v = *args[0]->listView()[0];
 }
@@ -3387,7 +3583,7 @@ static RegisterPrimOp primop_head({
 /* Return a list consisting of everything but the first element of
    a list.  Warning: this function takes O(n) time, so you probably
    don't want to use it!  */
-static void prim_tail(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_tail(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to 'builtins.tail'");
     if (args[0]->listSize() == 0)
@@ -3416,7 +3612,7 @@ static RegisterPrimOp primop_tail({
 });
 
 /* Apply a function to every element of a list. */
-static void prim_map(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_map(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.map");
 
@@ -3429,8 +3625,7 @@ static void prim_map(EvalState & state, const PosIdx pos, Value * * args, Value
 
     auto list = state.buildList(args[1]->listSize());
     for (const auto & [n, v] : enumerate(list))
-        (v = state.allocValue())->mkApp(
-            args[0], args[1]->listView()[n]);
+        (v = state.allocValue())->mkApp(args[0], args[1]->listView()[n]);
     v.mkList(list);
 }
 
@@ -3453,7 +3648,7 @@ static RegisterPrimOp primop_map({
 /* Filter a list using a predicate; that is, return a list containing
    every element from the list for which the predicate function
    returns true. */
-static void prim_filter(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_filter(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.filter");
 
@@ -3472,7 +3667,8 @@ static void prim_filter(EvalState & state, const PosIdx pos, Value * * args, Val
     for (size_t n = 0; n < len; ++n) {
         Value res;
         state.callFunction(*args[0], *args[1]->listView()[n], res, noPos);
-        if (state.forceBool(res, pos, "while evaluating the return value of the filtering function passed to builtins.filter"))
+        if (state.forceBool(
+                res, pos, "while evaluating the return value of the filtering function passed to builtins.filter"))
             vs[k++] = args[1]->listView()[n];
         else
             same = false;
@@ -3482,7 +3678,8 @@ static void prim_filter(EvalState & state, const PosIdx pos, Value * * args, Val
         v = *args[1];
     else {
         auto list = state.buildList(k);
-        for (const auto & [n, v] : enumerate(list)) v = vs[n];
+        for (const auto & [n, v] : enumerate(list))
+            v = vs[n];
         v.mkList(list);
     }
 }
@@ -3498,7 +3695,7 @@ static RegisterPrimOp primop_filter({
 });
 
 /* Return true if a list contains a given element. */
-static void prim_elem(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_elem(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     bool res = false;
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.elem");
@@ -3521,11 +3718,16 @@ static RegisterPrimOp primop_elem({
 });
 
 /* Concatenate a list of lists. */
-static void prim_concatLists(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_concatLists(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to builtins.concatLists");
     auto listView = args[0]->listView();
-    state.concatLists(v, args[0]->listSize(), listView.data(), pos, "while evaluating a value of the list passed to builtins.concatLists");
+    state.concatLists(
+        v,
+        args[0]->listSize(),
+        listView.data(),
+        pos,
+        "while evaluating a value of the list passed to builtins.concatLists");
 }
 
 static RegisterPrimOp primop_concatLists({
@@ -3538,7 +3740,7 @@ static RegisterPrimOp primop_concatLists({
 });
 
 /* Return the length of a list.  This is an O(1) time operation. */
-static void prim_length(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_length(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to builtins.length");
     v.mkInt(args[0]->listSize());
@@ -3555,7 +3757,7 @@ static RegisterPrimOp primop_length({
 
 /* Reduce a list by applying a binary operator, from left to
    right. The operator is applied strictly. */
-static void prim_foldlStrict(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_foldlStrict(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.foldlStrict");
     state.forceList(*args[2], pos, "while evaluating the third argument passed to builtins.foldlStrict");
@@ -3565,7 +3767,7 @@ static void prim_foldlStrict(EvalState & state, const PosIdx pos, Value * * args
 
         auto listView = args[2]->listView();
         for (auto [n, elem] : enumerate(listView)) {
-            Value * vs []{vCur, elem};
+            Value * vs[]{vCur, elem};
             vCur = n == args[2]->listSize() - 1 ? &v : state.allocValue();
             state.callFunction(*args[0], vs, *vCur, pos);
         }
@@ -3596,14 +3798,15 @@ static RegisterPrimOp primop_foldlStrict({
     .fun = prim_foldlStrict,
 });
 
-static void anyOrAll(bool any, EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void anyOrAll(bool any, EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    state.forceFunction(*args[0], pos, std::string("while evaluating the first argument passed to builtins.") + (any ? "any" : "all"));
-    state.forceList(*args[1], pos, std::string("while evaluating the second argument passed to builtins.") + (any ? "any" : "all"));
+    state.forceFunction(
+        *args[0], pos, std::string("while evaluating the first argument passed to builtins.") + (any ? "any" : "all"));
+    state.forceList(
+        *args[1], pos, std::string("while evaluating the second argument passed to builtins.") + (any ? "any" : "all"));
 
-    std::string_view errorCtx = any
-        ? "while evaluating the return value of the function passed to builtins.any"
-        : "while evaluating the return value of the function passed to builtins.all";
+    std::string_view errorCtx = any ? "while evaluating the return value of the function passed to builtins.any"
+                                    : "while evaluating the return value of the function passed to builtins.all";
 
     Value vTmp;
     for (auto elem : args[1]->listView()) {
@@ -3618,8 +3821,7 @@ static void anyOrAll(bool any, EvalState & state, const PosIdx pos, Value * * ar
     v.mkBool(!any);
 }
 
-
-static void prim_any(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_any(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     anyOrAll(true, state, pos, args, v);
 }
@@ -3634,7 +3836,7 @@ static RegisterPrimOp primop_any({
     .fun = prim_any,
 });
 
-static void prim_all(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_all(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     anyOrAll(false, state, pos, args, v);
 }
@@ -3649,7 +3851,7 @@ static RegisterPrimOp primop_all({
     .fun = prim_all,
 });
 
-static void prim_genList(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_genList(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto len_ = state.forceInt(*args[1], pos, "while evaluating the second argument passed to builtins.genList").value;
 
@@ -3687,10 +3889,9 @@ static RegisterPrimOp primop_genList({
     .fun = prim_genList,
 });
 
-static void prim_lessThan(EvalState & state, const PosIdx pos, Value * * args, Value & v);
+static void prim_lessThan(EvalState & state, const PosIdx pos, Value ** args, Value & v);
 
-
-static void prim_sort(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_sort(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.sort");
 
@@ -3712,13 +3913,15 @@ static void prim_sort(EvalState & state, const PosIdx pos, Value * * args, Value
         if (args[0]->isPrimOp()) {
             auto ptr = args[0]->primOp()->fun.target<decltype(&prim_lessThan)>();
             if (ptr && *ptr == prim_lessThan)
-                return CompareValues(state, noPos, "while evaluating the ordering function passed to builtins.sort")(a, b);
+                return CompareValues(state, noPos, "while evaluating the ordering function passed to builtins.sort")(
+                    a, b);
         }
 
         Value * vs[] = {a, b};
         Value vBool;
         state.callFunction(*args[0], vs, vBool, noPos);
-        return state.forceBool(vBool, pos, "while evaluating the return value of the sorting function passed to builtins.sort");
+        return state.forceBool(
+            vBool, pos, "while evaluating the return value of the sorting function passed to builtins.sort");
     };
 
     /* NOTE: Using custom implementation because std::sort and std::stable_sort
@@ -3780,7 +3983,7 @@ static RegisterPrimOp primop_sort({
     .fun = prim_sort,
 });
 
-static void prim_partition(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_partition(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.partition");
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.partition");
@@ -3794,7 +3997,8 @@ static void prim_partition(EvalState & state, const PosIdx pos, Value * * args,
         state.forceValue(*vElem, pos);
         Value res;
         state.callFunction(*args[0], *vElem, res, pos);
-        if (state.forceBool(res, pos, "while evaluating the return value of the partition function passed to builtins.partition"))
+        if (state.forceBool(
+                res, pos, "while evaluating the return value of the partition function passed to builtins.partition"))
             right.push_back(vElem);
         else
             wrong.push_back(vElem);
@@ -3806,13 +4010,13 @@ static void prim_partition(EvalState & state, const PosIdx pos, Value * * args,
     auto rlist = state.buildList(rsize);
     if (rsize)
         memcpy(rlist.elems, right.data(), sizeof(Value *) * rsize);
-    attrs.alloc(state.sRight).mkList(rlist);
+    attrs.alloc(state.s.right).mkList(rlist);
 
     auto wsize = wrong.size();
     auto wlist = state.buildList(wsize);
     if (wsize)
         memcpy(wlist.elems, wrong.data(), sizeof(Value *) * wsize);
-    attrs.alloc(state.sWrong).mkList(wlist);
+    attrs.alloc(state.s.wrong).mkList(wlist);
 
     v.mkAttrs(attrs);
 }
@@ -3840,7 +4044,7 @@ static RegisterPrimOp primop_partition({
     .fun = prim_partition,
 });
 
-static void prim_groupBy(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_groupBy(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.groupBy");
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.groupBy");
@@ -3850,9 +4054,10 @@ static void prim_groupBy(EvalState & state, const PosIdx pos, Value * * args, Va
     for (auto vElem : args[1]->listView()) {
         Value res;
         state.callFunction(*args[0], *vElem, res, pos);
-        auto name = state.forceStringNoCtx(res, pos, "while evaluating the return value of the grouping function passed to builtins.groupBy");
+        auto name = state.forceStringNoCtx(
+            res, pos, "while evaluating the return value of the grouping function passed to builtins.groupBy");
         auto sym = state.symbols.create(name);
-        auto vector = attrs.try_emplace(sym, ValueVector()).first;
+        auto vector = attrs.try_emplace<ValueVector>(sym, {}).first;
         vector->second.push_back(vElem);
     }
 
@@ -3892,7 +4097,7 @@ static RegisterPrimOp primop_groupBy({
     .fun = prim_groupBy,
 });
 
-static void prim_concatMap(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_concatMap(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.concatMap");
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.concatMap");
@@ -3905,7 +4110,10 @@ static void prim_concatMap(EvalState & state, const PosIdx pos, Value * * args,
     for (size_t n = 0; n < nrLists; ++n) {
         Value * vElem = args[1]->listView()[n];
         state.callFunction(*args[0], *vElem, lists[n], pos);
-        state.forceList(lists[n], lists[n].determinePos(args[0]->determinePos(pos)), "while evaluating the return value of the function passed to builtins.concatMap");
+        state.forceList(
+            lists[n],
+            lists[n].determinePos(args[0]->determinePos(pos)),
+            "while evaluating the return value of the function passed to builtins.concatMap");
         len += lists[n].listSize();
     }
 
@@ -3931,19 +4139,18 @@ static RegisterPrimOp primop_concatMap({
     .fun = prim_concatMap,
 });
 
-
 /*************************************************************
  * Integer arithmetic
  *************************************************************/
 
-
-static void prim_add(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_add(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     state.forceValue(*args[1], pos);
     if (args[0]->type() == nFloat || args[1]->type() == nFloat)
-        v.mkFloat(state.forceFloat(*args[0], pos, "while evaluating the first argument of the addition")
-                + state.forceFloat(*args[1], pos, "while evaluating the second argument of the addition"));
+        v.mkFloat(
+            state.forceFloat(*args[0], pos, "while evaluating the first argument of the addition")
+            + state.forceFloat(*args[1], pos, "while evaluating the second argument of the addition"));
     else {
         auto i1 = state.forceInt(*args[0], pos, "while evaluating the first argument of the addition");
         auto i2 = state.forceInt(*args[1], pos, "while evaluating the second argument of the addition");
@@ -3966,13 +4173,14 @@ static RegisterPrimOp primop_add({
     .fun = prim_add,
 });
 
-static void prim_sub(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_sub(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     state.forceValue(*args[1], pos);
     if (args[0]->type() == nFloat || args[1]->type() == nFloat)
-        v.mkFloat(state.forceFloat(*args[0], pos, "while evaluating the first argument of the subtraction")
-                - state.forceFloat(*args[1], pos, "while evaluating the second argument of the subtraction"));
+        v.mkFloat(
+            state.forceFloat(*args[0], pos, "while evaluating the first argument of the subtraction")
+            - state.forceFloat(*args[1], pos, "while evaluating the second argument of the subtraction"));
     else {
         auto i1 = state.forceInt(*args[0], pos, "while evaluating the first argument of the subtraction");
         auto i2 = state.forceInt(*args[1], pos, "while evaluating the second argument of the subtraction");
@@ -3996,13 +4204,14 @@ static RegisterPrimOp primop_sub({
     .fun = prim_sub,
 });
 
-static void prim_mul(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_mul(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     state.forceValue(*args[1], pos);
     if (args[0]->type() == nFloat || args[1]->type() == nFloat)
-        v.mkFloat(state.forceFloat(*args[0], pos, "while evaluating the first of the multiplication")
-                * state.forceFloat(*args[1], pos, "while evaluating the second argument of the multiplication"));
+        v.mkFloat(
+            state.forceFloat(*args[0], pos, "while evaluating the first of the multiplication")
+            * state.forceFloat(*args[1], pos, "while evaluating the second argument of the multiplication"));
     else {
         auto i1 = state.forceInt(*args[0], pos, "while evaluating the first argument of the multiplication");
         auto i2 = state.forceInt(*args[1], pos, "while evaluating the second argument of the multiplication");
@@ -4026,7 +4235,7 @@ static RegisterPrimOp primop_mul({
     .fun = prim_mul,
 });
 
-static void prim_div(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_div(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     state.forceValue(*args[1], pos);
@@ -4059,7 +4268,7 @@ static RegisterPrimOp primop_div({
     .fun = prim_div,
 });
 
-static void prim_bitAnd(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_bitAnd(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto i1 = state.forceInt(*args[0], pos, "while evaluating the first argument passed to builtins.bitAnd");
     auto i2 = state.forceInt(*args[1], pos, "while evaluating the second argument passed to builtins.bitAnd");
@@ -4075,7 +4284,7 @@ static RegisterPrimOp primop_bitAnd({
     .fun = prim_bitAnd,
 });
 
-static void prim_bitOr(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_bitOr(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto i1 = state.forceInt(*args[0], pos, "while evaluating the first argument passed to builtins.bitOr");
     auto i2 = state.forceInt(*args[1], pos, "while evaluating the second argument passed to builtins.bitOr");
@@ -4092,7 +4301,7 @@ static RegisterPrimOp primop_bitOr({
     .fun = prim_bitOr,
 });
 
-static void prim_bitXor(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_bitXor(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto i1 = state.forceInt(*args[0], pos, "while evaluating the first argument passed to builtins.bitXor");
     auto i2 = state.forceInt(*args[1], pos, "while evaluating the second argument passed to builtins.bitXor");
@@ -4109,7 +4318,7 @@ static RegisterPrimOp primop_bitXor({
     .fun = prim_bitXor,
 });
 
-static void prim_lessThan(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_lessThan(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceValue(*args[0], pos);
     state.forceValue(*args[1], pos);
@@ -4122,28 +4331,25 @@ static RegisterPrimOp primop_lessThan({
     .name = "__lessThan",
     .args = {"e1", "e2"},
     .doc = R"(
-      Return `true` if the number *e1* is less than the number *e2*, and
-      `false` otherwise. Evaluation aborts if either *e1* or *e2* does not
-      evaluate to a number.
+      Return `true` if the value *e1* is less than the value *e2*, and `false` otherwise.
+      Evaluation aborts if either *e1* or *e2* does not evaluate to a number, string or path.
+      Furthermore, it aborts if *e2* does not match *e1*'s type according to the aforementioned classification of number, string or path.
     )",
     .fun = prim_lessThan,
 });
 
-
 /*************************************************************
  * String manipulation
  *************************************************************/
 
-
 /* Convert the argument to a string.  Paths are *not* copied to the
    store, so `toString /foo/bar' yields `"/foo/bar"', not
    `"/nix/store/whatever..."'. */
-static void prim_toString(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_toString(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto s = state.coerceToString(pos, *args[0], context,
-            "while evaluating the first argument passed to builtins.toString",
-            true, false);
+    auto s = state.coerceToString(
+        pos, *args[0], context, "while evaluating the first argument passed to builtins.toString", true, false);
     v.mkString(*s, context);
 }
 
@@ -4175,15 +4381,25 @@ static RegisterPrimOp primop_toString({
    at byte position `min(start, stringLength str)' inclusive and
    ending at `min(start + len, stringLength str)'.  `start' must be
    non-negative. */
-static void prim_substring(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_substring(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     using NixUInt = std::make_unsigned_t<NixInt::Inner>;
-    NixInt::Inner start = state.forceInt(*args[0], pos, "while evaluating the first argument (the start offset) passed to builtins.substring").value;
+    NixInt::Inner start =
+        state
+            .forceInt(
+                *args[0], pos, "while evaluating the first argument (the start offset) passed to builtins.substring")
+            .value;
 
     if (start < 0)
         state.error<EvalError>("negative start position in 'substring'").atPos(pos).debugThrow();
 
-    NixInt::Inner len = state.forceInt(*args[1], pos, "while evaluating the second argument (the substring length) passed to builtins.substring").value;
+    NixInt::Inner len =
+        state
+            .forceInt(
+                *args[1],
+                pos,
+                "while evaluating the second argument (the substring length) passed to builtins.substring")
+            .value;
 
     // Negative length may be idiomatically passed to builtins.substring to get
     // the tail of the string.
@@ -4194,7 +4410,7 @@ static void prim_substring(EvalState & state, const PosIdx pos, Value * * args,
     if (len == 0) {
         state.forceValue(*args[2], pos);
         if (args[2]->type() == nString) {
-            v.mkString("", args[2]->context());
+            v.mkStringNoCopy("", args[2]->context());
             return;
         }
     }
@@ -4204,7 +4420,8 @@ static void prim_substring(EvalState & state, const PosIdx pos, Value * * args,
     }
 
     NixStringContext context;
-    auto s = state.coerceToString(pos, *args[2], context, "while evaluating the third argument (the string) passed to builtins.substring");
+    auto s = state.coerceToString(
+        pos, *args[2], context, "while evaluating the third argument (the string) passed to builtins.substring");
 
     v.mkString(NixUInt(start) >= s->size() ? "" : s->substr(start, _len), context);
 }
@@ -4230,10 +4447,11 @@ static RegisterPrimOp primop_substring({
     .fun = prim_substring,
 });
 
-static void prim_stringLength(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_stringLength(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto s = state.coerceToString(pos, *args[0], context, "while evaluating the argument passed to builtins.stringLength");
+    auto s =
+        state.coerceToString(pos, *args[0], context, "while evaluating the argument passed to builtins.stringLength");
     v.mkInt(NixInt::Inner(s->size()));
 }
 
@@ -4248,15 +4466,17 @@ static RegisterPrimOp primop_stringLength({
 });
 
 /* Return the cryptographic hash of a string in base-16. */
-static void prim_hashString(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_hashString(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto algo = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.hashString");
+    auto algo =
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.hashString");
     std::optional<HashAlgorithm> ha = parseHashAlgo(algo);
     if (!ha)
         state.error<EvalError>("unknown hash algorithm '%1%'", algo).atPos(pos).debugThrow();
 
     NixStringContext context; // discarded
-    auto s = state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.hashString");
+    auto s =
+        state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.hashString");
 
     v.mkString(hashString(*ha, s).to_string(HashFormat::Base16, false));
 }
@@ -4272,7 +4492,7 @@ static RegisterPrimOp primop_hashString({
     .fun = prim_hashString,
 });
 
-static void prim_convertHash(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_convertHash(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], pos, "while evaluating the first argument passed to builtins.convertHash");
     auto inputAttrs = args[0]->attrs();
@@ -4283,10 +4503,13 @@ static void prim_convertHash(EvalState & state, const PosIdx pos, Value * * args
     auto iteratorHashAlgo = inputAttrs->get(state.symbols.create("hashAlgo"));
     std::optional<HashAlgorithm> ha = std::nullopt;
     if (iteratorHashAlgo)
-        ha = parseHashAlgo(state.forceStringNoCtx(*iteratorHashAlgo->value, pos, "while evaluating the attribute 'hashAlgo'"));
+        ha = parseHashAlgo(
+            state.forceStringNoCtx(*iteratorHashAlgo->value, pos, "while evaluating the attribute 'hashAlgo'"));
 
-    auto iteratorToHashFormat = state.getAttr(state.symbols.create("toHashFormat"), args[0]->attrs(), "while locating the attribute 'toHashFormat'");
-    HashFormat hf = parseHashFormat(state.forceStringNoCtx(*iteratorToHashFormat->value, pos, "while evaluating the attribute 'toHashFormat'"));
+    auto iteratorToHashFormat = state.getAttr(
+        state.symbols.create("toHashFormat"), args[0]->attrs(), "while locating the attribute 'toHashFormat'");
+    HashFormat hf = parseHashFormat(
+        state.forceStringNoCtx(*iteratorToHashFormat->value, pos, "while evaluating the attribute 'toHashFormat'"));
 
     v.mkString(Hash::parseAny(hash, ha).to_string(hf, hf == HashFormat::SRI));
 }
@@ -4369,27 +4592,21 @@ static RegisterPrimOp primop_convertHash({
 
 struct RegexCache
 {
-    struct State
-    {
-        std::unordered_map<std::string, std::regex, StringViewHash, std::equal_to<>> cache;
-    };
-
-    Sync<State> state_;
+    boost::concurrent_flat_map<std::string, std::regex, StringViewHash, std::equal_to<>> cache;
 
     std::regex get(std::string_view re)
     {
-        auto state(state_.lock());
-        auto it = state->cache.find(re);
-        if (it != state->cache.end())
-            return it->second;
+        std::regex regex;
         /* No std::regex constructor overload from std::string_view, but can be constructed
            from a pointer + size or an iterator range. */
-        return state->cache
-            .emplace(
-                std::piecewise_construct,
-                std::forward_as_tuple(re),
-                std::forward_as_tuple(/*s=*/re.data(), /*count=*/re.size(), std::regex::extended))
-            .first->second;
+        cache.try_emplace_and_cvisit(
+            re,
+            /*s=*/re.data(),
+            /*count=*/re.size(),
+            std::regex::extended,
+            [&regex](const auto & kv) { regex = kv.second; },
+            [&regex](const auto & kv) { regex = kv.second; });
+        return regex;
     }
 };
 
@@ -4398,7 +4615,7 @@ std::shared_ptr<RegexCache> makeRegexCache()
     return std::make_shared<RegexCache>();
 }
 
-void prim_match(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+void prim_match(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto re = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.match");
 
@@ -4407,7 +4624,8 @@ void prim_match(EvalState & state, const PosIdx pos, Value * * args, Value & v)
         auto regex = state.regexCache->get(re);
 
         NixStringContext context;
-        const auto str = state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.match");
+        const auto str =
+            state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.match");
 
         std::cmatch match;
         if (!std::regex_match(str.begin(), str.end(), match, regex)) {
@@ -4419,7 +4637,7 @@ void prim_match(EvalState & state, const PosIdx pos, Value * * args, Value & v)
         auto list = state.buildList(match.size() - 1);
         for (const auto & [i, v2] : enumerate(list))
             if (!match[i + 1].matched)
-                v2 = &state.vNull;
+                v2 = &Value::vNull;
             else
                 v2 = mkString(state, match[i + 1]);
         v.mkList(list);
@@ -4427,13 +4645,9 @@ void prim_match(EvalState & state, const PosIdx pos, Value * * args, Value & v)
     } catch (std::regex_error & e) {
         if (e.code() == std::regex_constants::error_space) {
             // limit is _GLIBCXX_REGEX_STATE_LIMIT for libstdc++
-            state.error<EvalError>("memory limit exceeded by regular expression '%s'", re)
-                .atPos(pos)
-                .debugThrow();
+            state.error<EvalError>("memory limit exceeded by regular expression '%s'", re).atPos(pos).debugThrow();
         } else
-            state.error<EvalError>("invalid regular expression '%s'", re)
-                .atPos(pos)
-                .debugThrow();
+            state.error<EvalError>("invalid regular expression '%s'", re).atPos(pos).debugThrow();
     }
 }
 
@@ -4475,7 +4689,7 @@ static RegisterPrimOp primop_match({
 
 /* Split a string with a regular expression, and return a list of the
    non-matching parts interleaved by the lists of the matching groups. */
-void prim_split(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+void prim_split(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     auto re = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.split");
 
@@ -4484,7 +4698,8 @@ void prim_split(EvalState & state, const PosIdx pos, Value * * args, Value & v)
         auto regex = state.regexCache->get(re);
 
         NixStringContext context;
-        const auto str = state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.split");
+        const auto str =
+            state.forceString(*args[1], context, pos, "while evaluating the second argument passed to builtins.split");
 
         auto begin = std::cregex_iterator(str.begin(), str.end(), regex);
         auto end = std::cregex_iterator();
@@ -4514,7 +4729,7 @@ void prim_split(EvalState & state, const PosIdx pos, Value * * args, Value & v)
             auto list2 = state.buildList(slen);
             for (const auto & [si, v2] : enumerate(list2)) {
                 if (!match[si + 1].matched)
-                    v2 = &state.vNull;
+                    v2 = &Value::vNull;
                 else
                     v2 = mkString(state, match[si + 1]);
             }
@@ -4533,13 +4748,9 @@ void prim_split(EvalState & state, const PosIdx pos, Value * * args, Value & v)
     } catch (std::regex_error & e) {
         if (e.code() == std::regex_constants::error_space) {
             // limit is _GLIBCXX_REGEX_STATE_LIMIT for libstdc++
-            state.error<EvalError>("memory limit exceeded by regular expression '%s'", re)
-                .atPos(pos)
-                .debugThrow();
+            state.error<EvalError>("memory limit exceeded by regular expression '%s'", re).atPos(pos).debugThrow();
         } else
-            state.error<EvalError>("invalid regular expression '%s'", re)
-                .atPos(pos)
-                .debugThrow();
+            state.error<EvalError>("invalid regular expression '%s'", re).atPos(pos).debugThrow();
     }
 }
 
@@ -4580,20 +4791,34 @@ static RegisterPrimOp primop_split({
     .fun = prim_split,
 });
 
-static void prim_concatStringsSep(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_concatStringsSep(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
 
-    auto sep = state.forceString(*args[0], context, pos, "while evaluating the first argument (the separator string) passed to builtins.concatStringsSep");
-    state.forceList(*args[1], pos, "while evaluating the second argument (the list of strings to concat) passed to builtins.concatStringsSep");
+    auto sep = state.forceString(
+        *args[0],
+        context,
+        pos,
+        "while evaluating the first argument (the separator string) passed to builtins.concatStringsSep");
+    state.forceList(
+        *args[1],
+        pos,
+        "while evaluating the second argument (the list of strings to concat) passed to builtins.concatStringsSep");
 
     std::string res;
     res.reserve((args[1]->listSize() + 32) * sep.size());
     bool first = true;
 
     for (auto elem : args[1]->listView()) {
-        if (first) first = false; else res += sep;
-        res += *state.coerceToString(pos, *elem, context, "while evaluating one element of the list of strings to concat passed to builtins.concatStringsSep");
+        if (first)
+            first = false;
+        else
+            res += sep;
+        res += *state.coerceToString(
+            pos,
+            *elem,
+            context,
+            "while evaluating one element of the list of strings to concat passed to builtins.concatStringsSep");
     }
 
     v.mkString(res, context);
@@ -4610,29 +4835,31 @@ static RegisterPrimOp primop_concatStringsSep({
     .fun = prim_concatStringsSep,
 });
 
-static void prim_replaceStrings(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_replaceStrings(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to builtins.replaceStrings");
     state.forceList(*args[1], pos, "while evaluating the second argument passed to builtins.replaceStrings");
     if (args[0]->listSize() != args[1]->listSize())
-        state.error<EvalError>(
-            "'from' and 'to' arguments passed to builtins.replaceStrings have different lengths"
-        ).atPos(pos).debugThrow();
+        state.error<EvalError>("'from' and 'to' arguments passed to builtins.replaceStrings have different lengths")
+            .atPos(pos)
+            .debugThrow();
 
     std::vector<std::string_view> from;
     from.reserve(args[0]->listSize());
     for (auto elem : args[0]->listView())
-        from.emplace_back(state.forceString(*elem, pos, "while evaluating one of the strings to replace passed to builtins.replaceStrings"));
+        from.emplace_back(state.forceString(
+            *elem, pos, "while evaluating one of the strings to replace passed to builtins.replaceStrings"));
 
-    std::unordered_map<size_t, std::string_view> cache;
+    boost::unordered_flat_map<size_t, std::string_view> cache;
     auto to = args[1]->listView();
 
     NixStringContext context;
-    auto s = state.forceString(*args[2], context, pos, "while evaluating the third argument passed to builtins.replaceStrings");
+    auto s = state.forceString(
+        *args[2], context, pos, "while evaluating the third argument passed to builtins.replaceStrings");
 
     std::string res;
     // Loops one past last character to handle the case where 'from' contains an empty string.
-    for (size_t p = 0; p <= s.size(); ) {
+    for (size_t p = 0; p <= s.size();) {
         bool found = false;
         auto i = from.begin();
         auto j = to.begin();
@@ -4643,9 +4870,13 @@ static void prim_replaceStrings(EvalState & state, const PosIdx pos, Value * * a
                 auto v = cache.find(j_index);
                 if (v == cache.end()) {
                     NixStringContext ctx;
-                    auto ts = state.forceString(**j, ctx, pos, "while evaluating one of the replacement strings passed to builtins.replaceStrings");
+                    auto ts = state.forceString(
+                        **j,
+                        ctx,
+                        pos,
+                        "while evaluating one of the replacement strings passed to builtins.replaceStrings");
                     v = (cache.emplace(j_index, ts)).first;
-                    for (auto& path : ctx)
+                    for (auto & path : ctx)
                         context.insert(path);
                 }
                 res += v->second;
@@ -4688,18 +4919,17 @@ static RegisterPrimOp primop_replaceStrings({
     .fun = prim_replaceStrings,
 });
 
-
 /*************************************************************
  * Versions
  *************************************************************/
 
-
-static void prim_parseDrvName(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_parseDrvName(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto name = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.parseDrvName");
+    auto name =
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.parseDrvName");
     DrvName parsed(name);
     auto attrs = state.buildBindings(2);
-    attrs.alloc(state.sName).mkString(parsed.name);
+    attrs.alloc(state.s.name).mkString(parsed.name);
     attrs.alloc("version").mkString(parsed.version);
     v.mkAttrs(attrs);
 }
@@ -4718,10 +4948,12 @@ static RegisterPrimOp primop_parseDrvName({
     .fun = prim_parseDrvName,
 });
 
-static void prim_compareVersions(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_compareVersions(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto version1 = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.compareVersions");
-    auto version2 = state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument passed to builtins.compareVersions");
+    auto version1 =
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.compareVersions");
+    auto version2 = state.forceStringNoCtx(
+        *args[1], pos, "while evaluating the second argument passed to builtins.compareVersions");
     auto result = compareVersions(version1, version2);
     v.mkInt(result < 0 ? -1 : result > 0 ? 1 : 0);
 }
@@ -4739,9 +4971,10 @@ static RegisterPrimOp primop_compareVersions({
     .fun = prim_compareVersions,
 });
 
-static void prim_splitVersion(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_splitVersion(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    auto version = state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.splitVersion");
+    auto version =
+        state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.splitVersion");
     auto iter = version.cbegin();
     Strings components;
     while (iter != version.cend()) {
@@ -4767,18 +5000,15 @@ static RegisterPrimOp primop_splitVersion({
     .fun = prim_splitVersion,
 });
 
-
 /*************************************************************
  * Primop registration
  *************************************************************/
 
-
 RegisterPrimOp::RegisterPrimOp(PrimOp && primOp)
 {
     primOps().push_back(std::move(primOp));
 }
 
-
 void EvalState::createBaseEnv(const EvalSettings & evalSettings)
 {
     baseEnv.up = 0;
@@ -4788,9 +5018,12 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
 
     /* `builtins' must be first! */
     v.mkAttrs(buildBindings(128).finish());
-    addConstant("builtins", v, {
-        .type = nAttrs,
-        .doc = R"(
+    addConstant(
+        "builtins",
+        v,
+        {
+            .type = nAttrs,
+            .doc = R"(
           Contains all the built-in functions and values.
 
           Since built-in functions were added over time, [testing for attributes](./operators.md#has-attribute) in `builtins` can be used for graceful fallback on older Nix installations:
@@ -4800,12 +5033,15 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           if builtins ? hasContext then builtins.hasContext s else true
           ```
         )",
-    });
+        });
 
     v.mkBool(true);
-    addConstant("true", v, {
-        .type = nBool,
-        .doc = R"(
+    addConstant(
+        "true",
+        v,
+        {
+            .type = nBool,
+            .doc = R"(
           Primitive value.
 
           It can be returned by
@@ -4820,12 +5056,15 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           1
           ```
         )",
-    });
+        });
 
     v.mkBool(false);
-    addConstant("false", v, {
-        .type = nBool,
-        .doc = R"(
+    addConstant(
+        "false",
+        v,
+        {
+            .type = nBool,
+            .doc = R"(
           Primitive value.
 
           It can be returned by
@@ -4840,11 +5079,14 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           1
           ```
         )",
-    });
+        });
 
-    addConstant("null", &vNull, {
-        .type = nNull,
-        .doc = R"(
+    addConstant(
+        "null",
+        &Value::vNull,
+        {
+            .type = nNull,
+            .doc = R"(
           Primitive value.
 
           The name `null` is not special, and can be shadowed:
@@ -4854,14 +5096,17 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           1
           ```
         )",
-    });
+        });
 
     if (!settings.pureEval) {
         v.mkInt(time(0));
     }
-    addConstant("__currentTime", v, {
-        .type = nInt,
-        .doc = R"(
+    addConstant(
+        "__currentTime",
+        v,
+        {
+            .type = nInt,
+            .doc = R"(
           Return the [Unix time](https://en.wikipedia.org/wiki/Unix_time) at first evaluation.
           Repeated references to that name re-use the initially obtained value.
 
@@ -4880,14 +5125,17 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
 
           The [store path](@docroot@/store/store-path.md) of a derivation depending on `currentTime` differs for each evaluation, unless both evaluate `builtins.currentTime` in the same second.
         )",
-        .impureOnly = true,
-    });
+            .impureOnly = true,
+        });
 
     if (!settings.pureEval)
         v.mkString(settings.getCurrentSystem());
-    addConstant("__currentSystem", v, {
-        .type = nString,
-        .doc = R"(
+    addConstant(
+        "__currentSystem",
+        v,
+        {
+            .type = nString,
+            .doc = R"(
           The value of the
           [`eval-system`](@docroot@/command-ref/conf-file.md#conf-eval-system)
           or else
@@ -4910,13 +5158,16 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           "mips64-linux"
           ```
         )",
-        .impureOnly = true,
-    });
+            .impureOnly = true,
+        });
 
     v.mkString(nixVersion);
-    addConstant("__nixVersion", v, {
-        .type = nString,
-        .doc = R"(
+    addConstant(
+        "__nixVersion",
+        v,
+        {
+            .type = nString,
+            .doc = R"(
           The version of Nix.
 
           For example, where the command line returns the current Nix version,
@@ -4933,12 +5184,15 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           "2.16.0"
           ```
         )",
-    });
+        });
 
     v.mkString(store->storeDir);
-    addConstant("__storeDir", v, {
-        .type = nString,
-        .doc = R"(
+    addConstant(
+        "__storeDir",
+        v,
+        {
+            .type = nString,
+            .doc = R"(
           Logical file system location of the [Nix store](@docroot@/glossary.md#gloss-store) currently in use.
 
           This value is determined by the `store` parameter in [Store URLs](@docroot@/store/types/index.md#store-url-format):
@@ -4948,19 +5202,22 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           "/blah"
           ```
         )",
-    });
+        });
 
     /* Language version.  This should be increased every time a new
        language feature gets added.  It's not necessary to increase it
        when primops get added, because you can just use `builtins ?
        primOp' to check. */
     v.mkInt(6);
-    addConstant("__langVersion", v, {
-        .type = nInt,
-        .doc = R"(
+    addConstant(
+        "__langVersion",
+        v,
+        {
+            .type = nInt,
+            .doc = R"(
           The current version of the Nix language.
         )",
-    });
+        });
 
 #ifndef _WIN32 // TODO implement on Windows
     // Miscellaneous
@@ -4980,7 +5237,7 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
 
     addPrimOp({
         .name = "__traceVerbose",
-        .args = { "e1", "e2" },
+        .args = {"e1", "e2"},
         .arity = 2,
         .doc = R"(
           Evaluate *e1* and print its abstract syntax representation on standard
@@ -4999,9 +5256,12 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
         (list[n] = allocValue())->mkAttrs(attrs);
     }
     v.mkList(list);
-    addConstant("__nixPath", v, {
-        .type = nList,
-        .doc = R"(
+    addConstant(
+        "__nixPath",
+        v,
+        {
+            .type = nList,
+            .doc = R"(
           A list of search path entries used to resolve [lookup paths](@docroot@/language/constructs/lookup-path.md).
           Its value is primarily determined by the [`nix-path` configuration setting](@docroot@/command-ref/conf-file.md#conf-nix-path), which are
           - Overridden by the [`NIX_PATH`](@docroot@/command-ref/env-common.md#env-NIX_PATH) environment variable or the `--nix-path` option
@@ -5027,7 +5287,7 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
           builtins.findFile builtins.nixPath "nixpkgs"
           ```
         )",
-    });
+        });
 
     for (auto & primOp : RegisterPrimOp::primOps())
         if (experimentalFeatureSettings.isEnabled(primOp.experimentalFeature)) {
@@ -5048,9 +5308,12 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
        Null docs because it is documented separately.
        */
     auto vDerivation = allocValue();
-    addConstant("derivation", vDerivation, {
-        .type = nFunction,
-    });
+    addConstant(
+        "derivation",
+        vDerivation,
+        {
+            .type = nFunction,
+        });
 
     /* Now that we've added all primops, sort the `builtins' set,
        because attribute lookups expect it to be sorted. */
@@ -5063,5 +5326,4 @@ void EvalState::createBaseEnv(const EvalSettings & evalSettings)
     evalFile(derivationInternal, *vDerivation);
 }
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index 56962d6a8..12b8ffdf9 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -2,13 +2,15 @@
 #include "nix/expr/eval-inline.hh"
 #include "nix/store/derivations.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
-static void prim_unsafeDiscardStringContext(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_unsafeDiscardStringContext(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto s = state.coerceToString(pos, *args[0], context, "while evaluating the argument passed to builtins.unsafeDiscardStringContext");
+    auto s = state.coerceToString(
+        pos, *args[0], context, "while evaluating the argument passed to builtins.unsafeDiscardStringContext");
     v.mkString(*s);
 }
 
@@ -21,18 +23,17 @@ static RegisterPrimOp primop_unsafeDiscardStringContext({
     .fun = prim_unsafeDiscardStringContext,
 });
 
-
-static void prim_hasContext(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_hasContext(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
     state.forceString(*args[0], context, pos, "while evaluating the argument passed to builtins.hasContext");
     v.mkBool(!context.empty());
 }
 
-static RegisterPrimOp primop_hasContext({
-    .name = "__hasContext",
-    .args = {"s"},
-    .doc = R"(
+static RegisterPrimOp primop_hasContext(
+    {.name = "__hasContext",
+     .args = {"s"},
+     .doc = R"(
       Return `true` if string *s* has a non-empty context.
       The context can be obtained with
       [`getContext`](#builtins-getContext).
@@ -50,21 +51,18 @@ static RegisterPrimOp primop_hasContext({
       > else { ${name} = meta; }
       > ```
     )",
-    .fun = prim_hasContext
-});
+     .fun = prim_hasContext});
 
-
-static void prim_unsafeDiscardOutputDependency(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_unsafeDiscardOutputDependency(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto s = state.coerceToString(pos, *args[0], context, "while evaluating the argument passed to builtins.unsafeDiscardOutputDependency");
+    auto s = state.coerceToString(
+        pos, *args[0], context, "while evaluating the argument passed to builtins.unsafeDiscardOutputDependency");
 
     NixStringContext context2;
     for (auto && c : context) {
         if (auto * ptr = std::get_if<NixStringContextElem::DrvDeep>(&c.raw)) {
-            context2.emplace(NixStringContextElem::Opaque {
-                .path = ptr->drvPath
-            });
+            context2.emplace(NixStringContextElem::Opaque{.path = ptr->drvPath});
         } else {
             /* Can reuse original item */
             context2.emplace(std::move(c).raw);
@@ -74,10 +72,10 @@ static void prim_unsafeDiscardOutputDependency(EvalState & state, const PosIdx p
     v.mkString(*s, context2);
 }
 
-static RegisterPrimOp primop_unsafeDiscardOutputDependency({
-    .name = "__unsafeDiscardOutputDependency",
-    .args = {"s"},
-    .doc = R"(
+static RegisterPrimOp primop_unsafeDiscardOutputDependency(
+    {.name = "__unsafeDiscardOutputDependency",
+     .args = {"s"},
+     .doc = R"(
       Create a copy of the given string where every
       [derivation deep](@docroot@/language/string-context.md#string-context-element-derivation-deep)
       string context element is turned into a
@@ -94,58 +92,58 @@ static RegisterPrimOp primop_unsafeDiscardOutputDependency({
 
       [`builtins.addDrvOutputDependencies`]: #builtins-addDrvOutputDependencies
     )",
-    .fun = prim_unsafeDiscardOutputDependency
-});
+     .fun = prim_unsafeDiscardOutputDependency});
 
-
-static void prim_addDrvOutputDependencies(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_addDrvOutputDependencies(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto s = state.coerceToString(pos, *args[0], context, "while evaluating the argument passed to builtins.addDrvOutputDependencies");
+    auto s = state.coerceToString(
+        pos, *args[0], context, "while evaluating the argument passed to builtins.addDrvOutputDependencies");
 
-	auto contextSize = context.size();
+    auto contextSize = context.size();
     if (contextSize != 1) {
-        state.error<EvalError>(
-            "context of string '%s' must have exactly one element, but has %d",
-            *s,
-            contextSize
-        ).atPos(pos).debugThrow();
+        state.error<EvalError>("context of string '%s' must have exactly one element, but has %d", *s, contextSize)
+            .atPos(pos)
+            .debugThrow();
     }
-    NixStringContext context2 {
-        (NixStringContextElem { std::visit(overloaded {
-            [&](const NixStringContextElem::Opaque & c) -> NixStringContextElem::DrvDeep {
-                if (!c.path.isDerivation()) {
-                    state.error<EvalError>(
-                        "path '%s' is not a derivation",
-                        state.store->printStorePath(c.path)
-                    ).atPos(pos).debugThrow();
-                }
-                return NixStringContextElem::DrvDeep {
-                    .drvPath = c.path,
-                };
+    NixStringContext context2{
+        (NixStringContextElem{std::visit(
+            overloaded{
+                [&](const NixStringContextElem::Opaque & c) -> NixStringContextElem::DrvDeep {
+                    if (!c.path.isDerivation()) {
+                        state.error<EvalError>("path '%s' is not a derivation", state.store->printStorePath(c.path))
+                            .atPos(pos)
+                            .debugThrow();
+                    }
+                    return NixStringContextElem::DrvDeep{
+                        .drvPath = c.path,
+                    };
+                },
+                [&](const NixStringContextElem::Built & c) -> NixStringContextElem::DrvDeep {
+                    state
+                        .error<EvalError>(
+                            "`addDrvOutputDependencies` can only act on derivations, not on a derivation output such as '%1%'",
+                            c.output)
+                        .atPos(pos)
+                        .debugThrow();
+                },
+                [&](const NixStringContextElem::DrvDeep & c) -> NixStringContextElem::DrvDeep {
+                    /* Reuse original item because we want this to be idempotent. */
+                    /* FIXME: Suspicious move out of const. This is actually a copy, so the comment
+                     above does not make much sense. */
+                    return std::move(c);
+                },
             },
-            [&](const NixStringContextElem::Built & c) -> NixStringContextElem::DrvDeep {
-                state.error<EvalError>(
-                    "`addDrvOutputDependencies` can only act on derivations, not on a derivation output such as '%1%'",
-                    c.output
-                ).atPos(pos).debugThrow();
-            },
-            [&](const NixStringContextElem::DrvDeep & c) -> NixStringContextElem::DrvDeep {
-                /* Reuse original item because we want this to be idempotent. */
-                /* FIXME: Suspicious move out of const. This is actually a copy, so the comment
-                 above does not make much sense. */
-                return std::move(c);
-            },
-        }, context.begin()->raw) }),
+            context.begin()->raw)}),
     };
 
     v.mkString(*s, context2);
 }
 
-static RegisterPrimOp primop_addDrvOutputDependencies({
-    .name = "__addDrvOutputDependencies",
-    .args = {"s"},
-    .doc = R"(
+static RegisterPrimOp primop_addDrvOutputDependencies(
+    {.name = "__addDrvOutputDependencies",
+     .args = {"s"},
+     .doc = R"(
       Create a copy of the given string where a single
       [constant](@docroot@/language/string-context.md#string-context-element-constant)
       string context element is turned into a
@@ -159,9 +157,7 @@ static RegisterPrimOp primop_addDrvOutputDependencies({
 
       This is the opposite of [`builtins.unsafeDiscardOutputDependency`](#builtins-unsafeDiscardOutputDependency).
     )",
-    .fun = prim_addDrvOutputDependencies
-});
-
+     .fun = prim_addDrvOutputDependencies});
 
 /* Extract the context of a string as a structured Nix value.
 
@@ -182,31 +178,31 @@ static RegisterPrimOp primop_addDrvOutputDependencies({
    Note that for a given path any combination of the above attributes
    may be present.
 */
-static void prim_getContext(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_getContext(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    struct ContextInfo {
+    struct ContextInfo
+    {
         bool path = false;
         bool allOutputs = false;
         Strings outputs;
     };
+
     NixStringContext context;
     state.forceString(*args[0], context, pos, "while evaluating the argument passed to builtins.getContext");
     auto contextInfos = std::map<StorePath, ContextInfo>();
     for (auto && i : context) {
-        std::visit(overloaded {
-            [&](NixStringContextElem::DrvDeep && d) {
-                contextInfos[std::move(d.drvPath)].allOutputs = true;
+        std::visit(
+            overloaded{
+                [&](NixStringContextElem::DrvDeep && d) { contextInfos[std::move(d.drvPath)].allOutputs = true; },
+                [&](NixStringContextElem::Built && b) {
+                    // FIXME should eventually show string context as is, no
+                    // resolving here.
+                    auto drvPath = resolveDerivedPath(*state.store, *b.drvPath);
+                    contextInfos[std::move(drvPath)].outputs.emplace_back(std::move(b.output));
+                },
+                [&](NixStringContextElem::Opaque && o) { contextInfos[std::move(o.path)].path = true; },
             },
-            [&](NixStringContextElem::Built && b) {
-                // FIXME should eventually show string context as is, no
-                // resolving here.
-                auto drvPath = resolveDerivedPath(*state.store, *b.drvPath);
-                contextInfos[std::move(drvPath)].outputs.emplace_back(std::move(b.output));
-            },
-            [&](NixStringContextElem::Opaque && o) {
-                contextInfos[std::move(o.path)].path = true;
-            },
-        }, ((NixStringContextElem &&) i).raw);
+            ((NixStringContextElem &&) i).raw);
     }
 
     auto attrs = state.buildBindings(contextInfos.size());
@@ -223,7 +219,7 @@ static void prim_getContext(EvalState & state, const PosIdx pos, Value * * args,
             auto list = state.buildList(info.second.outputs.size());
             for (const auto & [i, output] : enumerate(info.second.outputs))
                 (list[i] = state.allocValue())->mkString(output);
-            infoAttrs.alloc(state.sOutputs).mkList(list);
+            infoAttrs.alloc(state.s.outputs).mkList(list);
         }
         attrs.alloc(state.store->printStorePath(info.first)).mkAttrs(infoAttrs);
     }
@@ -231,10 +227,10 @@ static void prim_getContext(EvalState & state, const PosIdx pos, Value * * args,
     v.mkAttrs(attrs);
 }
 
-static RegisterPrimOp primop_getContext({
-    .name = "__getContext",
-    .args = {"s"},
-    .doc = R"(
+static RegisterPrimOp primop_getContext(
+    {.name = "__getContext",
+     .args = {"s"},
+     .doc = R"(
       Return the string context of *s*.
 
       The string context tracks references to derivations within a string.
@@ -253,19 +249,18 @@ static RegisterPrimOp primop_getContext({
       { "/nix/store/arhvjaf6zmlyn8vh8fgn55rpwnxq0n7l-a.drv" = { outputs = [ "out" ]; }; }
       ```
     )",
-    .fun = prim_getContext
-});
-
+     .fun = prim_getContext});
 
 /* Append the given context to a given string.
 
    See the commentary above getContext for details of the
    context representation.
 */
-static void prim_appendContext(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_appendContext(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     NixStringContext context;
-    auto orig = state.forceString(*args[0], context, noPos, "while evaluating the first argument passed to builtins.appendContext");
+    auto orig = state.forceString(
+        *args[0], context, noPos, "while evaluating the first argument passed to builtins.appendContext");
 
     state.forceAttrs(*args[1], pos, "while evaluating the second argument passed to builtins.appendContext");
 
@@ -274,10 +269,7 @@ static void prim_appendContext(EvalState & state, const PosIdx pos, Value * * ar
     for (auto & i : *args[1]->attrs()) {
         const auto & name = state.symbols[i.name];
         if (!state.store->isStorePath(name))
-            state.error<EvalError>(
-                "context key '%s' is not a store path",
-                name
-            ).atPos(i.pos).debugThrow();
+            state.error<EvalError>("context key '%s' is not a store path", name).atPos(i.pos).debugThrow();
         auto namePath = state.store->parseStorePath(name);
         if (!settings.readOnlyMode)
             state.store->ensurePath(namePath);
@@ -285,39 +277,46 @@ static void prim_appendContext(EvalState & state, const PosIdx pos, Value * * ar
 
         if (auto attr = i.value->attrs()->get(sPath)) {
             if (state.forceBool(*attr->value, attr->pos, "while evaluating the `path` attribute of a string context"))
-                context.emplace(NixStringContextElem::Opaque {
-                    .path = namePath,
-                });
+                context.emplace(
+                    NixStringContextElem::Opaque{
+                        .path = namePath,
+                    });
         }
 
         if (auto attr = i.value->attrs()->get(sAllOutputs)) {
-            if (state.forceBool(*attr->value, attr->pos, "while evaluating the `allOutputs` attribute of a string context")) {
+            if (state.forceBool(
+                    *attr->value, attr->pos, "while evaluating the `allOutputs` attribute of a string context")) {
                 if (!isDerivation(name)) {
-                    state.error<EvalError>(
-                        "tried to add all-outputs context of %s, which is not a derivation, to a string",
-                        name
-                    ).atPos(i.pos).debugThrow();
+                    state
+                        .error<EvalError>(
+                            "tried to add all-outputs context of %s, which is not a derivation, to a string", name)
+                        .atPos(i.pos)
+                        .debugThrow();
                 }
-                context.emplace(NixStringContextElem::DrvDeep {
-                    .drvPath = namePath,
-                });
+                context.emplace(
+                    NixStringContextElem::DrvDeep{
+                        .drvPath = namePath,
+                    });
             }
         }
 
-        if (auto attr = i.value->attrs()->get(state.sOutputs)) {
+        if (auto attr = i.value->attrs()->get(state.s.outputs)) {
             state.forceList(*attr->value, attr->pos, "while evaluating the `outputs` attribute of a string context");
             if (attr->value->listSize() && !isDerivation(name)) {
-                state.error<EvalError>(
-                    "tried to add derivation output context of %s, which is not a derivation, to a string",
-                    name
-                ).atPos(i.pos).debugThrow();
+                state
+                    .error<EvalError>(
+                        "tried to add derivation output context of %s, which is not a derivation, to a string", name)
+                    .atPos(i.pos)
+                    .debugThrow();
             }
             for (auto elem : attr->value->listView()) {
-                auto outputName = state.forceStringNoCtx(*elem, attr->pos, "while evaluating an output name within a string context");
-                context.emplace(NixStringContextElem::Built {
-                    .drvPath = makeConstantStorePathRef(namePath),
-                    .output = std::string { outputName },
-                });
+                auto outputName =
+                    state.forceStringNoCtx(*elem, attr->pos, "while evaluating an output name within a string context");
+                context.emplace(
+                    NixStringContextElem::Built{
+                        .drvPath = makeConstantStorePathRef(namePath),
+                        .output = std::string{outputName},
+                    });
             }
         }
     }
@@ -325,10 +324,6 @@ static void prim_appendContext(EvalState & state, const PosIdx pos, Value * * ar
     v.mkString(orig, context);
 }
 
-static RegisterPrimOp primop_appendContext({
-    .name = "__appendContext",
-    .arity = 2,
-    .fun = prim_appendContext
-});
+static RegisterPrimOp primop_appendContext({.name = "__appendContext", .arity = 2, .fun = prim_appendContext});
 
-}
+} // namespace nix
diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index ea6145f6f..63da53aa9 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -3,6 +3,7 @@
 #include "nix/store/realisation.hh"
 #include "nix/store/make-content-addressed.hh"
 #include "nix/util/url.hh"
+#include "nix/util/environment-variables.hh"
 
 namespace nix {
 
@@ -15,29 +16,35 @@ namespace nix {
  * @param toPathMaybe Path to write the rewritten path to. If empty, the error shows the actual path.
  * @param v Return `Value`
  */
-static void runFetchClosureWithRewrite(EvalState & state, const PosIdx pos, Store & fromStore, const StorePath & fromPath, const std::optional<StorePath> & toPathMaybe, Value &v) {
+static void runFetchClosureWithRewrite(
+    EvalState & state,
+    const PosIdx pos,
+    Store & fromStore,
+    const StorePath & fromPath,
+    const std::optional<StorePath> & toPathMaybe,
+    Value & v)
+{
 
     // establish toPath or throw
 
     if (!toPathMaybe || !state.store->isValidPath(*toPathMaybe)) {
         auto rewrittenPath = makeContentAddressed(fromStore, *state.store, fromPath);
         if (toPathMaybe && *toPathMaybe != rewrittenPath)
-            throw Error({
-                .msg = HintFmt("rewriting '%s' to content-addressed form yielded '%s', while '%s' was expected",
-                    state.store->printStorePath(fromPath),
-                    state.store->printStorePath(rewrittenPath),
-                    state.store->printStorePath(*toPathMaybe)),
-                .pos = state.positions[pos]
-            });
+            throw Error(
+                {.msg = HintFmt(
+                     "rewriting '%s' to content-addressed form yielded '%s', while '%s' was expected",
+                     state.store->printStorePath(fromPath),
+                     state.store->printStorePath(rewrittenPath),
+                     state.store->printStorePath(*toPathMaybe)),
+                 .pos = state.positions[pos]});
         if (!toPathMaybe)
-            throw Error({
-                .msg = HintFmt(
-                    "rewriting '%s' to content-addressed form yielded '%s'\n"
-                    "Use this value for the 'toPath' attribute passed to 'fetchClosure'",
-                    state.store->printStorePath(fromPath),
-                    state.store->printStorePath(rewrittenPath)),
-                .pos = state.positions[pos]
-            });
+            throw Error(
+                {.msg = HintFmt(
+                     "rewriting '%s' to content-addressed form yielded '%s'\n"
+                     "Use this value for the 'toPath' attribute passed to 'fetchClosure'",
+                     state.store->printStorePath(fromPath),
+                     state.store->printStorePath(rewrittenPath)),
+                 .pos = state.positions[pos]});
     }
 
     const auto & toPath = *toPathMaybe;
@@ -49,13 +56,12 @@ static void runFetchClosureWithRewrite(EvalState & state, const PosIdx pos, Stor
     if (!resultInfo->isContentAddressed(*state.store)) {
         // We don't perform the rewriting when outPath already exists, as an optimisation.
         // However, we can quickly detect a mistake if the toPath is input addressed.
-        throw Error({
-            .msg = HintFmt(
-                "The 'toPath' value '%s' is input-addressed, so it can't possibly be the result of rewriting to a content-addressed path.\n\n"
-                "Set 'toPath' to an empty string to make Nix report the correct content-addressed path.",
-                state.store->printStorePath(toPath)),
-            .pos = state.positions[pos]
-        });
+        throw Error(
+            {.msg = HintFmt(
+                 "The 'toPath' value '%s' is input-addressed, so it can't possibly be the result of rewriting to a content-addressed path.\n\n"
+                 "Set 'toPath' to an empty string to make Nix report the correct content-addressed path.",
+                 state.store->printStorePath(toPath)),
+             .pos = state.positions[pos]});
     }
 
     state.mkStorePathString(toPath, v);
@@ -64,24 +70,25 @@ static void runFetchClosureWithRewrite(EvalState & state, const PosIdx pos, Stor
 /**
  * Fetch the closure and make sure it's content addressed.
  */
-static void runFetchClosureWithContentAddressedPath(EvalState & state, const PosIdx pos, Store & fromStore, const StorePath & fromPath, Value & v) {
+static void runFetchClosureWithContentAddressedPath(
+    EvalState & state, const PosIdx pos, Store & fromStore, const StorePath & fromPath, Value & v)
+{
 
     if (!state.store->isValidPath(fromPath))
-        copyClosure(fromStore, *state.store, RealisedPath::Set { fromPath });
+        copyClosure(fromStore, *state.store, RealisedPath::Set{fromPath});
 
     auto info = state.store->queryPathInfo(fromPath);
 
     if (!info->isContentAddressed(*state.store)) {
-        throw Error({
-            .msg = HintFmt(
-                "The 'fromPath' value '%s' is input-addressed, but 'inputAddressed' is set to 'false' (default).\n\n"
-                "If you do intend to fetch an input-addressed store path, add\n\n"
-                "    inputAddressed = true;\n\n"
-                "to the 'fetchClosure' arguments.\n\n"
-                "Note that to ensure authenticity input-addressed store paths, users must configure a trusted binary cache public key on their systems. This is not needed for content-addressed paths.",
-                state.store->printStorePath(fromPath)),
-            .pos = state.positions[pos]
-        });
+        throw Error(
+            {.msg = HintFmt(
+                 "The 'fromPath' value '%s' is input-addressed, but 'inputAddressed' is set to 'false' (default).\n\n"
+                 "If you do intend to fetch an input-addressed store path, add\n\n"
+                 "    inputAddressed = true;\n\n"
+                 "to the 'fetchClosure' arguments.\n\n"
+                 "Note that to ensure authenticity input-addressed store paths, users must configure a trusted binary cache public key on their systems. This is not needed for content-addressed paths.",
+                 state.store->printStorePath(fromPath)),
+             .pos = state.positions[pos]});
     }
 
     state.mkStorePathString(fromPath, v);
@@ -90,21 +97,22 @@ static void runFetchClosureWithContentAddressedPath(EvalState & state, const Pos
 /**
  * Fetch the closure and make sure it's input addressed.
  */
-static void runFetchClosureWithInputAddressedPath(EvalState & state, const PosIdx pos, Store & fromStore, const StorePath & fromPath, Value & v) {
+static void runFetchClosureWithInputAddressedPath(
+    EvalState & state, const PosIdx pos, Store & fromStore, const StorePath & fromPath, Value & v)
+{
 
     if (!state.store->isValidPath(fromPath))
-        copyClosure(fromStore, *state.store, RealisedPath::Set { fromPath });
+        copyClosure(fromStore, *state.store, RealisedPath::Set{fromPath});
 
     auto info = state.store->queryPathInfo(fromPath);
 
     if (info->isContentAddressed(*state.store)) {
-        throw Error({
-            .msg = HintFmt(
-                "The store object referred to by 'fromPath' at '%s' is not input-addressed, but 'inputAddressed' is set to 'true'.\n\n"
-                "Remove the 'inputAddressed' attribute (it defaults to 'false') to expect 'fromPath' to be content-addressed",
-                state.store->printStorePath(fromPath)),
-            .pos = state.positions[pos]
-        });
+        throw Error(
+            {.msg = HintFmt(
+                 "The store object referred to by 'fromPath' at '%s' is not input-addressed, but 'inputAddressed' is set to 'true'.\n\n"
+                 "Remove the 'inputAddressed' attribute (it defaults to 'false') to expect 'fromPath' to be content-addressed",
+                 state.store->printStorePath(fromPath)),
+             .pos = state.positions[pos]});
     }
 
     state.mkStorePathString(fromPath, v);
@@ -112,7 +120,7 @@ static void runFetchClosureWithInputAddressedPath(EvalState & state, const PosId
 
 typedef std::optional<StorePath> StorePathOrGap;
 
-static void prim_fetchClosure(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_fetchClosure(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     state.forceAttrs(*args[0], pos, "while evaluating the argument passed to builtins.fetchClosure");
 
@@ -124,7 +132,7 @@ static void prim_fetchClosure(EvalState & state, const PosIdx pos, Value * * arg
     for (auto & attr : *args[0]->attrs()) {
         const auto & attrName = state.symbols[attr.name];
         auto attrHint = [&]() -> std::string {
-            return "while evaluating the '" + attrName + "' attribute passed to builtins.fetchClosure";
+            return fmt("while evaluating the attribute '%s' passed to builtins.fetchClosure", attrName);
         };
 
         if (attrName == "fromPath") {
@@ -136,67 +144,58 @@ static void prim_fetchClosure(EvalState & state, const PosIdx pos, Value * * arg
             state.forceValue(*attr.value, attr.pos);
             bool isEmptyString = attr.value->type() == nString && attr.value->string_view() == "";
             if (isEmptyString) {
-                toPath = StorePathOrGap {};
-            }
-            else {
+                toPath = StorePathOrGap{};
+            } else {
                 NixStringContext context;
                 toPath = state.coerceToStorePath(attr.pos, *attr.value, context, attrHint());
             }
         }
 
         else if (attrName == "fromStore")
-            fromStoreUrl = state.forceStringNoCtx(*attr.value, attr.pos,
-                    attrHint());
+            fromStoreUrl = state.forceStringNoCtx(*attr.value, attr.pos, attrHint());
 
         else if (attrName == "inputAddressed")
             inputAddressedMaybe = state.forceBool(*attr.value, attr.pos, attrHint());
 
         else
-            throw Error({
-                .msg = HintFmt("attribute '%s' isn't supported in call to 'fetchClosure'", attrName),
-                .pos = state.positions[pos]
-            });
+            throw Error(
+                {.msg = HintFmt("attribute '%s' isn't supported in call to 'fetchClosure'", attrName),
+                 .pos = state.positions[pos]});
     }
 
     if (!fromPath)
-        throw Error({
-            .msg = HintFmt("attribute '%s' is missing in call to 'fetchClosure'", "fromPath"),
-            .pos = state.positions[pos]
-        });
+        throw Error(
+            {.msg = HintFmt("attribute '%s' is missing in call to 'fetchClosure'", "fromPath"),
+             .pos = state.positions[pos]});
 
     bool inputAddressed = inputAddressedMaybe.value_or(false);
 
     if (inputAddressed) {
         if (toPath)
-            throw Error({
-                .msg = HintFmt("attribute '%s' is set to true, but '%s' is also set. Please remove one of them",
-                    "inputAddressed",
-                    "toPath"),
-                .pos = state.positions[pos]
-            });
+            throw Error(
+                {.msg = HintFmt(
+                     "attribute '%s' is set to true, but '%s' is also set. Please remove one of them",
+                     "inputAddressed",
+                     "toPath"),
+                 .pos = state.positions[pos]});
     }
 
     if (!fromStoreUrl)
-        throw Error({
-            .msg = HintFmt("attribute '%s' is missing in call to 'fetchClosure'", "fromStore"),
-            .pos = state.positions[pos]
-        });
+        throw Error(
+            {.msg = HintFmt("attribute '%s' is missing in call to 'fetchClosure'", "fromStore"),
+             .pos = state.positions[pos]});
 
-    auto parsedURL = parseURL(*fromStoreUrl);
+    auto parsedURL = parseURL(*fromStoreUrl, /*lenient=*/true);
 
-    if (parsedURL.scheme != "http" &&
-        parsedURL.scheme != "https" &&
-        !(getEnv("_NIX_IN_TEST").has_value() && parsedURL.scheme == "file"))
-        throw Error({
-            .msg = HintFmt("'fetchClosure' only supports http:// and https:// stores"),
-            .pos = state.positions[pos]
-        });
+    if (parsedURL.scheme != "http" && parsedURL.scheme != "https"
+        && !(getEnv("_NIX_IN_TEST").has_value() && parsedURL.scheme == "file"))
+        throw Error(
+            {.msg = HintFmt("'fetchClosure' only supports http:// and https:// stores"), .pos = state.positions[pos]});
 
     if (!parsedURL.query.empty())
-        throw Error({
-            .msg = HintFmt("'fetchClosure' does not support URL query parameters (in '%s')", *fromStoreUrl),
-            .pos = state.positions[pos]
-        });
+        throw Error(
+            {.msg = HintFmt("'fetchClosure' does not support URL query parameters (in '%s')", *fromStoreUrl),
+             .pos = state.positions[pos]});
 
     auto fromStore = openStore(parsedURL.to_string());
 
@@ -284,4 +283,4 @@ static RegisterPrimOp primop_fetchClosure({
     .experimentalFeature = Xp::FetchClosure,
 });
 
-}
+} // namespace nix
diff --git a/src/libexpr/primops/fetchMercurial.cc b/src/libexpr/primops/fetchMercurial.cc
index 189bd1f73..c856deede 100644
--- a/src/libexpr/primops/fetchMercurial.cc
+++ b/src/libexpr/primops/fetchMercurial.cc
@@ -8,7 +8,7 @@
 
 namespace nix {
 
-static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     std::string url;
     std::optional<Hash> rev;
@@ -23,31 +23,46 @@ static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value * * a
         for (auto & attr : *args[0]->attrs()) {
             std::string_view n(state.symbols[attr.name]);
             if (n == "url")
-                url = state.coerceToString(attr.pos, *attr.value, context,
-                        "while evaluating the `url` attribute passed to builtins.fetchMercurial",
-                        false, false).toOwned();
+                url = state
+                          .coerceToString(
+                              attr.pos,
+                              *attr.value,
+                              context,
+                              "while evaluating the `url` attribute passed to builtins.fetchMercurial",
+                              false,
+                              false)
+                          .toOwned();
             else if (n == "rev") {
                 // Ugly: unlike fetchGit, here the "rev" attribute can
                 // be both a revision or a branch/tag name.
-                auto value = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `rev` attribute passed to builtins.fetchMercurial");
+                auto value = state.forceStringNoCtx(
+                    *attr.value, attr.pos, "while evaluating the `rev` attribute passed to builtins.fetchMercurial");
                 if (std::regex_match(value.begin(), value.end(), revRegex))
                     rev = Hash::parseAny(value, HashAlgorithm::SHA1);
                 else
                     ref = value;
-            }
-            else if (n == "name")
-                name = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `name` attribute passed to builtins.fetchMercurial");
+            } else if (n == "name")
+                name = state.forceStringNoCtx(
+                    *attr.value, attr.pos, "while evaluating the `name` attribute passed to builtins.fetchMercurial");
             else
-                state.error<EvalError>("unsupported argument '%s' to 'fetchMercurial'", state.symbols[attr.name]).atPos(attr.pos).debugThrow();
+                state.error<EvalError>("unsupported argument '%s' to 'fetchMercurial'", state.symbols[attr.name])
+                    .atPos(attr.pos)
+                    .debugThrow();
         }
 
         if (url.empty())
             state.error<EvalError>("'url' argument required").atPos(pos).debugThrow();
 
     } else
-        url = state.coerceToString(pos, *args[0], context,
-                "while evaluating the first argument passed to builtins.fetchMercurial",
-                false, false).toOwned();
+        url = state
+                  .coerceToString(
+                      pos,
+                      *args[0],
+                      context,
+                      "while evaluating the first argument passed to builtins.fetchMercurial",
+                      false,
+                      false)
+                  .toOwned();
 
     // FIXME: git externals probably can be used to bypass the URI
     // whitelist. Ah well.
@@ -60,14 +75,16 @@ static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value * * a
     attrs.insert_or_assign("type", "hg");
     attrs.insert_or_assign("url", url.find("://") != std::string::npos ? url : "file://" + url);
     attrs.insert_or_assign("name", std::string(name));
-    if (ref) attrs.insert_or_assign("ref", *ref);
-    if (rev) attrs.insert_or_assign("rev", rev->gitRev());
+    if (ref)
+        attrs.insert_or_assign("ref", *ref);
+    if (rev)
+        attrs.insert_or_assign("rev", rev->gitRev());
     auto input = fetchers::Input::fromAttrs(state.fetchSettings, std::move(attrs));
 
     auto [storePath, input2] = input.fetchToStore(state.store);
 
     auto attrs2 = state.buildBindings(8);
-    state.mkStorePathString(storePath, attrs2.alloc(state.sOutPath));
+    state.mkStorePathString(storePath, attrs2.alloc(state.s.outPath));
     if (input2.getRef())
         attrs2.alloc("branch").mkString(*input2.getRef());
     // Backward compatibility: set 'rev' to
@@ -82,10 +99,6 @@ static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value * * a
     state.allowPath(storePath);
 }
 
-static RegisterPrimOp r_fetchMercurial({
-    .name = "fetchMercurial",
-    .arity = 1,
-    .fun = prim_fetchMercurial
-});
+static RegisterPrimOp r_fetchMercurial({.name = "fetchMercurial", .arity = 1, .fun = prim_fetchMercurial});
 
-}
+} // namespace nix
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 5b6dd6531..e673e55a0 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -29,7 +29,7 @@ void emitTreeAttrs(
 {
     auto attrs = state.buildBindings(100);
 
-    state.mkStorePathString(storePath, attrs.alloc(state.sOutPath));
+    state.mkStorePathString(storePath, attrs.alloc(state.s.outPath));
 
     // FIXME: support arbitrary input attributes.
 
@@ -37,8 +37,7 @@ void emitTreeAttrs(
         attrs.alloc("narHash").mkString(narHash->to_string(HashFormat::SRI, true));
 
     if (input.getType() == "git")
-        attrs.alloc("submodules").mkBool(
-            fetchers::maybeGetBoolAttr(input.attrs, "submodules").value_or(false));
+        attrs.alloc("submodules").mkBool(fetchers::maybeGetBoolAttr(input.attrs, "submodules").value_or(false));
 
     if (!forceDirty) {
 
@@ -56,7 +55,6 @@ void emitTreeAttrs(
             attrs.alloc("revCount").mkInt(*revCount);
         else if (emptyRevFallback)
             attrs.alloc("revCount").mkInt(0);
-
     }
 
     if (auto dirtyRev = fetchers::maybeGetStrAttr(input.attrs, "dirtyRev")) {
@@ -66,14 +64,14 @@ void emitTreeAttrs(
 
     if (auto lastModified = input.getLastModified()) {
         attrs.alloc("lastModified").mkInt(*lastModified);
-        attrs.alloc("lastModifiedDate").mkString(
-            fmt("%s", std::put_time(std::gmtime(&*lastModified), "%Y%m%d%H%M%S")));
+        attrs.alloc("lastModifiedDate").mkString(fmt("%s", std::put_time(std::gmtime(&*lastModified), "%Y%m%d%H%M%S")));
     }
 
     v.mkAttrs(attrs);
 }
 
-struct FetchTreeParams {
+struct FetchTreeParams
+{
     bool emptyRevFallback = false;
     bool allowNameArgument = false;
     bool isFetchGit = false;
@@ -81,17 +79,14 @@ struct FetchTreeParams {
 };
 
 static void fetchTree(
-    EvalState & state,
-    const PosIdx pos,
-    Value * * args,
-    Value & v,
-    const FetchTreeParams & params = FetchTreeParams{}
-) {
-    fetchers::Input input { state.fetchSettings };
+    EvalState & state, const PosIdx pos, Value ** args, Value & v, const FetchTreeParams & params = FetchTreeParams{})
+{
+    fetchers::Input input{state.fetchSettings};
     NixStringContext context;
     std::optional<std::string> type;
     auto fetcher = params.isFetchGit ? "fetchGit" : "fetchTree";
-    if (params.isFetchGit) type = "git";
+    if (params.isFetchGit)
+        type = "git";
 
     state.forceValue(*args[0], pos);
 
@@ -100,49 +95,57 @@ static void fetchTree(
 
         fetchers::Attrs attrs;
 
-        if (auto aType = args[0]->attrs()->get(state.sType)) {
+        if (auto aType = args[0]->attrs()->get(state.s.type)) {
             if (type)
-                state.error<EvalError>(
-                    "unexpected argument 'type'"
-                ).atPos(pos).debugThrow();
-            type = state.forceStringNoCtx(*aType->value, aType->pos,
-                fmt("while evaluating the `type` argument passed to '%s'", fetcher));
+                state.error<EvalError>("unexpected argument 'type'").atPos(pos).debugThrow();
+            type = state.forceStringNoCtx(
+                *aType->value, aType->pos, fmt("while evaluating the `type` argument passed to '%s'", fetcher));
         } else if (!type)
-            state.error<EvalError>(
-                "argument 'type' is missing in call to '%s'", fetcher
-            ).atPos(pos).debugThrow();
+            state.error<EvalError>("argument 'type' is missing in call to '%s'", fetcher).atPos(pos).debugThrow();
 
         attrs.emplace("type", type.value());
 
         for (auto & attr : *args[0]->attrs()) {
-            if (attr.name == state.sType) continue;
+            if (attr.name == state.s.type)
+                continue;
             state.forceValue(*attr.value, attr.pos);
             if (attr.value->type() == nPath || attr.value->type() == nString) {
                 auto s = state.coerceToString(attr.pos, *attr.value, context, "", false, false).toOwned();
-                attrs.emplace(state.symbols[attr.name],
-                    params.isFetchGit && state.symbols[attr.name] == "url"
-                    ? fixGitURL(s)
-                    : s);
-            }
-            else if (attr.value->type() == nBool)
+                attrs.emplace(
+                    state.symbols[attr.name],
+                    params.isFetchGit && state.symbols[attr.name] == "url" ? fixGitURL(s).to_string() : s);
+            } else if (attr.value->type() == nBool)
                 attrs.emplace(state.symbols[attr.name], Explicit<bool>{attr.value->boolean()});
             else if (attr.value->type() == nInt) {
                 auto intValue = attr.value->integer().value;
 
                 if (intValue < 0)
-                    state.error<EvalError>("negative value given for '%s' argument '%s': %d", fetcher, state.symbols[attr.name], intValue).atPos(pos).debugThrow();
+                    state
+                        .error<EvalError>(
+                            "negative value given for '%s' argument '%s': %d",
+                            fetcher,
+                            state.symbols[attr.name],
+                            intValue)
+                        .atPos(pos)
+                        .debugThrow();
 
                 attrs.emplace(state.symbols[attr.name], uint64_t(intValue));
             } else if (state.symbols[attr.name] == "publicKeys") {
                 experimentalFeatureSettings.require(Xp::VerifiedFetches);
-                attrs.emplace(state.symbols[attr.name], printValueAsJSON(state, true, *attr.value, pos, context).dump());
-            }
-            else
-                state.error<TypeError>("argument '%s' to '%s' is %s while a string, Boolean or integer is expected",
-                    state.symbols[attr.name], fetcher, showType(*attr.value)).debugThrow();
+                attrs.emplace(
+                    state.symbols[attr.name], printValueAsJSON(state, true, *attr.value, pos, context).dump());
+            } else
+                state
+                    .error<TypeError>(
+                        "argument '%s' to '%s' is %s while a string, Boolean or integer is expected",
+                        state.symbols[attr.name],
+                        fetcher,
+                        showType(*attr.value))
+                    .debugThrow();
         }
 
-        if (params.isFetchGit && !attrs.contains("exportIgnore") && (!attrs.contains("submodules") || !*fetchers::maybeGetBoolAttr(attrs, "submodules"))) {
+        if (params.isFetchGit && !attrs.contains("exportIgnore")
+            && (!attrs.contains("submodules") || !*fetchers::maybeGetBoolAttr(attrs, "submodules"))) {
             attrs.emplace("exportIgnore", Explicit<bool>{true});
         }
 
@@ -153,29 +156,38 @@ static void fetchTree(
 
         if (!params.allowNameArgument)
             if (auto nameIter = attrs.find("name"); nameIter != attrs.end())
-                state.error<EvalError>(
-                    "argument 'name' isn’t supported in call to '%s'", fetcher
-                ).atPos(pos).debugThrow();
+                state.error<EvalError>("argument 'name' isn’t supported in call to '%s'", fetcher)
+                    .atPos(pos)
+                    .debugThrow();
 
         input = fetchers::Input::fromAttrs(state.fetchSettings, std::move(attrs));
     } else {
-        auto url = state.coerceToString(pos, *args[0], context,
-            fmt("while evaluating the first argument passed to '%s'", fetcher),
-            false, false).toOwned();
+        auto url = state
+                       .coerceToString(
+                           pos,
+                           *args[0],
+                           context,
+                           fmt("while evaluating the first argument passed to '%s'", fetcher),
+                           false,
+                           false)
+                       .toOwned();
 
         if (params.isFetchGit) {
             fetchers::Attrs attrs;
             attrs.emplace("type", "git");
-            attrs.emplace("url", fixGitURL(url));
-            if (!attrs.contains("exportIgnore") && (!attrs.contains("submodules") || !*fetchers::maybeGetBoolAttr(attrs, "submodules"))) {
+            attrs.emplace("url", fixGitURL(url).to_string());
+            if (!attrs.contains("exportIgnore")
+                && (!attrs.contains("submodules") || !*fetchers::maybeGetBoolAttr(attrs, "submodules"))) {
                 attrs.emplace("exportIgnore", Explicit<bool>{true});
             }
             input = fetchers::Input::fromAttrs(state.fetchSettings, std::move(attrs));
         } else {
             if (!experimentalFeatureSettings.isEnabled(Xp::Flakes))
-                state.error<EvalError>(
-                    "passing a string argument to '%s' requires the 'flakes' experimental feature", fetcher
-                ).atPos(pos).debugThrow();
+                state
+                    .error<EvalError>(
+                        "passing a string argument to '%s' requires the 'flakes' experimental feature", fetcher)
+                    .atPos(pos)
+                    .debugThrow();
             input = fetchers::Input::fromURL(state.fetchSettings, url);
         }
     }
@@ -190,9 +202,11 @@ static void fetchTree(
                 "This is deprecated since such inputs are verifiable but may not be reproducible.",
                 input.to_string());
         else
-            state.error<EvalError>(
-                "in pure evaluation mode, '%s' doesn't fetch unlocked input '%s'",
-                fetcher, input.to_string()).atPos(pos).debugThrow();
+            state
+                .error<EvalError>(
+                    "in pure evaluation mode, '%s' doesn't fetch unlocked input '%s'", fetcher, input.to_string())
+                .atPos(pos)
+                .debugThrow();
     }
 
     state.checkURI(input.toURLString());
@@ -211,9 +225,9 @@ static void fetchTree(
     emitTreeAttrs(state, storePath, input2, v, params.emptyRevFallback, false);
 }
 
-static void prim_fetchTree(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_fetchTree(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    fetchTree(state, pos, args, v, { });
+    fetchTree(state, pos, args, v, {});
 }
 
 static RegisterPrimOp primop_fetchTree({
@@ -446,7 +460,7 @@ static RegisterPrimOp primop_fetchTree({
     .experimentalFeature = Xp::FetchTree,
 });
 
-void prim_fetchFinalTree(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+void prim_fetchFinalTree(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     fetchTree(state, pos, args, v, {.isFinal = true});
 }
@@ -458,8 +472,14 @@ static RegisterPrimOp primop_fetchFinalTree({
     .internal = true,
 });
 
-static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v,
-    const std::string & who, bool unpack, std::string name)
+static void fetch(
+    EvalState & state,
+    const PosIdx pos,
+    Value ** args,
+    Value & v,
+    const std::string & who,
+    bool unpack,
+    std::string name)
 {
     std::optional<std::string> url;
     std::optional<Hash> expectedHash;
@@ -476,19 +496,20 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
             if (n == "url")
                 url = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the url we should fetch");
             else if (n == "sha256")
-                expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the sha256 of the content we should fetch"), HashAlgorithm::SHA256);
+                expectedHash = newHashAllowEmpty(
+                    state.forceStringNoCtx(
+                        *attr.value, attr.pos, "while evaluating the sha256 of the content we should fetch"),
+                    HashAlgorithm::SHA256);
             else if (n == "name") {
                 nameAttrPassed = true;
-                name = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the name of the content we should fetch");
-            }
-            else
-                state.error<EvalError>("unsupported argument '%s' to '%s'", n, who)
-                .atPos(pos).debugThrow();
+                name = state.forceStringNoCtx(
+                    *attr.value, attr.pos, "while evaluating the name of the content we should fetch");
+            } else
+                state.error<EvalError>("unsupported argument '%s' to '%s'", n, who).atPos(pos).debugThrow();
         }
 
         if (!url)
-            state.error<EvalError>(
-                "'url' argument required").atPos(pos).debugThrow();
+            state.error<EvalError>("'url' argument required").atPos(pos).debugThrow();
     } else
         url = state.forceStringNoCtx(*args[0], pos, "while evaluating the url we should fetch");
 
@@ -504,27 +525,41 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
         checkName(name);
     } catch (BadStorePathName & e) {
         auto resolution =
-            nameAttrPassed ? HintFmt("Please change the value for the 'name' attribute passed to '%s', so that it can create a valid store path.", who) :
-            isArgAttrs ? HintFmt("Please add a valid 'name' attribute to the argument for '%s', so that it can create a valid store path.", who) :
-            HintFmt("Please pass an attribute set with 'url' and 'name' attributes to '%s',  so that it can create a valid store path.", who);
+            nameAttrPassed
+                ? HintFmt(
+                      "Please change the value for the 'name' attribute passed to '%s', so that it can create a valid store path.",
+                      who)
+            : isArgAttrs
+                ? HintFmt(
+                      "Please add a valid 'name' attribute to the argument for '%s', so that it can create a valid store path.",
+                      who)
+                : HintFmt(
+                      "Please pass an attribute set with 'url' and 'name' attributes to '%s',  so that it can create a valid store path.",
+                      who);
 
-        state.error<EvalError>(
-            std::string("invalid store path name when fetching URL '%s': %s. %s"), *url, Uncolored(e.message()), Uncolored(resolution.str()))
-        .atPos(pos).debugThrow();
+        state
+            .error<EvalError>(
+                std::string("invalid store path name when fetching URL '%s': %s. %s"),
+                *url,
+                Uncolored(e.message()),
+                Uncolored(resolution.str()))
+            .atPos(pos)
+            .debugThrow();
     }
 
     if (state.settings.pureEval && !expectedHash)
-        state.error<EvalError>("in pure evaluation mode, '%s' requires a 'sha256' argument", who).atPos(pos).debugThrow();
+        state.error<EvalError>("in pure evaluation mode, '%s' requires a 'sha256' argument", who)
+            .atPos(pos)
+            .debugThrow();
 
     // early exit if pinned and already in the store
     if (expectedHash && expectedHash->algo == HashAlgorithm::SHA256) {
         auto expectedPath = state.store->makeFixedOutputPath(
             name,
-            FixedOutputInfo {
+            FixedOutputInfo{
                 .method = unpack ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat,
                 .hash = *expectedHash,
-                .references = {}
-            });
+                .references = {}});
 
         if (state.store->isValidPath(expectedPath)) {
             state.allowAndSetStorePathString(expectedPath, v);
@@ -534,35 +569,33 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
 
     // TODO: fetching may fail, yet the path may be substitutable.
     //       https://github.com/NixOS/nix/issues/4313
-    auto storePath =
-        unpack
-        ? fetchToStore(
-            state.fetchSettings,
-            *state.store,
-            fetchers::downloadTarball(state.store, state.fetchSettings, *url),
-            FetchMode::Copy,
-            name)
-        : fetchers::downloadFile(state.store, state.fetchSettings, *url, name).storePath;
+    auto storePath = unpack ? fetchToStore(
+                                  state.fetchSettings,
+                                  *state.store,
+                                  fetchers::downloadTarball(state.store, state.fetchSettings, *url),
+                                  FetchMode::Copy,
+                                  name)
+                            : fetchers::downloadFile(state.store, state.fetchSettings, *url, name).storePath;
 
     if (expectedHash) {
-        auto hash = unpack
-            ? state.store->queryPathInfo(storePath)->narHash
-            : hashFile(HashAlgorithm::SHA256, state.store->toRealPath(storePath));
+        auto hash = unpack ? state.store->queryPathInfo(storePath)->narHash
+                           : hashFile(HashAlgorithm::SHA256, state.store->toRealPath(storePath));
         if (hash != *expectedHash) {
-            state.error<EvalError>(
-                "hash mismatch in file downloaded from '%s':\n  specified: %s\n  got:       %s",
-                *url,
-                expectedHash->to_string(HashFormat::Nix32, true),
-                hash.to_string(HashFormat::Nix32, true)
-            ).withExitStatus(102)
-            .debugThrow();
+            state
+                .error<EvalError>(
+                    "hash mismatch in file downloaded from '%s':\n  specified: %s\n  got:       %s",
+                    *url,
+                    expectedHash->to_string(HashFormat::Nix32, true),
+                    hash.to_string(HashFormat::Nix32, true))
+                .withExitStatus(102)
+                .debugThrow();
         }
     }
 
     state.allowAndSetStorePathString(storePath, v);
 }
 
-static void prim_fetchurl(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_fetchurl(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     fetch(state, pos, args, v, "fetchurl", false, "");
 }
@@ -588,7 +621,7 @@ static RegisterPrimOp primop_fetchurl({
     .fun = prim_fetchurl,
 });
 
-static void prim_fetchTarball(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_fetchTarball(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     fetch(state, pos, args, v, "fetchTarball", true, "source");
 }
@@ -638,14 +671,10 @@ static RegisterPrimOp primop_fetchTarball({
     .fun = prim_fetchTarball,
 });
 
-static void prim_fetchGit(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+static void prim_fetchGit(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
-    fetchTree(state, pos, args, v,
-        FetchTreeParams {
-            .emptyRevFallback = true,
-            .allowNameArgument = true,
-            .isFetchGit = true
-        });
+    fetchTree(
+        state, pos, args, v, FetchTreeParams{.emptyRevFallback = true, .allowNameArgument = true, .isFetchGit = true});
 }
 
 static RegisterPrimOp primop_fetchGit({
@@ -858,4 +887,4 @@ static RegisterPrimOp primop_fetchGit({
     .fun = prim_fetchGit,
 });
 
-}
+} // namespace nix
diff --git a/src/libexpr/primops/fromTOML.cc b/src/libexpr/primops/fromTOML.cc
index 2a29e0424..3ab594905 100644
--- a/src/libexpr/primops/fromTOML.cc
+++ b/src/libexpr/primops/fromTOML.cc
@@ -1,104 +1,179 @@
 #include "nix/expr/primops.hh"
 #include "nix/expr/eval-inline.hh"
 
+#include "expr-config-private.hh"
+
 #include <sstream>
 
 #include <toml.hpp>
 
 namespace nix {
 
-static void prim_fromTOML(EvalState & state, const PosIdx pos, Value * * args, Value & val)
+#if HAVE_TOML11_4
+
+/**
+ * This is what toml11 < 4.0 did when choosing the subsecond precision.
+ * TOML 1.0.0 spec doesn't define how sub-millisecond ranges should be handled and calls it
+ * implementation defined behavior. For a lack of a better choice we stick with what older versions
+ * of toml11 did [1].
+ *
+ * [1]: https://github.com/ToruNiina/toml11/blob/dcfe39a783a94e8d52c885e5883a6fbb21529019/toml/datetime.hpp#L282
+ */
+static size_t normalizeSubsecondPrecision(toml::local_time lt)
+{
+    auto millis = lt.millisecond;
+    auto micros = lt.microsecond;
+    auto nanos = lt.nanosecond;
+    if (millis != 0 || micros != 0 || nanos != 0) {
+        if (micros != 0 || nanos != 0) {
+            if (nanos != 0)
+                return 9;
+            return 6;
+        }
+        return 3;
+    }
+    return 0;
+}
+
+/**
+ * Normalize date/time formats to serialize to the same strings as versions prior to toml11 4.0.
+ *
+ * Several things to consider:
+ *
+ * 1. Sub-millisecond range is represented the same way as in toml11 versions prior to 4.0. Precisioun is rounded
+ *    towards the next multiple of 3 or capped at 9 digits.
+ * 2. Seconds must be specified. This may become optional in (yet unreleased) TOML 1.1.0, but 1.0.0 defined local time
+ *    in terms of RFC3339 [1].
+ * 3. date-time separator (`t`, `T` or space ` `) is canonicalized to an upper T. This is compliant with RFC3339
+ *    [1] 5.6:
+ *    > Applications that generate this format SHOULD use upper case letters.
+ *
+ * [1]: https://datatracker.ietf.org/doc/html/rfc3339#section-5.6
+ */
+static void normalizeDatetimeFormat(toml::value & t)
+{
+    if (t.is_local_datetime()) {
+        auto & ldt = t.as_local_datetime();
+        t.as_local_datetime_fmt() = {
+            .delimiter = toml::datetime_delimiter_kind::upper_T,
+            // https://datatracker.ietf.org/doc/html/rfc3339#section-5.6
+            .has_seconds = true, // Mandated by TOML 1.0.0
+            .subsecond_precision = normalizeSubsecondPrecision(ldt.time),
+        };
+        return;
+    }
+
+    if (t.is_offset_datetime()) {
+        auto & odt = t.as_offset_datetime();
+        t.as_offset_datetime_fmt() = {
+            .delimiter = toml::datetime_delimiter_kind::upper_T,
+            // https://datatracker.ietf.org/doc/html/rfc3339#section-5.6
+            .has_seconds = true, // Mandated by TOML 1.0.0
+            .subsecond_precision = normalizeSubsecondPrecision(odt.time),
+        };
+        return;
+    }
+
+    if (t.is_local_time()) {
+        auto & lt = t.as_local_time();
+        t.as_local_time_fmt() = {
+            .has_seconds = true, // Mandated by TOML 1.0.0
+            .subsecond_precision = normalizeSubsecondPrecision(lt),
+        };
+        return;
+    }
+}
+
+#endif
+
+static void prim_fromTOML(EvalState & state, const PosIdx pos, Value ** args, Value & val)
 {
     auto toml = state.forceStringNoCtx(*args[0], pos, "while evaluating the argument passed to builtins.fromTOML");
 
     std::istringstream tomlStream(std::string{toml});
 
-    std::function<void(Value &, toml::value)> visit;
+    auto visit = [&](auto & self, Value & v, toml::value t) -> void {
+        switch (t.type()) {
+        case toml::value_t::table: {
+            auto table = toml::get<toml::table>(t);
+            auto attrs = state.buildBindings(table.size());
 
-    visit = [&](Value & v, toml::value t) {
+            for (auto & elem : table) {
+                forceNoNullByte(elem.first);
+                self(self, attrs.alloc(elem.first), elem.second);
+            }
 
-        switch(t.type())
-        {
-            case toml::value_t::table:
-                {
-                    auto table = toml::get<toml::table>(t);
-
-                    size_t size = 0;
-                    for (auto & i : table) { (void) i; size++; }
-
-                    auto attrs = state.buildBindings(size);
-
-                    for(auto & elem : table) {
-                        forceNoNullByte(elem.first);
-                        visit(attrs.alloc(elem.first), elem.second);
-                    }
-
-                    v.mkAttrs(attrs);
-                }
-                break;;
-            case toml::value_t::array:
-                {
-                    auto array = toml::get<std::vector<toml::value>>(t);
-
-                    auto list = state.buildList(array.size());
-                    for (const auto & [n, v] : enumerate(list))
-                        visit(*(v = state.allocValue()), array[n]);
-                    v.mkList(list);
-                }
-                break;;
-            case toml::value_t::boolean:
-                v.mkBool(toml::get<bool>(t));
-                break;;
-            case toml::value_t::integer:
-                v.mkInt(toml::get<int64_t>(t));
-                break;;
-            case toml::value_t::floating:
-                v.mkFloat(toml::get<NixFloat>(t));
-                break;;
-            case toml::value_t::string:
-                {
-                    auto s = toml::get<std::string_view>(t);
-                    forceNoNullByte(s);
-                    v.mkString(s);
-                }
-                break;;
-            case toml::value_t::local_datetime:
-            case toml::value_t::offset_datetime:
-            case toml::value_t::local_date:
-            case toml::value_t::local_time:
-                {
-                    if (experimentalFeatureSettings.isEnabled(Xp::ParseTomlTimestamps)) {
-                        auto attrs = state.buildBindings(2);
-                        attrs.alloc("_type").mkString("timestamp");
-                        std::ostringstream s;
-                        s << t;
-                        auto str = toView(s);
-                        forceNoNullByte(str);
-                        attrs.alloc("value").mkString(str);
-                        v.mkAttrs(attrs);
-                    } else {
-                        throw std::runtime_error("Dates and times are not supported");
-                    }
-                }
-                break;;
-            case toml::value_t::empty:
-                v.mkNull();
-                break;;
+            v.mkAttrs(attrs);
+        } break;
+        case toml::value_t::array: {
+            auto array = toml::get<std::vector<toml::value>>(t);
 
+            auto list = state.buildList(array.size());
+            for (const auto & [n, v] : enumerate(list))
+                self(self, *(v = state.allocValue()), array[n]);
+            v.mkList(list);
+        } break;
+        case toml::value_t::boolean:
+            v.mkBool(toml::get<bool>(t));
+            break;
+        case toml::value_t::integer:
+            v.mkInt(toml::get<int64_t>(t));
+            break;
+        case toml::value_t::floating:
+            v.mkFloat(toml::get<NixFloat>(t));
+            break;
+        case toml::value_t::string: {
+            auto s = toml::get<std::string_view>(t);
+            forceNoNullByte(s);
+            v.mkString(s);
+        } break;
+        case toml::value_t::local_datetime:
+        case toml::value_t::offset_datetime:
+        case toml::value_t::local_date:
+        case toml::value_t::local_time: {
+            if (experimentalFeatureSettings.isEnabled(Xp::ParseTomlTimestamps)) {
+#if HAVE_TOML11_4
+                normalizeDatetimeFormat(t);
+#endif
+                auto attrs = state.buildBindings(2);
+                attrs.alloc("_type").mkStringNoCopy("timestamp");
+                std::ostringstream s;
+                s << t;
+                auto str = toView(s);
+                forceNoNullByte(str);
+                attrs.alloc("value").mkString(str);
+                v.mkAttrs(attrs);
+            } else {
+                throw std::runtime_error("Dates and times are not supported");
+            }
+        } break;
+        case toml::value_t::empty:
+            v.mkNull();
+            break;
         }
     };
 
     try {
-        visit(val, toml::parse(tomlStream, "fromTOML" /* the "filename" */));
+        visit(
+            visit,
+            val,
+            toml::parse(
+                tomlStream,
+                "fromTOML" /* the "filename" */
+#if HAVE_TOML11_4
+                ,
+                toml::spec::v(1, 0, 0) // Be explicit that we are parsing TOML 1.0.0 without extensions
+#endif
+                ));
     } catch (std::exception & e) { // TODO: toml::syntax_error
         state.error<EvalError>("while parsing TOML: %s", e.what()).atPos(pos).debugThrow();
     }
 }
 
-static RegisterPrimOp primop_fromTOML({
-    .name = "fromTOML",
-    .args = {"e"},
-    .doc = R"(
+static RegisterPrimOp primop_fromTOML(
+    {.name = "fromTOML",
+     .args = {"e"},
+     .doc = R"(
       Convert a TOML string to a Nix value. For example,
 
       ```nix
@@ -112,7 +187,6 @@ static RegisterPrimOp primop_fromTOML({
 
       returns the value `{ s = "a"; table = { y = 2; }; x = 1; }`.
     )",
-    .fun = prim_fromTOML
-});
+     .fun = prim_fromTOML});
 
-}
+} // namespace nix
diff --git a/src/libexpr/print-ambiguous.cc b/src/libexpr/print-ambiguous.cc
index 2a0b009eb..8b80e2a66 100644
--- a/src/libexpr/print-ambiguous.cc
+++ b/src/libexpr/print-ambiguous.cc
@@ -7,11 +7,7 @@ namespace nix {
 
 // See: https://github.com/NixOS/nix/issues/9730
 void printAmbiguous(
-    Value &v,
-    const SymbolTable &symbols,
-    std::ostream &str,
-    std::set<const void *> *seen,
-    int depth)
+    Value & v, const SymbolTable & symbols, std::ostream & str, std::set<const void *> * seen, int depth)
 {
     checkInterrupt();
 
@@ -100,4 +96,4 @@ void printAmbiguous(
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index 1f0c592c1..071addc1a 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -1,5 +1,4 @@
 #include <limits>
-#include <unordered_set>
 #include <sstream>
 
 #include "nix/expr/print.hh"
@@ -10,6 +9,8 @@
 #include "nix/util/english.hh"
 #include "nix/expr/eval.hh"
 
+#include <boost/unordered/unordered_flat_set.hpp>
+
 namespace nix {
 
 void printElided(
@@ -28,9 +29,7 @@ void printElided(
         output << ANSI_NORMAL;
 }
 
-
-std::ostream &
-printLiteralString(std::ostream & str, const std::string_view string, size_t maxLength, bool ansiColors)
+std::ostream & printLiteralString(std::ostream & str, const std::string_view string, size_t maxLength, bool ansiColors)
 {
     size_t charsPrinted = 0;
     if (ansiColors)
@@ -43,12 +42,18 @@ printLiteralString(std::ostream & str, const std::string_view string, size_t max
             return str;
         }
 
-        if (*i == '\"' || *i == '\\') str << "\\" << *i;
-        else if (*i == '\n') str << "\\n";
-        else if (*i == '\r') str << "\\r";
-        else if (*i == '\t') str << "\\t";
-        else if (*i == '$' && *(i+1) == '{') str << "\\" << *i;
-        else str << *i;
+        if (*i == '\"' || *i == '\\')
+            str << "\\" << *i;
+        else if (*i == '\n')
+            str << "\\n";
+        else if (*i == '\r')
+            str << "\\r";
+        else if (*i == '\t')
+            str << "\\t";
+        else if (*i == '$' && *(i + 1) == '{')
+            str << "\\" << *i;
+        else
+            str << *i;
         charsPrinted++;
     }
     str << "\"";
@@ -57,14 +62,12 @@ printLiteralString(std::ostream & str, const std::string_view string, size_t max
     return str;
 }
 
-std::ostream &
-printLiteralString(std::ostream & str, const std::string_view string)
+std::ostream & printLiteralString(std::ostream & str, const std::string_view string)
 {
     return printLiteralString(str, string, std::numeric_limits<size_t>::max(), false);
 }
 
-std::ostream &
-printLiteralBool(std::ostream & str, bool boolean)
+std::ostream & printLiteralBool(std::ostream & str, bool boolean)
 {
     str << (boolean ? "true" : "false");
     return str;
@@ -79,14 +82,13 @@ printLiteralBool(std::ostream & str, bool boolean)
 // For example `or' doesn't need to be quoted.
 bool isReservedKeyword(const std::string_view str)
 {
-    static const std::unordered_set<std::string_view> reservedKeywords = {
-        "if", "then", "else", "assert", "with", "let", "in", "rec", "inherit"
-    };
+    static const boost::unordered_flat_set<std::string_view> reservedKeywords = {
+        "if", "then", "else", "assert", "with", "let", "in", "rec", "inherit"};
     return reservedKeywords.contains(str);
 }
 
-std::ostream &
-printIdentifier(std::ostream & str, std::string_view s) {
+std::ostream & printIdentifier(std::ostream & str, std::string_view s)
+{
     if (s.empty())
         str << "\"\"";
     else if (isReservedKeyword(s))
@@ -98,10 +100,8 @@ printIdentifier(std::ostream & str, std::string_view s) {
             return str;
         }
         for (auto c : s)
-            if (!((c >= 'a' && c <= 'z') ||
-                  (c >= 'A' && c <= 'Z') ||
-                  (c >= '0' && c <= '9') ||
-                  c == '_' || c == '\'' || c == '-')) {
+            if (!((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '_' || c == '\''
+                  || c == '-')) {
                 printLiteralString(str, s);
                 return str;
             }
@@ -112,21 +112,22 @@ printIdentifier(std::ostream & str, std::string_view s) {
 
 static bool isVarName(std::string_view s)
 {
-    if (s.size() == 0) return false;
-    if (isReservedKeyword(s)) return false;
+    if (s.size() == 0)
+        return false;
+    if (isReservedKeyword(s))
+        return false;
     char c = s[0];
-    if ((c >= '0' && c <= '9') || c == '-' || c == '\'') return false;
+    if ((c >= '0' && c <= '9') || c == '-' || c == '\'')
+        return false;
     for (auto & i : s)
-        if (!((i >= 'a' && i <= 'z') ||
-              (i >= 'A' && i <= 'Z') ||
-              (i >= '0' && i <= '9') ||
-              i == '_' || i == '-' || i == '\''))
+        if (!((i >= 'a' && i <= 'z') || (i >= 'A' && i <= 'Z') || (i >= '0' && i <= '9') || i == '_' || i == '-'
+              || i == '\''))
             return false;
     return true;
 }
 
-std::ostream &
-printAttributeName(std::ostream & str, std::string_view name) {
+std::ostream & printAttributeName(std::ostream & str, std::string_view name)
+{
     if (isVarName(name))
         str << name;
     else
@@ -134,7 +135,7 @@ printAttributeName(std::ostream & str, std::string_view name) {
     return str;
 }
 
-bool isImportantAttrName(const std::string& attrName)
+bool isImportantAttrName(const std::string & attrName)
 {
     return attrName == "type" || attrName == "_type";
 }
@@ -144,12 +145,11 @@ typedef std::pair<std::string, Value *> AttrPair;
 struct ImportantFirstAttrNameCmp
 {
 
-    bool operator()(const AttrPair& lhs, const AttrPair& rhs) const
+    bool operator()(const AttrPair & lhs, const AttrPair & rhs) const
     {
         auto lhsIsImportant = isImportantAttrName(lhs.first);
         auto rhsIsImportant = isImportantAttrName(rhs.first);
-        return std::forward_as_tuple(!lhsIsImportant, lhs.first)
-            < std::forward_as_tuple(!rhsIsImportant, rhs.first);
+        return std::forward_as_tuple(!lhsIsImportant, lhs.first) < std::forward_as_tuple(!rhsIsImportant, rhs.first);
     }
 };
 
@@ -273,9 +273,10 @@ private:
     void printDerivation(Value & v)
     {
         std::optional<StorePath> storePath;
-        if (auto i = v.attrs()->get(state.sDrvPath)) {
+        if (auto i = v.attrs()->get(state.s.drvPath)) {
             NixStringContext context;
-            storePath = state.coerceToStorePath(i->pos, *i->value, context, "while evaluating the drvPath of a derivation");
+            storePath =
+                state.coerceToStorePath(i->pos, *i->value, context, "while evaluating the drvPath of a derivation");
         }
 
         /* This unfortunately breaks printing nested values because of
@@ -499,10 +500,10 @@ private:
                 output << ANSI_NORMAL;
         } else if (v.isThunk() || v.isApp()) {
             if (options.ansiColors)
-                    output << ANSI_MAGENTA;
+                output << ANSI_MAGENTA;
             output << "«thunk»";
             if (options.ansiColors)
-                    output << ANSI_NORMAL;
+                output << ANSI_NORMAL;
         } else {
             unreachable();
         }
@@ -593,8 +594,7 @@ private:
             }
         } catch (Error & e) {
             if (options.errors == ErrorPrintBehavior::Throw
-                || (options.errors == ErrorPrintBehavior::ThrowTopLevel
-                    && depth == 0)) {
+                || (options.errors == ErrorPrintBehavior::ThrowTopLevel && depth == 0)) {
                 throw;
             }
             printError_(e);
@@ -603,7 +603,11 @@ private:
 
 public:
     Printer(std::ostream & output, EvalState & state, PrintOptions options)
-        : output(output), state(state), options(options) { }
+        : output(output)
+        , state(state)
+        , options(options)
+    {
+    }
 
     void print(Value & v)
     {
@@ -636,8 +640,8 @@ std::ostream & operator<<(std::ostream & output, const ValuePrinter & printer)
 template<>
 HintFmt & HintFmt::operator%(const ValuePrinter & value)
 {
-        fmt % value;
-        return *this;
+    fmt % value;
+    return *this;
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/search-path.cc b/src/libexpr/search-path.cc
index 76aecd4e5..5912c6129 100644
--- a/src/libexpr/search-path.cc
+++ b/src/libexpr/search-path.cc
@@ -2,8 +2,7 @@
 
 namespace nix {
 
-std::optional<std::string_view> LookupPath::Prefix::suffixIfPotentialMatch(
-    std::string_view path) const
+std::optional<std::string_view> LookupPath::Prefix::suffixIfPotentialMatch(std::string_view path) const
 {
     auto n = s.size();
 
@@ -21,29 +20,25 @@ std::optional<std::string_view> LookupPath::Prefix::suffixIfPotentialMatch(
     }
 
     /* Skip next path separator. */
-    return {
-        path.substr(needSeparator ? n + 1 : n)
-    };
+    return {path.substr(needSeparator ? n + 1 : n)};
 }
 
-
 LookupPath::Elem LookupPath::Elem::parse(std::string_view rawElem)
 {
     size_t pos = rawElem.find('=');
 
-    return LookupPath::Elem {
-        .prefix = Prefix {
-            .s = pos == std::string::npos
-                ? std::string { "" }
-                : std::string { rawElem.substr(0, pos) },
-        },
-        .path = Path {
-            .s = std::string { rawElem.substr(pos + 1) },
-        },
+    return LookupPath::Elem{
+        .prefix =
+            Prefix{
+                .s = pos == std::string::npos ? std::string{""} : std::string{rawElem.substr(0, pos)},
+            },
+        .path =
+            Path{
+                .s = std::string{rawElem.substr(pos + 1)},
+            },
     };
 }
 
-
 LookupPath LookupPath::parse(const Strings & rawElems)
 {
     LookupPath res;
@@ -52,4 +47,4 @@ LookupPath LookupPath::parse(const Strings & rawElems)
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libexpr/value-to-json.cc b/src/libexpr/value-to-json.cc
index a9b51afa0..2cd853f60 100644
--- a/src/libexpr/value-to-json.cc
+++ b/src/libexpr/value-to-json.cc
@@ -7,107 +7,109 @@
 #include <iomanip>
 #include <nlohmann/json.hpp>
 
-
 namespace nix {
 using json = nlohmann::json;
+
 // TODO: rename. It doesn't print.
-json printValueAsJSON(EvalState & state, bool strict,
-    Value & v, const PosIdx pos, NixStringContext & context, bool copyToStore)
+json printValueAsJSON(
+    EvalState & state, bool strict, Value & v, const PosIdx pos, NixStringContext & context, bool copyToStore)
 {
     checkInterrupt();
 
-    if (strict) state.forceValue(v, pos);
+    if (strict)
+        state.forceValue(v, pos);
 
     json out;
 
     switch (v.type()) {
 
-        case nInt:
-            out = v.integer().value;
-            break;
+    case nInt:
+        out = v.integer().value;
+        break;
 
-        case nBool:
-            out = v.boolean();
-            break;
+    case nBool:
+        out = v.boolean();
+        break;
 
-        case nString:
-            copyContext(v, context);
-            out = v.c_str();
-            break;
+    case nString:
+        copyContext(v, context);
+        out = v.c_str();
+        break;
 
-        case nPath:
-            if (copyToStore)
-                out = state.store->printStorePath(
-                    state.copyPathToStore(context, v.path()));
-            else
-                out = v.path().path.abs();
-            break;
+    case nPath:
+        if (copyToStore)
+            out = state.store->printStorePath(state.copyPathToStore(context, v.path()));
+        else
+            out = v.path().path.abs();
+        break;
 
-        case nNull:
-            // already initialized as null
-            break;
+    case nNull:
+        // already initialized as null
+        break;
 
-        case nAttrs: {
-            auto maybeString = state.tryAttrsToString(pos, v, context, false, false);
-            if (maybeString) {
-                out = *maybeString;
-                break;
-            }
-            if (auto i = v.attrs()->get(state.sOutPath))
-                return printValueAsJSON(state, strict, *i->value, i->pos, context, copyToStore);
-            else {
-                out = json::object();
-                for (auto & a : v.attrs()->lexicographicOrder(state.symbols)) {
-                    try {
-                        out.emplace(state.symbols[a->name], printValueAsJSON(state, strict, *a->value, a->pos, context, copyToStore));
-                    } catch (Error & e) {
-                        e.addTrace(state.positions[a->pos],
-                            HintFmt("while evaluating attribute '%1%'", state.symbols[a->name]));
-                        throw;
-                    }
-                }
-            }
+    case nAttrs: {
+        auto maybeString = state.tryAttrsToString(pos, v, context, false, false);
+        if (maybeString) {
+            out = *maybeString;
             break;
         }
-
-        case nList: {
-            out = json::array();
-            int i = 0;
-            for (auto elem : v.listView()) {
+        if (auto i = v.attrs()->get(state.s.outPath))
+            return printValueAsJSON(state, strict, *i->value, i->pos, context, copyToStore);
+        else {
+            out = json::object();
+            for (auto & a : v.attrs()->lexicographicOrder(state.symbols)) {
                 try {
-                    out.push_back(printValueAsJSON(state, strict, *elem, pos, context, copyToStore));
+                    out.emplace(
+                        state.symbols[a->name],
+                        printValueAsJSON(state, strict, *a->value, a->pos, context, copyToStore));
                 } catch (Error & e) {
-                    e.addTrace(state.positions[pos],
-                        HintFmt("while evaluating list element at index %1%", i));
+                    e.addTrace(
+                        state.positions[a->pos], HintFmt("while evaluating attribute '%1%'", state.symbols[a->name]));
                     throw;
                 }
-                i++;
             }
-            break;
         }
+        break;
+    }
 
-        case nExternal:
-            return v.external()->printValueAsJSON(state, strict, context, copyToStore);
-            break;
+    case nList: {
+        out = json::array();
+        int i = 0;
+        for (auto elem : v.listView()) {
+            try {
+                out.push_back(printValueAsJSON(state, strict, *elem, pos, context, copyToStore));
+            } catch (Error & e) {
+                e.addTrace(state.positions[pos], HintFmt("while evaluating list element at index %1%", i));
+                throw;
+            }
+            i++;
+        }
+        break;
+    }
 
-        case nFloat:
-            out = v.fpoint();
-            break;
+    case nExternal:
+        return v.external()->printValueAsJSON(state, strict, context, copyToStore);
+        break;
 
-        case nThunk:
-        case nFunction:
-            state.error<TypeError>(
-                "cannot convert %1% to JSON",
-                showType(v)
-            )
-            .atPos(v.determinePos(pos))
-            .debugThrow();
+    case nFloat:
+        out = v.fpoint();
+        break;
+
+    case nThunk:
+    case nFunction:
+        state.error<TypeError>("cannot convert %1% to JSON", showType(v)).atPos(v.determinePos(pos)).debugThrow();
     }
     return out;
 }
 
-void printValueAsJSON(EvalState & state, bool strict,
-    Value & v, const PosIdx pos, std::ostream & str, NixStringContext & context, bool copyToStore)
+void printValueAsJSON(
+    EvalState & state,
+    bool strict,
+    Value & v,
+    const PosIdx pos,
+    std::ostream & str,
+    NixStringContext & context,
+    bool copyToStore)
 {
     try {
         str << printValueAsJSON(state, strict, v, pos, context, copyToStore);
@@ -116,12 +118,10 @@ void printValueAsJSON(EvalState & state, bool strict,
     }
 }
 
-json ExternalValueBase::printValueAsJSON(EvalState & state, bool strict,
-    NixStringContext & context, bool copyToStore) const
+json ExternalValueBase::printValueAsJSON(
+    EvalState & state, bool strict, NixStringContext & context, bool copyToStore) const
 {
-    state.error<TypeError>("cannot convert %1% to JSON", showType())
-    .debugThrow();
+    state.error<TypeError>("cannot convert %1% to JSON", showType()).debugThrow();
 }
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/value-to-xml.cc b/src/libexpr/value-to-xml.cc
index 235ef2627..31400e439 100644
--- a/src/libexpr/value-to-xml.cc
+++ b/src/libexpr/value-to-xml.cc
@@ -5,10 +5,8 @@
 
 #include <cstdlib>
 
-
 namespace nix {
 
-
 static XMLAttrs singletonAttrs(const std::string & name, std::string_view value)
 {
     XMLAttrs attrs;
@@ -16,12 +14,16 @@ static XMLAttrs singletonAttrs(const std::string & name, std::string_view value)
     return attrs;
 }
 
-
-static void printValueAsXML(EvalState & state, bool strict, bool location,
-    Value & v, XMLWriter & doc, NixStringContext & context, PathSet & drvsSeen,
+static void printValueAsXML(
+    EvalState & state,
+    bool strict,
+    bool location,
+    Value & v,
+    XMLWriter & doc,
+    NixStringContext & context,
+    PathSet & drvsSeen,
     const PosIdx pos);
 
-
 static void posToXML(EvalState & state, XMLAttrs & xmlAttrs, const Pos & pos)
 {
     if (auto path = std::get_if<SourcePath>(&pos.origin))
@@ -30,142 +32,167 @@ static void posToXML(EvalState & state, XMLAttrs & xmlAttrs, const Pos & pos)
     xmlAttrs["column"] = fmt("%1%", pos.column);
 }
 
-
-static void showAttrs(EvalState & state, bool strict, bool location,
-    const Bindings & attrs, XMLWriter & doc, NixStringContext & context, PathSet & drvsSeen)
+static void showAttrs(
+    EvalState & state,
+    bool strict,
+    bool location,
+    const Bindings & attrs,
+    XMLWriter & doc,
+    NixStringContext & context,
+    PathSet & drvsSeen)
 {
     StringSet names;
 
     for (auto & a : attrs.lexicographicOrder(state.symbols)) {
         XMLAttrs xmlAttrs;
         xmlAttrs["name"] = state.symbols[a->name];
-        if (location && a->pos) posToXML(state, xmlAttrs, state.positions[a->pos]);
+        if (location && a->pos)
+            posToXML(state, xmlAttrs, state.positions[a->pos]);
 
         XMLOpenElement _(doc, "attr", xmlAttrs);
-        printValueAsXML(state, strict, location,
-            *a->value, doc, context, drvsSeen, a->pos);
+        printValueAsXML(state, strict, location, *a->value, doc, context, drvsSeen, a->pos);
     }
 }
 
-
-static void printValueAsXML(EvalState & state, bool strict, bool location,
-    Value & v, XMLWriter & doc, NixStringContext & context, PathSet & drvsSeen,
+static void printValueAsXML(
+    EvalState & state,
+    bool strict,
+    bool location,
+    Value & v,
+    XMLWriter & doc,
+    NixStringContext & context,
+    PathSet & drvsSeen,
     const PosIdx pos)
 {
     checkInterrupt();
 
-    if (strict) state.forceValue(v, pos);
+    if (strict)
+        state.forceValue(v, pos);
 
     switch (v.type()) {
 
-        case nInt:
-            doc.writeEmptyElement("int", singletonAttrs("value", fmt("%1%", v.integer())));
-            break;
+    case nInt:
+        doc.writeEmptyElement("int", singletonAttrs("value", fmt("%1%", v.integer())));
+        break;
 
-        case nBool:
-            doc.writeEmptyElement("bool", singletonAttrs("value", v.boolean() ? "true" : "false"));
-            break;
+    case nBool:
+        doc.writeEmptyElement("bool", singletonAttrs("value", v.boolean() ? "true" : "false"));
+        break;
 
-        case nString:
-            /* !!! show the context? */
-            copyContext(v, context);
-            doc.writeEmptyElement("string", singletonAttrs("value", v.c_str()));
-            break;
+    case nString:
+        /* !!! show the context? */
+        copyContext(v, context);
+        doc.writeEmptyElement("string", singletonAttrs("value", v.c_str()));
+        break;
 
-        case nPath:
-            doc.writeEmptyElement("path", singletonAttrs("value", v.path().to_string()));
-            break;
+    case nPath:
+        doc.writeEmptyElement("path", singletonAttrs("value", v.path().to_string()));
+        break;
 
-        case nNull:
-            doc.writeEmptyElement("null");
-            break;
+    case nNull:
+        doc.writeEmptyElement("null");
+        break;
 
-        case nAttrs:
-            if (state.isDerivation(v)) {
-                XMLAttrs xmlAttrs;
-
-                Path drvPath;
-                if (auto a = v.attrs()->get(state.sDrvPath)) {
-                    if (strict) state.forceValue(*a->value, a->pos);
-                    if (a->value->type() == nString)
-                        xmlAttrs["drvPath"] = drvPath = a->value->c_str();
-                }
-
-                if (auto a = v.attrs()->get(state.sOutPath)) {
-                    if (strict) state.forceValue(*a->value, a->pos);
-                    if (a->value->type() == nString)
-                        xmlAttrs["outPath"] = a->value->c_str();
-                }
-
-                XMLOpenElement _(doc, "derivation", xmlAttrs);
-
-                if (drvPath != "" && drvsSeen.insert(drvPath).second)
-                    showAttrs(state, strict, location, *v.attrs(), doc, context, drvsSeen);
-                else
-                    doc.writeEmptyElement("repeated");
-            }
-
-            else {
-                XMLOpenElement _(doc, "attrs");
-                showAttrs(state, strict, location, *v.attrs(), doc, context, drvsSeen);
-            }
-
-            break;
-
-        case nList: {
-            XMLOpenElement _(doc, "list");
-            for (auto v2 : v.listView())
-                printValueAsXML(state, strict, location, *v2, doc, context, drvsSeen, pos);
-            break;
-        }
-
-        case nFunction: {
-            if (!v.isLambda()) {
-                // FIXME: Serialize primops and primopapps
-                doc.writeEmptyElement("unevaluated");
-                break;
-            }
+    case nAttrs:
+        if (state.isDerivation(v)) {
             XMLAttrs xmlAttrs;
-            if (location) posToXML(state, xmlAttrs, state.positions[v.lambda().fun->pos]);
-            XMLOpenElement _(doc, "function", xmlAttrs);
 
-            if (v.lambda().fun->hasFormals()) {
-                XMLAttrs attrs;
-                if (v.lambda().fun->arg) attrs["name"] = state.symbols[v.lambda().fun->arg];
-                if (v.lambda().fun->formals->ellipsis) attrs["ellipsis"] = "1";
-                XMLOpenElement _(doc, "attrspat", attrs);
-                for (auto & i : v.lambda().fun->formals->lexicographicOrder(state.symbols))
-                    doc.writeEmptyElement("attr", singletonAttrs("name", state.symbols[i.name]));
-            } else
-                doc.writeEmptyElement("varpat", singletonAttrs("name", state.symbols[v.lambda().fun->arg]));
+            Path drvPath;
+            if (auto a = v.attrs()->get(state.s.drvPath)) {
+                if (strict)
+                    state.forceValue(*a->value, a->pos);
+                if (a->value->type() == nString)
+                    xmlAttrs["drvPath"] = drvPath = a->value->c_str();
+            }
 
-            break;
+            if (auto a = v.attrs()->get(state.s.outPath)) {
+                if (strict)
+                    state.forceValue(*a->value, a->pos);
+                if (a->value->type() == nString)
+                    xmlAttrs["outPath"] = a->value->c_str();
+            }
+
+            XMLOpenElement _(doc, "derivation", xmlAttrs);
+
+            if (drvPath != "" && drvsSeen.insert(drvPath).second)
+                showAttrs(state, strict, location, *v.attrs(), doc, context, drvsSeen);
+            else
+                doc.writeEmptyElement("repeated");
         }
 
-        case nExternal:
-            v.external()->printValueAsXML(state, strict, location, doc, context, drvsSeen, pos);
-            break;
+        else {
+            XMLOpenElement _(doc, "attrs");
+            showAttrs(state, strict, location, *v.attrs(), doc, context, drvsSeen);
+        }
 
-        case nFloat:
-            doc.writeEmptyElement("float", singletonAttrs("value", fmt("%1%", v.fpoint())));
-            break;
+        break;
 
-        case nThunk:
+    case nList: {
+        XMLOpenElement _(doc, "list");
+        for (auto v2 : v.listView())
+            printValueAsXML(state, strict, location, *v2, doc, context, drvsSeen, pos);
+        break;
+    }
+
+    case nFunction: {
+        if (!v.isLambda()) {
+            // FIXME: Serialize primops and primopapps
             doc.writeEmptyElement("unevaluated");
+            break;
+        }
+        XMLAttrs xmlAttrs;
+        if (location)
+            posToXML(state, xmlAttrs, state.positions[v.lambda().fun->pos]);
+        XMLOpenElement _(doc, "function", xmlAttrs);
+
+        if (v.lambda().fun->hasFormals()) {
+            XMLAttrs attrs;
+            if (v.lambda().fun->arg)
+                attrs["name"] = state.symbols[v.lambda().fun->arg];
+            if (v.lambda().fun->formals->ellipsis)
+                attrs["ellipsis"] = "1";
+            XMLOpenElement _(doc, "attrspat", attrs);
+            for (auto & i : v.lambda().fun->formals->lexicographicOrder(state.symbols))
+                doc.writeEmptyElement("attr", singletonAttrs("name", state.symbols[i.name]));
+        } else
+            doc.writeEmptyElement("varpat", singletonAttrs("name", state.symbols[v.lambda().fun->arg]));
+
+        break;
+    }
+
+    case nExternal:
+        v.external()->printValueAsXML(state, strict, location, doc, context, drvsSeen, pos);
+        break;
+
+    case nFloat:
+        doc.writeEmptyElement("float", singletonAttrs("value", fmt("%1%", v.fpoint())));
+        break;
+
+    case nThunk:
+        doc.writeEmptyElement("unevaluated");
     }
 }
 
-
-void ExternalValueBase::printValueAsXML(EvalState & state, bool strict,
-    bool location, XMLWriter & doc, NixStringContext & context, PathSet & drvsSeen,
+void ExternalValueBase::printValueAsXML(
+    EvalState & state,
+    bool strict,
+    bool location,
+    XMLWriter & doc,
+    NixStringContext & context,
+    PathSet & drvsSeen,
     const PosIdx pos) const
 {
     doc.writeEmptyElement("unevaluated");
 }
 
-
-void printValueAsXML(EvalState & state, bool strict, bool location,
-    Value & v, std::ostream & out, NixStringContext & context, const PosIdx pos)
+void printValueAsXML(
+    EvalState & state,
+    bool strict,
+    bool location,
+    Value & v,
+    std::ostream & out,
+    NixStringContext & context,
+    const PosIdx pos)
 {
     XMLWriter doc(true, out);
     XMLOpenElement root(doc, "expr");
@@ -173,5 +200,4 @@ void printValueAsXML(EvalState & state, bool strict, bool location,
     printValueAsXML(state, strict, location, v, doc, context, drvsSeen, pos);
 }
 
-
-}
+} // namespace nix
diff --git a/src/libexpr/value.cc b/src/libexpr/value.cc
new file mode 100644
index 000000000..07d036b0d
--- /dev/null
+++ b/src/libexpr/value.cc
@@ -0,0 +1,29 @@
+#include "nix/expr/value.hh"
+
+namespace nix {
+
+Value Value::vEmptyList = []() {
+    Value res;
+    res.setStorage(List{.size = 0, .elems = nullptr});
+    return res;
+}();
+
+Value Value::vNull = []() {
+    Value res;
+    res.mkNull();
+    return res;
+}();
+
+Value Value::vTrue = []() {
+    Value res;
+    res.mkBool(true);
+    return res;
+}();
+
+Value Value::vFalse = []() {
+    Value res;
+    res.mkBool(false);
+    return res;
+}();
+
+} // namespace nix
diff --git a/src/libexpr/value/context.cc b/src/libexpr/value/context.cc
index 40d08da59..6eb313211 100644
--- a/src/libexpr/value/context.cc
+++ b/src/libexpr/value/context.cc
@@ -5,9 +5,7 @@
 
 namespace nix {
 
-NixStringContextElem NixStringContextElem::parse(
-    std::string_view s0,
-    const ExperimentalFeatureSettings & xpSettings)
+NixStringContextElem NixStringContextElem::parse(std::string_view s0, const ExperimentalFeatureSettings & xpSettings)
 {
     std::string_view s = s0;
 
@@ -16,16 +14,16 @@ NixStringContextElem NixStringContextElem::parse(
         // Case on whether there is a '!'
         size_t index = s.find("!");
         if (index == std::string_view::npos) {
-            return SingleDerivedPath::Opaque {
-                .path = StorePath { s },
+            return SingleDerivedPath::Opaque{
+                .path = StorePath{s},
             };
         } else {
-            std::string output { s.substr(0, index) };
+            std::string output{s.substr(0, index)};
             // Advance string to parse after the '!'
             s = s.substr(index + 1);
             auto drv = make_ref<SingleDerivedPath>(parseRest());
             drvRequireExperiment(*drv, xpSettings);
-            return SingleDerivedPath::Built {
+            return SingleDerivedPath::Built{
                 .drvPath = std::move(drv),
                 .output = std::move(output),
             };
@@ -33,8 +31,7 @@ NixStringContextElem NixStringContextElem::parse(
     };
 
     if (s.size() == 0) {
-        throw BadNixStringContextElem(s0,
-            "String context element should never be an empty string");
+        throw BadNixStringContextElem(s0, "String context element should never be an empty string");
     }
 
     switch (s.at(0)) {
@@ -44,28 +41,23 @@ NixStringContextElem NixStringContextElem::parse(
 
         // Find *second* '!'
         if (s.find("!") == std::string_view::npos) {
-            throw BadNixStringContextElem(s0,
-                "String content element beginning with '!' should have a second '!'");
+            throw BadNixStringContextElem(s0, "String content element beginning with '!' should have a second '!'");
         }
 
-        return std::visit(
-            [&](auto x) -> NixStringContextElem { return std::move(x); },
-            parseRest());
+        return std::visit([&](auto x) -> NixStringContextElem { return std::move(x); }, parseRest());
     }
     case '=': {
-        return NixStringContextElem::DrvDeep {
-            .drvPath = StorePath { s.substr(1) },
+        return NixStringContextElem::DrvDeep{
+            .drvPath = StorePath{s.substr(1)},
         };
     }
     default: {
         // Ensure no '!'
         if (s.find("!") != std::string_view::npos) {
-            throw BadNixStringContextElem(s0,
-                "String content element not beginning with '!' should not have a second '!'");
+            throw BadNixStringContextElem(
+                s0, "String content element not beginning with '!' should not have a second '!'");
         }
-        return std::visit(
-            [&](auto x) -> NixStringContextElem { return std::move(x); },
-            parseRest());
+        return std::visit([&](auto x) -> NixStringContextElem { return std::move(x); }, parseRest());
     }
     }
 }
@@ -76,33 +68,33 @@ std::string NixStringContextElem::to_string() const
 
     std::function<void(const SingleDerivedPath &)> toStringRest;
     toStringRest = [&](auto & p) {
-        std::visit(overloaded {
-            [&](const SingleDerivedPath::Opaque & o) {
-                res += o.path.to_string();
+        std::visit(
+            overloaded{
+                [&](const SingleDerivedPath::Opaque & o) { res += o.path.to_string(); },
+                [&](const SingleDerivedPath::Built & o) {
+                    res += o.output;
+                    res += '!';
+                    toStringRest(*o.drvPath);
+                },
             },
-            [&](const SingleDerivedPath::Built & o) {
-                res += o.output;
-                res += '!';
-                toStringRest(*o.drvPath);
-            },
-        }, p.raw());
+            p.raw());
     };
 
-    std::visit(overloaded {
-        [&](const NixStringContextElem::Built & b) {
-            res += '!';
-            toStringRest(b);
+    std::visit(
+        overloaded{
+            [&](const NixStringContextElem::Built & b) {
+                res += '!';
+                toStringRest(b);
+            },
+            [&](const NixStringContextElem::Opaque & o) { toStringRest(o); },
+            [&](const NixStringContextElem::DrvDeep & d) {
+                res += '=';
+                res += d.drvPath.to_string();
+            },
         },
-        [&](const NixStringContextElem::Opaque & o) {
-            toStringRest(o);
-        },
-        [&](const NixStringContextElem::DrvDeep & d) {
-            res += '=';
-            res += d.drvPath.to_string();
-        },
-    }, raw);
+        raw);
 
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libfetchers-c/meson.build b/src/libfetchers-c/meson.build
index e34997f09..8542744b4 100644
--- a/src/libfetchers-c/meson.build
+++ b/src/libfetchers-c/meson.build
@@ -1,7 +1,9 @@
-project('nix-fetchers-c', 'cpp',
+project(
+  'nix-fetchers-c',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -35,7 +37,7 @@ sources = files(
   'nix_api_fetchers.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 headers = files(
   'nix_api_fetchers.h',
@@ -53,7 +55,7 @@ this_library = library(
   sources,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libfetchers-c/nix_api_fetchers.cc b/src/libfetchers-c/nix_api_fetchers.cc
index 4e8037a5e..7fefedb0c 100644
--- a/src/libfetchers-c/nix_api_fetchers.cc
+++ b/src/libfetchers-c/nix_api_fetchers.cc
@@ -2,6 +2,8 @@
 #include "nix_api_fetchers_internal.hh"
 #include "nix_api_util_internal.h"
 
+extern "C" {
+
 nix_fetchers_settings * nix_fetchers_settings_new(nix_c_context * context)
 {
     try {
@@ -17,3 +19,5 @@ void nix_fetchers_settings_free(nix_fetchers_settings * settings)
 {
     delete settings;
 }
+
+} // extern "C"
diff --git a/src/libfetchers-tests/access-tokens.cc b/src/libfetchers-tests/access-tokens.cc
index 93043ba3e..7127434db 100644
--- a/src/libfetchers-tests/access-tokens.cc
+++ b/src/libfetchers-tests/access-tokens.cc
@@ -19,6 +19,7 @@ public:
     {
         experimentalFeatureSettings.experimentalFeatures.get().insert(Xp::Flakes);
     }
+
     void TearDown() override {}
 };
 
@@ -98,4 +99,4 @@ TEST_F(AccessKeysTest, multipleSourceHut)
     ASSERT_EQ(token, "token");
 }
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers-tests/git-utils.cc b/src/libfetchers-tests/git-utils.cc
index c2c7f9da0..f9fae23da 100644
--- a/src/libfetchers-tests/git-utils.cc
+++ b/src/libfetchers-tests/git-utils.cc
@@ -3,20 +3,28 @@
 #include <gmock/gmock.h>
 #include <git2/global.h>
 #include <git2/repository.h>
+#include <git2/signature.h>
 #include <git2/types.h>
+#include <git2/object.h>
+#include <git2/tag.h>
 #include <gtest/gtest.h>
 #include "nix/util/fs-sink.hh"
 #include "nix/util/serialise.hh"
 #include "nix/fetchers/git-lfs-fetch.hh"
 
+#include <git2/blob.h>
+#include <git2/tree.h>
+
 namespace nix {
 
 class GitUtilsTest : public ::testing::Test
 {
     // We use a single repository for all tests.
-    std::filesystem::path tmpDir;
     std::unique_ptr<AutoDelete> delTmpDir;
 
+protected:
+    std::filesystem::path tmpDir;
+
 public:
     void SetUp() override
     {
@@ -115,4 +123,108 @@ TEST_F(GitUtilsTest, sink_hardlink)
     }
 };
 
+TEST_F(GitUtilsTest, peel_reference)
+{
+    // Create a commit in the repo
+    git_repository * rawRepo = nullptr;
+    ASSERT_EQ(git_repository_open(&rawRepo, tmpDir.string().c_str()), 0);
+
+    // Create a blob
+    git_oid blob_oid;
+    const char * blob_content = "hello world";
+    ASSERT_EQ(git_blob_create_from_buffer(&blob_oid, rawRepo, blob_content, strlen(blob_content)), 0);
+
+    // Create a tree with that blob
+    git_treebuilder * builder = nullptr;
+    ASSERT_EQ(git_treebuilder_new(&builder, rawRepo, nullptr), 0);
+    ASSERT_EQ(git_treebuilder_insert(nullptr, builder, "file.txt", &blob_oid, GIT_FILEMODE_BLOB), 0);
+
+    git_oid tree_oid;
+    ASSERT_EQ(git_treebuilder_write(&tree_oid, builder), 0);
+    git_treebuilder_free(builder);
+
+    git_tree * tree = nullptr;
+    ASSERT_EQ(git_tree_lookup(&tree, rawRepo, &tree_oid), 0);
+
+    // Create a commit
+    git_signature * sig = nullptr;
+    ASSERT_EQ(git_signature_now(&sig, "nix", "nix@example.com"), 0);
+
+    git_oid commit_oid;
+    ASSERT_EQ(git_commit_create_v(&commit_oid, rawRepo, "HEAD", sig, sig, nullptr, "initial commit", tree, 0), 0);
+
+    // Lookup our commit
+    git_object * commit_object = nullptr;
+    ASSERT_EQ(git_object_lookup(&commit_object, rawRepo, &commit_oid, GIT_OBJECT_COMMIT), 0);
+
+    // Create annotated tag
+    git_oid tag_oid;
+    ASSERT_EQ(git_tag_create(&tag_oid, rawRepo, "v1", commit_object, sig, "annotated tag", 0), 0);
+
+    auto repo = openRepo();
+
+    // Use resolveRef to get peeled object
+    auto resolved = repo->resolveRef("refs/tags/v1");
+
+    // Now assert that we have unpeeled it!
+    ASSERT_STREQ(resolved.gitRev().c_str(), git_oid_tostr_s(&commit_oid));
+
+    git_signature_free(sig);
+    git_repository_free(rawRepo);
+}
+
+TEST(GitUtils, isLegalRefName)
+{
+    ASSERT_TRUE(isLegalRefName("foox"));
+    ASSERT_TRUE(isLegalRefName("1337"));
+    ASSERT_TRUE(isLegalRefName("foo.baz"));
+    ASSERT_TRUE(isLegalRefName("foo/bar/baz"));
+    ASSERT_TRUE(isLegalRefName("foo./bar"));
+    ASSERT_TRUE(isLegalRefName("heads/foo@bar"));
+    ASSERT_TRUE(isLegalRefName("heads/fu\303\237"));
+    ASSERT_TRUE(isLegalRefName("foo-bar-baz"));
+    ASSERT_TRUE(isLegalRefName("branch#"));
+    ASSERT_TRUE(isLegalRefName("$1"));
+    ASSERT_TRUE(isLegalRefName("foo.locke"));
+
+    ASSERT_FALSE(isLegalRefName("refs///heads/foo"));
+    ASSERT_FALSE(isLegalRefName("heads/foo/"));
+    ASSERT_FALSE(isLegalRefName("///heads/foo"));
+    ASSERT_FALSE(isLegalRefName(".foo"));
+    ASSERT_FALSE(isLegalRefName("./foo"));
+    ASSERT_FALSE(isLegalRefName("./foo/bar"));
+    ASSERT_FALSE(isLegalRefName("foo/./bar"));
+    ASSERT_FALSE(isLegalRefName("foo/bar/."));
+    ASSERT_FALSE(isLegalRefName("foo bar"));
+    ASSERT_FALSE(isLegalRefName("foo?bar"));
+    ASSERT_FALSE(isLegalRefName("foo^bar"));
+    ASSERT_FALSE(isLegalRefName("foo~bar"));
+    ASSERT_FALSE(isLegalRefName("foo:bar"));
+    ASSERT_FALSE(isLegalRefName("foo[bar"));
+    ASSERT_FALSE(isLegalRefName("foo/bar/."));
+    ASSERT_FALSE(isLegalRefName(".refs/foo"));
+    ASSERT_FALSE(isLegalRefName("refs/heads/foo."));
+    ASSERT_FALSE(isLegalRefName("heads/foo..bar"));
+    ASSERT_FALSE(isLegalRefName("heads/foo?bar"));
+    ASSERT_FALSE(isLegalRefName("heads/foo.lock"));
+    ASSERT_FALSE(isLegalRefName("heads///foo.lock"));
+    ASSERT_FALSE(isLegalRefName("foo.lock/bar"));
+    ASSERT_FALSE(isLegalRefName("foo.lock///bar"));
+    ASSERT_FALSE(isLegalRefName("heads/v@{ation"));
+    ASSERT_FALSE(isLegalRefName("heads/foo\bar"));
+
+    ASSERT_FALSE(isLegalRefName("@"));
+    ASSERT_FALSE(isLegalRefName("\37"));
+    ASSERT_FALSE(isLegalRefName("\177"));
+
+    ASSERT_FALSE(isLegalRefName("foo/*"));
+    ASSERT_FALSE(isLegalRefName("*/foo"));
+    ASSERT_FALSE(isLegalRefName("foo/*/bar"));
+    ASSERT_FALSE(isLegalRefName("*"));
+    ASSERT_FALSE(isLegalRefName("foo/*/*"));
+    ASSERT_FALSE(isLegalRefName("*/foo/*"));
+    ASSERT_FALSE(isLegalRefName("/foo"));
+    ASSERT_FALSE(isLegalRefName(""));
+}
+
 } // namespace nix
diff --git a/src/libfetchers-tests/git.cc b/src/libfetchers-tests/git.cc
new file mode 100644
index 000000000..af987e260
--- /dev/null
+++ b/src/libfetchers-tests/git.cc
@@ -0,0 +1,200 @@
+#include "nix/store/store-open.hh"
+#include "nix/store/globals.hh"
+#include "nix/fetchers/fetch-settings.hh"
+#include "nix/fetchers/fetchers.hh"
+#include "nix/fetchers/git-utils.hh"
+
+#include <git2.h>
+#include <gtest/gtest.h>
+
+#include <filesystem>
+
+namespace {
+
+template<class T, void (*F)(T *)>
+struct Deleter
+{
+    void operator()(T * p) const
+    {
+        if (p)
+            F(p);
+    }
+};
+
+template<class T, void (*F)(T *)>
+using Handle = std::unique_ptr<T, Deleter<T, F>>;
+
+using RepoHandle = Handle<git_repository, git_repository_free>;
+using IndexHandle = Handle<git_index, git_index_free>;
+using TreeHandle = Handle<git_tree, git_tree_free>;
+using SigHandle = Handle<git_signature, git_signature_free>;
+using RefHandle = Handle<git_reference, git_reference_free>;
+using CommitHandle = Handle<git_commit, git_commit_free>;
+using SubmoduleHandle = Handle<git_submodule, git_submodule_free>;
+
+#define CHECK_LIBGIT(expr) ASSERT_TRUE((expr) >= 0) << git_error_last()
+
+static void commitAll(git_repository * repo, const char * msg)
+{
+    IndexHandle idx;
+    {
+        git_index * raw = nullptr;
+        CHECK_LIBGIT(git_repository_index(&raw, repo));
+        idx.reset(raw);
+    }
+    CHECK_LIBGIT(git_index_add_all(idx.get(), nullptr, 0, nullptr, nullptr));
+    CHECK_LIBGIT(git_index_write(idx.get()));
+
+    git_oid treeId{};
+    CHECK_LIBGIT(git_index_write_tree(&treeId, idx.get()));
+    TreeHandle tree;
+    {
+        git_tree * raw = nullptr;
+        CHECK_LIBGIT(git_tree_lookup(&raw, repo, &treeId));
+        tree.reset(raw);
+    }
+
+    SigHandle sig;
+    {
+        git_signature * raw = nullptr;
+        CHECK_LIBGIT(git_signature_now(&raw, "you", "you@example.com"));
+        sig.reset(raw);
+    }
+
+    git_oid commitId{};
+    if (git_repository_is_empty(repo) == 1) {
+        CHECK_LIBGIT(git_commit_create_v(&commitId, repo, "HEAD", sig.get(), sig.get(), nullptr, msg, tree.get(), 0));
+        CHECK_LIBGIT(git_reference_create(nullptr, repo, "refs/heads/main", &commitId, true, nullptr));
+        CHECK_LIBGIT(git_repository_set_head(repo, "refs/heads/main"));
+    } else {
+        RefHandle head;
+        {
+            git_reference * raw = nullptr;
+            CHECK_LIBGIT(git_repository_head(&raw, repo));
+            head.reset(raw);
+        }
+        CommitHandle parent;
+        {
+            git_commit * raw = nullptr;
+            CHECK_LIBGIT(git_commit_lookup(&raw, repo, git_reference_target(head.get())));
+            parent.reset(raw);
+        }
+        const git_commit * parents[] = {parent.get()};
+        CHECK_LIBGIT(git_commit_create(
+            &commitId,
+            repo,
+            "HEAD",
+            sig.get(),
+            sig.get(),
+            /*message_encoding=*/nullptr,
+            msg,
+            tree.get(),
+            /*parent_count=*/1,
+            &parents[0]));
+    }
+}
+
+} // namespace
+
+using namespace nix;
+
+class GitTest : public ::testing::Test
+{
+    std::unique_ptr<AutoDelete> delTmpDir;
+
+protected:
+    std::filesystem::path tmpDir;
+
+    void SetUp() override
+    {
+        tmpDir = createTempDir();
+        delTmpDir = std::make_unique<AutoDelete>(tmpDir, /*recursive=*/true);
+        nix::initLibStore(/*loadConfig=*/false);
+        git_libgit2_init();
+    }
+
+    void TearDown() override
+    {
+        delTmpDir.reset();
+    }
+};
+
+// Regression test for https://github.com/NixOS/nix/issues/13215
+TEST_F(GitTest, submodulePeriodSupport)
+{
+    auto storePath = tmpDir / "store";
+    auto repoPath = tmpDir / "repo";
+    auto submodulePath = tmpDir / "submodule";
+
+    // Set up our git directories: one top level and a submodule
+    // the submodule in the .gitmodules has the branch listed as '.'
+
+    // 1) Create sub repo
+    {
+        git_repository * raw = nullptr;
+        CHECK_LIBGIT(git_repository_init(&raw, submodulePath.string().c_str(), /*is_bare=*/0));
+        RepoHandle sub(raw);
+        writeFile(submodulePath / "lib.txt", "hello from submodule\n");
+        commitAll(sub.get(), "init sub");
+    }
+
+    // 2) Create super repo
+    RepoHandle super;
+    {
+        git_repository * raw = nullptr;
+        CHECK_LIBGIT(git_repository_init(&raw, repoPath.string().c_str(), /*is_bare=*/0));
+        super.reset(raw);
+    }
+
+    writeFile(repoPath / "README.md", "# super\n");
+    commitAll(super.get(), "init super");
+
+    // 3) Add submodule at deps/sub
+    {
+        git_repository * raw = nullptr;
+        git_clone_options cloneOpts = GIT_CLONE_OPTIONS_INIT;
+        // clone from local subPath into superPath/deps/sub
+        CHECK_LIBGIT(
+            git_clone(&raw, submodulePath.string().c_str(), (repoPath / "deps" / "sub").string().c_str(), &cloneOpts));
+        RepoHandle sub(raw);
+    }
+
+    // 4) Add submodule and set branch="."
+    SubmoduleHandle sm;
+    {
+        git_submodule * raw = nullptr;
+        CHECK_LIBGIT(git_submodule_add_setup(
+            &raw,
+            super.get(),
+            "../submodule",
+            "deps/sub",
+            /*use_gitlink=*/1));
+        sm.reset(raw);
+    }
+    CHECK_LIBGIT(git_submodule_set_branch(super.get(), git_submodule_name(sm.get()), /*branch=*/"."));
+    CHECK_LIBGIT(git_submodule_sync(sm.get()));
+
+    // 5) Finalize now that the worktree exists; libgit2 can read its HEAD OID
+    CHECK_LIBGIT(git_submodule_add_finalize(sm.get()));
+    // 6) Commit the addition in super
+    commitAll(super.get(), "Add submodule with branch='.'");
+
+    // TODO: Use dummy:// store with MemorySourceAccessor.
+    Path storeTmpDir = createTempDir();
+    auto storeTmpDirAutoDelete = AutoDelete(storeTmpDir, true);
+    ref<Store> store = openStore(storeTmpDir);
+
+    auto settings = fetchers::Settings{};
+    auto input = fetchers::Input::fromAttrs(
+        settings,
+        {
+            {"url", "file://" + repoPath.string()},
+            {"submodules", Explicit{true}},
+            {"type", "git"},
+            {"ref", "main"},
+        });
+
+    auto [accessor, i] = input.getAccessor(store);
+
+    ASSERT_EQ(accessor->readFile(CanonPath("deps/sub/lib.txt")), "hello from submodule\n");
+}
diff --git a/src/libfetchers-tests/meson.build b/src/libfetchers-tests/meson.build
index 33bc7f30e..a18f64d79 100644
--- a/src/libfetchers-tests/meson.build
+++ b/src/libfetchers-tests/meson.build
@@ -1,7 +1,9 @@
-project('nix-fetchers-tests', 'cpp',
+project(
+  'nix-fetchers-tests',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -19,8 +21,7 @@ deps_private_maybe_subproject = [
   dependency('nix-fetchers'),
   dependency('nix-fetchers-c'),
 ]
-deps_public_maybe_subproject = [
-]
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 subdir('nix-meson-build-support/export-all-symbols')
@@ -40,11 +41,12 @@ subdir('nix-meson-build-support/common')
 sources = files(
   'access-tokens.cc',
   'git-utils.cc',
+  'git.cc',
   'nix_api_fetchers.cc',
   'public-key.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 
 this_exe = executable(
@@ -53,7 +55,7 @@ this_exe = executable(
   dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
   # TODO: -lrapidcheck, see ../libutil-support/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   # get main from gtest
   install : true,
 )
@@ -62,7 +64,7 @@ test(
   meson.project_name(),
   this_exe,
   env : {
-    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+    '_NIX_TEST_UNIT_DATA' : meson.current_source_dir() / 'data',
   },
   protocol : 'gtest',
 )
diff --git a/src/libfetchers-tests/package.nix b/src/libfetchers-tests/package.nix
index 48c1a07d8..780618725 100644
--- a/src/libfetchers-tests/package.nix
+++ b/src/libfetchers-tests/package.nix
@@ -3,6 +3,7 @@
   buildPackages,
   stdenv,
   mkMesonExecutable,
+  writableTmpDirAsHomeHook,
 
   nix-fetchers,
   nix-fetchers-c,
@@ -57,18 +58,13 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
           }
-          (
-            lib.optionalString stdenv.hostPlatform.isWindows ''
-              export HOME="$PWD/home-dir"
-              mkdir -p "$HOME"
-            ''
-            + ''
-              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
-              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-              touch $out
-            ''
-          );
+          ''
+            export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+            touch $out
+          '';
     };
   };
 
diff --git a/src/libfetchers-tests/public-key.cc b/src/libfetchers-tests/public-key.cc
index 39a7cf4bd..97a232447 100644
--- a/src/libfetchers-tests/public-key.cc
+++ b/src/libfetchers-tests/public-key.cc
@@ -13,42 +13,44 @@ class PublicKeyTest : public CharacterizationTest
     std::filesystem::path unitTestData = getUnitTestData() / "public-key";
 
 public:
-    std::filesystem::path goldenMaster(std::string_view testStem) const override {
+    std::filesystem::path goldenMaster(std::string_view testStem) const override
+    {
         return unitTestData / testStem;
     }
 };
 
-#define TEST_JSON(FIXTURE, NAME, VAL)                                     \
-    TEST_F(FIXTURE, PublicKey_ ## NAME ## _from_json) {                   \
-        readTest(#NAME ".json", [&](const auto & encoded_) {              \
-            fetchers::PublicKey expected { VAL };                         \
-            fetchers::PublicKey got = nlohmann::json::parse(encoded_);    \
-            ASSERT_EQ(got, expected);                                     \
-        });                                                               \
-    }                                                                     \
-                                                                          \
-    TEST_F(FIXTURE, PublicKey_ ## NAME ## _to_json) {                     \
-        writeTest(#NAME ".json", [&]() -> json {                          \
-            return nlohmann::json(fetchers::PublicKey { VAL });           \
-        }, [](const auto & file) {                                        \
-            return json::parse(readFile(file));                           \
-        }, [](const auto & file, const auto & got) {                      \
-            return writeFile(file, got.dump(2) + "\n");                   \
-        });                                                               \
+#define TEST_JSON(FIXTURE, NAME, VAL)                                                                 \
+    TEST_F(FIXTURE, PublicKey_##NAME##_from_json)                                                     \
+    {                                                                                                 \
+        readTest(#NAME ".json", [&](const auto & encoded_) {                                          \
+            fetchers::PublicKey expected{VAL};                                                        \
+            fetchers::PublicKey got = nlohmann::json::parse(encoded_);                                \
+            ASSERT_EQ(got, expected);                                                                 \
+        });                                                                                           \
+    }                                                                                                 \
+                                                                                                      \
+    TEST_F(FIXTURE, PublicKey_##NAME##_to_json)                                                       \
+    {                                                                                                 \
+        writeTest(                                                                                    \
+            #NAME ".json",                                                                            \
+            [&]() -> json { return nlohmann::json(fetchers::PublicKey{VAL}); },                       \
+            [](const auto & file) { return json::parse(readFile(file)); },                            \
+            [](const auto & file, const auto & got) { return writeFile(file, got.dump(2) + "\n"); }); \
     }
 
-TEST_JSON(PublicKeyTest, simple, (fetchers::PublicKey { .type = "ssh-rsa", .key = "ABCDE" }))
+TEST_JSON(PublicKeyTest, simple, (fetchers::PublicKey{.type = "ssh-rsa", .key = "ABCDE"}))
 
-TEST_JSON(PublicKeyTest, defaultType, fetchers::PublicKey { .key = "ABCDE" })
+TEST_JSON(PublicKeyTest, defaultType, fetchers::PublicKey{.key = "ABCDE"})
 
 #undef TEST_JSON
 
-TEST_F(PublicKeyTest, PublicKey_noRoundTrip_from_json) {
+TEST_F(PublicKeyTest, PublicKey_noRoundTrip_from_json)
+{
     readTest("noRoundTrip.json", [&](const auto & encoded_) {
-        fetchers::PublicKey expected = { .type = "ssh-ed25519", .key = "ABCDE" };
+        fetchers::PublicKey expected = {.type = "ssh-ed25519", .key = "ABCDE"};
         fetchers::PublicKey got = nlohmann::json::parse(encoded_);
         ASSERT_EQ(got, expected);
     });
 }
 
-}
+} // namespace nix
diff --git a/src/libfetchers/attrs.cc b/src/libfetchers/attrs.cc
index 6808e8af1..841808bd1 100644
--- a/src/libfetchers/attrs.cc
+++ b/src/libfetchers/attrs.cc
@@ -15,7 +15,7 @@ Attrs jsonToAttrs(const nlohmann::json & json)
         else if (i.value().is_string())
             attrs.emplace(i.key(), i.value().get<std::string>());
         else if (i.value().is_boolean())
-            attrs.emplace(i.key(), Explicit<bool> { i.value().get<bool>() });
+            attrs.emplace(i.key(), Explicit<bool>{i.value().get<bool>()});
         else
             throw Error("unsupported input attribute type in lock file");
     }
@@ -33,7 +33,8 @@ nlohmann::json attrsToJSON(const Attrs & attrs)
             json[attr.first] = *v;
         } else if (auto v = std::get_if<Explicit<bool>>(&attr.second)) {
             json[attr.first] = v->t;
-        } else unreachable();
+        } else
+            unreachable();
     }
     return json;
 }
@@ -41,7 +42,8 @@ nlohmann::json attrsToJSON(const Attrs & attrs)
 std::optional<std::string> maybeGetStrAttr(const Attrs & attrs, const std::string & name)
 {
     auto i = attrs.find(name);
-    if (i == attrs.end()) return {};
+    if (i == attrs.end())
+        return {};
     if (auto v = std::get_if<std::string>(&i->second))
         return *v;
     throw Error("input attribute '%s' is not a string %s", name, attrsToJSON(attrs).dump());
@@ -58,7 +60,8 @@ std::string getStrAttr(const Attrs & attrs, const std::string & name)
 std::optional<uint64_t> maybeGetIntAttr(const Attrs & attrs, const std::string & name)
 {
     auto i = attrs.find(name);
-    if (i == attrs.end()) return {};
+    if (i == attrs.end())
+        return {};
     if (auto v = std::get_if<uint64_t>(&i->second))
         return *v;
     throw Error("input attribute '%s' is not an integer", name);
@@ -75,7 +78,8 @@ uint64_t getIntAttr(const Attrs & attrs, const std::string & name)
 std::optional<bool> maybeGetBoolAttr(const Attrs & attrs, const std::string & name)
 {
     auto i = attrs.find(name);
-    if (i == attrs.end()) return {};
+    if (i == attrs.end())
+        return {};
     if (auto v = std::get_if<Explicit<bool>>(&i->second))
         return v->t;
     throw Error("input attribute '%s' is not a Boolean", name);
@@ -99,7 +103,8 @@ StringMap attrsToQuery(const Attrs & attrs)
             query.insert_or_assign(attr.first, *v);
         } else if (auto v = std::get_if<Explicit<bool>>(&attr.second)) {
             query.insert_or_assign(attr.first, v->t ? "1" : "0");
-        } else unreachable();
+        } else
+            unreachable();
     }
     return query;
 }
@@ -109,4 +114,4 @@ Hash getRevAttr(const Attrs & attrs, const std::string & name)
     return Hash::parseAny(getStrAttr(attrs, name), HashAlgorithm::SHA1);
 }
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index 9a2531ba5..67361c765 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -4,6 +4,7 @@
 #include "nix/store/sqlite.hh"
 #include "nix/util/sync.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/globals.hh"
 
 #include <nlohmann/json.hpp>
 
@@ -37,53 +38,44 @@ struct CacheImpl : Cache
     {
         auto state(_state.lock());
 
-        auto dbPath = getCacheDir() + "/fetcher-cache-v3.sqlite";
+        auto dbPath = getCacheDir() + "/fetcher-cache-v4.sqlite";
         createDirs(dirOf(dbPath));
 
         state->db = SQLite(dbPath);
         state->db.isCache();
         state->db.exec(schema);
 
-        state->upsert.create(state->db,
-            "insert or replace into Cache(domain, key, value, timestamp) values (?, ?, ?, ?)");
+        state->upsert.create(
+            state->db, "insert or replace into Cache(domain, key, value, timestamp) values (?, ?, ?, ?)");
 
-        state->lookup.create(state->db,
-            "select value, timestamp from Cache where domain = ? and key = ?");
+        state->lookup.create(state->db, "select value, timestamp from Cache where domain = ? and key = ?");
     }
 
-    void upsert(
-        const Key & key,
-        const Attrs & value) override
+    void upsert(const Key & key, const Attrs & value) override
     {
-        _state.lock()->upsert.use()
-            (key.first)
-            (attrsToJSON(key.second).dump())
-            (attrsToJSON(value).dump())
-            (time(0)).exec();
+        _state.lock()
+            ->upsert.use()(key.first)(attrsToJSON(key.second).dump())(attrsToJSON(value).dump())(time(0))
+            .exec();
     }
 
-    std::optional<Attrs> lookup(
-        const Key & key) override
+    std::optional<Attrs> lookup(const Key & key) override
     {
         if (auto res = lookupExpired(key))
             return std::move(res->value);
         return {};
     }
 
-    std::optional<Attrs> lookupWithTTL(
-        const Key & key) override
+    std::optional<Attrs> lookupWithTTL(const Key & key) override
     {
         if (auto res = lookupExpired(key)) {
             if (!res->expired)
                 return std::move(res->value);
-            debug("ignoring expired cache entry '%s:%s'",
-                key.first, attrsToJSON(key.second).dump());
+            debug("ignoring expired cache entry '%s:%s'", key.first, attrsToJSON(key.second).dump());
         }
         return {};
     }
 
-    std::optional<Result> lookupExpired(
-        const Key & key) override
+    std::optional<Result> lookupExpired(const Key & key) override
     {
         auto state(_state.lock());
 
@@ -100,17 +92,13 @@ struct CacheImpl : Cache
 
         debug("using cache entry '%s:%s' -> '%s'", key.first, keyJSON, valueJSON);
 
-        return Result {
+        return Result{
             .expired = settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0),
             .value = jsonToAttrs(nlohmann::json::parse(valueJSON)),
         };
     }
 
-    void upsert(
-        Key key,
-        Store & store,
-        Attrs value,
-        const StorePath & storePath) override
+    void upsert(Key key, Store & store, Attrs value, const StorePath & storePath) override
     {
         /* Add the store prefix to the cache key to handle multiple
            store prefixes. */
@@ -121,14 +109,13 @@ struct CacheImpl : Cache
         upsert(key, value);
     }
 
-    std::optional<ResultWithStorePath> lookupStorePath(
-        Key key,
-        Store & store) override
+    std::optional<ResultWithStorePath> lookupStorePath(Key key, Store & store) override
     {
         key.second.insert_or_assign("store", store.storeDir);
 
         auto res = lookupExpired(key);
-        if (!res) return std::nullopt;
+        if (!res)
+            return std::nullopt;
 
         auto storePathS = getStrAttr(res->value, "storePath");
         res->value.erase("storePath");
@@ -138,14 +125,16 @@ struct CacheImpl : Cache
         store.addTempRoot(res2.storePath);
         if (!store.isValidPath(res2.storePath)) {
             // FIXME: we could try to substitute 'storePath'.
-            debug("ignoring disappeared cache entry '%s:%s' -> '%s'",
+            debug(
+                "ignoring disappeared cache entry '%s:%s' -> '%s'",
                 key.first,
                 attrsToJSON(key.second).dump(),
                 store.printStorePath(res2.storePath));
             return std::nullopt;
         }
 
-        debug("using cache entry '%s:%s' -> '%s', '%s'",
+        debug(
+            "using cache entry '%s:%s' -> '%s', '%s'",
             key.first,
             attrsToJSON(key.second).dump(),
             attrsToJSON(res2.value).dump(),
@@ -154,9 +143,7 @@ struct CacheImpl : Cache
         return res2;
     }
 
-    std::optional<ResultWithStorePath> lookupStorePathWithTTL(
-        Key key,
-        Store & store) override
+    std::optional<ResultWithStorePath> lookupStorePathWithTTL(Key key, Store & store) override
     {
         auto res = lookupStorePath(std::move(key), store);
         return res && !res->expired ? res : std::nullopt;
@@ -171,4 +158,4 @@ ref<Cache> Settings::getCache() const
     return ref<Cache>(*cache);
 }
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/fetch-settings.cc b/src/libfetchers/fetch-settings.cc
index 4b4e4e29d..f92b94a0b 100644
--- a/src/libfetchers/fetch-settings.cc
+++ b/src/libfetchers/fetch-settings.cc
@@ -2,8 +2,6 @@
 
 namespace nix::fetchers {
 
-Settings::Settings()
-{
-}
+Settings::Settings() {}
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/fetch-to-store.cc b/src/libfetchers/fetch-to-store.cc
index f7ab32322..6ce78e115 100644
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@@ -5,18 +5,11 @@
 namespace nix {
 
 fetchers::Cache::Key makeFetchToStoreCacheKey(
-    const std::string & name,
-    const std::string & fingerprint,
-    ContentAddressMethod method,
-    const std::string & path)
+    const std::string & name, const std::string & fingerprint, ContentAddressMethod method, const std::string & path)
 {
-    return fetchers::Cache::Key{"fetchToStore", {
-        {"name", name},
-        {"fingerprint", fingerprint},
-        {"method", std::string{method.render()}},
-        {"path", path}
-    }};
-
+    return fetchers::Cache::Key{
+        "fetchToStore",
+        {{"name", name}, {"fingerprint", fingerprint}, {"method", std::string{method.render()}}, {"path", path}}};
 }
 
 StorePath fetchToStore(
@@ -43,17 +36,17 @@ StorePath fetchToStore(
     } else
         debug("source path '%s' is uncacheable", path);
 
-    Activity act(*logger, lvlChatty, actUnknown,
+    Activity act(
+        *logger,
+        lvlChatty,
+        actUnknown,
         fmt(mode == FetchMode::DryRun ? "hashing '%s'" : "copying '%s' to the store", path));
 
     auto filter2 = filter ? *filter : defaultPathFilter;
 
-    auto storePath =
-        mode == FetchMode::DryRun
-        ? store.computeStorePath(
-            name, path, method, HashAlgorithm::SHA256, {}, filter2).first
-        : store.addToStore(
-            name, path, method, HashAlgorithm::SHA256, {}, filter2, repair);
+    auto storePath = mode == FetchMode::DryRun
+                         ? store.computeStorePath(name, path, method, HashAlgorithm::SHA256, {}, filter2).first
+                         : store.addToStore(name, path, method, HashAlgorithm::SHA256, {}, filter2, repair);
 
     debug(mode == FetchMode::DryRun ? "hashed '%s'" : "copied '%s' to '%s'", path, store.printStorePath(storePath));
 
@@ -63,4 +56,4 @@ StorePath fetchToStore(
     return storePath;
 }
 
-}
+} // namespace nix
diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index 9cb896601..54013bf55 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -39,9 +39,7 @@ nlohmann::json dumpRegisterInputSchemeInfo()
     return res;
 }
 
-Input Input::fromURL(
-    const Settings & settings,
-    const std::string & url, bool requireTree)
+Input Input::fromURL(const Settings & settings, const std::string & url, bool requireTree)
 {
     return fromURL(settings, parseURL(url), requireTree);
 }
@@ -55,9 +53,7 @@ static void fixupInput(Input & input)
     input.getLastModified();
 }
 
-Input Input::fromURL(
-    const Settings & settings,
-    const ParsedURL & url, bool requireTree)
+Input Input::fromURL(const Settings & settings, const ParsedURL & url, bool requireTree)
 {
     for (auto & [_, inputScheme] : inputSchemes()) {
         auto res = inputScheme->inputFromURL(settings, url, requireTree);
@@ -86,7 +82,7 @@ Input Input::fromAttrs(const Settings & settings, Attrs && attrs)
         // but not all of them. Doing this is to support those other
         // operations which are supposed to be robust on
         // unknown/uninterpretable inputs.
-        Input input { settings };
+        Input input{settings};
         input.attrs = attrs;
         fixupInput(input);
         return input;
@@ -97,7 +93,8 @@ Input Input::fromAttrs(const Settings & settings, Attrs && attrs)
         i ? *i : nullptr;
     });
 
-    if (!inputScheme) return raw();
+    if (!inputScheme)
+        return raw();
 
     experimentalFeatureSettings.require(inputScheme->experimentalFeature());
 
@@ -108,7 +105,8 @@ Input Input::fromAttrs(const Settings & settings, Attrs && attrs)
             throw Error("input attribute '%s' not supported by scheme '%s'", name, schemeName);
 
     auto res = inputScheme->inputFromAttrs(settings, attrs);
-    if (!res) return raw();
+    if (!res)
+        return raw();
     res->scheme = inputScheme;
     fixupInput(*res);
     return std::move(*res);
@@ -116,9 +114,11 @@ Input Input::fromAttrs(const Settings & settings, Attrs && attrs)
 
 std::optional<std::string> Input::getFingerprint(ref<Store> store) const
 {
-    if (!scheme) return std::nullopt;
+    if (!scheme)
+        return std::nullopt;
 
-    if (cachedFingerprint) return *cachedFingerprint;
+    if (cachedFingerprint)
+        return *cachedFingerprint;
 
     auto fingerprint = scheme->getFingerprint(store, *this);
 
@@ -173,18 +173,20 @@ Attrs Input::toAttrs() const
     return attrs;
 }
 
-bool Input::operator ==(const Input & other) const noexcept
+bool Input::operator==(const Input & other) const noexcept
 {
     return attrs == other.attrs;
 }
 
 bool Input::contains(const Input & other) const
 {
-    if (*this == other) return true;
+    if (*this == other)
+        return true;
     auto other2(other);
     other2.attrs.erase("ref");
     other2.attrs.erase("rev");
-    if (*this == other2) return true;
+    if (*this == other2)
+        return true;
     return false;
 }
 
@@ -198,7 +200,8 @@ std::pair<StorePath, Input> Input::fetchToStore(ref<Store> store) const
         try {
             auto [accessor, result] = getAccessorUnchecked(store);
 
-            auto storePath = nix::fetchToStore(*settings, *store, SourcePath(accessor), FetchMode::Copy, result.getName());
+            auto storePath =
+                nix::fetchToStore(*settings, *store, SourcePath(accessor), FetchMode::Copy, result.getName());
 
             auto narHash = store->queryPathInfo(storePath)->narHash;
             result.attrs.insert_or_assign("narHash", narHash.to_string(HashFormat::SRI, true));
@@ -237,7 +240,8 @@ void Input::checkLocks(Input specified, Input & result)
         for (auto & field : specified.attrs) {
             auto field2 = result.attrs.find(field.first);
             if (field2 != result.attrs.end() && field.second != field2->second)
-                throw Error("mismatch in field '%s' of input '%s', got '%s'",
+                throw Error(
+                    "mismatch in field '%s' of input '%s', got '%s'",
                     field.first,
                     attrsToJSON(specified.attrs),
                     attrsToJSON(result.attrs));
@@ -251,30 +255,38 @@ void Input::checkLocks(Input specified, Input & result)
     if (auto prevNarHash = specified.getNarHash()) {
         if (result.getNarHash() != prevNarHash) {
             if (result.getNarHash())
-                throw Error((unsigned int) 102, "NAR hash mismatch in input '%s', expected '%s' but got '%s'",
-                    specified.to_string(), prevNarHash->to_string(HashFormat::SRI, true), result.getNarHash()->to_string(HashFormat::SRI, true));
+                throw Error(
+                    (unsigned int) 102,
+                    "NAR hash mismatch in input '%s', expected '%s' but got '%s'",
+                    specified.to_string(),
+                    prevNarHash->to_string(HashFormat::SRI, true),
+                    result.getNarHash()->to_string(HashFormat::SRI, true));
             else
-                throw Error((unsigned int) 102, "NAR hash mismatch in input '%s', expected '%s' but got none",
-                    specified.to_string(), prevNarHash->to_string(HashFormat::SRI, true));
+                throw Error(
+                    (unsigned int) 102,
+                    "NAR hash mismatch in input '%s', expected '%s' but got none",
+                    specified.to_string(),
+                    prevNarHash->to_string(HashFormat::SRI, true));
         }
     }
 
     if (auto prevLastModified = specified.getLastModified()) {
         if (result.getLastModified() != prevLastModified)
-            throw Error("'lastModified' attribute mismatch in input '%s', expected %d, got %d",
-                result.to_string(), *prevLastModified, result.getLastModified().value_or(-1));
+            throw Error(
+                "'lastModified' attribute mismatch in input '%s', expected %d, got %d",
+                result.to_string(),
+                *prevLastModified,
+                result.getLastModified().value_or(-1));
     }
 
     if (auto prevRev = specified.getRev()) {
         if (result.getRev() != prevRev)
-            throw Error("'rev' attribute mismatch in input '%s', expected %s",
-                result.to_string(), prevRev->gitRev());
+            throw Error("'rev' attribute mismatch in input '%s', expected %s", result.to_string(), prevRev->gitRev());
     }
 
     if (auto prevRevCount = specified.getRevCount()) {
         if (result.getRevCount() != prevRevCount)
-            throw Error("'revCount' attribute mismatch in input '%s', expected %d",
-                result.to_string(), *prevRevCount);
+            throw Error("'revCount' attribute mismatch in input '%s', expected %d", result.to_string(), *prevRevCount);
     }
 }
 
@@ -318,8 +330,7 @@ std::pair<ref<SourceAccessor>, Input> Input::getAccessorUnchecked(ref<Store> sto
 
             store->ensurePath(storePath);
 
-            debug("using substituted/cached input '%s' in '%s'",
-                to_string(), store->printStorePath(storePath));
+            debug("using substituted/cached input '%s' in '%s'", to_string(), store->printStorePath(storePath));
 
             auto accessor = makeStorePathAccessor(store, storePath);
 
@@ -341,11 +352,10 @@ std::pair<ref<SourceAccessor>, Input> Input::getAccessorUnchecked(ref<Store> sto
     return {accessor, std::move(result)};
 }
 
-Input Input::applyOverrides(
-    std::optional<std::string> ref,
-    std::optional<Hash> rev) const
+Input Input::applyOverrides(std::optional<std::string> ref, std::optional<Hash> rev) const
 {
-    if (!scheme) return *this;
+    if (!scheme)
+        return *this;
     return scheme->applyOverrides(*this, ref, rev);
 }
 
@@ -361,10 +371,7 @@ std::optional<std::filesystem::path> Input::getSourcePath() const
     return scheme->getSourcePath(*this);
 }
 
-void Input::putFile(
-    const CanonPath & path,
-    std::string_view contents,
-    std::optional<std::string> commitMsg) const
+void Input::putFile(const CanonPath & path, std::string_view contents, std::optional<std::string> commitMsg) const
 {
     assert(scheme);
     return scheme->putFile(*this, path, contents, commitMsg);
@@ -380,11 +387,13 @@ StorePath Input::computeStorePath(Store & store) const
     auto narHash = getNarHash();
     if (!narHash)
         throw Error("cannot compute store path for unlocked input '%s'", to_string());
-    return store.makeFixedOutputPath(getName(), FixedOutputInfo {
-        .method = FileIngestionMethod::NixArchive,
-        .hash = *narHash,
-        .references = {},
-    });
+    return store.makeFixedOutputPath(
+        getName(),
+        FixedOutputInfo{
+            .method = FileIngestionMethod::NixArchive,
+            .hash = *narHash,
+            .references = {},
+        });
 }
 
 std::string Input::getType() const
@@ -417,7 +426,7 @@ std::optional<Hash> Input::getRev() const
     if (auto s = maybeGetStrAttr(attrs, "rev")) {
         try {
             hash = Hash::parseAnyPrefixed(*s);
-        } catch (BadHash &e) {
+        } catch (BadHash & e) {
             // Default to sha1 for backwards compatibility with existing
             // usages (e.g. `builtins.fetchTree` calls or flake inputs).
             hash = Hash::parseAny(*s, HashAlgorithm::SHA1);
@@ -446,10 +455,7 @@ ParsedURL InputScheme::toURL(const Input & input) const
     throw Error("don't know how to convert input '%s' to a URL", attrsToJSON(input.attrs));
 }
 
-Input InputScheme::applyOverrides(
-    const Input & input,
-    std::optional<std::string> ref,
-    std::optional<Hash> rev) const
+Input InputScheme::applyOverrides(const Input & input, std::optional<std::string> ref, std::optional<Hash> rev) const
 {
     if (ref)
         throw Error("don't know how to set branch/tag name of input '%s' to '%s'", input.to_string(), *ref);
@@ -464,10 +470,7 @@ std::optional<std::filesystem::path> InputScheme::getSourcePath(const Input & in
 }
 
 void InputScheme::putFile(
-    const Input & input,
-    const CanonPath & path,
-    std::string_view contents,
-    std::optional<std::string> commitMsg) const
+    const Input & input, const CanonPath & path, std::string_view contents, std::optional<std::string> commitMsg) const
 {
     throw Error("input '%s' does not support modifying file '%s'", input.to_string(), path);
 }
@@ -482,12 +485,12 @@ std::optional<ExperimentalFeature> InputScheme::experimentalFeature() const
     return {};
 }
 
-std::string publicKeys_to_string(const std::vector<PublicKey>& publicKeys)
+std::string publicKeys_to_string(const std::vector<PublicKey> & publicKeys)
 {
     return ((nlohmann::json) publicKeys).dump();
 }
 
-}
+} // namespace nix::fetchers
 
 namespace nlohmann {
 
@@ -497,7 +500,7 @@ using namespace nix;
 
 fetchers::PublicKey adl_serializer<fetchers::PublicKey>::from_json(const json & json)
 {
-    fetchers::PublicKey res = { };
+    fetchers::PublicKey res = {};
     if (auto type = optionalValueAt(json, "type"))
         res.type = getString(*type);
 
@@ -514,4 +517,4 @@ void adl_serializer<fetchers::PublicKey>::to_json(json & json, fetchers::PublicK
 
 #endif
 
-}
+} // namespace nlohmann
diff --git a/src/libfetchers/filtering-source-accessor.cc b/src/libfetchers/filtering-source-accessor.cc
index 72a3fb4eb..d0991ae23 100644
--- a/src/libfetchers/filtering-source-accessor.cc
+++ b/src/libfetchers/filtering-source-accessor.cc
@@ -1,5 +1,7 @@
 #include "nix/fetchers/filtering-source-accessor.hh"
 
+#include <boost/unordered/unordered_flat_set.hpp>
+
 namespace nix {
 
 std::optional<std::filesystem::path> FilteringSourceAccessor::getPhysicalPath(const CanonPath & path)
@@ -50,31 +52,29 @@ std::string FilteringSourceAccessor::showPath(const CanonPath & path)
 void FilteringSourceAccessor::checkAccess(const CanonPath & path)
 {
     if (!isAllowed(path))
-        throw makeNotAllowedError
-            ? makeNotAllowedError(path)
-            : RestrictedPathError("access to path '%s' is forbidden", showPath(path));
+        throw makeNotAllowedError ? makeNotAllowedError(path)
+                                  : RestrictedPathError("access to path '%s' is forbidden", showPath(path));
 }
 
 struct AllowListSourceAccessorImpl : AllowListSourceAccessor
 {
     std::set<CanonPath> allowedPrefixes;
-    std::unordered_set<CanonPath> allowedPaths;
+    boost::unordered_flat_set<CanonPath, std::hash<CanonPath>> allowedPaths;
 
     AllowListSourceAccessorImpl(
         ref<SourceAccessor> next,
         std::set<CanonPath> && allowedPrefixes,
-        std::unordered_set<CanonPath> && allowedPaths,
+        boost::unordered_flat_set<CanonPath, std::hash<CanonPath>> && allowedPaths,
         MakeNotAllowedError && makeNotAllowedError)
         : AllowListSourceAccessor(SourcePath(next), std::move(makeNotAllowedError))
         , allowedPrefixes(std::move(allowedPrefixes))
         , allowedPaths(std::move(allowedPaths))
-    { }
+    {
+    }
 
     bool isAllowed(const CanonPath & path) override
     {
-        return
-            allowedPaths.contains(path)
-            || path.isAllowed(allowedPrefixes);
+        return allowedPaths.contains(path) || path.isAllowed(allowedPrefixes);
     }
 
     void allowPrefix(CanonPath prefix) override
@@ -86,23 +86,21 @@ struct AllowListSourceAccessorImpl : AllowListSourceAccessor
 ref<AllowListSourceAccessor> AllowListSourceAccessor::create(
     ref<SourceAccessor> next,
     std::set<CanonPath> && allowedPrefixes,
-    std::unordered_set<CanonPath> && allowedPaths,
+    boost::unordered_flat_set<CanonPath, std::hash<CanonPath>> && allowedPaths,
     MakeNotAllowedError && makeNotAllowedError)
 {
     return make_ref<AllowListSourceAccessorImpl>(
-        next,
-        std::move(allowedPrefixes),
-        std::move(allowedPaths),
-        std::move(makeNotAllowedError));
+        next, std::move(allowedPrefixes), std::move(allowedPaths), std::move(makeNotAllowedError));
 }
 
 bool CachingFilteringSourceAccessor::isAllowed(const CanonPath & path)
 {
     auto i = cache.find(path);
-    if (i != cache.end()) return i->second;
+    if (i != cache.end())
+        return i->second;
     auto res = isAllowedUncached(path);
     cache.emplace(path, res);
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libfetchers/git-lfs-fetch.cc b/src/libfetchers/git-lfs-fetch.cc
index 97f10f0c6..9688daa4a 100644
--- a/src/libfetchers/git-lfs-fetch.cc
+++ b/src/libfetchers/git-lfs-fetch.cc
@@ -5,6 +5,7 @@
 #include "nix/util/url.hh"
 #include "nix/util/users.hh"
 #include "nix/util/hash.hh"
+#include "nix/store/ssh.hh"
 
 #include <git2/attr.h>
 #include <git2/config.h>
@@ -15,20 +16,19 @@
 
 namespace nix::lfs {
 
-// if authHeader is "", downloadToSink assumes no auth is expected
 static void downloadToSink(
     const std::string & url,
-    const std::string & authHeader,
+    const std::optional<std::string> & authHeader,
     // FIXME: passing a StringSink is superfluous, we may as well
     // return a string. Or use an abstract Sink for streaming.
     StringSink & sink,
     std::string sha256Expected,
     size_t sizeExpected)
 {
-    FileTransferRequest request(url);
+    FileTransferRequest request(parseURL(url));
     Headers headers;
-    if (!authHeader.empty())
-        headers.push_back({"Authorization", authHeader});
+    if (authHeader.has_value())
+        headers.push_back({"Authorization", *authHeader});
     request.headers = headers;
     getFileTransfer()->download(std::move(request), sink);
 
@@ -42,27 +42,54 @@ static void downloadToSink(
             "hash mismatch while fetching %s: expected sha256:%s but got sha256:%s", url, sha256Expected, sha256Actual);
 }
 
-static std::string getLfsApiToken(const ParsedURL & url)
+namespace {
+
+struct LfsApiInfo
 {
-    auto [status, output] = runProgram(
-        RunOptions{
-            .program = "ssh",
-            .args = {*url.authority, "git-lfs-authenticate", url.path, "download"},
-        });
+    std::string endpoint;
+    std::optional<std::string> authHeader;
+};
 
-    if (output.empty())
-        throw Error(
-            "git-lfs-authenticate: no output (cmd: ssh %s git-lfs-authenticate %s download)",
-            url.authority.value_or(""),
-            url.path);
+} // namespace
 
-    auto queryResp = nlohmann::json::parse(output);
-    if (!queryResp.contains("header"))
-        throw Error("no header in git-lfs-authenticate response");
-    if (!queryResp["header"].contains("Authorization"))
-        throw Error("no Authorization in git-lfs-authenticate response");
+static LfsApiInfo getLfsApi(const ParsedURL & url)
+{
+    assert(url.authority.has_value());
+    if (url.scheme == "ssh") {
+        auto args = getNixSshOpts();
 
-    return queryResp["header"]["Authorization"].get<std::string>();
+        if (url.authority->port)
+            args.push_back(fmt("-p%d", *url.authority->port));
+
+        std::ostringstream hostnameAndUser;
+        if (url.authority->user)
+            hostnameAndUser << *url.authority->user << "@";
+        hostnameAndUser << url.authority->host;
+        args.push_back(std::move(hostnameAndUser).str());
+
+        args.push_back("--");
+        args.push_back("git-lfs-authenticate");
+        // FIXME %2F encode slashes? Does this command take/accept percent encoding?
+        args.push_back(url.renderPath(/*encode=*/false));
+        args.push_back("download");
+
+        auto [status, output] = runProgram({.program = "ssh", .args = args});
+
+        if (output.empty())
+            throw Error("git-lfs-authenticate: no output (cmd: 'ssh %s')", concatStringsSep(" ", args));
+
+        auto queryResp = nlohmann::json::parse(output);
+        auto headerIt = queryResp.find("header");
+        if (headerIt == queryResp.end())
+            throw Error("no header in git-lfs-authenticate response");
+        auto authIt = headerIt->find("Authorization");
+        if (authIt == headerIt->end())
+            throw Error("no Authorization in git-lfs-authenticate response");
+
+        return {queryResp.at("href").get<std::string>(), authIt->get<std::string>()};
+    }
+
+    return {url.to_string() + "/info/lfs", std::nullopt};
 }
 
 typedef std::unique_ptr<git_config, Deleter<git_config_free>> GitConfig;
@@ -153,7 +180,7 @@ Fetch::Fetch(git_repository * repo, git_oid rev)
 
     const auto remoteUrl = lfs::getLfsEndpointUrl(repo);
 
-    this->url = nix::parseURL(nix::fixGitURL(remoteUrl)).canonicalise();
+    this->url = nix::fixGitURL(remoteUrl).canonicalise();
 }
 
 bool Fetch::shouldFetch(const CanonPath & path) const
@@ -178,13 +205,14 @@ static nlohmann::json pointerToPayload(const std::vector<Pointer> & items)
 
 std::vector<nlohmann::json> Fetch::fetchUrls(const std::vector<Pointer> & pointers) const
 {
-    ParsedURL httpUrl(url);
-    httpUrl.scheme = url.scheme == "ssh" ? "https" : url.scheme;
-    FileTransferRequest request(httpUrl.to_string() + "/info/lfs/objects/batch");
+    auto api = lfs::getLfsApi(this->url);
+    auto url = api.endpoint + "/objects/batch";
+    const auto & authHeader = api.authHeader;
+    FileTransferRequest request(parseURL(url));
     request.post = true;
     Headers headers;
-    if (this->url.scheme == "ssh")
-        headers.push_back({"Authorization", lfs::getLfsApiToken(this->url)});
+    if (authHeader.has_value())
+        headers.push_back({"Authorization", *authHeader});
     headers.push_back({"Content-Type", "application/vnd.git-lfs+json"});
     headers.push_back({"Accept", "application/vnd.git-lfs+json"});
     request.headers = headers;
@@ -257,11 +285,16 @@ void Fetch::fetch(
     try {
         std::string sha256 = obj.at("oid"); // oid is also the sha256
         std::string ourl = obj.at("actions").at("download").at("href");
-        std::string authHeader = "";
-        if (obj.at("actions").at("download").contains("header")
-            && obj.at("actions").at("download").at("header").contains("Authorization")) {
-            authHeader = obj["actions"]["download"]["header"]["Authorization"];
-        }
+        auto authHeader = [&]() -> std::optional<std::string> {
+            const auto & download = obj.at("actions").at("download");
+            auto headerIt = download.find("header");
+            if (headerIt == download.end())
+                return std::nullopt;
+            auto authIt = headerIt->find("Authorization");
+            if (authIt == headerIt->end())
+                return std::nullopt;
+            return std::string(*authIt);
+        }();
         const uint64_t size = obj.at("size");
         sizeCallback(size);
         downloadToSink(ourl, authHeader, sink, sha256, size);
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index b55b53899..d152ae22d 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -2,6 +2,7 @@
 #include "nix/fetchers/git-lfs-fetch.hh"
 #include "nix/fetchers/cache.hh"
 #include "nix/fetchers/fetch-settings.hh"
+#include "nix/util/base-n.hh"
 #include "nix/util/finally.hh"
 #include "nix/util/processes.hh"
 #include "nix/util/signals.hh"
@@ -29,31 +30,33 @@
 #include <git2/sys/mempack.h>
 #include <git2/tree.h>
 
+#include <boost/unordered/unordered_flat_map.hpp>
+#include <boost/unordered/unordered_flat_set.hpp>
 #include <iostream>
-#include <unordered_set>
 #include <queue>
 #include <regex>
 #include <span>
 
 namespace std {
 
-template<> struct hash<git_oid>
+template<>
+struct hash<git_oid>
 {
     size_t operator()(const git_oid & oid) const
     {
-        return * (size_t *) oid.id;
+        return *(size_t *) oid.id;
     }
 };
 
-}
+} // namespace std
 
-std::ostream & operator << (std::ostream & str, const git_oid & oid)
+std::ostream & operator<<(std::ostream & str, const git_oid & oid)
 {
     str << git_oid_tostr_s(&oid);
     return str;
 }
 
-bool operator == (const git_oid & oid1, const git_oid & oid2)
+bool operator==(const git_oid & oid1, const git_oid & oid2)
 {
     return git_oid_equal(&oid1, &oid2);
 }
@@ -81,9 +84,9 @@ typedef std::unique_ptr<git_indexer, Deleter<git_indexer_free>> Indexer;
 
 Hash toHash(const git_oid & oid)
 {
-    #ifdef GIT_EXPERIMENTAL_SHA256
+#ifdef GIT_EXPERIMENTAL_SHA256
     assert(oid.type == GIT_OID_SHA1);
-    #endif
+#endif
     Hash hash(HashAlgorithm::SHA1);
     memcpy(hash.hash, oid.id, hash.hashSize);
     return hash;
@@ -91,8 +94,11 @@ Hash toHash(const git_oid & oid)
 
 static void initLibGit2()
 {
-    if (git_libgit2_init() < 0)
-        throw Error("initialising libgit2: %s", git_error_last()->message);
+    static std::once_flag initialized;
+    std::call_once(initialized, []() {
+        if (git_libgit2_init() < 0)
+            throw Error("initialising libgit2: %s", git_error_last()->message);
+    });
 }
 
 git_oid hashToOID(const Hash & hash)
@@ -117,7 +123,7 @@ template<typename T>
 T peelObject(git_object * obj, git_object_t type)
 {
     T obj2;
-    if (git_object_peel((git_object * *) (typename T::pointer *) Setter(obj2), obj, type)) {
+    if (git_object_peel((git_object **) (typename T::pointer *) Setter(obj2), obj, type)) {
         auto err = git_error_last();
         throw Error("peeling Git object '%s': %s", *git_object_id(obj), err->message);
     }
@@ -128,7 +134,7 @@ template<typename T>
 T dupObject(typename T::pointer obj)
 {
     T obj2;
-    if (git_object_dup((git_object * *) (typename T::pointer *) Setter(obj2), (git_object *) obj))
+    if (git_object_dup((git_object **) (typename T::pointer *) Setter(obj2), (git_object *) obj))
         throw Error("duplicating object '%s': %s", *git_object_id((git_object *) obj), git_error_last()->message);
     return obj2;
 }
@@ -147,21 +153,22 @@ static Object peelToTreeOrBlob(git_object * obj)
         return peelObject<Object>(obj, GIT_OBJECT_TREE);
 }
 
-struct PackBuilderContext {
+struct PackBuilderContext
+{
     std::exception_ptr exception;
 
     void handleException(const char * activity, int errCode)
     {
         switch (errCode) {
-            case GIT_OK:
-                break;
-            case GIT_EUSER:
-                if (!exception)
-                    panic("PackBuilderContext::handleException: user error, but exception was not set");
+        case GIT_OK:
+            break;
+        case GIT_EUSER:
+            if (!exception)
+                panic("PackBuilderContext::handleException: user error, but exception was not set");
 
-                std::rethrow_exception(exception);
-            default:
-                throw Error("%s: %i, %s", Uncolored(activity), errCode, git_error_last()->message);
+            std::rethrow_exception(exception);
+        default:
+            throw Error("%s: %i, %s", Uncolored(activity), errCode, git_error_last()->message);
         }
     }
 };
@@ -171,9 +178,9 @@ extern "C" {
 /**
  * A `git_packbuilder_progress` implementation that aborts the pack building if needed.
  */
-static int packBuilderProgressCheckInterrupt(int stage, uint32_t current, uint32_t total, void *payload)
+static int packBuilderProgressCheckInterrupt(int stage, uint32_t current, uint32_t total, void * payload)
 {
-    PackBuilderContext & args = * (PackBuilderContext *) payload;
+    PackBuilderContext & args = *(PackBuilderContext *) payload;
     try {
         checkInterrupt();
         return GIT_OK;
@@ -182,15 +189,17 @@ static int packBuilderProgressCheckInterrupt(int stage, uint32_t current, uint32
         return GIT_EUSER;
     }
 };
+
 static git_packbuilder_progress PACKBUILDER_PROGRESS_CHECK_INTERRUPT = &packBuilderProgressCheckInterrupt;
 
 } // extern "C"
 
-static void initRepoAtomically(std::filesystem::path &path, bool bare)
+static void initRepoAtomically(std::filesystem::path & path, bool bare)
 {
-    if (pathExists(path.string())) return;
+    if (pathExists(path.string()))
+        return;
 
-    Path tmpDir = createTempDir(os_string_to_string(PathViewNG { std::filesystem::path(path).parent_path() }));
+    Path tmpDir = createTempDir(os_string_to_string(PathViewNG{std::filesystem::path(path).parent_path()}));
     AutoDelete delTmpDir(tmpDir, true);
     Repository tmpRepo;
 
@@ -204,8 +213,7 @@ static void initRepoAtomically(std::filesystem::path &path, bool bare)
             // `path` may be attempted to be deleted by s::f::rename, in which case the code is:
             || e.code() == std::errc::directory_not_empty) {
             return;
-        }
-        else
+        } else
             throw SysError("moving temporary git repository from %s to %s", tmpDir, path);
     }
     // we successfully moved the repository, so the temporary directory no longer exists.
@@ -249,16 +257,17 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
             throw Error("adding mempack backend to Git object database: %s", git_error_last()->message);
     }
 
-    operator git_repository * ()
+    operator git_repository *()
     {
         return repo.get();
     }
 
-    void flush() override {
+    void flush() override
+    {
         checkInterrupt();
 
         git_buf buf = GIT_BUF_INIT;
-        Finally _disposeBuf { [&] { git_buf_dispose(&buf); } };
+        Finally _disposeBuf{[&] { git_buf_dispose(&buf); }};
         PackBuilder packBuilder;
         PackBuilderContext packBuilderContext;
         git_packbuilder_new(Setter(packBuilder), *this);
@@ -266,14 +275,9 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
         git_packbuilder_set_threads(packBuilder.get(), 0 /* autodetect */);
 
         packBuilderContext.handleException(
-            "preparing packfile",
-            git_mempack_write_thin_pack(mempack_backend, packBuilder.get())
-        );
+            "preparing packfile", git_mempack_write_thin_pack(mempack_backend, packBuilder.get()));
         checkInterrupt();
-        packBuilderContext.handleException(
-            "writing packfile",
-            git_packbuilder_write_buf(&buf, packBuilder.get())
-        );
+        packBuilderContext.handleException("writing packfile", git_packbuilder_write_buf(&buf, packBuilder.get()));
         checkInterrupt();
 
         std::string repo_path = std::string(git_repository_path(repo.get()));
@@ -312,13 +316,14 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
 
     uint64_t getRevCount(const Hash & rev) override
     {
-        std::unordered_set<git_oid> done;
+        boost::unordered_flat_set<git_oid, std::hash<git_oid>> done;
         std::queue<Commit> todo;
 
         todo.push(peelObject<Commit>(lookupObject(*this, hashToOID(rev)).get(), GIT_OBJECT_COMMIT));
 
         while (auto commit = pop(todo)) {
-            if (!done.insert(*git_commit_id(commit->get())).second) continue;
+            if (!done.insert(*git_commit_id(commit->get())).second)
+                continue;
 
             for (size_t n = 0; n < git_commit_parentcount(commit->get()); ++n) {
                 git_commit * parent;
@@ -330,8 +335,7 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
                         "or add set the shallow parameter to true in builtins.fetchGit, "
                         "or fetch the complete history for this branch.",
                         *git_commit_id(commit->get()),
-                        git_error_last()->message
-                    );
+                        git_error_last()->message);
                 }
                 todo.push(Commit(parent));
             }
@@ -361,7 +365,13 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
     Hash resolveRef(std::string ref) override
     {
         Object object;
-        if (git_revparse_single(Setter(object), *this, ref.c_str()))
+
+        // Using the rev-parse notation which libgit2 supports, make sure we peel
+        // the ref ultimately down to the underlying commit.
+        // This is to handle the case where it may be an annotated tag which itself has
+        // an object_id.
+        std::string peeledRef = ref + "^{commit}";
+        if (git_revparse_single(Setter(object), *this, peeledRef.c_str()))
             throw Error("resolving Git reference '%s': %s", ref, git_error_last()->message);
         auto oid = git_object_id(object.get());
         return toHash(*oid);
@@ -382,7 +392,8 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
         while (true) {
             git_config_entry * entry = nullptr;
             if (auto err = git_config_next(&entry, it.get())) {
-                if (err == GIT_ITEROVER) break;
+                if (err == GIT_ITEROVER)
+                    break;
                 throw Error("iterating over .gitmodules: %s", git_error_last()->message);
             }
             entries.emplace(entry->name + 10, entry->value);
@@ -391,14 +402,16 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
         std::vector<Submodule> result;
 
         for (auto & [key, value] : entries) {
-            if (!hasSuffix(key, ".path")) continue;
+            if (!hasSuffix(key, ".path"))
+                continue;
             std::string key2(key, 0, key.size() - 5);
             auto path = CanonPath(value);
-            result.push_back(Submodule {
-                .path = path,
-                .url = entries[key2 + ".url"],
-                .branch = entries[key2 + ".branch"],
-            });
+            result.push_back(
+                Submodule{
+                    .path = path,
+                    .url = entries[key2 + ".url"],
+                    .branch = entries[key2 + ".branch"],
+                });
         }
 
         return result;
@@ -424,11 +437,9 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
 
         /* Get all tracked files and determine whether the working
            directory is dirty. */
-        std::function<int(const char * path, unsigned int statusFlags)> statusCallback = [&](const char * path, unsigned int statusFlags)
-        {
-            if (!(statusFlags & GIT_STATUS_INDEX_DELETED) &&
-                !(statusFlags & GIT_STATUS_WT_DELETED))
-            {
+        std::function<int(const char * path, unsigned int statusFlags)> statusCallback = [&](const char * path,
+                                                                                             unsigned int statusFlags) {
+            if (!(statusFlags & GIT_STATUS_INDEX_DELETED) && !(statusFlags & GIT_STATUS_WT_DELETED)) {
                 info.files.insert(CanonPath(path));
                 if (statusFlags != GIT_STATUS_CURRENT)
                     info.dirtyFiles.insert(CanonPath(path));
@@ -484,7 +495,8 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
 
         Object obj;
         if (auto errCode = git_object_lookup(Setter(obj), *this, &oid, GIT_OBJECT_ANY)) {
-            if (errCode == GIT_ENOTFOUND) return false;
+            if (errCode == GIT_ENOTFOUND)
+                return false;
             auto err = git_error_last();
             throw Error("getting Git object '%s': %s", oid, err->message);
         }
@@ -495,6 +507,7 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
     /**
      * A 'GitSourceAccessor' with no regard for export-ignore or any other transformations.
      */
+<<<<<<< HEAD
     ref<GitSourceAccessor> getRawAccessor(
         const Hash & rev,
         bool smudgeLfs = false,
@@ -506,6 +519,12 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
         std::string displayPrefix,
         bool smudgeLfs = false,
         bool applyFilters = false) override;
+=======
+    ref<GitSourceAccessor> getRawAccessor(const Hash & rev, bool smudgeLfs = false);
+
+    ref<SourceAccessor>
+    getAccessor(const Hash & rev, bool exportIgnore, std::string displayPrefix, bool smudgeLfs = false) override;
+>>>>>>> origin/master
 
     ref<SourceAccessor> getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError e) override;
 
@@ -521,7 +540,8 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
     static int transferProgressCallback(const git_indexer_progress * stats, void * payload)
     {
         auto act = (Activity *) payload;
-        act->result(resFetchStatus,
+        act->result(
+            resFetchStatus,
             fmt("%d/%d objects received, %d/%d deltas indexed, %.1f MiB",
                 stats->received_objects,
                 stats->total_objects,
@@ -531,14 +551,12 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
         return getInterrupted() ? -1 : 0;
     }
 
-    void fetch(
-        const std::string & url,
-        const std::string & refspec,
-        bool shallow) override
+    void fetch(const std::string & url, const std::string & refspec, bool shallow) override
     {
         Activity act(*logger, lvlTalkative, actFetchTree, fmt("fetching Git repository '%s'", url));
 
-        // TODO: implement git-credential helper support (preferably via libgit2, which as of 2024-01 does not support that)
+        // TODO: implement git-credential helper support (preferably via libgit2, which as of 2024-01 does not support
+        // that)
         //       then use code that was removed in this commit (see blame)
 
         auto dir = this->path;
@@ -547,55 +565,68 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
             append(gitArgs, {"--depth", "1"});
         append(gitArgs, {std::string("--"), url, refspec});
 
-        runProgram(RunOptions {
-            .program = "git",
-            .lookupPath = true,
-            // FIXME: git stderr messes up our progress indicator, so
-            // we're using --quiet for now. Should process its stderr.
-            .args = gitArgs,
-            .input = {},
-            .isInteractive = true
-        });
+        auto [status, output] = runProgram(
+            RunOptions{
+                .program = "git",
+                .lookupPath = true,
+                // FIXME: git stderr messes up our progress indicator, so
+                // we're using --quiet for now. Should process its stderr.
+                .args = gitArgs,
+                .input = {},
+                .mergeStderrToStdout = true,
+                .isInteractive = true});
+
+        if (status > 0) {
+            throw Error("Failed to fetch git repository %s : %s", url, output);
+        }
     }
 
-    void verifyCommit(
-        const Hash & rev,
-        const std::vector<fetchers::PublicKey> & publicKeys) override
+    void verifyCommit(const Hash & rev, const std::vector<fetchers::PublicKey> & publicKeys) override
     {
+        // Map of SSH key types to their internal OpenSSH representations
+        static const boost::unordered_flat_map<std::string_view, std::string_view> keyTypeMap = {
+            {"ssh-dsa", "ssh-dsa"},
+            {"ssh-ecdsa", "ssh-ecdsa"},
+            {"ssh-ecdsa-sk", "sk-ecdsa-sha2-nistp256@openssh.com"},
+            {"ssh-ed25519", "ssh-ed25519"},
+            {"ssh-ed25519-sk", "sk-ssh-ed25519@openssh.com"},
+            {"ssh-rsa", "ssh-rsa"}};
+
         // Create ad-hoc allowedSignersFile and populate it with publicKeys
         auto allowedSignersFile = createTempFile().second;
         std::string allowedSigners;
+
         for (const fetchers::PublicKey & k : publicKeys) {
-            if (k.type != "ssh-dsa"
-                && k.type != "ssh-ecdsa"
-                && k.type != "ssh-ecdsa-sk"
-                && k.type != "ssh-ed25519"
-                && k.type != "ssh-ed25519-sk"
-                && k.type != "ssh-rsa")
-                throw Error("Unknown key type '%s'.\n"
-                    "Please use one of\n"
-                    "- ssh-dsa\n"
-                    "  ssh-ecdsa\n"
-                    "  ssh-ecdsa-sk\n"
-                    "  ssh-ed25519\n"
-                    "  ssh-ed25519-sk\n"
-                    "  ssh-rsa", k.type);
-            allowedSigners += "* " + k.type + " " + k.key + "\n";
+            auto it = keyTypeMap.find(k.type);
+            if (it == keyTypeMap.end()) {
+                std::string supportedTypes;
+                for (const auto & [type, _] : keyTypeMap) {
+                    supportedTypes += fmt("  %s\n", type);
+                }
+                throw Error(
+                    "Invalid SSH key type '%s' in publicKeys.\n"
+                    "Please use one of:\n%s",
+                    k.type,
+                    supportedTypes);
+            }
+
+            allowedSigners += fmt("* %s %s\n", it->second, k.key);
         }
         writeFile(allowedSignersFile, allowedSigners);
 
         // Run verification command
-        auto [status, output] = runProgram(RunOptions {
+        auto [status, output] = runProgram(
+            RunOptions{
                 .program = "git",
-                .args = {
-                    "-c",
-                    "gpg.ssh.allowedSignersFile=" + allowedSignersFile,
-                    "-C", path.string(),
-                    "verify-commit",
-                    rev.gitRev()
-                },
+                .args =
+                    {"-c",
+                     "gpg.ssh.allowedSignersFile=" + allowedSignersFile,
+                     "-C",
+                     path.string(),
+                     "verify-commit",
+                     rev.gitRev()},
                 .mergeStderrToStdout = true,
-        });
+            });
 
         /* Evaluate result through status code and checking if public
            key fingerprints appear on stderr. This is necessary
@@ -603,16 +634,17 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
            commit being signed by gpg keys that are present in the
            users key agent. */
         std::string re = R"(Good "git" signature for \* with .* key SHA256:[)";
-        for (const fetchers::PublicKey & k : publicKeys){
+        for (const fetchers::PublicKey & k : publicKeys) {
             // Calculate sha256 fingerprint from public key and escape the regex symbol '+' to match the key literally
             std::string keyDecoded;
             try {
-                keyDecoded = base64Decode(k.key);
+                keyDecoded = base64::decode(k.key);
             } catch (Error & e) {
                 e.addTrace({}, "while decoding public key '%s' used for git signature", k.key);
             }
-            auto fingerprint = trim(hashString(HashAlgorithm::SHA256, keyDecoded).to_string(nix::HashFormat::Base64, false), "=");
-            auto escaped_fingerprint = std::regex_replace(fingerprint, std::regex("\\+"), "\\+" );
+            auto fingerprint =
+                trim(hashString(HashAlgorithm::SHA256, keyDecoded).to_string(nix::HashFormat::Base64, false), "=");
+            auto escaped_fingerprint = std::regex_replace(fingerprint, std::regex("\\+"), "\\+");
             re += "(" + escaped_fingerprint + ")";
         }
         re += "]";
@@ -679,15 +711,13 @@ struct GitSourceAccessor : SourceAccessor
     Sync<State> state_;
 
     GitSourceAccessor(ref<GitRepoImpl> repo_, const Hash & rev, bool smudgeLfs, bool applyFilters_)
-        : state_{
-                State {
-                    .repo = repo_,
+        : state_{State{
+              .repo = repo_,
                     .oid = hashToOID(rev),
-                    .root = peelToTreeOrBlob(lookupObject(*repo_, hashToOID(rev)).get()),
-                    .lfsFetch = smudgeLfs ? std::make_optional(lfs::Fetch(*repo_, hashToOID(rev))) : std::nullopt,
-                    .applyFilters = applyFilters_,
-                }
-            }
+              .root = peelToTreeOrBlob(lookupObject(*repo_, hashToOID(rev)).get()),
+              .lfsFetch = smudgeLfs ? std::make_optional(lfs::Fetch(*repo_, hashToOID(rev))) : std::nullopt,
+              .applyFilters = applyFilters_,
+          }}
     {
     }
 
@@ -703,8 +733,9 @@ struct GitSourceAccessor : SourceAccessor
                 try {
                     // FIXME: do we need to hold the state lock while
                     // doing this?
-                    auto contents = std::string((const char *) git_blob_rawcontent(blob.get()), git_blob_rawsize(blob.get()));
-                    state->lfsFetch->fetch(contents, path, s, [&s](uint64_t size){ s.s.reserve(size); });
+                    auto contents =
+                        std::string((const char *) git_blob_rawcontent(blob.get()), git_blob_rawsize(blob.get()));
+                    state->lfsFetch->fetch(contents, path, s, [&s](uint64_t size) { s.s.reserve(size); });
                 } catch (Error & e) {
                     e.addTrace({}, "while smudging git-lfs file '%s'", path);
                     throw;
@@ -753,7 +784,7 @@ struct GitSourceAccessor : SourceAccessor
         auto state(state_.lock());
 
         if (path.isRoot())
-            return Stat { .type = git_object_type(state->root.get()) == GIT_OBJECT_TREE ? tDirectory : tRegular };
+            return Stat{.type = git_object_type(state->root.get()) == GIT_OBJECT_TREE ? tDirectory : tRegular};
 
         auto entry = lookup(*state, path);
         if (!entry)
@@ -762,20 +793,20 @@ struct GitSourceAccessor : SourceAccessor
         auto mode = git_tree_entry_filemode(entry);
 
         if (mode == GIT_FILEMODE_TREE)
-            return Stat { .type = tDirectory };
+            return Stat{.type = tDirectory};
 
         else if (mode == GIT_FILEMODE_BLOB)
-            return Stat { .type = tRegular };
+            return Stat{.type = tRegular};
 
         else if (mode == GIT_FILEMODE_BLOB_EXECUTABLE)
-            return Stat { .type = tRegular, .isExecutable = true };
+            return Stat{.type = tRegular, .isExecutable = true};
 
         else if (mode == GIT_FILEMODE_LINK)
-            return Stat { .type = tSymlink };
+            return Stat{.type = tSymlink};
 
         else if (mode == GIT_FILEMODE_COMMIT)
             // Treat submodules as an empty directory.
-            return Stat { .type = tDirectory };
+            return Stat{.type = tDirectory};
 
         else
             throw Error("file '%s' has an unsupported Git file type");
@@ -785,24 +816,23 @@ struct GitSourceAccessor : SourceAccessor
     {
         auto state(state_.lock());
 
-        return std::visit(overloaded {
-            [&](Tree tree) {
-                DirEntries res;
+        return std::visit(
+            overloaded{
+                [&](Tree tree) {
+                    DirEntries res;
 
-                auto count = git_tree_entrycount(tree.get());
+                    auto count = git_tree_entrycount(tree.get());
 
-                for (size_t n = 0; n < count; ++n) {
-                    auto entry = git_tree_entry_byindex(tree.get(), n);
-                    // FIXME: add to cache
-                    res.emplace(std::string(git_tree_entry_name(entry)), DirEntry{});
-                }
+                    for (size_t n = 0; n < count; ++n) {
+                        auto entry = git_tree_entry_byindex(tree.get(), n);
+                        // FIXME: add to cache
+                        res.emplace(std::string(git_tree_entry_name(entry)), DirEntry{});
+                    }
 
-                return res;
-            },
-            [&](Submodule) {
-                return DirEntries();
-            }
-        }, getTree(*state, path));
+                    return res;
+                },
+                [&](Submodule) { return DirEntries(); }},
+            getTree(*state, path));
     }
 
     std::string readLink(const CanonPath & path) override
@@ -826,21 +856,24 @@ struct GitSourceAccessor : SourceAccessor
         return toHash(*git_tree_entry_id(entry));
     }
 
-    std::unordered_map<CanonPath, TreeEntry> lookupCache;
+    boost::unordered_flat_map<CanonPath, TreeEntry, std::hash<CanonPath>> lookupCache;
 
     /* Recursively look up 'path' relative to the root. */
     git_tree_entry * lookup(State & state, const CanonPath & path)
     {
         auto i = lookupCache.find(path);
-        if (i != lookupCache.end()) return i->second.get();
+        if (i != lookupCache.end())
+            return i->second.get();
 
         auto parent = path.parent();
-        if (!parent) return nullptr;
+        if (!parent)
+            return nullptr;
 
         auto name = path.baseName().value();
 
         auto parentTree = lookupTree(state, *parent);
-        if (!parentTree) return nullptr;
+        if (!parentTree)
+            return nullptr;
 
         auto count = git_tree_entrycount(parentTree->get());
 
@@ -882,7 +915,7 @@ struct GitSourceAccessor : SourceAccessor
             return std::nullopt;
 
         Tree tree;
-        if (git_tree_entry_to_object((git_object * *) (git_tree * *) Setter(tree), *state.repo, entry))
+        if (git_tree_entry_to_object((git_object **) (git_tree **) Setter(tree), *state.repo, entry))
             throw Error("looking up directory '%s': %s", showPath(path), git_error_last()->message);
 
         return tree;
@@ -896,7 +929,8 @@ struct GitSourceAccessor : SourceAccessor
         return entry;
     }
 
-    struct Submodule { };
+    struct Submodule
+    {};
 
     std::variant<Tree, Submodule> getTree(State & state, const CanonPath & path)
     {
@@ -916,7 +950,7 @@ struct GitSourceAccessor : SourceAccessor
             throw Error("'%s' is not a directory", showPath(path));
 
         Tree tree;
-        if (git_tree_entry_to_object((git_object * *) (git_tree * *) Setter(tree), *state.repo, entry))
+        if (git_tree_entry_to_object((git_object **) (git_tree **) Setter(tree), *state.repo, entry))
             throw Error("looking up directory '%s': %s", showPath(path), git_error_last()->message);
 
         return tree;
@@ -927,16 +961,12 @@ struct GitSourceAccessor : SourceAccessor
         if (!expectSymlink && git_object_type(state.root.get()) == GIT_OBJECT_BLOB)
             return dupObject<Blob>((git_blob *) &*state.root);
 
-        auto notExpected = [&]()
-        {
-            throw Error(
-                expectSymlink
-                ? "'%s' is not a symlink"
-                : "'%s' is not a regular file",
-                showPath(path));
+        auto notExpected = [&]() {
+            throw Error(expectSymlink ? "'%s' is not a symlink" : "'%s' is not a regular file", showPath(path));
         };
 
-        if (path.isRoot()) notExpected();
+        if (path.isRoot())
+            notExpected();
 
         auto entry = need(state, path);
 
@@ -953,26 +983,31 @@ struct GitSourceAccessor : SourceAccessor
         }
 
         Blob blob;
-        if (git_tree_entry_to_object((git_object * *) (git_blob * *) Setter(blob), *state.repo, entry))
+        if (git_tree_entry_to_object((git_object **) (git_blob **) Setter(blob), *state.repo, entry))
             throw Error("looking up file '%s': %s", showPath(path), git_error_last()->message);
 
         return blob;
     }
 };
 
-struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor {
+struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor
+{
     ref<GitRepoImpl> repo;
     std::optional<Hash> rev;
 
     GitExportIgnoreSourceAccessor(ref<GitRepoImpl> repo, ref<SourceAccessor> next, std::optional<Hash> rev)
-        : CachingFilteringSourceAccessor(next, [&](const CanonPath & path) {
-            return RestrictedPathError(fmt("'%s' does not exist because it was fetched with exportIgnore enabled", path));
-        })
+        : CachingFilteringSourceAccessor(
+              next,
+              [&](const CanonPath & path) {
+                  return RestrictedPathError(
+                      fmt("'%s' does not exist because it was fetched with exportIgnore enabled", path));
+              })
         , repo(repo)
         , rev(rev)
-    { }
+    {
+    }
 
-    bool gitAttrGet(const CanonPath & path, const char * attrName, const char * & valueOut)
+    bool gitAttrGet(const CanonPath & path, const char * attrName, const char *& valueOut)
     {
         const char * pathCStr = path.rel_c_str();
 
@@ -982,27 +1017,16 @@ struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor {
             // TODO: test that gitattributes from global and system are not used
             //       (ie more or less: home and etc - both of them!)
             opts.flags = GIT_ATTR_CHECK_INCLUDE_COMMIT | GIT_ATTR_CHECK_NO_SYSTEM;
-            return git_attr_get_ext(
-                &valueOut,
-                *repo,
-                &opts,
-                pathCStr,
-                attrName
-                );
-        }
-        else {
+            return git_attr_get_ext(&valueOut, *repo, &opts, pathCStr, attrName);
+        } else {
             return git_attr_get(
-                &valueOut,
-                *repo,
-                GIT_ATTR_CHECK_INDEX_ONLY | GIT_ATTR_CHECK_NO_SYSTEM,
-                pathCStr,
-                attrName);
+                &valueOut, *repo, GIT_ATTR_CHECK_INDEX_ONLY | GIT_ATTR_CHECK_NO_SYSTEM, pathCStr, attrName);
         }
     }
 
     bool isExportIgnored(const CanonPath & path)
     {
-        const char *exportIgnoreEntry = nullptr;
+        const char * exportIgnoreEntry = nullptr;
 
         // GIT_ATTR_CHECK_INDEX_ONLY:
         // > It will use index only for creating archives or for a bare repo
@@ -1013,8 +1037,7 @@ struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor {
                 return false;
             else
                 throw Error("looking up '%s': %s", showPath(path), git_error_last()->message);
-        }
-        else {
+        } else {
             // Official git will silently reject export-ignore lines that have
             // values. We do the same.
             return GIT_ATTR_IS_TRUE(exportIgnoreEntry);
@@ -1025,7 +1048,6 @@ struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor {
     {
         return !isExportIgnored(path);
     }
-
 };
 
 struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
@@ -1045,26 +1067,25 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
         const git_tree_entry * entry;
         Tree prevTree = nullptr;
 
-        if (!pendingDirs.empty() &&
-            (entry = git_treebuilder_get(pendingDirs.back().builder.get(), name.c_str())))
-        {
+        if (!pendingDirs.empty() && (entry = git_treebuilder_get(pendingDirs.back().builder.get(), name.c_str()))) {
             /* Clone a tree that we've already finished. This happens
                if a tarball has directory entries that are not
                contiguous. */
             if (git_tree_entry_type(entry) != GIT_OBJECT_TREE)
                 throw Error("parent of '%s' is not a directory", name);
 
-            if (git_tree_entry_to_object((git_object * *) (git_tree * *) Setter(prevTree), *repo, entry))
+            if (git_tree_entry_to_object((git_object **) (git_tree **) Setter(prevTree), *repo, entry))
                 throw Error("looking up parent of '%s': %s", name, git_error_last()->message);
         }
 
         git_treebuilder * b;
         if (git_treebuilder_new(&b, *repo, prevTree.get()))
             throw Error("creating a tree builder: %s", git_error_last()->message);
-        pendingDirs.push_back({ .name = std::move(name), .builder = TreeBuilder(b) });
+        pendingDirs.push_back({.name = std::move(name), .builder = TreeBuilder(b)});
     };
 
-    GitFileSystemObjectSinkImpl(ref<GitRepoImpl> repo) : repo(repo)
+    GitFileSystemObjectSinkImpl(ref<GitRepoImpl> repo)
+        : repo(repo)
     {
         pushBuilder("");
     }
@@ -1111,53 +1132,54 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
     {
         std::span<const std::string> pathComponents2{pathComponents};
 
-        updateBuilders(
-            isDir
-            ? pathComponents2
-            : pathComponents2.first(pathComponents2.size() - 1));
+        updateBuilders(isDir ? pathComponents2 : pathComponents2.first(pathComponents2.size() - 1));
 
         return true;
     }
 
-    void createRegularFile(
-        const CanonPath & path,
-        std::function<void(CreateRegularFileSink &)> func) override
+    void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func) override
     {
         auto pathComponents = tokenizeString<std::vector<std::string>>(path.rel(), "/");
-        if (!prepareDirs(pathComponents, false)) return;
+        if (!prepareDirs(pathComponents, false))
+            return;
 
         git_writestream * stream = nullptr;
         if (git_blob_create_from_stream(&stream, *repo, nullptr))
             throw Error("creating a blob stream object: %s", git_error_last()->message);
 
-        struct CRF : CreateRegularFileSink {
+        struct CRF : CreateRegularFileSink
+        {
             const CanonPath & path;
             GitFileSystemObjectSinkImpl & back;
             git_writestream * stream;
             bool executable = false;
+
             CRF(const CanonPath & path, GitFileSystemObjectSinkImpl & back, git_writestream * stream)
-                : path(path), back(back), stream(stream)
-            {}
-            void operator () (std::string_view data) override
+                : path(path)
+                , back(back)
+                , stream(stream)
+            {
+            }
+
+            void operator()(std::string_view data) override
             {
                 if (stream->write(stream, data.data(), data.size()))
                     throw Error("writing a blob for tarball member '%s': %s", path, git_error_last()->message);
             }
+
             void isExecutable() override
             {
                 executable = true;
             }
-        } crf { path, *this, stream };
+        } crf{path, *this, stream};
+
         func(crf);
 
         git_oid oid;
         if (git_blob_create_from_stream_commit(&oid, stream))
             throw Error("creating a blob object for tarball member '%s': %s", path, git_error_last()->message);
 
-        addToTree(*pathComponents.rbegin(), oid,
-            crf.executable
-            ? GIT_FILEMODE_BLOB_EXECUTABLE
-            : GIT_FILEMODE_BLOB);
+        addToTree(*pathComponents.rbegin(), oid, crf.executable ? GIT_FILEMODE_BLOB_EXECUTABLE : GIT_FILEMODE_BLOB);
     }
 
     void createDirectory(const CanonPath & path) override
@@ -1169,7 +1191,8 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
     void createSymlink(const CanonPath & path, const std::string & target) override
     {
         auto pathComponents = tokenizeString<std::vector<std::string>>(path.rel(), "/");
-        if (!prepareDirs(pathComponents, false)) return;
+        if (!prepareDirs(pathComponents, false))
+            return;
 
         git_oid oid;
         if (git_blob_create_from_buffer(&oid, *repo, target.c_str(), target.size()))
@@ -1184,7 +1207,8 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
         for (auto & c : path)
             pathComponents.emplace_back(c);
 
-        if (!prepareDirs(pathComponents, false)) return;
+        if (!prepareDirs(pathComponents, false))
+            return;
 
         // We can't just look up the path from the start of the root, since
         // some parent directories may not have finished yet, so we compute
@@ -1228,9 +1252,7 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
 
         assert(entry);
 
-        addToTree(*pathComponents.rbegin(),
-            *git_tree_entry_id(entry),
-            git_tree_entry_filemode(entry));
+        addToTree(*pathComponents.rbegin(), *git_tree_entry_id(entry), git_tree_entry_filemode(entry));
     }
 
     Hash flush() override
@@ -1245,21 +1267,30 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
     }
 };
 
+<<<<<<< HEAD
 ref<GitSourceAccessor> GitRepoImpl::getRawAccessor(
     const Hash & rev,
     bool smudgeLfs,
     bool applyFilters)
+=======
+ref<GitSourceAccessor> GitRepoImpl::getRawAccessor(const Hash & rev, bool smudgeLfs)
+>>>>>>> origin/master
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
     return make_ref<GitSourceAccessor>(self, rev, smudgeLfs, applyFilters);
 }
 
+<<<<<<< HEAD
 ref<SourceAccessor> GitRepoImpl::getAccessor(
     const Hash & rev,
     bool exportIgnore,
     std::string displayPrefix,
     bool smudgeLfs,
     bool applyFilters)
+=======
+ref<SourceAccessor>
+GitRepoImpl::getAccessor(const Hash & rev, bool exportIgnore, std::string displayPrefix, bool smudgeLfs)
+>>>>>>> origin/master
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
     ref<GitSourceAccessor> rawGitAccessor = getRawAccessor(rev, smudgeLfs, applyFilters);
@@ -1270,16 +1301,17 @@ ref<SourceAccessor> GitRepoImpl::getAccessor(
         return rawGitAccessor;
 }
 
-ref<SourceAccessor> GitRepoImpl::getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError)
+ref<SourceAccessor>
+GitRepoImpl::getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError)
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
-    ref<SourceAccessor> fileAccessor =
-        AllowListSourceAccessor::create(
-            makeFSSourceAccessor(path),
-            std::set<CanonPath>{ wd.files },
-            // Always allow access to the root, but not its children.
-            std::unordered_set<CanonPath>{CanonPath::root},
-            std::move(makeNotAllowedError)).cast<SourceAccessor>();
+    ref<SourceAccessor> fileAccessor = AllowListSourceAccessor::create(
+                                           makeFSSourceAccessor(path),
+                                           std::set<CanonPath>{wd.files},
+                                           // Always allow access to the root, but not its children.
+                                           boost::unordered_flat_set<CanonPath, std::hash<CanonPath>>{CanonPath::root},
+                                           std::move(makeNotAllowedError))
+                                           .cast<SourceAccessor>();
     if (exportIgnore)
         return make_ref<GitExportIgnoreSourceAccessor>(self, fileAccessor, std::nullopt);
     else
@@ -1297,7 +1329,8 @@ std::vector<std::tuple<GitRepoImpl::Submodule, Hash>> GitRepoImpl::getSubmodules
     CanonPath modulesFile(".gitmodules");
 
     auto accessor = getAccessor(rev, exportIgnore, "");
-    if (!accessor->pathExists(modulesFile)) return {};
+    if (!accessor->pathExists(modulesFile))
+        return {};
 
     /* Parse it and get the revision of each submodule. */
     auto configS = accessor->readFile(modulesFile);
@@ -1337,11 +1370,71 @@ GitRepo::WorkdirInfo GitRepo::getCachedWorkdirInfo(const std::filesystem::path &
     {
         auto cache(_cache.lock());
         auto i = cache->find(path);
-        if (i != cache->end()) return i->second;
+        if (i != cache->end())
+            return i->second;
     }
     auto workdirInfo = GitRepo::openRepo(path)->getWorkdirInfo();
     _cache.lock()->emplace(path, workdirInfo);
     return workdirInfo;
 }
 
+/**
+ * Checks that the git reference is valid and normalizes slash '/' sequences.
+ *
+ * Accepts shorthand references (one-level refnames are allowed).
+ */
+bool isValidRefNameAllowNormalizations(const std::string & refName)
+{
+    /* Unfortunately libgit2 doesn't expose the limit in headers, but its internal
+       limit is also 1024. */
+    std::array<char, 1024> normalizedRefBuffer;
+
+    /* It would be nice to have a better API like git_reference_name_is_valid, but
+     * with GIT_REFERENCE_FORMAT_REFSPEC_SHORTHAND flag. libgit2 uses it internally
+     * but doesn't expose it in public headers [1].
+     * [1]:
+     * https://github.com/libgit2/libgit2/blob/9d5f1bacc23594c2ba324c8f0d41b88bf0e9ef04/src/libgit2/refs.c#L1362-L1365
+     */
+
+    auto res = git_reference_normalize_name(
+        normalizedRefBuffer.data(),
+        normalizedRefBuffer.size(),
+        refName.c_str(),
+        GIT_REFERENCE_FORMAT_ALLOW_ONELEVEL | GIT_REFERENCE_FORMAT_REFSPEC_SHORTHAND);
+
+    return res == 0;
 }
+
+bool isLegalRefName(const std::string & refName)
+{
+    initLibGit2();
+
+    /* Since `git_reference_normalize_name` is the best API libgit2 has for verifying
+     * reference names with shorthands (see comment in normalizeRefName), we need to
+     * ensure that exceptions to the validity checks imposed by normalization [1] are checked
+     * explicitly.
+     * [1]: https://git-scm.com/docs/git-check-ref-format#Documentation/git-check-ref-format.txt---normalize
+     */
+
+    /* Check for cases that don't get rejected by libgit2.
+     * FIXME: libgit2 should reject this. */
+    if (refName == "@")
+        return false;
+
+    /* Leading slashes and consecutive slashes are stripped during normalizatiton. */
+    if (refName.starts_with('/') || refName.find("//") != refName.npos)
+        return false;
+
+    /* Refer to libgit2. */
+    if (!isValidRefNameAllowNormalizations(refName))
+        return false;
+
+    /* libgit2 doesn't barf on DEL symbol.
+     * FIXME: libgit2 should reject this. */
+    if (refName.find('\177') != refName.npos)
+        return false;
+
+    return true;
+}
+
+} // namespace nix
diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index 9d37c4ee8..c3cb036af 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -43,10 +43,8 @@ bool isCacheFileWithinTtl(time_t now, const struct stat & st)
 
 Path getCachePath(std::string_view key, bool shallow)
 {
-    return getCacheDir()
-    + "/gitv3/"
-    + hashString(HashAlgorithm::SHA256, key).to_string(HashFormat::Nix32, false)
-    + (shallow ? "-shallow" : "");
+    return getCacheDir() + "/gitv3/" + hashString(HashAlgorithm::SHA256, key).to_string(HashFormat::Nix32, false)
+           + (shallow ? "-shallow" : "");
 }
 
 // Returns the name of the HEAD branch.
@@ -58,24 +56,26 @@ Path getCachePath(std::string_view key, bool shallow)
 //   ...
 std::optional<std::string> readHead(const Path & path)
 {
-    auto [status, output] = runProgram(RunOptions {
-        .program = "git",
-        // FIXME: use 'HEAD' to avoid returning all refs
-        .args = {"ls-remote", "--symref", path},
-        .isInteractive = true,
-    });
-    if (status != 0) return std::nullopt;
+    auto [status, output] = runProgram(
+        RunOptions{
+            .program = "git",
+            // FIXME: use 'HEAD' to avoid returning all refs
+            .args = {"ls-remote", "--symref", path},
+            .isInteractive = true,
+        });
+    if (status != 0)
+        return std::nullopt;
 
     std::string_view line = output;
     line = line.substr(0, line.find("\n"));
     if (const auto parseResult = git::parseLsRemoteLine(line); parseResult && parseResult->reference == "HEAD") {
         switch (parseResult->kind) {
-            case git::LsRemoteRefLine::Kind::Symbolic:
-                debug("resolved HEAD ref '%s' for repo '%s'", parseResult->target, path);
-                break;
-            case git::LsRemoteRefLine::Kind::Object:
-                debug("resolved HEAD rev '%s' for repo '%s'", parseResult->target, path);
-                break;
+        case git::LsRemoteRefLine::Kind::Symbolic:
+            debug("resolved HEAD ref '%s' for repo '%s'", parseResult->target, path);
+            break;
+        case git::LsRemoteRefLine::Kind::Object:
+            debug("resolved HEAD rev '%s' for repo '%s'", parseResult->target, path);
+            break;
         }
         return parseResult->target;
     }
@@ -87,15 +87,15 @@ bool storeCachedHead(const std::string & actualUrl, bool shallow, const std::str
 {
     Path cacheDir = getCachePath(actualUrl, shallow);
     try {
-        runProgram("git", true, { "-C", cacheDir, "--git-dir", ".", "symbolic-ref", "--", "HEAD", headRef });
-    } catch (ExecError &e) {
+        runProgram("git", true, {"-C", cacheDir, "--git-dir", ".", "symbolic-ref", "--", "HEAD", headRef});
+    } catch (ExecError & e) {
         if (
 #ifndef WIN32 // TODO abstract over exit status handling on Windows
             !WIFEXITED(e.status)
 #else
             e.status != 0
 #endif
-            )
+        )
             throw;
 
         return false;
@@ -116,17 +116,15 @@ std::optional<std::string> readHeadCached(const std::string & actualUrl, bool sh
     std::optional<std::string> cachedRef;
     if (stat(headRefFile.c_str(), &st) == 0) {
         cachedRef = readHead(cacheDir);
-        if (cachedRef != std::nullopt &&
-            *cachedRef != gitInitialBranch &&
-            isCacheFileWithinTtl(now, st))
-        {
+        if (cachedRef != std::nullopt && *cachedRef != gitInitialBranch && isCacheFileWithinTtl(now, st)) {
             debug("using cached HEAD ref '%s' for repo '%s'", *cachedRef, actualUrl);
             return cachedRef;
         }
     }
 
     auto ref = readHead(actualUrl);
-    if (ref) return ref;
+    if (ref)
+        return ref;
 
     if (cachedRef) {
         // If the cached git ref is expired in fetch() below, and the 'git fetch'
@@ -152,28 +150,26 @@ std::vector<PublicKey> getPublicKeys(const Attrs & attrs)
         }
     }
     if (attrs.contains("publicKey"))
-        publicKeys.push_back(PublicKey{maybeGetStrAttr(attrs, "keytype").value_or("ssh-ed25519"),getStrAttr(attrs, "publicKey")});
+        publicKeys.push_back(
+            PublicKey{maybeGetStrAttr(attrs, "keytype").value_or("ssh-ed25519"), getStrAttr(attrs, "publicKey")});
     return publicKeys;
 }
 
-}  // end namespace
+} // end namespace
 
 static const Hash nullRev{HashAlgorithm::SHA1};
 
 struct GitInputScheme : InputScheme
 {
-    std::optional<Input> inputFromURL(
-        const Settings & settings,
-        const ParsedURL & url, bool requireTree) const override
+    std::optional<Input> inputFromURL(const Settings & settings, const ParsedURL & url, bool requireTree) const override
     {
-        if (url.scheme != "git" &&
-            url.scheme != "git+http" &&
-            url.scheme != "git+https" &&
-            url.scheme != "git+ssh" &&
-            url.scheme != "git+file") return {};
+        auto parsedScheme = parseUrlScheme(url.scheme);
+        if (parsedScheme.application != "git")
+            return {};
 
         auto url2(url);
-        if (hasPrefix(url2.scheme, "git+")) url2.scheme = std::string(url2.scheme, 4);
+        if (hasPrefix(url2.scheme, "git+"))
+            url2.scheme = std::string(url2.scheme, 4);
         url2.query.clear();
 
         Attrs attrs;
@@ -182,8 +178,10 @@ struct GitInputScheme : InputScheme
         for (auto & [name, value] : url.query) {
             if (name == "rev" || name == "ref" || name == "keytype" || name == "publicKey" || name == "publicKeys")
                 attrs.emplace(name, value);
-            else if (name == "shallow" || name == "submodules" || name == "lfs" || name == "exportIgnore" || name == "allRefs" || name == "verifyCommit" || name == "applyFilters")
-                attrs.emplace(name, Explicit<bool> { value == "1" });
+            else if (
+                name == "shallow" || name == "submodules" || name == "lfs" || name == "exportIgnore"
+                || name == "allRefs" || name == "verifyCommit" || name == "applyFilters")
+                attrs.emplace(name, Explicit<bool>{value == "1"});
             else
                 url2.query.emplace(name, value);
         }
@@ -193,7 +191,6 @@ struct GitInputScheme : InputScheme
         return inputFromAttrs(settings, attrs);
     }
 
-
     std::string_view schemeName() const override
     {
         return "git";
@@ -224,29 +221,20 @@ struct GitInputScheme : InputScheme
         };
     }
 
-    std::optional<Input> inputFromAttrs(
-        const Settings & settings,
-        const Attrs & attrs) const override
+    std::optional<Input> inputFromAttrs(const Settings & settings, const Attrs & attrs) const override
     {
         for (auto & [name, _] : attrs)
-            if (name == "verifyCommit"
-                || name == "keytype"
-                || name == "publicKey"
-                || name == "publicKeys")
+            if (name == "verifyCommit" || name == "keytype" || name == "publicKey" || name == "publicKeys")
                 experimentalFeatureSettings.require(Xp::VerifiedFetches);
 
         maybeGetBoolAttr(attrs, "verifyCommit");
 
-        if (auto ref = maybeGetStrAttr(attrs, "ref")) {
-            if (std::regex_search(*ref, badGitRefRegex))
-                throw BadURL("invalid Git branch/tag name '%s'", *ref);
-        }
+        if (auto ref = maybeGetStrAttr(attrs, "ref"); ref && !isLegalRefName(*ref))
+            throw BadURL("invalid Git branch/tag name '%s'", *ref);
 
         Input input{settings};
         input.attrs = attrs;
-        auto url = fixGitURL(getStrAttr(attrs, "url"));
-        parseURL(url);
-        input.attrs["url"] = url;
+        input.attrs["url"] = fixGitURL(getStrAttr(attrs, "url")).to_string();
         getShallowAttr(input);
         getSubmodulesAttr(input);
         getAllRefsAttr(input);
@@ -256,9 +244,12 @@ struct GitInputScheme : InputScheme
     ParsedURL toURL(const Input & input) const override
     {
         auto url = parseURL(getStrAttr(input.attrs, "url"));
-        if (url.scheme != "git") url.scheme = "git+" + url.scheme;
-        if (auto rev = input.getRev()) url.query.insert_or_assign("rev", rev->gitRev());
-        if (auto ref = input.getRef()) url.query.insert_or_assign("ref", *ref);
+        if (url.scheme != "git")
+            url.scheme = "git+" + url.scheme;
+        if (auto rev = input.getRev())
+            url.query.insert_or_assign("rev", rev->gitRev());
+        if (auto ref = input.getRef())
+            url.query.insert_or_assign("ref", *ref);
         if (getShallowAttr(input))
             url.query.insert_or_assign("shallow", "1");
         if (getLfsAttr(input))
@@ -273,22 +264,20 @@ struct GitInputScheme : InputScheme
         if (publicKeys.size() == 1) {
             url.query.insert_or_assign("keytype", publicKeys.at(0).type);
             url.query.insert_or_assign("publicKey", publicKeys.at(0).key);
-        }
-        else if (publicKeys.size() > 1)
+        } else if (publicKeys.size() > 1)
             url.query.insert_or_assign("publicKeys", publicKeys_to_string(publicKeys));
         if (maybeGetBoolAttr(input.attrs, "applyFilters").value_or(false))
             url.query.insert_or_assign("applyFilters", "1");
         return url;
     }
 
-    Input applyOverrides(
-        const Input & input,
-        std::optional<std::string> ref,
-        std::optional<Hash> rev) const override
+    Input applyOverrides(const Input & input, std::optional<std::string> ref, std::optional<Hash> rev) const override
     {
         auto res(input);
-        if (rev) res.attrs.insert_or_assign("rev", rev->gitRev());
-        if (ref) res.attrs.insert_or_assign("ref", *ref);
+        if (rev)
+            res.attrs.insert_or_assign("rev", rev->gitRev());
+        if (ref)
+            res.attrs.insert_or_assign("ref", *ref);
         if (!res.getRef() && res.getRev())
             throw Error("Git input '%s' has a commit hash but no branch/tag name", res.to_string());
         return res;
@@ -307,7 +296,8 @@ struct GitInputScheme : InputScheme
             args.push_back(*ref);
         }
 
-        if (input.getRev()) throw UnimplementedError("cloning a specific revision is not implemented");
+        if (input.getRev())
+            throw UnimplementedError("cloning a specific revision is not implemented");
 
         args.push_back(destDir);
 
@@ -328,14 +318,23 @@ struct GitInputScheme : InputScheme
         auto repoInfo = getRepoInfo(input);
         auto repoPath = repoInfo.getPath();
         if (!repoPath)
-            throw Error("cannot commit '%s' to Git repository '%s' because it's not a working tree", path, input.to_string());
+            throw Error(
+                "cannot commit '%s' to Git repository '%s' because it's not a working tree", path, input.to_string());
 
         writeFile(*repoPath / path.rel(), contents);
 
-        auto result = runProgram(RunOptions {
-            .program = "git",
-            .args = {"-C", repoPath->string(), "--git-dir", repoInfo.gitDir, "check-ignore", "--quiet", std::string(path.rel())},
-        });
+        auto result = runProgram(
+            RunOptions{
+                .program = "git",
+                .args =
+                    {"-C",
+                     repoPath->string(),
+                     "--git-dir",
+                     repoInfo.gitDir,
+                     "check-ignore",
+                     "--quiet",
+                     std::string(path.rel())},
+            });
         auto exitCode =
 #ifndef WIN32 // TODO abstract over exit status handling on Windows
             WEXITSTATUS(result.first)
@@ -346,15 +345,32 @@ struct GitInputScheme : InputScheme
 
         if (exitCode != 0) {
             // The path is not `.gitignore`d, we can add the file.
-            runProgram("git", true,
-                { "-C", repoPath->string(), "--git-dir", repoInfo.gitDir, "add", "--intent-to-add", "--", std::string(path.rel()) });
-
+            runProgram(
+                "git",
+                true,
+                {"-C",
+                 repoPath->string(),
+                 "--git-dir",
+                 repoInfo.gitDir,
+                 "add",
+                 "--intent-to-add",
+                 "--",
+                 std::string(path.rel())});
 
             if (commitMsg) {
                 // Pause the logger to allow for user input (such as a gpg passphrase) in `git commit`
                 auto suspension = logger->suspend();
-                runProgram("git", true,
-                    { "-C", repoPath->string(), "--git-dir", repoInfo.gitDir, "commit", std::string(path.rel()), "-F", "-" },
+                runProgram(
+                    "git",
+                    true,
+                    {"-C",
+                     repoPath->string(),
+                     "--git-dir",
+                     repoInfo.gitDir,
+                     "commit",
+                     std::string(path.rel()),
+                     "-F",
+                     "-"},
                     *commitMsg);
             }
         }
@@ -373,12 +389,10 @@ struct GitInputScheme : InputScheme
         std::string locationToArg() const
         {
             return std::visit(
-                overloaded {
-                    [&](const std::filesystem::path & path)
-                    { return path.string(); },
-                    [&](const ParsedURL & url)
-                    { return url.to_string(); }
-                }, location);
+                overloaded{
+                    [&](const std::filesystem::path & path) { return path.string(); },
+                    [&](const ParsedURL & url) { return url.to_string(); }},
+                location);
         }
 
         std::optional<std::filesystem::path> getPath() const
@@ -435,10 +449,11 @@ struct GitInputScheme : InputScheme
 
     RepoInfo getRepoInfo(const Input & input) const
     {
-        auto checkHashAlgorithm = [&](const std::optional<Hash> & hash)
-        {
+        auto checkHashAlgorithm = [&](const std::optional<Hash> & hash) {
             if (hash.has_value() && !(hash->algo == HashAlgorithm::SHA1 || hash->algo == HashAlgorithm::SHA256))
-                throw Error("Hash '%s' is not supported by Git. Supported types are sha1 and sha256.", hash->to_string(HashFormat::Base16, true));
+                throw Error(
+                    "Hash '%s' is not supported by Git. Supported types are sha1 and sha256.",
+                    hash->to_string(HashFormat::Base16, true));
         };
 
         if (auto rev = input.getRev())
@@ -452,8 +467,11 @@ struct GitInputScheme : InputScheme
         // repo, treat as a remote URI to force a clone.
         static bool forceHttp = getEnv("_NIX_FORCE_HTTP") == "1"; // for testing
         auto url = parseURL(getStrAttr(input.attrs, "url"));
-        bool isBareRepository = url.scheme == "file" && !pathExists(url.path + "/.git");
-        //
+
+        // Why are we checking for bare repository?
+        // well if it's a bare repository we want to force a git fetch rather than copying the folder
+        auto isBareRepository = [](PathView path) { return pathExists(path) && !pathExists(path + "/.git"); };
+
         // FIXME: here we turn a possibly relative path into an absolute path.
         // This allows relative git flake inputs to be resolved against the
         // **current working directory** (as in POSIX), which tends to work out
@@ -462,15 +480,23 @@ struct GitInputScheme : InputScheme
         //
         // See: https://discourse.nixos.org/t/57783 and #9708
         //
-        if (url.scheme == "file" && !forceHttp && !isBareRepository) {
-            if (!isAbsolute(url.path)) {
+        if (url.scheme == "file" && !forceHttp && !isBareRepository(renderUrlPathEnsureLegal(url.path))) {
+            auto path = renderUrlPathEnsureLegal(url.path);
+
+            if (!isAbsolute(path)) {
                 warn(
                     "Fetching Git repository '%s', which uses a path relative to the current directory. "
                     "This is not supported and will stop working in a future release. "
                     "See https://github.com/NixOS/nix/issues/12281 for details.",
                     url);
             }
-            repoInfo.location = std::filesystem::absolute(url.path);
+
+            // If we don't check here for the path existence, then we can give libgit2 any directory
+            // and it will initialize them as git directories.
+            if (!pathExists(path)) {
+                throw Error("The path '%s' does not exist.", path);
+            }
+            repoInfo.location = std::filesystem::absolute(path);
         } else {
             if (url.scheme == "file")
                 /* Query parameters are meaningless for file://, but
@@ -488,7 +514,11 @@ struct GitInputScheme : InputScheme
         return repoInfo;
     }
 
-    uint64_t getLastModified(const Settings & settings, const RepoInfo & repoInfo, const std::filesystem::path & repoDir, const Hash & rev) const
+    uint64_t getLastModified(
+        const Settings & settings,
+        const RepoInfo & repoInfo,
+        const std::filesystem::path & repoDir,
+        const Hash & rev) const
     {
         Cache::Key key{"gitLastModified", {{"rev", rev.gitRev()}}};
 
@@ -504,7 +534,11 @@ struct GitInputScheme : InputScheme
         return lastModified;
     }
 
-    uint64_t getRevCount(const Settings & settings, const RepoInfo & repoInfo, const std::filesystem::path & repoDir, const Hash & rev) const
+    uint64_t getRevCount(
+        const Settings & settings,
+        const RepoInfo & repoInfo,
+        const std::filesystem::path & repoDir,
+        const Hash & rev) const
     {
         Cache::Key key{"gitRevCount", {{"rev", rev.gitRev()}}};
 
@@ -513,7 +547,8 @@ struct GitInputScheme : InputScheme
         if (auto revCountAttrs = cache->lookup(key))
             return getIntAttr(*revCountAttrs, "revCount");
 
-        Activity act(*logger, lvlChatty, actUnknown, fmt("getting Git revision count of '%s'", repoInfo.locationToArg()));
+        Activity act(
+            *logger, lvlChatty, actUnknown, fmt("getting Git revision count of '%s'", repoInfo.locationToArg()));
 
         auto revCount = GitRepo::openRepo(repoDir)->getRevCount(rev);
 
@@ -525,12 +560,10 @@ struct GitInputScheme : InputScheme
     std::string getDefaultRef(const RepoInfo & repoInfo, bool shallow) const
     {
         auto head = std::visit(
-            overloaded {
-                [&](const std::filesystem::path & path)
-                { return GitRepo::openRepo(path)->getWorkdirRef(); },
-                [&](const ParsedURL & url)
-                { return readHeadCached(url.to_string(), shallow); }
-            }, repoInfo.location);
+            overloaded{
+                [&](const std::filesystem::path & path) { return GitRepo::openRepo(path)->getWorkdirRef(); },
+                [&](const ParsedURL & url) { return readHeadCached(url.to_string(), shallow); }},
+            repoInfo.location);
         if (!head) {
             warn("could not read HEAD ref from repo at '%s', using 'master'", repoInfo.locationToArg());
             return "master";
@@ -564,14 +597,13 @@ struct GitInputScheme : InputScheme
             if (input.getRev() && repo)
                 repo->verifyCommit(*input.getRev(), publicKeys);
             else
-                throw Error("commit verification is required for Git repository '%s', but it's dirty", input.to_string());
+                throw Error(
+                    "commit verification is required for Git repository '%s', but it's dirty", input.to_string());
         }
     }
 
-    std::pair<ref<SourceAccessor>, Input> getAccessorFromCommit(
-        ref<Store> store,
-        RepoInfo & repoInfo,
-        Input && input) const
+    std::pair<ref<SourceAccessor>, Input>
+    getAccessorFromCommit(ref<Store> store, RepoInfo & repoInfo, Input && input) const
     {
         assert(!repoInfo.workdirInfo.isDirty);
 
@@ -602,12 +634,9 @@ struct GitInputScheme : InputScheme
             // We need to set the origin so resolving submodule URLs works
             repo->setRemote("origin", repoUrl.to_string());
 
-            auto localRefFile =
-                ref.compare(0, 5, "refs/") == 0
-                ? cacheDir / ref
-                : cacheDir / "refs/heads" / ref;
+            auto localRefFile = ref.compare(0, 5, "refs/") == 0 ? cacheDir / ref : cacheDir / "refs/heads" / ref;
 
-            bool doFetch;
+            bool doFetch = false;
             time_t now = time(0);
 
             /* If a rev was specified, we need to fetch if it's not in the
@@ -621,30 +650,27 @@ struct GitInputScheme : InputScheme
                     /* If the local ref is older than ‘tarball-ttl’ seconds, do a
                        git fetch to update the local ref to the remote ref. */
                     struct stat st;
-                    doFetch = stat(localRefFile.string().c_str(), &st) != 0 ||
-                        !isCacheFileWithinTtl(now, st);
+                    doFetch = stat(localRefFile.string().c_str(), &st) != 0 || !isCacheFileWithinTtl(now, st);
                 }
             }
 
             if (doFetch) {
                 bool shallow = getShallowAttr(input);
                 try {
-                    auto fetchRef =
-                        getAllRefsAttr(input)
-                        ? "refs/*:refs/*"
-                        : input.getRev()
-                        ? input.getRev()->gitRev()
-                        : ref.compare(0, 5, "refs/") == 0
-                        ? fmt("%1%:%1%", ref)
-                        : ref == "HEAD"
-                        ? ref
-                        : fmt("%1%:%1%", "refs/heads/" + ref);
+                    auto fetchRef = getAllRefsAttr(input)             ? "refs/*:refs/*"
+                                    : input.getRev()                  ? input.getRev()->gitRev()
+                                    : ref.compare(0, 5, "refs/") == 0 ? fmt("%1%:%1%", ref)
+                                    : ref == "HEAD"                   ? ref
+                                                                      : fmt("%1%:%1%", "refs/heads/" + ref);
 
                     repo->fetch(repoUrl.to_string(), fetchRef, shallow);
                 } catch (Error & e) {
-                    if (!std::filesystem::exists(localRefFile)) throw;
+                    if (!std::filesystem::exists(localRefFile))
+                        throw;
                     logError(e.info());
-                    warn("could not update local clone of Git repository '%s'; continuing with the most recent version", repoInfo.locationToArg());
+                    warn(
+                        "could not update local clone of Git repository '%s'; continuing with the most recent version",
+                        repoInfo.locationToArg());
                 }
 
                 try {
@@ -661,16 +687,17 @@ struct GitInputScheme : InputScheme
                 if (!repo->hasObject(*rev))
                     throw Error(
                         "Cannot find Git revision '%s' in ref '%s' of repository '%s'! "
-                        "Please make sure that the " ANSI_BOLD "rev" ANSI_NORMAL " exists on the "
-                        ANSI_BOLD "ref" ANSI_NORMAL " you've specified or add " ANSI_BOLD
-                        "allRefs = true;" ANSI_NORMAL " to " ANSI_BOLD "fetchGit" ANSI_NORMAL ".",
+                        "Please make sure that the " ANSI_BOLD "rev" ANSI_NORMAL " exists on the " ANSI_BOLD
+                        "ref" ANSI_NORMAL " you've specified or add " ANSI_BOLD "allRefs = true;" ANSI_NORMAL
+                        " to " ANSI_BOLD "fetchGit" ANSI_NORMAL ".",
                         rev->gitRev(),
                         ref,
                         repoInfo.locationToArg());
             } else
                 input.attrs.insert_or_assign("rev", repo->resolveRef(ref).gitRev());
 
-            // cache dir lock is removed at scope end; we will only use read-only operations on specific revisions in the remainder
+            // cache dir lock is removed at scope end; we will only use read-only operations on specific revisions in
+            // the remainder
         }
 
         auto repo = GitRepo::openRepo(repoDir);
@@ -678,7 +705,9 @@ struct GitInputScheme : InputScheme
         auto isShallow = repo->isShallow();
 
         if (isShallow && !getShallowAttr(input))
-            throw Error("'%s' is a shallow Git repository, but shallow repositories are only allowed when `shallow = true;` is specified", repoInfo.locationToArg());
+            throw Error(
+                "'%s' is a shallow Git repository, but shallow repositories are only allowed when `shallow = true;` is specified",
+                repoInfo.locationToArg());
 
         // FIXME: check whether rev is an ancestor of ref?
 
@@ -690,8 +719,7 @@ struct GitInputScheme : InputScheme
         });
 
         if (!getShallowAttr(input))
-            infoAttrs.insert_or_assign("revCount",
-                getRevCount(*input.settings, repoInfo, repoDir, rev));
+            infoAttrs.insert_or_assign("revCount", getRevCount(*input.settings, repoInfo, repoDir, rev));
 
         printTalkative("using revision %s of repo '%s'", rev.gitRev(), repoInfo.locationToArg());
 
@@ -710,22 +738,34 @@ struct GitInputScheme : InputScheme
 
             for (auto & [submodule, submoduleRev] : repo->getSubmodules(rev, exportIgnore)) {
                 auto resolved = repo->resolveSubmoduleUrl(submodule.url);
-                debug("Git submodule %s: %s %s %s -> %s",
-                    submodule.path, submodule.url, submodule.branch, submoduleRev.gitRev(), resolved);
+                debug(
+                    "Git submodule %s: %s %s %s -> %s",
+                    submodule.path,
+                    submodule.url,
+                    submodule.branch,
+                    submoduleRev.gitRev(),
+                    resolved);
                 fetchers::Attrs attrs;
                 attrs.insert_or_assign("type", "git");
                 attrs.insert_or_assign("url", resolved);
-                if (submodule.branch != "")
-                    attrs.insert_or_assign("ref", submodule.branch);
+                if (submodule.branch != "") {
+                    // A special value of . is used to indicate that the name of the branch in the submodule
+                    // should be the same name as the current branch in the current repository.
+                    // https://git-scm.com/docs/gitmodules
+                    if (submodule.branch == ".") {
+                        attrs.insert_or_assign("ref", ref);
+                    } else {
+                        attrs.insert_or_assign("ref", submodule.branch);
+                    }
+                }
                 attrs.insert_or_assign("rev", submoduleRev.gitRev());
-                attrs.insert_or_assign("exportIgnore", Explicit<bool>{ exportIgnore });
-                attrs.insert_or_assign("applyFilters", Explicit<bool>{ applyFilters });
-                attrs.insert_or_assign("submodules", Explicit<bool>{ true });
-                attrs.insert_or_assign("lfs", Explicit<bool>{ smudgeLfs });
-                attrs.insert_or_assign("allRefs", Explicit<bool>{ true });
+                attrs.insert_or_assign("exportIgnore", Explicit<bool>{exportIgnore});
+                attrs.insert_or_assign("applyFilters", Explicit<bool>{applyFilters});
+                attrs.insert_or_assign("submodules", Explicit<bool>{true});
+                attrs.insert_or_assign("lfs", Explicit<bool>{smudgeLfs});
+                attrs.insert_or_assign("allRefs", Explicit<bool>{true});
                 auto submoduleInput = fetchers::Input::fromAttrs(*input.settings, std::move(attrs));
-                auto [submoduleAccessor, submoduleInput2] =
-                    submoduleInput.getAccessor(store);
+                auto [submoduleAccessor, submoduleInput2] = submoduleInput.getAccessor(store);
                 submoduleAccessor->setPathDisplay("«" + submoduleInput.to_string() + "»");
                 mounts.insert_or_assign(submodule.path, submoduleAccessor);
             }
@@ -744,10 +784,8 @@ struct GitInputScheme : InputScheme
         return {accessor, std::move(input)};
     }
 
-    std::pair<ref<SourceAccessor>, Input> getAccessorFromWorkdir(
-        ref<Store> store,
-        RepoInfo & repoInfo,
-        Input && input) const
+    std::pair<ref<SourceAccessor>, Input>
+    getAccessorFromWorkdir(ref<Store> store, RepoInfo & repoInfo, Input && input) const
     {
         auto repoPath = repoInfo.getPath().value();
 
@@ -761,9 +799,7 @@ struct GitInputScheme : InputScheme
         auto exportIgnore = getExportIgnoreAttr(input);
 
         ref<SourceAccessor> accessor =
-            repo->getAccessor(repoInfo.workdirInfo,
-                exportIgnore,
-                makeNotAllowedError(repoPath));
+            repo->getAccessor(repoInfo.workdirInfo, exportIgnore, makeNotAllowedError(repoPath));
 
         /* If the repo has submodules, return a mounted input accessor
            consisting of the accessor for the top-level repo and the
@@ -776,14 +812,13 @@ struct GitInputScheme : InputScheme
                 fetchers::Attrs attrs;
                 attrs.insert_or_assign("type", "git");
                 attrs.insert_or_assign("url", submodulePath.string());
-                attrs.insert_or_assign("exportIgnore", Explicit<bool>{ exportIgnore });
-                attrs.insert_or_assign("submodules", Explicit<bool>{ true });
+                attrs.insert_or_assign("exportIgnore", Explicit<bool>{exportIgnore});
+                attrs.insert_or_assign("submodules", Explicit<bool>{true});
                 // TODO: fall back to getAccessorFromCommit-like fetch when submodules aren't checked out
                 // attrs.insert_or_assign("allRefs", Explicit<bool>{ true });
 
                 auto submoduleInput = fetchers::Input::fromAttrs(*input.settings, std::move(attrs));
-                auto [submoduleAccessor, submoduleInput2] =
-                    submoduleInput.getAccessor(store);
+                auto [submoduleAccessor, submoduleInput2] = submoduleInput.getAccessor(store);
                 submoduleAccessor->setPathDisplay("«" + submoduleInput.to_string() + "»");
 
                 /* If the submodule is dirty, mark this repo dirty as
@@ -809,8 +844,8 @@ struct GitInputScheme : InputScheme
 
             input.attrs.insert_or_assign("rev", rev.gitRev());
             if (!getShallowAttr(input)) {
-                input.attrs.insert_or_assign("revCount",
-                    rev == nullRev ? 0 : getRevCount(*input.settings, repoInfo, repoPath, rev));
+                input.attrs.insert_or_assign(
+                    "revCount", rev == nullRev ? 0 : getRevCount(*input.settings, repoInfo, repoPath, rev));
             }
 
             verifyCommit(input, repo);
@@ -818,10 +853,8 @@ struct GitInputScheme : InputScheme
             repoInfo.warnDirty(*input.settings);
 
             if (repoInfo.workdirInfo.headRev) {
-                input.attrs.insert_or_assign("dirtyRev",
-                    repoInfo.workdirInfo.headRev->gitRev() + "-dirty");
-                input.attrs.insert_or_assign("dirtyShortRev",
-                    repoInfo.workdirInfo.headRev->gitShortRev() + "-dirty");
+                input.attrs.insert_or_assign("dirtyRev", repoInfo.workdirInfo.headRev->gitRev() + "-dirty");
+                input.attrs.insert_or_assign("dirtyShortRev", repoInfo.workdirInfo.headRev->gitShortRev() + "-dirty");
             }
 
             verifyCommit(input, nullptr);
@@ -830,8 +863,8 @@ struct GitInputScheme : InputScheme
         input.attrs.insert_or_assign(
             "lastModified",
             repoInfo.workdirInfo.headRev
-            ? getLastModified(*input.settings, repoInfo, repoPath, *repoInfo.workdirInfo.headRev)
-            : 0);
+                ? getLastModified(*input.settings, repoInfo, repoPath, *repoInfo.workdirInfo.headRev)
+                : 0);
 
         return {accessor, std::move(input)};
     }
@@ -842,8 +875,7 @@ struct GitInputScheme : InputScheme
 
         auto repoInfo = getRepoInfo(input);
 
-        if (getExportIgnoreAttr(input)
-            && getSubmodulesAttr(input)) {
+        if (getExportIgnoreAttr(input) && getSubmodulesAttr(input)) {
             /* In this situation, we don't have a git CLI behavior that we can copy.
                `git archive` does not support submodules, so it is unclear whether
                rules from the parent should affect the submodule or not.
@@ -852,27 +884,26 @@ struct GitInputScheme : InputScheme
             throw UnimplementedError("exportIgnore and submodules are not supported together yet");
         }
 
-        auto [accessor, final] =
-            input.getRef() || input.getRev() || !repoInfo.getPath()
-            ? getAccessorFromCommit(store, repoInfo, std::move(input))
-            : getAccessorFromWorkdir(store, repoInfo, std::move(input));
+        auto [accessor, final] = input.getRef() || input.getRev() || !repoInfo.getPath()
+                                     ? getAccessorFromCommit(store, repoInfo, std::move(input))
+                                     : getAccessorFromWorkdir(store, repoInfo, std::move(input));
 
         return {accessor, std::move(final)};
     }
 
     std::optional<std::string> getFingerprint(ref<Store> store, const Input & input) const override
     {
-        auto makeFingerprint = [&](const Hash & rev)
-        {
-            // FIXME(gdennis): Update
-            return rev.gitRev() + (getSubmodulesAttr(input) ? ";s" : "") + (getExportIgnoreAttr(input) ? ";e" : "") + (getLfsAttr(input) ? ";l" : "") + (getApplyFiltersAttr(input) ? ";f" : "");
+        auto makeFingerprint = [&](const Hash & rev) {
+            return rev.gitRev() + (getSubmodulesAttr(input) ? ";s" : "") + (getExportIgnoreAttr(input) ? ";e" : "")
+                   + (getLfsAttr(input) ? ";l" : "") + (getApplyFiltersAttr(input) ? ";f" : "");
         };
 
         if (auto rev = input.getRev())
             return makeFingerprint(*rev);
         else {
             auto repoInfo = getRepoInfo(input);
-            if (auto repoPath = repoInfo.getPath(); repoPath && repoInfo.workdirInfo.headRev && repoInfo.workdirInfo.submodules.empty()) {
+            if (auto repoPath = repoInfo.getPath();
+                repoPath && repoInfo.workdirInfo.headRev && repoInfo.workdirInfo.submodules.empty()) {
                 /* Calculate a fingerprint that takes into account the
                    deleted and modified/added files. */
                 HashSink hashSink{HashAlgorithm::SHA512};
@@ -886,7 +917,7 @@ struct GitInputScheme : InputScheme
                     writeString(file.abs(), hashSink);
                 }
                 return makeFingerprint(*repoInfo.workdirInfo.headRev)
-                    + ";d=" + hashSink.finish().first.to_string(HashFormat::Base16, false);
+                       + ";d=" + hashSink.finish().hash.to_string(HashFormat::Base16, false);
             }
             return std::nullopt;
         }
@@ -901,4 +932,4 @@ struct GitInputScheme : InputScheme
 
 static auto rGitInputScheme = OnStartup([] { registerInputScheme(std::make_unique<GitInputScheme>()); });
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 7a902d816..723c075f2 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -19,7 +19,7 @@ namespace nix::fetchers {
 
 struct DownloadUrl
 {
-    std::string url;
+    ParsedURL url;
     Headers headers;
 };
 
@@ -29,15 +29,17 @@ std::regex hostRegex(hostRegexS, std::regex::ECMAScript);
 
 struct GitArchiveInputScheme : InputScheme
 {
-    virtual std::optional<std::pair<std::string, std::string>> accessHeaderFromToken(const std::string & token) const = 0;
+    virtual std::optional<std::pair<std::string, std::string>>
+    accessHeaderFromToken(const std::string & token) const = 0;
 
-    std::optional<Input> inputFromURL(
-        const fetchers::Settings & settings,
-        const ParsedURL & url, bool requireTree) const override
+    std::optional<Input>
+    inputFromURL(const fetchers::Settings & settings, const ParsedURL & url, bool requireTree) const override
     {
-        if (url.scheme != schemeName()) return {};
+        if (url.scheme != schemeName())
+            return {};
 
-        auto path = tokenizeString<std::vector<std::string>>(url.path, "/");
+        /* This ignores empty path segments for back-compat. Older versions used a tokenizeString here. */
+        auto path = url.pathSegments(/*skipEmpty=*/true) | std::ranges::to<std::vector<std::string>>();
 
         std::optional<Hash> rev;
         std::optional<std::string> ref;
@@ -47,7 +49,7 @@ struct GitArchiveInputScheme : InputScheme
         if (size == 3) {
             if (std::regex_match(path[2], revRegex))
                 rev = Hash::parseAny(path[2], HashAlgorithm::SHA1);
-            else if (std::regex_match(path[2], refRegex))
+            else if (isLegalRefName(path[2]))
                 ref = path[2];
             else
                 throw BadURL("in URL '%s', '%s' is not a commit hash or branch/tag name", url, path[2]);
@@ -60,7 +62,7 @@ struct GitArchiveInputScheme : InputScheme
                 }
             }
 
-            if (std::regex_match(rs, refRegex)) {
+            if (isLegalRefName(rs)) {
                 ref = rs;
             } else {
                 throw BadURL("in URL '%s', '%s' is not a branch/tag name", url, rs);
@@ -68,20 +70,18 @@ struct GitArchiveInputScheme : InputScheme
         } else if (size < 2)
             throw BadURL("URL '%s' is invalid", url);
 
-        for (auto &[name, value] : url.query) {
+        for (auto & [name, value] : url.query) {
             if (name == "rev") {
                 if (rev)
                     throw BadURL("URL '%s' contains multiple commit hashes", url);
                 rev = Hash::parseAny(value, HashAlgorithm::SHA1);
-            }
-            else if (name == "ref") {
-                if (!std::regex_match(value, refRegex))
+            } else if (name == "ref") {
+                if (!isLegalRefName(value))
                     throw BadURL("URL '%s' contains an invalid branch/tag name", url);
                 if (ref)
                     throw BadURL("URL '%s' contains multiple branch/tag names", url);
                 ref = value;
-            }
-            else if (name == "host") {
+            } else if (name == "host") {
                 if (!std::regex_match(value, hostRegex))
                     throw BadURL("URL '%s' contains an invalid instance host", url);
                 host_url = value;
@@ -93,12 +93,15 @@ struct GitArchiveInputScheme : InputScheme
             throw BadURL("URL '%s' contains both a commit hash and a branch/tag name %s %s", url, *ref, rev->gitRev());
 
         Input input{settings};
-        input.attrs.insert_or_assign("type", std::string { schemeName() });
+        input.attrs.insert_or_assign("type", std::string{schemeName()});
         input.attrs.insert_or_assign("owner", path[0]);
         input.attrs.insert_or_assign("repo", path[1]);
-        if (rev) input.attrs.insert_or_assign("rev", rev->gitRev());
-        if (ref) input.attrs.insert_or_assign("ref", *ref);
-        if (host_url) input.attrs.insert_or_assign("host", *host_url);
+        if (rev)
+            input.attrs.insert_or_assign("rev", rev->gitRev());
+        if (ref)
+            input.attrs.insert_or_assign("ref", *ref);
+        if (host_url)
+            input.attrs.insert_or_assign("host", *host_url);
 
         auto narHash = url.query.find("narHash");
         if (narHash != url.query.end())
@@ -121,9 +124,7 @@ struct GitArchiveInputScheme : InputScheme
         };
     }
 
-    std::optional<Input> inputFromAttrs(
-        const fetchers::Settings & settings,
-        const Attrs & attrs) const override
+    std::optional<Input> inputFromAttrs(const fetchers::Settings & settings, const Attrs & attrs) const override
     {
         getStrAttr(attrs, "owner");
         getStrAttr(attrs, "repo");
@@ -139,12 +140,14 @@ struct GitArchiveInputScheme : InputScheme
         auto repo = getStrAttr(input.attrs, "repo");
         auto ref = input.getRef();
         auto rev = input.getRev();
-        auto path = owner + "/" + repo;
+        std::vector<std::string> path{owner, repo};
         assert(!(ref && rev));
-        if (ref) path += "/" + *ref;
-        if (rev) path += "/" + rev->to_string(HashFormat::Base16, false);
-        auto url = ParsedURL {
-            .scheme = std::string { schemeName() },
+        if (ref)
+            path.push_back(*ref);
+        if (rev)
+            path.push_back(rev->to_string(HashFormat::Base16, false));
+        auto url = ParsedURL{
+            .scheme = std::string{schemeName()},
             .path = path,
         };
         if (auto narHash = input.getNarHash())
@@ -155,15 +158,15 @@ struct GitArchiveInputScheme : InputScheme
         return url;
     }
 
-    Input applyOverrides(
-        const Input & _input,
-        std::optional<std::string> ref,
-        std::optional<Hash> rev) const override
+    Input applyOverrides(const Input & _input, std::optional<std::string> ref, std::optional<Hash> rev) const override
     {
         auto input(_input);
         if (rev && ref)
-            throw BadURL("cannot apply both a commit hash (%s) and a branch/tag name ('%s') to input '%s'",
-                rev->gitRev(), *ref, input.to_string());
+            throw BadURL(
+                "cannot apply both a commit hash (%s) and a branch/tag name ('%s') to input '%s'",
+                rev->gitRev(),
+                *ref,
+                input.to_string());
         if (rev) {
             input.attrs.insert_or_assign("rev", rev->gitRev());
             input.attrs.erase("ref");
@@ -176,22 +179,18 @@ struct GitArchiveInputScheme : InputScheme
     }
 
     // Search for the longest possible match starting from the beginning and ending at either the end or a path segment.
-    std::optional<std::string> getAccessToken(const fetchers::Settings & settings, const std::string & host, const std::string & url) const override
+    std::optional<std::string> getAccessToken(
+        const fetchers::Settings & settings, const std::string & host, const std::string & url) const override
     {
         auto tokens = settings.accessTokens.get();
         std::string answer;
         size_t answer_match_len = 0;
-        if(! url.empty()) {
+        if (!url.empty()) {
             for (auto & token : tokens) {
                 auto first = url.find(token.first);
-                if (
-                    first != std::string::npos
-                    && token.first.length() > answer_match_len
-                    && first == 0
-                    && url.substr(0,token.first.length()) == token.first
-                    && (url.length() == token.first.length() || url[token.first.length()] == '/')
-                    )
-                {
+                if (first != std::string::npos && token.first.length() > answer_match_len && first == 0
+                    && url.substr(0, token.first.length()) == token.first
+                    && (url.length() == token.first.length() || url[token.first.length()] == '/')) {
                     answer = token.second;
                     answer_match_len = token.first.length();
                 }
@@ -204,21 +203,17 @@ struct GitArchiveInputScheme : InputScheme
         return {};
     }
 
-    Headers makeHeadersWithAuthTokens(
-        const fetchers::Settings & settings,
-        const std::string & host,
-        const Input & input) const
+    Headers
+    makeHeadersWithAuthTokens(const fetchers::Settings & settings, const std::string & host, const Input & input) const
     {
         auto owner = getStrAttr(input.attrs, "owner");
         auto repo = getStrAttr(input.attrs, "repo");
-        auto hostAndPath = fmt( "%s/%s/%s", host, owner, repo);
+        auto hostAndPath = fmt("%s/%s/%s", host, owner, repo);
         return makeHeadersWithAuthTokens(settings, host, hostAndPath);
     }
 
     Headers makeHeadersWithAuthTokens(
-        const fetchers::Settings & settings,
-        const std::string & host,
-        const std::string & hostAndPath) const
+        const fetchers::Settings & settings, const std::string & host, const std::string & hostAndPath) const
     {
         Headers headers;
         auto accessToken = getAccessToken(settings, host, hostAndPath);
@@ -250,7 +245,8 @@ struct GitArchiveInputScheme : InputScheme
 
     std::pair<Input, TarballInfo> downloadArchive(ref<Store> store, Input input) const
     {
-        if (!maybeGetStrAttr(input.attrs, "ref")) input.attrs.insert_or_assign("ref", "HEAD");
+        if (!maybeGetStrAttr(input.attrs, "ref"))
+            input.attrs.insert_or_assign("ref", "HEAD");
 
         std::optional<Hash> upstreamTreeHash;
 
@@ -275,7 +271,7 @@ struct GitArchiveInputScheme : InputScheme
                 auto treeHash = getRevAttr(*treeHashAttrs, "treeHash");
                 auto lastModified = getIntAttr(*lastModifiedAttrs, "lastModified");
                 if (getTarballCache()->hasObject(treeHash))
-                    return {std::move(input), TarballInfo { .treeHash = treeHash, .lastModified = (time_t) lastModified }};
+                    return {std::move(input), TarballInfo{.treeHash = treeHash, .lastModified = (time_t) lastModified}};
                 else
                     debug("Git tree with hash '%s' has disappeared from the cache, refetching...", treeHash.gitRev());
             }
@@ -290,10 +286,10 @@ struct GitArchiveInputScheme : InputScheme
             getFileTransfer()->download(std::move(req), sink);
         });
 
-        auto act = std::make_unique<Activity>(*logger, lvlInfo, actUnknown,
-            fmt("unpacking '%s' into the Git cache", input.to_string()));
+        auto act = std::make_unique<Activity>(
+            *logger, lvlInfo, actUnknown, fmt("unpacking '%s' into the Git cache", input.to_string()));
 
-        TarArchive archive { *source };
+        TarArchive archive{*source};
         auto tarballCache = getTarballCache();
         auto parseSink = tarballCache->getFileSystemObjectSink();
         auto lastModified = unpackTarfileToSink(archive, *parseSink);
@@ -301,22 +297,20 @@ struct GitArchiveInputScheme : InputScheme
 
         act.reset();
 
-        TarballInfo tarballInfo {
-            .treeHash = tarballCache->dereferenceSingletonDirectory(tree),
-            .lastModified = lastModified
-        };
+        TarballInfo tarballInfo{
+            .treeHash = tarballCache->dereferenceSingletonDirectory(tree), .lastModified = lastModified};
 
         cache->upsert(treeHashKey, Attrs{{"treeHash", tarballInfo.treeHash.gitRev()}});
         cache->upsert(lastModifiedKey, Attrs{{"lastModified", (uint64_t) tarballInfo.lastModified}});
 
-        #if 0
+#if 0
         if (upstreamTreeHash != tarballInfo.treeHash)
             warn(
                 "Git tree hash mismatch for revision '%s' of '%s': "
                 "expected '%s', got '%s'. "
                 "This can happen if the Git repository uses submodules.",
                 rev->gitRev(), input.to_string(), upstreamTreeHash->gitRev(), tarballInfo.treeHash.gitRev());
-        #endif
+#endif
 
         return {std::move(input), tarballInfo};
     }
@@ -325,15 +319,12 @@ struct GitArchiveInputScheme : InputScheme
     {
         auto [input, tarballInfo] = downloadArchive(store, _input);
 
-        #if 0
+#if 0
         input.attrs.insert_or_assign("treeHash", tarballInfo.treeHash.gitRev());
-        #endif
+#endif
         input.attrs.insert_or_assign("lastModified", uint64_t(tarballInfo.lastModified));
 
-        auto accessor = getTarballCache()->getAccessor(
-            tarballInfo.treeHash,
-            false,
-            "«" + input.to_string() + "»");
+        auto accessor = getTarballCache()->getAccessor(tarballInfo.treeHash, false, "«" + input.to_string() + "»");
 
         return {accessor, input};
     }
@@ -345,8 +336,7 @@ struct GitArchiveInputScheme : InputScheme
            locking. FIXME: in the future, we may want to require a Git
            tree hash instead of a NAR hash. */
         return input.getRev().has_value()
-            && (input.settings->trustTarballsFromGitForges ||
-                input.getNarHash().has_value());
+               && (input.settings->trustTarballsFromGitForges || input.getNarHash().has_value());
     }
 
     std::optional<ExperimentalFeature> experimentalFeature() const override
@@ -365,7 +355,10 @@ struct GitArchiveInputScheme : InputScheme
 
 struct GitHubInputScheme : GitArchiveInputScheme
 {
-    std::string_view schemeName() const override { return "github"; }
+    std::string_view schemeName() const override
+    {
+        return "github";
+    }
 
     std::optional<std::pair<std::string, std::string>> accessHeaderFromToken(const std::string & token) const override
     {
@@ -397,22 +390,20 @@ struct GitHubInputScheme : GitArchiveInputScheme
     {
         auto host = getHost(input);
         auto url = fmt(
-            host == "github.com"
-            ? "https://api.%s/repos/%s/%s/commits/%s"
-            : "https://%s/api/v3/repos/%s/%s/commits/%s",
-            host, getOwner(input), getRepo(input), *input.getRef());
+            host == "github.com" ? "https://api.%s/repos/%s/%s/commits/%s" : "https://%s/api/v3/repos/%s/%s/commits/%s",
+            host,
+            getOwner(input),
+            getRepo(input),
+            *input.getRef());
 
         Headers headers = makeHeadersWithAuthTokens(*input.settings, host, input);
 
         auto json = nlohmann::json::parse(
-            readFile(
-                store->toRealPath(
-                    downloadFile(store, *input.settings, url, "source", headers).storePath)));
+            readFile(store->toRealPath(downloadFile(store, *input.settings, url, "source", headers).storePath)));
 
-        return RefInfo {
-            .rev = Hash::parseAny(std::string { json["sha"] }, HashAlgorithm::SHA1),
-            .treeHash = Hash::parseAny(std::string { json["commit"]["tree"]["sha"] }, HashAlgorithm::SHA1)
-        };
+        return RefInfo{
+            .rev = Hash::parseAny(std::string{json["sha"]}, HashAlgorithm::SHA1),
+            .treeHash = Hash::parseAny(std::string{json["commit"]["tree"]["sha"]}, HashAlgorithm::SHA1)};
     }
 
     DownloadUrl getDownloadUrl(const Input & input) const override
@@ -423,24 +414,20 @@ struct GitHubInputScheme : GitArchiveInputScheme
 
         // If we have no auth headers then we default to the public archive
         // urls so we do not run into rate limits.
-        const auto urlFmt =
-            host != "github.com"
-            ? "https://%s/api/v3/repos/%s/%s/tarball/%s"
-            : headers.empty()
-            ? "https://%s/%s/%s/archive/%s.tar.gz"
-            : "https://api.%s/repos/%s/%s/tarball/%s";
+        const auto urlFmt = host != "github.com" ? "https://%s/api/v3/repos/%s/%s/tarball/%s"
+                            : headers.empty()    ? "https://%s/%s/%s/archive/%s.tar.gz"
+                                                 : "https://api.%s/repos/%s/%s/tarball/%s";
 
-        const auto url = fmt(urlFmt, host, getOwner(input), getRepo(input),
-            input.getRev()->to_string(HashFormat::Base16, false));
+        const auto url =
+            fmt(urlFmt, host, getOwner(input), getRepo(input), input.getRev()->to_string(HashFormat::Base16, false));
 
-        return DownloadUrl { url, headers };
+        return DownloadUrl{parseURL(url), headers};
     }
 
     void clone(const Input & input, const Path & destDir) const override
     {
         auto host = getHost(input);
-        Input::fromURL(*input.settings, fmt("git+https://%s/%s/%s.git",
-                host, getOwner(input), getRepo(input)))
+        Input::fromURL(*input.settings, fmt("git+https://%s/%s/%s.git", host, getOwner(input), getRepo(input)))
             .applyOverrides(input.getRef(), input.getRev())
             .clone(destDir);
     }
@@ -448,7 +435,10 @@ struct GitHubInputScheme : GitArchiveInputScheme
 
 struct GitLabInputScheme : GitArchiveInputScheme
 {
-    std::string_view schemeName() const override { return "gitlab"; }
+    std::string_view schemeName() const override
+    {
+        return "gitlab";
+    }
 
     std::optional<std::pair<std::string, std::string>> accessHeaderFromToken(const std::string & token) const override
     {
@@ -462,32 +452,33 @@ struct GitLabInputScheme : GitArchiveInputScheme
         auto fldsplit = token.find_first_of(':');
         // n.b. C++20 would allow: if (token.starts_with("OAuth2:")) ...
         if ("OAuth2" == token.substr(0, fldsplit))
-            return std::make_pair("Authorization", fmt("Bearer %s", token.substr(fldsplit+1)));
+            return std::make_pair("Authorization", fmt("Bearer %s", token.substr(fldsplit + 1)));
         if ("PAT" == token.substr(0, fldsplit))
-            return std::make_pair("Private-token", token.substr(fldsplit+1));
-        warn("Unrecognized GitLab token type %s",  token.substr(0, fldsplit));
-        return std::make_pair(token.substr(0,fldsplit), token.substr(fldsplit+1));
+            return std::make_pair("Private-token", token.substr(fldsplit + 1));
+        warn("Unrecognized GitLab token type %s", token.substr(0, fldsplit));
+        return std::make_pair(token.substr(0, fldsplit), token.substr(fldsplit + 1));
     }
 
     RefInfo getRevFromRef(nix::ref<Store> store, const Input & input) const override
     {
         auto host = maybeGetStrAttr(input.attrs, "host").value_or("gitlab.com");
         // See rate limiting note below
-        auto url = fmt("https://%s/api/v4/projects/%s%%2F%s/repository/commits?ref_name=%s",
-            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"), *input.getRef());
+        auto url =
+            fmt("https://%s/api/v4/projects/%s%%2F%s/repository/commits?ref_name=%s",
+                host,
+                getStrAttr(input.attrs, "owner"),
+                getStrAttr(input.attrs, "repo"),
+                *input.getRef());
 
         Headers headers = makeHeadersWithAuthTokens(*input.settings, host, input);
 
         auto json = nlohmann::json::parse(
-            readFile(
-                store->toRealPath(
-                    downloadFile(store, *input.settings, url, "source", headers).storePath)));
+            readFile(store->toRealPath(downloadFile(store, *input.settings, url, "source", headers).storePath)));
 
         if (json.is_array() && json.size() >= 1 && json[0]["id"] != nullptr) {
-          return RefInfo {
-              .rev = Hash::parseAny(std::string(json[0]["id"]), HashAlgorithm::SHA1)
-          };
-        } if (json.is_array() && json.size() == 0) {
+            return RefInfo{.rev = Hash::parseAny(std::string(json[0]["id"]), HashAlgorithm::SHA1)};
+        }
+        if (json.is_array() && json.size() == 0) {
             throw Error("No commits returned by GitLab API -- does the git ref really exist?");
         } else {
             throw Error("Unexpected response received from GitLab: %s", json);
@@ -502,20 +493,24 @@ struct GitLabInputScheme : GitArchiveInputScheme
         // is 10 reqs/sec/ip-addr.  See
         // https://docs.gitlab.com/ee/user/gitlab_com/index.html#gitlabcom-specific-rate-limits
         auto host = maybeGetStrAttr(input.attrs, "host").value_or("gitlab.com");
-        auto url = fmt("https://%s/api/v4/projects/%s%%2F%s/repository/archive.tar.gz?sha=%s",
-            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"),
-            input.getRev()->to_string(HashFormat::Base16, false));
+        auto url =
+            fmt("https://%s/api/v4/projects/%s%%2F%s/repository/archive.tar.gz?sha=%s",
+                host,
+                getStrAttr(input.attrs, "owner"),
+                getStrAttr(input.attrs, "repo"),
+                input.getRev()->to_string(HashFormat::Base16, false));
 
         Headers headers = makeHeadersWithAuthTokens(*input.settings, host, input);
-        return DownloadUrl { url, headers };
+        return DownloadUrl{parseURL(url), headers};
     }
 
     void clone(const Input & input, const Path & destDir) const override
     {
         auto host = maybeGetStrAttr(input.attrs, "host").value_or("gitlab.com");
         // FIXME: get username somewhere
-        Input::fromURL(*input.settings, fmt("git+https://%s/%s/%s.git",
-                host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo")))
+        Input::fromURL(
+            *input.settings,
+            fmt("git+https://%s/%s/%s.git", host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo")))
             .applyOverrides(input.getRef(), input.getRev())
             .clone(destDir);
     }
@@ -523,7 +518,10 @@ struct GitLabInputScheme : GitArchiveInputScheme
 
 struct SourceHutInputScheme : GitArchiveInputScheme
 {
-    std::string_view schemeName() const override { return "sourcehut"; }
+    std::string_view schemeName() const override
+    {
+        return "sourcehut";
+    }
 
     std::optional<std::pair<std::string, std::string>> accessHeaderFromToken(const std::string & token) const override
     {
@@ -543,8 +541,8 @@ struct SourceHutInputScheme : GitArchiveInputScheme
         auto ref = *input.getRef();
 
         auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
-        auto base_url = fmt("https://%s/%s/%s",
-            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"));
+        auto base_url =
+            fmt("https://%s/%s/%s", host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"));
 
         Headers headers = makeHeadersWithAuthTokens(*input.settings, host, input);
 
@@ -572,7 +570,7 @@ struct SourceHutInputScheme : GitArchiveInputScheme
 
         std::string line;
         std::optional<std::string> id;
-        while(!id && getline(is, line)) {
+        while (!id && getline(is, line)) {
             auto parsedLine = git::parseLsRemoteLine(line);
             if (parsedLine && parsedLine->reference && std::regex_match(*parsedLine->reference, refRegex))
                 id = parsedLine->target;
@@ -581,27 +579,29 @@ struct SourceHutInputScheme : GitArchiveInputScheme
         if (!id)
             throw BadURL("in '%d', couldn't find ref '%d'", input.to_string(), ref);
 
-        return RefInfo {
-            .rev = Hash::parseAny(*id, HashAlgorithm::SHA1)
-        };
+        return RefInfo{.rev = Hash::parseAny(*id, HashAlgorithm::SHA1)};
     }
 
     DownloadUrl getDownloadUrl(const Input & input) const override
     {
         auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
-        auto url = fmt("https://%s/%s/%s/archive/%s.tar.gz",
-            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"),
-            input.getRev()->to_string(HashFormat::Base16, false));
+        auto url =
+            fmt("https://%s/%s/%s/archive/%s.tar.gz",
+                host,
+                getStrAttr(input.attrs, "owner"),
+                getStrAttr(input.attrs, "repo"),
+                input.getRev()->to_string(HashFormat::Base16, false));
 
         Headers headers = makeHeadersWithAuthTokens(*input.settings, host, input);
-        return DownloadUrl { url, headers };
+        return DownloadUrl{parseURL(url), headers};
     }
 
     void clone(const Input & input, const Path & destDir) const override
     {
         auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
-        Input::fromURL(*input.settings, fmt("git+https://%s/%s/%s",
-                host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo")))
+        Input::fromURL(
+            *input.settings,
+            fmt("git+https://%s/%s/%s", host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo")))
             .applyOverrides(input.getRef(), input.getRev())
             .clone(destDir);
     }
@@ -611,4 +611,4 @@ static auto rGitHubInputScheme = OnStartup([] { registerInputScheme(std::make_un
 static auto rGitLabInputScheme = OnStartup([] { registerInputScheme(std::make_unique<GitLabInputScheme>()); });
 static auto rSourceHutInputScheme = OnStartup([] { registerInputScheme(std::make_unique<SourceHutInputScheme>()); });
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/include/nix/fetchers/attrs.hh b/src/libfetchers/include/nix/fetchers/attrs.hh
index 582abd144..8a21b8ddb 100644
--- a/src/libfetchers/include/nix/fetchers/attrs.hh
+++ b/src/libfetchers/include/nix/fetchers/attrs.hh
@@ -41,4 +41,4 @@ StringMap attrsToQuery(const Attrs & attrs);
 
 Hash getRevAttr(const Attrs & attrs, const std::string & name);
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/include/nix/fetchers/cache.hh b/src/libfetchers/include/nix/fetchers/cache.hh
index 6ac693183..7219635ec 100644
--- a/src/libfetchers/include/nix/fetchers/cache.hh
+++ b/src/libfetchers/include/nix/fetchers/cache.hh
@@ -12,7 +12,7 @@ namespace nix::fetchers {
  */
 struct Cache
 {
-    virtual ~Cache() { }
+    virtual ~Cache() {}
 
     /**
      * A domain is a partition of the key/value cache for a particular
@@ -28,22 +28,18 @@ struct Cache
     /**
      * Add a key/value pair to the cache.
      */
-    virtual void upsert(
-        const Key & key,
-        const Attrs & value) = 0;
+    virtual void upsert(const Key & key, const Attrs & value) = 0;
 
     /**
      * Look up a key with infinite TTL.
      */
-    virtual std::optional<Attrs> lookup(
-        const Key & key) = 0;
+    virtual std::optional<Attrs> lookup(const Key & key) = 0;
 
     /**
      * Look up a key. Return nothing if its TTL has exceeded
      * `settings.tarballTTL`.
      */
-    virtual std::optional<Attrs> lookupWithTTL(
-        const Key & key) = 0;
+    virtual std::optional<Attrs> lookupWithTTL(const Key & key) = 0;
 
     struct Result
     {
@@ -55,19 +51,14 @@ struct Cache
      * Look up a key. Return a bool denoting whether its TTL has
      * exceeded `settings.tarballTTL`.
      */
-    virtual std::optional<Result> lookupExpired(
-        const Key & key) = 0;
+    virtual std::optional<Result> lookupExpired(const Key & key) = 0;
 
     /**
      * Insert a cache entry that has a store path associated with
      * it. Such cache entries are always considered stale if the
      * associated store path is invalid.
      */
-    virtual void upsert(
-        Key key,
-        Store & store,
-        Attrs value,
-        const StorePath & storePath) = 0;
+    virtual void upsert(Key key, Store & store, Attrs value, const StorePath & storePath) = 0;
 
     struct ResultWithStorePath : Result
     {
@@ -78,17 +69,13 @@ struct Cache
      * Look up a store path in the cache. The returned store path will
      * be valid, but it may be expired.
      */
-    virtual std::optional<ResultWithStorePath> lookupStorePath(
-        Key key,
-        Store & store) = 0;
+    virtual std::optional<ResultWithStorePath> lookupStorePath(Key key, Store & store) = 0;
 
     /**
      * Look up a store path in the cache. Return nothing if its TTL
      * has exceeded `settings.tarballTTL`.
      */
-    virtual std::optional<ResultWithStorePath> lookupStorePathWithTTL(
-        Key key,
-        Store & store) = 0;
+    virtual std::optional<ResultWithStorePath> lookupStorePathWithTTL(Key key, Store & store) = 0;
 };
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/include/nix/fetchers/fetch-settings.hh b/src/libfetchers/include/nix/fetchers/fetch-settings.hh
index 9cfd25e0b..605b95e0d 100644
--- a/src/libfetchers/include/nix/fetchers/fetch-settings.hh
+++ b/src/libfetchers/include/nix/fetchers/fetch-settings.hh
@@ -19,7 +19,10 @@ struct Settings : public Config
 {
     Settings();
 
-    Setting<StringMap> accessTokens{this, {}, "access-tokens",
+    Setting<StringMap> accessTokens{
+        this,
+        {},
+        "access-tokens",
         R"(
           Access tokens used to access protected GitHub, GitLab, or
           other locations requiring token-based authentication.
@@ -70,11 +73,9 @@ struct Settings : public Config
           value.
           )"};
 
-    Setting<bool> allowDirty{this, true, "allow-dirty",
-        "Whether to allow dirty Git/Mercurial trees."};
+    Setting<bool> allowDirty{this, true, "allow-dirty", "Whether to allow dirty Git/Mercurial trees."};
 
-    Setting<bool> warnDirty{this, true, "warn-dirty",
-        "Whether to warn about dirty Git/Mercurial trees."};
+    Setting<bool> warnDirty{this, true, "warn-dirty", "Whether to warn about dirty Git/Mercurial trees."};
 
     Setting<bool> allowDirtyLocks{
         this,
@@ -93,7 +94,9 @@ struct Settings : public Config
         Xp::Flakes};
 
     Setting<bool> trustTarballsFromGitForges{
-        this, true, "trust-tarballs-from-git-forges",
+        this,
+        true,
+        "trust-tarballs-from-git-forges",
         R"(
           If enabled (the default), Nix considers tarballs from
           GitHub and similar Git forges to be locked if a Git revision
@@ -107,13 +110,18 @@ struct Settings : public Config
           e.g. `github:NixOS/patchelf/7c2f768bf9601268a4e71c2ebe91e2011918a70f?narHash=sha256-PPXqKY2hJng4DBVE0I4xshv/vGLUskL7jl53roB8UdU%3D`.
         )"};
 
-    Setting<std::string> flakeRegistry{this, "https://channels.nixos.org/flake-registry.json", "flake-registry",
+    Setting<std::string> flakeRegistry{
+        this,
+        "https://channels.nixos.org/flake-registry.json",
+        "flake-registry",
         R"(
           Path or URI of the global flake registry.
 
           When empty, disables the global flake registry.
         )",
-        {}, true, Xp::Flakes};
+        {},
+        true,
+        Xp::Flakes};
 
     ref<Cache> getCache() const;
 
@@ -121,4 +129,4 @@ private:
     mutable Sync<std::shared_ptr<Cache>> _cache;
 };
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/include/nix/fetchers/fetch-to-store.hh b/src/libfetchers/include/nix/fetchers/fetch-to-store.hh
index a52d567ec..3a2232302 100644
--- a/src/libfetchers/include/nix/fetchers/fetch-to-store.hh
+++ b/src/libfetchers/include/nix/fetchers/fetch-to-store.hh
@@ -27,4 +27,4 @@ StorePath fetchToStore(
 fetchers::Cache::Key makeFetchToStoreCacheKey(
     const std::string & name, const std::string & fingerprint, ContentAddressMethod method, const std::string & path);
 
-}
+} // namespace nix
diff --git a/src/libfetchers/include/nix/fetchers/fetchers.hh b/src/libfetchers/include/nix/fetchers/fetchers.hh
index 1f8f6bdac..9dcd365ea 100644
--- a/src/libfetchers/include/nix/fetchers/fetchers.hh
+++ b/src/libfetchers/include/nix/fetchers/fetchers.hh
@@ -13,7 +13,11 @@
 
 #include "nix/util/ref.hh"
 
-namespace nix { class Store; class StorePath; struct SourceAccessor; }
+namespace nix {
+class Store;
+class StorePath;
+struct SourceAccessor;
+} // namespace nix
 
 namespace nix::fetchers {
 
@@ -36,7 +40,8 @@ struct Input
 
     Input(const Settings & settings)
         : settings{&settings}
-    { }
+    {
+    }
 
     std::shared_ptr<InputScheme> scheme; // note: can be null
     Attrs attrs;
@@ -52,22 +57,16 @@ public:
      *
      * The URL indicate which sort of fetcher, and provides information to that fetcher.
      */
-    static Input fromURL(
-        const Settings & settings,
-        const std::string & url, bool requireTree = true);
+    static Input fromURL(const Settings & settings, const std::string & url, bool requireTree = true);
 
-    static Input fromURL(
-        const Settings & settings,
-        const ParsedURL & url, bool requireTree = true);
+    static Input fromURL(const Settings & settings, const ParsedURL & url, bool requireTree = true);
 
     /**
      * Create an `Input` from a an `Attrs`.
      *
      * The URL indicate which sort of fetcher, and provides information to that fetcher.
      */
-    static Input fromAttrs(
-        const Settings & settings,
-        Attrs && attrs);
+    static Input fromAttrs(const Settings & settings, Attrs && attrs);
 
     ParsedURL toURL() const;
 
@@ -108,9 +107,9 @@ public:
      */
     bool isFinal() const;
 
-    bool operator ==(const Input & other) const noexcept;
+    bool operator==(const Input & other) const noexcept;
 
-    bool operator <(const Input & other) const
+    bool operator<(const Input & other) const
     {
         return attrs < other.attrs;
     }
@@ -149,9 +148,7 @@ private:
 
 public:
 
-    Input applyOverrides(
-        std::optional<std::string> ref,
-        std::optional<Hash> rev) const;
+    Input applyOverrides(std::optional<std::string> ref, std::optional<Hash> rev) const;
 
     void clone(const Path & destDir) const;
 
@@ -161,10 +158,7 @@ public:
      * Write a file to this input, for input types that support
      * writing. Optionally commit the change (for e.g. Git inputs).
      */
-    void putFile(
-        const CanonPath & path,
-        std::string_view contents,
-        std::optional<std::string> commitMsg) const;
+    void putFile(const CanonPath & path, std::string_view contents, std::optional<std::string> commitMsg) const;
 
     std::string getName() const;
 
@@ -200,16 +194,12 @@ public:
  */
 struct InputScheme
 {
-    virtual ~InputScheme()
-    { }
+    virtual ~InputScheme() {}
 
-    virtual std::optional<Input> inputFromURL(
-        const Settings & settings,
-        const ParsedURL & url, bool requireTree) const = 0;
+    virtual std::optional<Input>
+    inputFromURL(const Settings & settings, const ParsedURL & url, bool requireTree) const = 0;
 
-    virtual std::optional<Input> inputFromAttrs(
-        const Settings & settings,
-        const Attrs & attrs) const = 0;
+    virtual std::optional<Input> inputFromAttrs(const Settings & settings, const Attrs & attrs) const = 0;
 
     /**
      * What is the name of the scheme?
@@ -231,10 +221,7 @@ struct InputScheme
 
     virtual ParsedURL toURL(const Input & input) const;
 
-    virtual Input applyOverrides(
-        const Input & input,
-        std::optional<std::string> ref,
-        std::optional<Hash> rev) const;
+    virtual Input applyOverrides(const Input & input, std::optional<std::string> ref, std::optional<Hash> rev) const;
 
     virtual void clone(const Input & input, const Path & destDir) const;
 
@@ -254,19 +241,30 @@ struct InputScheme
     virtual std::optional<ExperimentalFeature> experimentalFeature() const;
 
     virtual bool isDirect(const Input & input) const
-    { return true; }
+    {
+        return true;
+    }
 
     virtual std::optional<std::string> getFingerprint(ref<Store> store, const Input & input) const
-    { return std::nullopt; }
+    {
+        return std::nullopt;
+    }
 
     virtual bool isLocked(const Input & input) const
-    { return false; }
+    {
+        return false;
+    }
 
     virtual std::optional<std::string> isRelative(const Input & input) const
-    { return std::nullopt; }
+    {
+        return std::nullopt;
+    }
 
-    virtual std::optional<std::string> getAccessToken(const fetchers::Settings & settings, const std::string & host, const std::string & url) const
-    { return {};}
+    virtual std::optional<std::string>
+    getAccessToken(const fetchers::Settings & settings, const std::string & host, const std::string & url) const
+    {
+        return {};
+    }
 };
 
 void registerInputScheme(std::shared_ptr<InputScheme> && fetcher);
@@ -278,11 +276,11 @@ struct PublicKey
     std::string type = "ssh-ed25519";
     std::string key;
 
-    auto operator <=>(const PublicKey &) const = default;
+    auto operator<=>(const PublicKey &) const = default;
 };
 
-std::string publicKeys_to_string(const std::vector<PublicKey>&);
+std::string publicKeys_to_string(const std::vector<PublicKey> &);
 
-}
+} // namespace nix::fetchers
 
 JSON_IMPL(fetchers::PublicKey)
diff --git a/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh b/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh
index 2b59f03ca..1d4028be5 100644
--- a/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh
+++ b/src/libfetchers/include/nix/fetchers/filtering-source-accessor.hh
@@ -2,7 +2,7 @@
 
 #include "nix/util/source-path.hh"
 
-#include <unordered_set>
+#include <boost/unordered/unordered_flat_set_fwd.hpp>
 
 namespace nix {
 
@@ -72,7 +72,7 @@ struct AllowListSourceAccessor : public FilteringSourceAccessor
     static ref<AllowListSourceAccessor> create(
         ref<SourceAccessor> next,
         std::set<CanonPath> && allowedPrefixes,
-        std::unordered_set<CanonPath> && allowedPaths,
+        boost::unordered_flat_set<CanonPath, std::hash<CanonPath>> && allowedPaths,
         MakeNotAllowedError && makeNotAllowedError);
 
     using FilteringSourceAccessor::FilteringSourceAccessor;
@@ -92,4 +92,4 @@ struct CachingFilteringSourceAccessor : FilteringSourceAccessor
     virtual bool isAllowedUncached(const CanonPath & path) = 0;
 };
 
-}
+} // namespace nix
diff --git a/src/libfetchers/include/nix/fetchers/git-utils.hh b/src/libfetchers/include/nix/fetchers/git-utils.hh
index 386cbe216..d6ab1db45 100644
--- a/src/libfetchers/include/nix/fetchers/git-utils.hh
+++ b/src/libfetchers/include/nix/fetchers/git-utils.hh
@@ -5,7 +5,10 @@
 
 namespace nix {
 
-namespace fetchers { struct PublicKey; struct Settings; }
+namespace fetchers {
+struct PublicKey;
+struct Settings;
+} // namespace fetchers
 
 /**
  * A sink that writes into a Git repository. Note that nothing may be written
@@ -21,8 +24,7 @@ struct GitFileSystemObjectSink : ExtendedFileSystemObjectSink
 
 struct GitRepo
 {
-    virtual ~GitRepo()
-    { }
+    virtual ~GitRepo() {}
 
     static ref<GitRepo> openRepo(const std::filesystem::path & path, bool create = false, bool bare = false);
 
@@ -86,31 +88,23 @@ struct GitRepo
 
     virtual bool hasObject(const Hash & oid) = 0;
 
-    virtual ref<SourceAccessor> getAccessor(
-        const Hash & rev,
-        bool exportIgnore,
-        std::string displayPrefix,
-        bool smudgeLfs = false,
-        bool applyFilters = false) = 0;
+    virtual ref<SourceAccessor>
+    getAccessor(const Hash & rev, bool exportIgnore, std::string displayPrefix, bool smudgeLfs = false, bool applyFilters = false) = 0;
 
-    virtual ref<SourceAccessor> getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError) = 0;
+    virtual ref<SourceAccessor>
+    getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError) = 0;
 
     virtual ref<GitFileSystemObjectSink> getFileSystemObjectSink() = 0;
 
     virtual void flush() = 0;
 
-    virtual void fetch(
-        const std::string & url,
-        const std::string & refspec,
-        bool shallow) = 0;
+    virtual void fetch(const std::string & url, const std::string & refspec, bool shallow) = 0;
 
     /**
      * Verify that commit `rev` is signed by one of the keys in
      * `publicKeys`. Throw an error if it isn't.
      */
-    virtual void verifyCommit(
-        const Hash & rev,
-        const std::vector<fetchers::PublicKey> & publicKeys) = 0;
+    virtual void verifyCommit(const Hash & rev, const std::vector<fetchers::PublicKey> & publicKeys) = 0;
 
     /**
      * Given a Git tree hash, compute the hash of its NAR
@@ -132,8 +126,11 @@ ref<GitRepo> getTarballCache();
 template<auto del>
 struct Deleter
 {
-    template <typename T>
-    void operator()(T * p) const { del(p); };
+    template<typename T>
+    void operator()(T * p) const
+    {
+        del(p);
+    };
 };
 
 // A helper to ensure that we don't leak objects returned by libgit2.
@@ -143,11 +140,28 @@ struct Setter
     T & t;
     typename T::pointer p = nullptr;
 
-    Setter(T & t) : t(t) { }
+    Setter(T & t)
+        : t(t)
+    {
+    }
 
-    ~Setter() { if (p) t = T(p); }
+    ~Setter()
+    {
+        if (p)
+            t = T(p);
+    }
 
-    operator typename T::pointer * () { return &p; }
+    operator typename T::pointer *()
+    {
+        return &p;
+    }
 };
 
-}
+/**
+ * Checks that the git reference is valid and normalized.
+ *
+ * Accepts shorthand references (one-level refnames are allowed).
+ */
+bool isLegalRefName(const std::string & refName);
+
+} // namespace nix
diff --git a/src/libfetchers/include/nix/fetchers/input-cache.hh b/src/libfetchers/include/nix/fetchers/input-cache.hh
index f9278053a..402412071 100644
--- a/src/libfetchers/include/nix/fetchers/input-cache.hh
+++ b/src/libfetchers/include/nix/fetchers/input-cache.hh
@@ -11,6 +11,7 @@ struct InputCache
         ref<SourceAccessor> accessor;
         Input resolvedInput;
         Input lockedInput;
+        Attrs extraAttrs;
     };
 
     CachedResult getAccessor(ref<Store> store, const Input & originalInput, UseRegistries useRegistries);
@@ -19,6 +20,7 @@ struct InputCache
     {
         Input lockedInput;
         ref<SourceAccessor> accessor;
+        Attrs extraAttrs;
     };
 
     virtual std::optional<CachedInput> lookup(const Input & originalInput) const = 0;
@@ -32,4 +34,4 @@ struct InputCache
     virtual ~InputCache() = default;
 };
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/include/nix/fetchers/meson.build b/src/libfetchers/include/nix/fetchers/meson.build
index e6ddedd97..fcd446a6d 100644
--- a/src/libfetchers/include/nix/fetchers/meson.build
+++ b/src/libfetchers/include/nix/fetchers/meson.build
@@ -1,4 +1,4 @@
-include_dirs = [include_directories('../..')]
+include_dirs = [ include_directories('../..') ]
 
 headers = files(
   'attrs.hh',
diff --git a/src/libfetchers/include/nix/fetchers/registry.hh b/src/libfetchers/include/nix/fetchers/registry.hh
index efbfe07c8..90fc3d853 100644
--- a/src/libfetchers/include/nix/fetchers/registry.hh
+++ b/src/libfetchers/include/nix/fetchers/registry.hh
@@ -4,7 +4,9 @@
 #include "nix/util/types.hh"
 #include "nix/fetchers/fetchers.hh"
 
-namespace nix { class Store; }
+namespace nix {
+class Store;
+}
 
 namespace nix::fetchers {
 
@@ -34,18 +36,14 @@ struct Registry
     Registry(const Settings & settings, RegistryType type)
         : settings{settings}
         , type{type}
-    { }
+    {
+    }
 
-    static std::shared_ptr<Registry> read(
-        const Settings & settings,
-        const Path & path, RegistryType type);
+    static std::shared_ptr<Registry> read(const Settings & settings, const Path & path, RegistryType type);
 
     void write(const Path & path);
 
-    void add(
-        const Input & from,
-        const Input & to,
-        const Attrs & extraAttrs);
+    void add(const Input & from, const Input & to, const Attrs & extraAttrs);
 
     void remove(const Input & input);
 };
@@ -60,10 +58,7 @@ Path getUserRegistryPath();
 
 Registries getRegistries(const Settings & settings, ref<Store> store);
 
-void overrideRegistry(
-    const Input & from,
-    const Input & to,
-    const Attrs & extraAttrs);
+void overrideRegistry(const Input & from, const Input & to, const Attrs & extraAttrs);
 
 enum class UseRegistries : int {
     No,
@@ -75,9 +70,6 @@ enum class UseRegistries : int {
  * Rewrite a flakeref using the registries. If `filter` is set, only
  * use the registries for which the filter function returns true.
  */
-std::pair<Input, Attrs> lookupInRegistries(
-    ref<Store> store,
-    const Input & input,
-    UseRegistries useRegistries);
+std::pair<Input, Attrs> lookupInRegistries(ref<Store> store, const Input & input, UseRegistries useRegistries);
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/include/nix/fetchers/store-path-accessor.hh b/src/libfetchers/include/nix/fetchers/store-path-accessor.hh
index 021df5a62..a107293f8 100644
--- a/src/libfetchers/include/nix/fetchers/store-path-accessor.hh
+++ b/src/libfetchers/include/nix/fetchers/store-path-accessor.hh
@@ -11,4 +11,4 @@ ref<SourceAccessor> makeStorePathAccessor(ref<Store> store, const StorePath & st
 
 SourcePath getUnfilteredRootPath(CanonPath path);
 
-}
+} // namespace nix
diff --git a/src/libfetchers/include/nix/fetchers/tarball.hh b/src/libfetchers/include/nix/fetchers/tarball.hh
index 2c5ea209f..be816a24c 100644
--- a/src/libfetchers/include/nix/fetchers/tarball.hh
+++ b/src/libfetchers/include/nix/fetchers/tarball.hh
@@ -10,7 +10,7 @@
 namespace nix {
 class Store;
 struct SourceAccessor;
-}
+} // namespace nix
 
 namespace nix::fetchers {
 
@@ -43,9 +43,6 @@ struct DownloadTarballResult
  * Download and import a tarball into the Git cache. The result is the
  * Git tree hash of the root directory.
  */
-ref<SourceAccessor> downloadTarball(
-    ref<Store> store,
-    const Settings & settings,
-    const std::string & url);
+ref<SourceAccessor> downloadTarball(ref<Store> store, const Settings & settings, const std::string & url);
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/indirect.cc b/src/libfetchers/indirect.cc
index 47cb7587c..e05d27adc 100644
--- a/src/libfetchers/indirect.cc
+++ b/src/libfetchers/indirect.cc
@@ -1,4 +1,5 @@
 #include "nix/fetchers/fetchers.hh"
+#include "nix/fetchers/git-utils.hh"
 #include "nix/util/url-parts.hh"
 #include "nix/store/path.hh"
 
@@ -8,13 +9,13 @@ std::regex flakeRegex("[a-zA-Z][a-zA-Z0-9_-]*", std::regex::ECMAScript);
 
 struct IndirectInputScheme : InputScheme
 {
-    std::optional<Input> inputFromURL(
-        const Settings & settings,
-        const ParsedURL & url, bool requireTree) const override
+    std::optional<Input> inputFromURL(const Settings & settings, const ParsedURL & url, bool requireTree) const override
     {
-        if (url.scheme != "flake") return {};
+        if (url.scheme != "flake")
+            return {};
 
-        auto path = tokenizeString<std::vector<std::string>>(url.path, "/");
+        /* This ignores empty path segments for back-compat. Older versions used a tokenizeString here. */
+        auto path = url.pathSegments(/*skipEmpty=*/true) | std::ranges::to<std::vector<std::string>>();
 
         std::optional<Hash> rev;
         std::optional<std::string> ref;
@@ -23,12 +24,12 @@ struct IndirectInputScheme : InputScheme
         } else if (path.size() == 2) {
             if (std::regex_match(path[1], revRegex))
                 rev = Hash::parseAny(path[1], HashAlgorithm::SHA1);
-            else if (std::regex_match(path[1], refRegex))
+            else if (isLegalRefName(path[1]))
                 ref = path[1];
             else
                 throw BadURL("in flake URL '%s', '%s' is not a commit hash or branch/tag name", url, path[1]);
         } else if (path.size() == 3) {
-            if (!std::regex_match(path[1], refRegex))
+            if (!isLegalRefName(path[1]))
                 throw BadURL("in flake URL '%s', '%s' is not a branch/tag name", url, path[1]);
             ref = path[1];
             if (!std::regex_match(path[2], revRegex))
@@ -46,8 +47,10 @@ struct IndirectInputScheme : InputScheme
         Input input{settings};
         input.attrs.insert_or_assign("type", "indirect");
         input.attrs.insert_or_assign("id", id);
-        if (rev) input.attrs.insert_or_assign("rev", rev->gitRev());
-        if (ref) input.attrs.insert_or_assign("ref", *ref);
+        if (rev)
+            input.attrs.insert_or_assign("rev", rev->gitRev());
+        if (ref)
+            input.attrs.insert_or_assign("ref", *ref);
 
         return input;
     }
@@ -67,9 +70,7 @@ struct IndirectInputScheme : InputScheme
         };
     }
 
-    std::optional<Input> inputFromAttrs(
-        const Settings & settings,
-        const Attrs & attrs) const override
+    std::optional<Input> inputFromAttrs(const Settings & settings, const Attrs & attrs) const override
     {
         auto id = getStrAttr(attrs, "id");
         if (!std::regex_match(id, flakeRegex))
@@ -82,22 +83,26 @@ struct IndirectInputScheme : InputScheme
 
     ParsedURL toURL(const Input & input) const override
     {
-        ParsedURL url;
-        url.scheme = "flake";
-        url.path = getStrAttr(input.attrs, "id");
-        if (auto ref = input.getRef()) { url.path += '/'; url.path += *ref; };
-        if (auto rev = input.getRev()) { url.path += '/'; url.path += rev->gitRev(); };
+        ParsedURL url{
+            .scheme = "flake",
+            .path = {getStrAttr(input.attrs, "id")},
+        };
+        if (auto ref = input.getRef()) {
+            url.path.push_back(*ref);
+        };
+        if (auto rev = input.getRev()) {
+            url.path.push_back(rev->gitRev());
+        };
         return url;
     }
 
-    Input applyOverrides(
-        const Input & _input,
-        std::optional<std::string> ref,
-        std::optional<Hash> rev) const override
+    Input applyOverrides(const Input & _input, std::optional<std::string> ref, std::optional<Hash> rev) const override
     {
         auto input(_input);
-        if (rev) input.attrs.insert_or_assign("rev", rev->gitRev());
-        if (ref) input.attrs.insert_or_assign("ref", *ref);
+        if (rev)
+            input.attrs.insert_or_assign("rev", rev->gitRev());
+        if (ref)
+            input.attrs.insert_or_assign("ref", *ref);
         return input;
     }
 
@@ -112,9 +117,11 @@ struct IndirectInputScheme : InputScheme
     }
 
     bool isDirect(const Input & input) const override
-    { return false; }
+    {
+        return false;
+    }
 };
 
 static auto rIndirectInputScheme = OnStartup([] { registerInputScheme(std::make_unique<IndirectInputScheme>()); });
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/input-cache.cc b/src/libfetchers/input-cache.cc
index 1a4bb28a3..c44f1a236 100644
--- a/src/libfetchers/input-cache.cc
+++ b/src/libfetchers/input-cache.cc
@@ -22,7 +22,8 @@ InputCache::getAccessor(ref<Store> store, const Input & originalInput, UseRegist
                 fetched = lookup(resolvedInput);
                 if (!fetched) {
                     auto [accessor, lockedInput] = resolvedInput.getAccessor(store);
-                    fetched.emplace(CachedInput{.lockedInput = lockedInput, .accessor = accessor});
+                    fetched.emplace(
+                        CachedInput{.lockedInput = lockedInput, .accessor = accessor, .extraAttrs = extraAttrs});
                 }
                 upsert(resolvedInput, *fetched);
             } else {
@@ -36,7 +37,7 @@ InputCache::getAccessor(ref<Store> store, const Input & originalInput, UseRegist
 
     debug("got tree '%s' from '%s'", fetched->accessor, fetched->lockedInput.to_string());
 
-    return {fetched->accessor, resolvedInput, fetched->lockedInput};
+    return {fetched->accessor, resolvedInput, fetched->lockedInput, fetched->extraAttrs};
 }
 
 struct InputCacheImpl : InputCache
@@ -73,4 +74,4 @@ ref<InputCache> InputCache::create()
     return make_ref<InputCacheImpl>();
 }
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 0b63876de..641b3d6a8 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -21,12 +21,7 @@ static RunOptions hgOptions(const Strings & args)
     // Set HGPLAIN: this means we get consistent output from hg and avoids leakage from a user or system .hgrc.
     env["HGPLAIN"] = "";
 
-    return {
-        .program = "hg",
-        .lookupPath = true,
-        .args = args,
-        .environment = env
-    };
+    return {.program = "hg", .lookupPath = true, .args = args, .environment = env};
 }
 
 // runProgram wrapper that uses hgOptions instead of stock RunOptions.
@@ -45,14 +40,10 @@ static std::string runHg(const Strings & args, const std::optional<std::string>
 
 struct MercurialInputScheme : InputScheme
 {
-    std::optional<Input> inputFromURL(
-        const Settings & settings,
-        const ParsedURL & url, bool requireTree) const override
+    std::optional<Input> inputFromURL(const Settings & settings, const ParsedURL & url, bool requireTree) const override
     {
-        if (url.scheme != "hg+http" &&
-            url.scheme != "hg+https" &&
-            url.scheme != "hg+ssh" &&
-            url.scheme != "hg+file") return {};
+        if (url.scheme != "hg+http" && url.scheme != "hg+https" && url.scheme != "hg+ssh" && url.scheme != "hg+file")
+            return {};
 
         auto url2(url);
         url2.scheme = std::string(url2.scheme, 3);
@@ -61,7 +52,7 @@ struct MercurialInputScheme : InputScheme
         Attrs attrs;
         attrs.emplace("type", "hg");
 
-        for (auto &[name, value] : url.query) {
+        for (auto & [name, value] : url.query) {
             if (name == "rev" || name == "ref")
                 attrs.emplace(name, value);
             else
@@ -90,9 +81,7 @@ struct MercurialInputScheme : InputScheme
         };
     }
 
-    std::optional<Input> inputFromAttrs(
-        const Settings & settings,
-        const Attrs & attrs) const override
+    std::optional<Input> inputFromAttrs(const Settings & settings, const Attrs & attrs) const override
     {
         parseURL(getStrAttr(attrs, "url"));
 
@@ -110,19 +99,20 @@ struct MercurialInputScheme : InputScheme
     {
         auto url = parseURL(getStrAttr(input.attrs, "url"));
         url.scheme = "hg+" + url.scheme;
-        if (auto rev = input.getRev()) url.query.insert_or_assign("rev", rev->gitRev());
-        if (auto ref = input.getRef()) url.query.insert_or_assign("ref", *ref);
+        if (auto rev = input.getRev())
+            url.query.insert_or_assign("rev", rev->gitRev());
+        if (auto ref = input.getRef())
+            url.query.insert_or_assign("ref", *ref);
         return url;
     }
 
-    Input applyOverrides(
-        const Input & input,
-        std::optional<std::string> ref,
-        std::optional<Hash> rev) const override
+    Input applyOverrides(const Input & input, std::optional<std::string> ref, std::optional<Hash> rev) const override
     {
         auto res(input);
-        if (rev) res.attrs.insert_or_assign("rev", rev->gitRev());
-        if (ref) res.attrs.insert_or_assign("ref", *ref);
+        if (rev)
+            res.attrs.insert_or_assign("rev", rev->gitRev());
+        if (ref)
+            res.attrs.insert_or_assign("ref", *ref);
         return res;
     }
 
@@ -130,7 +120,7 @@ struct MercurialInputScheme : InputScheme
     {
         auto url = parseURL(getStrAttr(input.attrs, "url"));
         if (url.scheme == "file" && !input.getRef() && !input.getRev())
-            return url.path;
+            return renderUrlPathEnsureLegal(url.path);
         return {};
     }
 
@@ -142,26 +132,27 @@ struct MercurialInputScheme : InputScheme
     {
         auto [isLocal, repoPath] = getActualUrl(input);
         if (!isLocal)
-            throw Error("cannot commit '%s' to Mercurial repository '%s' because it's not a working tree", path, input.to_string());
+            throw Error(
+                "cannot commit '%s' to Mercurial repository '%s' because it's not a working tree",
+                path,
+                input.to_string());
 
         auto absPath = CanonPath(repoPath) / path;
 
         writeFile(absPath.abs(), contents);
 
         // FIXME: shut up if file is already tracked.
-        runHg(
-            { "add", absPath.abs() });
+        runHg({"add", absPath.abs()});
 
         if (commitMsg)
-            runHg(
-                { "commit", absPath.abs(), "-m", *commitMsg });
+            runHg({"commit", absPath.abs(), "-m", *commitMsg});
     }
 
     std::pair<bool, std::string> getActualUrl(const Input & input) const
     {
         auto url = parseURL(getStrAttr(input.attrs, "url"));
         bool isLocal = url.scheme == "file";
-        return {isLocal, isLocal ? url.path : url.to_string()};
+        return {isLocal, isLocal ? renderUrlPathEnsureLegal(url.path) : url.to_string()};
     }
 
     StorePath fetchToStore(ref<Store> store, Input & input) const
@@ -179,7 +170,7 @@ struct MercurialInputScheme : InputScheme
 
         if (!input.getRef() && !input.getRev() && isLocal && pathExists(actualUrl + "/.hg")) {
 
-            bool clean = runHg({ "status", "-R", actualUrl, "--modified", "--added", "--removed" }) == "";
+            bool clean = runHg({"status", "-R", actualUrl, "--modified", "--added", "--removed"}) == "";
 
             if (!clean) {
 
@@ -192,10 +183,11 @@ struct MercurialInputScheme : InputScheme
                 if (input.settings->warnDirty)
                     warn("Mercurial tree '%s' is unclean", actualUrl);
 
-                input.attrs.insert_or_assign("ref", chomp(runHg({ "branch", "-R", actualUrl })));
+                input.attrs.insert_or_assign("ref", chomp(runHg({"branch", "-R", actualUrl})));
 
                 auto files = tokenizeString<StringSet>(
-                    runHg({ "status", "-R", actualUrl, "--clean", "--modified", "--added", "--no-status", "--print0" }), "\0"s);
+                    runHg({"status", "-R", actualUrl, "--clean", "--modified", "--added", "--no-status", "--print0"}),
+                    "\0"s);
 
                 Path actualPath(absPath(actualUrl));
 
@@ -217,29 +209,28 @@ struct MercurialInputScheme : InputScheme
                 auto storePath = store->addToStore(
                     input.getName(),
                     {getFSSourceAccessor(), CanonPath(actualPath)},
-                    ContentAddressMethod::Raw::NixArchive, HashAlgorithm::SHA256, {},
+                    ContentAddressMethod::Raw::NixArchive,
+                    HashAlgorithm::SHA256,
+                    {},
                     filter);
 
                 return storePath;
             }
         }
 
-        if (!input.getRef()) input.attrs.insert_or_assign("ref", "default");
+        if (!input.getRef())
+            input.attrs.insert_or_assign("ref", "default");
 
-        auto revInfoKey = [&](const Hash & rev)
-        {
+        auto revInfoKey = [&](const Hash & rev) {
             if (rev.algo != HashAlgorithm::SHA1)
-                throw Error("Hash '%s' is not supported by Mercurial. Only sha1 is supported.", rev.to_string(HashFormat::Base16, true));
+                throw Error(
+                    "Hash '%s' is not supported by Mercurial. Only sha1 is supported.",
+                    rev.to_string(HashFormat::Base16, true));
 
-            return Cache::Key{"hgRev", {
-                {"store", store->storeDir},
-                {"name", name},
-                {"rev", input.getRev()->gitRev()}
-            }};
+            return Cache::Key{"hgRev", {{"store", store->storeDir}, {"name", name}, {"rev", input.getRev()->gitRev()}}};
         };
 
-        auto makeResult = [&](const Attrs & infoAttrs, const StorePath & storePath) -> StorePath
-        {
+        auto makeResult = [&](const Attrs & infoAttrs, const StorePath & storePath) -> StorePath {
             assert(input.getRev());
             assert(!origRev || origRev == input.getRev());
             input.attrs.insert_or_assign("revCount", getIntAttr(infoAttrs, "revCount"));
@@ -247,10 +238,7 @@ struct MercurialInputScheme : InputScheme
         };
 
         /* Check the cache for the most recent rev for this URL/ref. */
-        Cache::Key refToRevKey{"hgRefToRev", {
-            {"url", actualUrl},
-            {"ref", *input.getRef()}
-        }};
+        Cache::Key refToRevKey{"hgRefToRev", {{"url", actualUrl}, {"ref", *input.getRef()}}};
 
         if (!input.getRev()) {
             if (auto res = input.settings->getCache()->lookupWithTTL(refToRevKey))
@@ -263,43 +251,47 @@ struct MercurialInputScheme : InputScheme
                 return makeResult(res->value, res->storePath);
         }
 
-        Path cacheDir = fmt("%s/hg/%s", getCacheDir(), hashString(HashAlgorithm::SHA256, actualUrl).to_string(HashFormat::Nix32, false));
+        Path cacheDir =
+            fmt("%s/hg/%s",
+                getCacheDir(),
+                hashString(HashAlgorithm::SHA256, actualUrl).to_string(HashFormat::Nix32, false));
 
         /* If this is a commit hash that we already have, we don't
            have to pull again. */
-        if (!(input.getRev()
-                && pathExists(cacheDir)
-                && runProgram(hgOptions({ "log", "-R", cacheDir, "-r", input.getRev()->gitRev(), "--template", "1" })).second == "1"))
-        {
+        if (!(input.getRev() && pathExists(cacheDir)
+              && runProgram(hgOptions({"log", "-R", cacheDir, "-r", input.getRev()->gitRev(), "--template", "1"}))
+                         .second
+                     == "1")) {
             Activity act(*logger, lvlTalkative, actUnknown, fmt("fetching Mercurial repository '%s'", actualUrl));
 
             if (pathExists(cacheDir)) {
                 try {
-                    runHg({ "pull", "-R", cacheDir, "--", actualUrl });
-                }
-                catch (ExecError & e) {
+                    runHg({"pull", "-R", cacheDir, "--", actualUrl});
+                } catch (ExecError & e) {
                     auto transJournal = cacheDir + "/.hg/store/journal";
                     /* hg throws "abandoned transaction" error only if this file exists */
                     if (pathExists(transJournal)) {
-                        runHg({ "recover", "-R", cacheDir });
-                        runHg({ "pull", "-R", cacheDir, "--", actualUrl });
+                        runHg({"recover", "-R", cacheDir});
+                        runHg({"pull", "-R", cacheDir, "--", actualUrl});
                     } else {
                         throw ExecError(e.status, "'hg pull' %s", statusToString(e.status));
                     }
                 }
             } else {
                 createDirs(dirOf(cacheDir));
-                runHg({ "clone", "--noupdate", "--", actualUrl, cacheDir });
+                runHg({"clone", "--noupdate", "--", actualUrl, cacheDir});
             }
         }
 
         /* Fetch the remote rev or ref. */
-        auto tokens = tokenizeString<std::vector<std::string>>(
-            runHg({
-                "log", "-R", cacheDir,
-                "-r", input.getRev() ? input.getRev()->gitRev() : *input.getRef(),
-                "--template", "{node} {rev} {branch}"
-            }));
+        auto tokens = tokenizeString<std::vector<std::string>>(runHg(
+            {"log",
+             "-R",
+             cacheDir,
+             "-r",
+             input.getRev() ? input.getRev()->gitRev() : *input.getRef(),
+             "--template",
+             "{node} {rev} {branch}"}));
         assert(tokens.size() == 3);
 
         auto rev = Hash::parseAny(tokens[0], HashAlgorithm::SHA1);
@@ -315,7 +307,7 @@ struct MercurialInputScheme : InputScheme
         Path tmpDir = createTempDir();
         AutoDelete delTmpDir(tmpDir, true);
 
-        runHg({ "archive", "-R", cacheDir, "-r", rev.gitRev(), tmpDir });
+        runHg({"archive", "-R", cacheDir, "-r", rev.gitRev(), tmpDir});
 
         deletePath(tmpDir + "/.hg_archival.txt");
 
@@ -362,4 +354,4 @@ struct MercurialInputScheme : InputScheme
 
 static auto rMercurialInputScheme = OnStartup([] { registerInputScheme(std::make_unique<MercurialInputScheme>()); });
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 321146ca4..922a2c491 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -1,7 +1,9 @@
-project('nix-fetchers', 'cpp',
+project(
+  'nix-fetchers',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -16,8 +18,7 @@ subdir('nix-meson-build-support/deps-lists')
 
 configuration_data()
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
@@ -27,7 +28,7 @@ subdir('nix-meson-build-support/subprojects')
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
 
-libgit2 = dependency('libgit2')
+libgit2 = dependency('libgit2', version : '>= 1.9')
 deps_private += libgit2
 
 subdir('nix-meson-build-support/common')
@@ -62,9 +63,10 @@ this_library = library(
   sources,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 install_headers(headers, subdir : 'nix/fetchers', preserve_path : true)
diff --git a/src/libfetchers/path.cc b/src/libfetchers/path.cc
index 9239fd274..b66459fb9 100644
--- a/src/libfetchers/path.cc
+++ b/src/libfetchers/path.cc
@@ -10,18 +10,17 @@ namespace nix::fetchers {
 
 struct PathInputScheme : InputScheme
 {
-    std::optional<Input> inputFromURL(
-        const Settings & settings,
-        const ParsedURL & url, bool requireTree) const override
+    std::optional<Input> inputFromURL(const Settings & settings, const ParsedURL & url, bool requireTree) const override
     {
-        if (url.scheme != "path") return {};
+        if (url.scheme != "path")
+            return {};
 
-        if (url.authority && *url.authority != "")
+        if (url.authority && url.authority->host.size())
             throw Error("path URL '%s' should not have an authority ('%s')", url, *url.authority);
 
         Input input{settings};
         input.attrs.insert_or_assign("type", "path");
-        input.attrs.insert_or_assign("path", url.path);
+        input.attrs.insert_or_assign("path", renderUrlPathEnsureLegal(url.path));
 
         for (auto & [name, value] : url.query)
             if (name == "rev" || name == "narHash")
@@ -31,8 +30,7 @@ struct PathInputScheme : InputScheme
                     input.attrs.insert_or_assign(name, *n);
                 else
                     throw Error("path URL '%s' has invalid parameter '%s'", url, name);
-            }
-            else
+            } else
                 throw Error("path URL '%s' has unsupported parameter '%s'", url, name);
 
         return input;
@@ -59,9 +57,7 @@ struct PathInputScheme : InputScheme
         };
     }
 
-    std::optional<Input> inputFromAttrs(
-        const Settings & settings,
-        const Attrs & attrs) const override
+    std::optional<Input> inputFromAttrs(const Settings & settings, const Attrs & attrs) const override
     {
         getStrAttr(attrs, "path");
 
@@ -76,9 +72,9 @@ struct PathInputScheme : InputScheme
         query.erase("path");
         query.erase("type");
         query.erase("__final");
-        return ParsedURL {
+        return ParsedURL{
             .scheme = "path",
-            .path = getStrAttr(input.attrs, "path"),
+            .path = splitString<std::vector<std::string>>(getStrAttr(input.attrs, "path"), "/"),
             .query = query,
         };
     }
@@ -139,9 +135,8 @@ struct PathInputScheme : InputScheme
         time_t mtime = 0;
         if (!storePath || storePath->name() != "source" || !store->isValidPath(*storePath)) {
             // FIXME: try to substitute storePath.
-            auto src = sinkToSource([&](Sink & sink) {
-                mtime = dumpPathAndGetMtime(absPath.string(), sink, defaultPathFilter);
-            });
+            auto src = sinkToSource(
+                [&](Sink & sink) { mtime = dumpPathAndGetMtime(absPath.string(), sink, defaultPathFilter); });
             storePath = store->addToStoreFromDump(*src, "source");
         }
 
@@ -186,4 +181,4 @@ struct PathInputScheme : InputScheme
 
 static auto rPathInputScheme = OnStartup([] { registerInputScheme(std::make_unique<PathInputScheme>()); });
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/pch/precompiled-headers.hh b/src/libfetchers/pch/precompiled-headers.hh
new file mode 100644
index 000000000..db7f22a2e
--- /dev/null
+++ b/src/libfetchers/pch/precompiled-headers.hh
@@ -0,0 +1,3 @@
+#include "nix/fetchers/fetchers.hh"
+#include "nix/store/store-api.hh"
+#include "nix/util/json-utils.hh"
diff --git a/src/libfetchers/registry.cc b/src/libfetchers/registry.cc
index 335935f53..e570fc84b 100644
--- a/src/libfetchers/registry.cc
+++ b/src/libfetchers/registry.cc
@@ -10,9 +10,7 @@
 
 namespace nix::fetchers {
 
-std::shared_ptr<Registry> Registry::read(
-    const Settings & settings,
-    const Path & path, RegistryType type)
+std::shared_ptr<Registry> Registry::read(const Settings & settings, const Path & path, RegistryType type)
 {
     debug("reading registry '%s'", path);
 
@@ -38,12 +36,11 @@ std::shared_ptr<Registry> Registry::read(
                 }
                 auto exact = i.find("exact");
                 registry->entries.push_back(
-                    Entry {
+                    Entry{
                         .from = Input::fromAttrs(settings, jsonToAttrs(i["from"])),
                         .to = Input::fromAttrs(settings, std::move(toAttrs)),
                         .extraAttrs = extraAttrs,
-                        .exact = exact != i.end() && exact.value()
-                    });
+                        .exact = exact != i.end() && exact.value()});
             }
         }
 
@@ -81,17 +78,9 @@ void Registry::write(const Path & path)
     writeFile(path, json.dump(2));
 }
 
-void Registry::add(
-    const Input & from,
-    const Input & to,
-    const Attrs & extraAttrs)
+void Registry::add(const Input & from, const Input & to, const Attrs & extraAttrs)
 {
-    entries.emplace_back(
-        Entry {
-            .from = from,
-            .to = to,
-            .extraAttrs = extraAttrs
-        });
+    entries.emplace_back(Entry{.from = from, .to = to, .extraAttrs = extraAttrs});
 }
 
 void Registry::remove(const Input & input)
@@ -108,8 +97,7 @@ static Path getSystemRegistryPath()
 
 static std::shared_ptr<Registry> getSystemRegistry(const Settings & settings)
 {
-    static auto systemRegistry =
-        Registry::read(settings, getSystemRegistryPath(), Registry::System);
+    static auto systemRegistry = Registry::read(settings, getSystemRegistryPath(), Registry::System);
     return systemRegistry;
 }
 
@@ -120,29 +108,23 @@ Path getUserRegistryPath()
 
 std::shared_ptr<Registry> getUserRegistry(const Settings & settings)
 {
-    static auto userRegistry =
-        Registry::read(settings, getUserRegistryPath(), Registry::User);
+    static auto userRegistry = Registry::read(settings, getUserRegistryPath(), Registry::User);
     return userRegistry;
 }
 
 std::shared_ptr<Registry> getCustomRegistry(const Settings & settings, const Path & p)
 {
-    static auto customRegistry =
-        Registry::read(settings, p, Registry::Custom);
+    static auto customRegistry = Registry::read(settings, p, Registry::Custom);
     return customRegistry;
 }
 
 std::shared_ptr<Registry> getFlagRegistry(const Settings & settings)
 {
-    static auto flagRegistry =
-        std::make_shared<Registry>(settings, Registry::Flag);
+    static auto flagRegistry = std::make_shared<Registry>(settings, Registry::Flag);
     return flagRegistry;
 }
 
-void overrideRegistry(
-    const Input & from,
-    const Input & to,
-    const Attrs & extraAttrs)
+void overrideRegistry(const Input & from, const Input & to, const Attrs & extraAttrs)
 {
     getFlagRegistry(*from.settings)->add(from, to, extraAttrs);
 }
@@ -178,10 +160,7 @@ Registries getRegistries(const Settings & settings, ref<Store> store)
     return registries;
 }
 
-std::pair<Input, Attrs> lookupInRegistries(
-    ref<Store> store,
-    const Input & _input,
-    UseRegistries useRegistries)
+std::pair<Input, Attrs> lookupInRegistries(ref<Store> store, const Input & _input, UseRegistries useRegistries)
 {
     Attrs extraAttrs;
     int n = 0;
@@ -190,10 +169,11 @@ std::pair<Input, Attrs> lookupInRegistries(
     if (useRegistries == UseRegistries::No)
         return {input, extraAttrs};
 
- restart:
+restart:
 
     n++;
-    if (n > 100) throw Error("cycle detected in flake registry for '%s'", input.to_string());
+    if (n > 100)
+        throw Error("cycle detected in flake registry for '%s'", input.to_string());
 
     for (auto & registry : getRegistries(*input.settings, store)) {
         if (useRegistries == UseRegistries::Limited
@@ -229,4 +209,4 @@ std::pair<Input, Attrs> lookupInRegistries(
     return {input, extraAttrs};
 }
 
-}
+} // namespace nix::fetchers
diff --git a/src/libfetchers/store-path-accessor.cc b/src/libfetchers/store-path-accessor.cc
index f389d0327..65160e311 100644
--- a/src/libfetchers/store-path-accessor.cc
+++ b/src/libfetchers/store-path-accessor.cc
@@ -8,4 +8,4 @@ ref<SourceAccessor> makeStorePathAccessor(ref<Store> store, const StorePath & st
     return projectSubdirSourceAccessor(store->getFSAccessor(), storePath.to_string());
 }
 
-}
+} // namespace nix
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index b0822cc33..b55837c9e 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -22,15 +22,16 @@ DownloadFileResult downloadFile(
 {
     // FIXME: check store
 
-    Cache::Key key{"file", {{
-        {"url", url},
-        {"name", name},
-    }}};
+    Cache::Key key{
+        "file",
+        {{
+            {"url", url},
+            {"name", name},
+        }}};
 
     auto cached = settings.getCache()->lookupStorePath(key, *store);
 
-    auto useCached = [&]() -> DownloadFileResult
-    {
+    auto useCached = [&]() -> DownloadFileResult {
         return {
             .storePath = std::move(cached->storePath),
             .etag = getStrAttr(cached->value, "etag"),
@@ -42,7 +43,7 @@ DownloadFileResult downloadFile(
     if (cached && !cached->expired)
         return useCached();
 
-    FileTransferRequest request(url);
+    FileTransferRequest request(ValidURL{url});
     request.headers = headers;
     if (cached)
         request.expectedETag = getStrAttr(cached->value, "etag");
@@ -73,18 +74,17 @@ DownloadFileResult downloadFile(
         StringSink sink;
         dumpString(res.data, sink);
         auto hash = hashString(HashAlgorithm::SHA256, res.data);
-        ValidPathInfo info {
+        auto info = ValidPathInfo::makeFromCA(
             *store,
             name,
-            FixedOutputInfo {
+            FixedOutputInfo{
                 .method = FileIngestionMethod::Flat,
                 .hash = hash,
                 .references = {},
             },
-            hashString(HashAlgorithm::SHA256, sink.s),
-        };
+            hashString(HashAlgorithm::SHA256, sink.s));
         info.narSize = sink.s.size();
-        auto source = StringSource { sink.s };
+        auto source = StringSource{sink.s};
         store->addToStore(info, source, NoRepair, NoCheckSigs);
         storePath = std::move(info.path);
     }
@@ -106,19 +106,34 @@ DownloadFileResult downloadFile(
 }
 
 static DownloadTarballResult downloadTarball_(
-    const Settings & settings,
-    const std::string & url,
-    const Headers & headers,
-    const std::string & displayPrefix)
+    const Settings & settings, const std::string & urlS, const Headers & headers, const std::string & displayPrefix)
 {
-    Cache::Key cacheKey{"tarball", {{"url", url}}};
+    ValidURL url = urlS;
+
+    // Some friendly error messages for common mistakes.
+    // Namely lets catch when the url is a local file path, but
+    // it is not in fact a tarball.
+    if (url.scheme() == "file") {
+        std::filesystem::path localPath = renderUrlPathEnsureLegal(url.path());
+        if (!exists(localPath)) {
+            throw Error("tarball '%s' does not exist.", localPath);
+        }
+        if (is_directory(localPath)) {
+            if (exists(localPath / ".git")) {
+                throw Error(
+                    "tarball '%s' is a git repository, not a tarball. Please use `git+file` as the scheme.", localPath);
+            }
+            throw Error("tarball '%s' is a directory, not a file.", localPath);
+        }
+    }
+
+    Cache::Key cacheKey{"tarball", {{"url", urlS}}};
 
     auto cached = settings.getCache()->lookupExpired(cacheKey);
 
-    auto attrsToResult = [&](const Attrs & infoAttrs)
-    {
+    auto attrsToResult = [&](const Attrs & infoAttrs) {
         auto treeHash = getRevAttr(infoAttrs, "treeHash");
-        return DownloadTarballResult {
+        return DownloadTarballResult{
             .treeHash = treeHash,
             .lastModified = (time_t) getIntAttr(infoAttrs, "lastModified"),
             .immutableUrl = maybeGetStrAttr(infoAttrs, "immutableUrl"),
@@ -139,39 +154,32 @@ static DownloadTarballResult downloadTarball_(
     auto source = sinkToSource([&](Sink & sink) {
         FileTransferRequest req(url);
         req.expectedETag = cached ? getStrAttr(cached->value, "etag") : "";
-        getFileTransfer()->download(std::move(req), sink,
-            [_res](FileTransferResult r)
-            {
-                *_res->lock() = r;
-            });
+        getFileTransfer()->download(std::move(req), sink, [_res](FileTransferResult r) { *_res->lock() = r; });
     });
 
     // TODO: fall back to cached value if download fails.
 
-    auto act = std::make_unique<Activity>(*logger, lvlInfo, actUnknown,
-        fmt("unpacking '%s' into the Git cache", url));
+    auto act = std::make_unique<Activity>(*logger, lvlInfo, actUnknown, fmt("unpacking '%s' into the Git cache", url));
 
     AutoDelete cleanupTemp;
 
     /* Note: if the download is cached, `importTarball()` will receive
        no data, which causes it to import an empty tarball. */
-    auto archive =
-        hasSuffix(toLower(parseURL(url).path), ".zip")
-        ? ({
-                /* In streaming mode, libarchive doesn't handle
-                   symlinks in zip files correctly (#10649). So write
-                   the entire file to disk so libarchive can access it
-                   in random-access mode. */
-                auto [fdTemp, path] = createTempFile("nix-zipfile");
-                cleanupTemp.reset(path);
-                debug("downloading '%s' into '%s'...", url, path);
-                {
-                    FdSink sink(fdTemp.get());
-                    source->drainInto(sink);
-                }
-                TarArchive{path};
-          })
-        : TarArchive{*source};
+    auto archive = !url.path().empty() && hasSuffix(toLower(url.path().back()), ".zip") ? ({
+        /* In streaming mode, libarchive doesn't handle
+           symlinks in zip files correctly (#10649). So write
+           the entire file to disk so libarchive can access it
+           in random-access mode. */
+        auto [fdTemp, path] = createTempFile("nix-zipfile");
+        cleanupTemp.reset(path);
+        debug("downloading '%s' into '%s'...", url, path);
+        {
+            FdSink sink(fdTemp.get());
+            source->drainInto(sink);
+        }
+        TarArchive{path};
+    })
+                                                                                        : TarArchive{*source};
     auto tarballCache = getTarballCache();
     auto parseSink = tarballCache->getFileSystemObjectSink();
     auto lastModified = unpackTarfileToSink(archive, *parseSink);
@@ -189,8 +197,7 @@ static DownloadTarballResult downloadTarball_(
         infoAttrs = cached->value;
     } else {
         infoAttrs.insert_or_assign("etag", res->etag);
-        infoAttrs.insert_or_assign("treeHash",
-            tarballCache->dereferenceSingletonDirectory(tree).gitRev());
+        infoAttrs.insert_or_assign("treeHash", tarballCache->dereferenceSingletonDirectory(tree).gitRev());
         infoAttrs.insert_or_assign("lastModified", uint64_t(lastModified));
         if (res->immutableUrl)
             infoAttrs.insert_or_assign("immutableUrl", *res->immutableUrl);
@@ -208,10 +215,7 @@ static DownloadTarballResult downloadTarball_(
     return attrsToResult(infoAttrs);
 }
 
-ref<SourceAccessor> downloadTarball(
-    ref<Store> store,
-    const Settings & settings,
-    const std::string & url)
+ref<SourceAccessor> downloadTarball(ref<Store> store, const Settings & settings, const std::string & url)
 {
     /* Go through Input::getAccessor() to ensure that the resulting
        accessor has a fingerprint. */
@@ -229,21 +233,22 @@ struct CurlInputScheme : InputScheme
 {
     const StringSet transportUrlSchemes = {"file", "http", "https"};
 
-    bool hasTarballExtension(std::string_view path) const
+    bool hasTarballExtension(const ParsedURL & url) const
     {
-        return hasSuffix(path, ".zip") || hasSuffix(path, ".tar")
-            || hasSuffix(path, ".tgz") || hasSuffix(path, ".tar.gz")
-            || hasSuffix(path, ".tar.xz") || hasSuffix(path, ".tar.bz2")
-            || hasSuffix(path, ".tar.zst");
+        if (url.path.empty())
+            return false;
+        const auto & path = url.path.back();
+        return hasSuffix(path, ".zip") || hasSuffix(path, ".tar") || hasSuffix(path, ".tgz")
+               || hasSuffix(path, ".tar.gz") || hasSuffix(path, ".tar.xz") || hasSuffix(path, ".tar.bz2")
+               || hasSuffix(path, ".tar.zst");
     }
 
     virtual bool isValidURL(const ParsedURL & url, bool requireTree) const = 0;
 
     static const StringSet specialParams;
 
-    std::optional<Input> inputFromURL(
-        const Settings & settings,
-        const ParsedURL & _url, bool requireTree) const override
+    std::optional<Input>
+    inputFromURL(const Settings & settings, const ParsedURL & _url, bool requireTree) const override
     {
         if (!isValidURL(_url, requireTree))
             return std::nullopt;
@@ -277,7 +282,7 @@ struct CurlInputScheme : InputScheme
         for (auto & param : allowedAttrs())
             url.query.erase(param);
 
-        input.attrs.insert_or_assign("type", std::string { schemeName() });
+        input.attrs.insert_or_assign("type", std::string{schemeName()});
         input.attrs.insert_or_assign("url", url.to_string());
         return input;
     }
@@ -296,14 +301,12 @@ struct CurlInputScheme : InputScheme
         };
     }
 
-    std::optional<Input> inputFromAttrs(
-        const Settings & settings,
-        const Attrs & attrs) const override
+    std::optional<Input> inputFromAttrs(const Settings & settings, const Attrs & attrs) const override
     {
         Input input{settings};
         input.attrs = attrs;
 
-        //input.locked = (bool) maybeGetStrAttr(input.attrs, "hash");
+        // input.locked = (bool) maybeGetStrAttr(input.attrs, "hash");
         return input;
     }
 
@@ -325,15 +328,17 @@ struct CurlInputScheme : InputScheme
 
 struct FileInputScheme : CurlInputScheme
 {
-    std::string_view schemeName() const override { return "file"; }
+    std::string_view schemeName() const override
+    {
+        return "file";
+    }
 
     bool isValidURL(const ParsedURL & url, bool requireTree) const override
     {
         auto parsedUrlScheme = parseUrlScheme(url.scheme);
         return transportUrlSchemes.count(std::string(parsedUrlScheme.transport))
-            && (parsedUrlScheme.application
-                ? parsedUrlScheme.application.value() == schemeName()
-                : (!requireTree && !hasTarballExtension(url.path)));
+               && (parsedUrlScheme.application ? parsedUrlScheme.application.value() == schemeName()
+                                               : (!requireTree && !hasTarballExtension(url)));
     }
 
     std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
@@ -359,27 +364,26 @@ struct FileInputScheme : CurlInputScheme
 
 struct TarballInputScheme : CurlInputScheme
 {
-    std::string_view schemeName() const override { return "tarball"; }
+    std::string_view schemeName() const override
+    {
+        return "tarball";
+    }
 
     bool isValidURL(const ParsedURL & url, bool requireTree) const override
     {
         auto parsedUrlScheme = parseUrlScheme(url.scheme);
 
         return transportUrlSchemes.count(std::string(parsedUrlScheme.transport))
-            && (parsedUrlScheme.application
-                ? parsedUrlScheme.application.value() == schemeName()
-                : (requireTree || hasTarballExtension(url.path)));
+               && (parsedUrlScheme.application ? parsedUrlScheme.application.value() == schemeName()
+                                               : (requireTree || hasTarballExtension(url)));
     }
 
     std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
     {
         auto input(_input);
 
-        auto result = downloadTarball_(
-            *input.settings,
-            getStrAttr(input.attrs, "url"),
-            {},
-            "«" + input.to_string() + "»");
+        auto result =
+            downloadTarball_(*input.settings, getStrAttr(input.attrs, "url"), {}, "«" + input.to_string() + "»");
 
         if (result.immutableUrl) {
             auto immutableInput = Input::fromURL(*input.settings, *result.immutableUrl);
@@ -393,7 +397,8 @@ struct TarballInputScheme : CurlInputScheme
         if (result.lastModified && !input.attrs.contains("lastModified"))
             input.attrs.insert_or_assign("lastModified", uint64_t(result.lastModified));
 
-        input.attrs.insert_or_assign("narHash",
+        input.attrs.insert_or_assign(
+            "narHash",
             getTarballCache()->treeHashToNarHash(*input.settings, result.treeHash).to_string(HashFormat::SRI, true));
 
         return {result.accessor, input};
@@ -413,4 +418,4 @@ struct TarballInputScheme : CurlInputScheme
 static auto rTarballInputScheme = OnStartup([] { registerInputScheme(std::make_unique<TarballInputScheme>()); });
 static auto rFileInputScheme = OnStartup([] { registerInputScheme(std::make_unique<FileInputScheme>()); });
 
-}
+} // namespace nix::fetchers
diff --git a/src/libflake-c/meson.build b/src/libflake-c/meson.build
index 5a81618c8..933e06d90 100644
--- a/src/libflake-c/meson.build
+++ b/src/libflake-c/meson.build
@@ -1,7 +1,9 @@
-project('nix-flake-c', 'cpp',
+project(
+  'nix-flake-c',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -35,7 +37,7 @@ sources = files(
   'nix_api_flake.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 headers = files(
   'nix_api_flake.h',
@@ -53,7 +55,7 @@ this_library = library(
   sources,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libflake-c/nix_api_flake.cc b/src/libflake-c/nix_api_flake.cc
index ad8f0bf4e..2de0e667e 100644
--- a/src/libflake-c/nix_api_flake.cc
+++ b/src/libflake-c/nix_api_flake.cc
@@ -10,6 +10,8 @@
 
 #include "nix/flake/flake.hh"
 
+extern "C" {
+
 nix_flake_settings * nix_flake_settings_new(nix_c_context * context)
 {
     nix_clear_err(context);
@@ -203,3 +205,5 @@ nix_value * nix_locked_flake_get_output_attrs(
     }
     NIXC_CATCH_ERRS_NULL
 }
+
+} // extern "C"
diff --git a/src/libflake-tests/flakeref.cc b/src/libflake-tests/flakeref.cc
index 1abaffb96..e2cb91bb8 100644
--- a/src/libflake-tests/flakeref.cc
+++ b/src/libflake-tests/flakeref.cc
@@ -2,65 +2,256 @@
 
 #include "nix/fetchers/fetch-settings.hh"
 #include "nix/flake/flakeref.hh"
+#include "nix/fetchers/attrs.hh"
 
 namespace nix {
 
 /* ----------- tests for flake/flakeref.hh --------------------------------------------------*/
 
-    TEST(parseFlakeRef, path) {
-        experimentalFeatureSettings.experimentalFeatures.get().insert(Xp::Flakes);
+TEST(parseFlakeRef, path)
+{
+    experimentalFeatureSettings.experimentalFeatures.get().insert(Xp::Flakes);
 
-        fetchers::Settings fetchSettings;
+    fetchers::Settings fetchSettings;
 
-        {
-            auto s = "/foo/bar";
-            auto flakeref = parseFlakeRef(fetchSettings, s);
-            ASSERT_EQ(flakeref.to_string(), "path:/foo/bar");
-        }
-
-        {
-            auto s = "/foo/bar?revCount=123&rev=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
-            auto flakeref = parseFlakeRef(fetchSettings, s);
-            ASSERT_EQ(flakeref.to_string(), "path:/foo/bar?rev=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&revCount=123");
-        }
-
-        {
-            auto s = "/foo/bar?xyzzy=123";
-            EXPECT_THROW(
-                parseFlakeRef(fetchSettings, s),
-                Error);
-        }
-
-        {
-            auto s = "/foo/bar#bla";
-            EXPECT_THROW(
-                parseFlakeRef(fetchSettings, s),
-                Error);
-        }
-
-        {
-            auto s = "/foo/bar#bla";
-            auto [flakeref, fragment] = parseFlakeRefWithFragment(fetchSettings, s);
-            ASSERT_EQ(flakeref.to_string(), "path:/foo/bar");
-            ASSERT_EQ(fragment, "bla");
-        }
-
-        {
-            auto s = "/foo/bar?revCount=123#bla";
-            auto [flakeref, fragment] = parseFlakeRefWithFragment(fetchSettings, s);
-            ASSERT_EQ(flakeref.to_string(), "path:/foo/bar?revCount=123");
-            ASSERT_EQ(fragment, "bla");
-        }
-    }
-
-    TEST(to_string, doesntReencodeUrl) {
-        fetchers::Settings fetchSettings;
-        auto s = "http://localhost:8181/test/+3d.tar.gz";
+    {
+        auto s = "/foo/bar";
         auto flakeref = parseFlakeRef(fetchSettings, s);
-        auto unparsed = flakeref.to_string();
-        auto expected = "http://localhost:8181/test/%2B3d.tar.gz";
-
-        ASSERT_EQ(unparsed, expected);
+        ASSERT_EQ(flakeref.to_string(), "path:/foo/bar");
     }
 
+    {
+        auto s = "/foo/bar?revCount=123&rev=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        auto flakeref = parseFlakeRef(fetchSettings, s);
+        ASSERT_EQ(flakeref.to_string(), "path:/foo/bar?rev=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&revCount=123");
+    }
+
+    {
+        auto s = "/foo/bar?xyzzy=123";
+        EXPECT_THROW(parseFlakeRef(fetchSettings, s), Error);
+    }
+
+    {
+        auto s = "/foo/bar#bla";
+        EXPECT_THROW(parseFlakeRef(fetchSettings, s), Error);
+    }
+
+    {
+        auto s = "/foo/bar#bla";
+        auto [flakeref, fragment] = parseFlakeRefWithFragment(fetchSettings, s);
+        ASSERT_EQ(flakeref.to_string(), "path:/foo/bar");
+        ASSERT_EQ(fragment, "bla");
+    }
+
+    {
+        auto s = "/foo/bar?revCount=123#bla";
+        auto [flakeref, fragment] = parseFlakeRefWithFragment(fetchSettings, s);
+        ASSERT_EQ(flakeref.to_string(), "path:/foo/bar?revCount=123");
+        ASSERT_EQ(fragment, "bla");
+    }
+
+    {
+        auto s = "/foo bar/baz?dir=bla space";
+        auto flakeref = parseFlakeRef(fetchSettings, s);
+        ASSERT_EQ(flakeref.to_string(), "path:/foo%20bar/baz?dir=bla%20space");
+        ASSERT_EQ(flakeref.toAttrs().at("dir"), fetchers::Attr("bla space"));
+    }
 }
+
+TEST(parseFlakeRef, GitArchiveInput)
+{
+    experimentalFeatureSettings.experimentalFeatures.get().insert(Xp::Flakes);
+
+    fetchers::Settings fetchSettings;
+
+    {
+        auto s = "github:foo/bar/branch%23"; // branch name with `#`
+        auto flakeref = parseFlakeRef(fetchSettings, s);
+        ASSERT_EQ(flakeref.to_string(), "github:foo/bar/branch%23");
+    }
+
+    {
+        auto s = "github:foo/bar?ref=branch%23"; // branch name with `#`
+        auto flakeref = parseFlakeRef(fetchSettings, s);
+        ASSERT_EQ(flakeref.to_string(), "github:foo/bar/branch%23");
+    }
+
+    {
+        auto s = "github:foo/bar?ref=branch#\"name.with.dot\""; // unescaped quotes `"`
+        auto [flakeref, fragment] = parseFlakeRefWithFragment(fetchSettings, s);
+        ASSERT_EQ(fragment, "\"name.with.dot\"");
+        ASSERT_EQ(flakeref.to_string(), "github:foo/bar/branch");
+    }
+
+    {
+        auto s = "github:foo/bar#\"name.with.dot\""; // unescaped quotes `"`
+        auto [flakeref, fragment] = parseFlakeRefWithFragment(fetchSettings, s);
+        ASSERT_EQ(fragment, "\"name.with.dot\"");
+        ASSERT_EQ(flakeref.to_string(), "github:foo/bar");
+    }
+}
+
+struct InputFromURLTestCase
+{
+    std::string url;
+    fetchers::Attrs attrs;
+    std::string description;
+    std::string expectedUrl = url;
+};
+
+class InputFromURLTest : public ::testing::WithParamInterface<InputFromURLTestCase>, public ::testing::Test
+{};
+
+TEST_P(InputFromURLTest, attrsAreCorrectAndRoundTrips)
+{
+    experimentalFeatureSettings.experimentalFeatures.get().insert(Xp::Flakes);
+    fetchers::Settings fetchSettings;
+
+    const auto & testCase = GetParam();
+
+    auto flakeref = parseFlakeRef(fetchSettings, testCase.url);
+
+    EXPECT_EQ(flakeref.toAttrs(), testCase.attrs);
+    EXPECT_EQ(flakeref.to_string(), testCase.expectedUrl);
+
+    auto input = fetchers::Input::fromURL(fetchSettings, flakeref.to_string());
+
+    EXPECT_EQ(input.toURLString(), testCase.expectedUrl);
+    EXPECT_EQ(input.toAttrs(), testCase.attrs);
+
+    // Round-trip check.
+    auto input2 = fetchers::Input::fromURL(fetchSettings, input.toURLString());
+    EXPECT_EQ(input, input2);
+    EXPECT_EQ(input.toURLString(), input2.toURLString());
+}
+
+using fetchers::Attr;
+
+INSTANTIATE_TEST_SUITE_P(
+    InputFromURL,
+    InputFromURLTest,
+    ::testing::Values(
+        InputFromURLTestCase{
+            .url = "flake:nixpkgs",
+            .attrs =
+                {
+                    {"id", Attr("nixpkgs")},
+                    {"type", Attr("indirect")},
+                },
+            .description = "basic_indirect",
+        },
+        InputFromURLTestCase{
+            .url = "flake:nixpkgs/branch",
+            .attrs =
+                {
+                    {"id", Attr("nixpkgs")},
+                    {"type", Attr("indirect")},
+                    {"ref", Attr("branch")},
+                },
+            .description = "basic_indirect_branch",
+        },
+        InputFromURLTestCase{
+            .url = "nixpkgs/branch",
+            .attrs =
+                {
+                    {"id", Attr("nixpkgs")},
+                    {"type", Attr("indirect")},
+                    {"ref", Attr("branch")},
+                },
+            .description = "flake_id_ref_branch",
+            .expectedUrl = "flake:nixpkgs/branch",
+        },
+        InputFromURLTestCase{
+            .url = "nixpkgs/branch/2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
+            .attrs =
+                {
+                    {"id", Attr("nixpkgs")},
+                    {"type", Attr("indirect")},
+                    {"ref", Attr("branch")},
+                    {"rev", Attr("2aae6c35c94fcfb415dbe95f408b9ce91ee846ed")},
+                },
+            .description = "flake_id_ref_branch_trailing_slash",
+            .expectedUrl = "flake:nixpkgs/branch/2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
+        },
+        // The following tests are for back-compat with lax parsers in older versions
+        // that used `tokenizeString` for splitting path segments, which ignores empty
+        // strings.
+        InputFromURLTestCase{
+            .url = "nixpkgs/branch////",
+            .attrs =
+                {
+                    {"id", Attr("nixpkgs")},
+                    {"type", Attr("indirect")},
+                    {"ref", Attr("branch")},
+                },
+            .description = "flake_id_ref_branch_ignore_empty_trailing_segments",
+            .expectedUrl = "flake:nixpkgs/branch",
+        },
+        InputFromURLTestCase{
+            .url = "nixpkgs/branch///2aae6c35c94fcfb415dbe95f408b9ce91ee846ed///",
+            .attrs =
+                {
+                    {"id", Attr("nixpkgs")},
+                    {"type", Attr("indirect")},
+                    {"ref", Attr("branch")},
+                    {"rev", Attr("2aae6c35c94fcfb415dbe95f408b9ce91ee846ed")},
+                },
+            .description = "flake_id_ref_branch_ignore_empty_segments_ref_rev",
+            .expectedUrl = "flake:nixpkgs/branch/2aae6c35c94fcfb415dbe95f408b9ce91ee846ed",
+        },
+        InputFromURLTestCase{
+            // Note that this is different from above because the "flake id" shorthand
+            // doesn't allow this.
+            .url = "flake:/nixpkgs///branch////",
+            .attrs =
+                {
+                    {"id", Attr("nixpkgs")},
+                    {"type", Attr("indirect")},
+                    {"ref", Attr("branch")},
+                },
+            .description = "indirect_branch_empty_segments_everywhere",
+            .expectedUrl = "flake:nixpkgs/branch",
+        },
+        InputFromURLTestCase{
+            // TODO: Technically this has an empty authority, but it's ignored
+            // for now. Yes, this is what all versions going back to at least
+            // 2.18 did and yes, this should not be allowed.
+            .url = "github://////owner%42/////repo%41///branch%43////",
+            .attrs =
+                {
+                    {"type", Attr("github")},
+                    {"owner", Attr("ownerB")},
+                    {"repo", Attr("repoA")},
+                    {"ref", Attr("branchC")},
+                },
+            .description = "github_ref_slashes_in_path_everywhere",
+            .expectedUrl = "github:ownerB/repoA/branchC",
+        },
+        InputFromURLTestCase{
+            // FIXME: Subgroups in gitlab URLs are busted. This double-encoding
+            // behavior exists since 2.18. See issue #9161 and PR #8845.
+            .url = "gitlab:/owner%252Fsubgroup/////repo%41///branch%43////",
+            .attrs =
+                {
+                    {"type", Attr("gitlab")},
+                    {"owner", Attr("owner%2Fsubgroup")},
+                    {"repo", Attr("repoA")},
+                    {"ref", Attr("branchC")},
+                },
+            .description = "gitlab_ref_slashes_in_path_everywhere_with_pct_encoding",
+            .expectedUrl = "gitlab:owner%252Fsubgroup/repoA/branchC",
+        }),
+    [](const ::testing::TestParamInfo<InputFromURLTestCase> & info) { return info.param.description; });
+
+TEST(to_string, doesntReencodeUrl)
+{
+    fetchers::Settings fetchSettings;
+    auto s = "http://localhost:8181/test/+3d.tar.gz";
+    auto flakeref = parseFlakeRef(fetchSettings, s);
+    auto unparsed = flakeref.to_string();
+    auto expected = "http://localhost:8181/test/%2B3d.tar.gz";
+
+    ASSERT_EQ(unparsed, expected);
+}
+
+} // namespace nix
diff --git a/src/libflake-tests/meson.build b/src/libflake-tests/meson.build
index 593b0e18d..59094abe8 100644
--- a/src/libflake-tests/meson.build
+++ b/src/libflake-tests/meson.build
@@ -1,7 +1,9 @@
-project('nix-flake-tests', 'cpp',
+project(
+  'nix-flake-tests',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -19,8 +21,7 @@ deps_private_maybe_subproject = [
   dependency('nix-flake'),
   dependency('nix-flake-c'),
 ]
-deps_public_maybe_subproject = [
-]
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 subdir('nix-meson-build-support/export-all-symbols')
@@ -40,7 +41,7 @@ sources = files(
   'url-name.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 
 this_exe = executable(
@@ -49,7 +50,7 @@ this_exe = executable(
   dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
   # TODO: -lrapidcheck, see ../libutil-support/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   # get main from gtest
   install : true,
 )
@@ -58,8 +59,9 @@ test(
   meson.project_name(),
   this_exe,
   env : {
-    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
-    'NIX_CONFIG': 'extra-experimental-features = flakes',
+    '_NIX_TEST_UNIT_DATA' : meson.current_source_dir() / 'data',
+    'NIX_CONFIG' : 'extra-experimental-features = flakes',
+    'HOME' : meson.current_build_dir() / 'test-home',
   },
   protocol : 'gtest',
 )
diff --git a/src/libflake-tests/package.nix b/src/libflake-tests/package.nix
index 714f3791a..397ef4192 100644
--- a/src/libflake-tests/package.nix
+++ b/src/libflake-tests/package.nix
@@ -3,6 +3,7 @@
   buildPackages,
   stdenv,
   mkMesonExecutable,
+  writableTmpDirAsHomeHook,
 
   nix-flake,
   nix-flake-c,
@@ -55,19 +56,14 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
           }
-          (
-            lib.optionalString stdenv.hostPlatform.isWindows ''
-              export HOME="$PWD/home-dir"
-              mkdir -p "$HOME"
-            ''
-            + ''
-              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
-              export NIX_CONFIG="extra-experimental-features = flakes"
-              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-              touch $out
-            ''
-          );
+          (''
+            export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+            export NIX_CONFIG="extra-experimental-features = flakes"
+            ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+            touch $out
+          '');
     };
   };
 
diff --git a/src/libflake-tests/url-name.cc b/src/libflake-tests/url-name.cc
index c795850f9..81ba516c8 100644
--- a/src/libflake-tests/url-name.cc
+++ b/src/libflake-tests/url-name.cc
@@ -5,66 +5,82 @@ namespace nix {
 
 /* ----------- tests for url-name.hh --------------------------------------------------*/
 
-    TEST(getNameFromURL, getNameFromURL) {
-        ASSERT_EQ(getNameFromURL(parseURL("path:/home/user/project")), "project");
-        ASSERT_EQ(getNameFromURL(parseURL("path:~/repos/nixpkgs#packages.x86_64-linux.hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("path:~/repos/nixpkgs#legacyPackages.x86_64-linux.hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("path:~/repos/nixpkgs#packages.x86_64-linux.Hello")), "Hello");
-        ASSERT_EQ(getNameFromURL(parseURL("path:.#nonStandardAttr.mylaptop")), "mylaptop");
-        ASSERT_EQ(getNameFromURL(parseURL("path:./repos/myflake#nonStandardAttr.mylaptop")), "mylaptop");
-        ASSERT_EQ(getNameFromURL(parseURL("path:./nixpkgs#packages.x86_64-linux.complex^bin,man")), "complex");
-        ASSERT_EQ(getNameFromURL(parseURL("path:./myproj#packages.x86_64-linux.default^*")), "myproj");
-        ASSERT_EQ(getNameFromURL(parseURL("path:./myproj#defaultPackage.x86_64-linux")), "myproj");
+TEST(getNameFromURL, getNameFromURL)
+{
+    ASSERT_EQ(getNameFromURL(parseURL("path:/home/user/project")), "project");
+    ASSERT_EQ(getNameFromURL(parseURL("path:~/repos/nixpkgs#packages.x86_64-linux.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("path:~/repos/nixpkgs#legacyPackages.x86_64-linux.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("path:~/repos/nixpkgs#packages.x86_64-linux.Hello")), "Hello");
+    ASSERT_EQ(getNameFromURL(parseURL("path:.#nonStandardAttr.mylaptop")), "mylaptop");
+    ASSERT_EQ(getNameFromURL(parseURL("path:./repos/myflake#nonStandardAttr.mylaptop")), "mylaptop");
+    ASSERT_EQ(
+        getNameFromURL(parseURL("path:./nixpkgs#packages.x86_64-linux.complex^bin,man", /*lenient=*/true)), "complex");
+    ASSERT_EQ(getNameFromURL(parseURL("path:./myproj#packages.x86_64-linux.default^*", /*lenient=*/true)), "myproj");
+    ASSERT_EQ(getNameFromURL(parseURL("path:./myproj#defaultPackage.x86_64-linux")), "myproj");
 
-        ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nixpkgs#packages.x86_64-linux.hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nixpkgs#hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nix#packages.x86_64-linux.default")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nix#")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nix")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("github:cachix/devenv/main#packages.x86_64-linux.default")), "devenv");
-        ASSERT_EQ(getNameFromURL(parseURL("github:edolstra/nix-warez?rev=1234&dir=blender&ref=master")), "blender");
+    ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nixpkgs#packages.x86_64-linux.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nixpkgs#hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nix#packages.x86_64-linux.default")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nix#")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("github:NixOS/nix")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("github:cachix/devenv/main#packages.x86_64-linux.default")), "devenv");
+    ASSERT_EQ(getNameFromURL(parseURL("github:edolstra/nix-warez?rev=1234&dir=blender&ref=master")), "blender");
 
-        ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nixpkgs#packages.x86_64-linux.hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nixpkgs#hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nix#packages.x86_64-linux.default")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nix#")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nix")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("gitlab:cachix/devenv/main#packages.x86_64-linux.default")), "devenv");
+    ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nixpkgs#packages.x86_64-linux.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nixpkgs#hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nix#packages.x86_64-linux.default")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nix#")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("gitlab:NixOS/nix")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("gitlab:cachix/devenv/main#packages.x86_64-linux.default")), "devenv");
 
-        ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nixpkgs#packages.x86_64-linux.hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nixpkgs#hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nix#packages.x86_64-linux.default")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nix#")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nix")), "nix");
-        ASSERT_EQ(getNameFromURL(parseURL("sourcehut:cachix/devenv/main#packages.x86_64-linux.default")), "devenv");
+    ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nixpkgs#packages.x86_64-linux.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nixpkgs#hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nix#packages.x86_64-linux.default")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nix#")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("sourcehut:NixOS/nix")), "nix");
+    ASSERT_EQ(getNameFromURL(parseURL("sourcehut:cachix/devenv/main#packages.x86_64-linux.default")), "devenv");
 
-        ASSERT_EQ(getNameFromURL(parseURL("git://github.com/edolstra/dwarffs")), "dwarffs");
-        ASSERT_EQ(getNameFromURL(parseURL("git://github.com/edolstra/nix-warez?dir=blender")), "blender");
-        ASSERT_EQ(getNameFromURL(parseURL("git+file:///home/user/project")), "project");
-        ASSERT_EQ(getNameFromURL(parseURL("git+file:///home/user/project?ref=fa1e2d23a22")), "project");
-        ASSERT_EQ(getNameFromURL(parseURL("git+ssh://git@github.com/someuser/my-repo#")), "my-repo");
-        ASSERT_EQ(getNameFromURL(parseURL("git+git://github.com/someuser/my-repo?rev=v1.2.3")), "my-repo");
-        ASSERT_EQ(getNameFromURL(parseURL("git+ssh:///home/user/project?dir=subproject&rev=v2.4")), "subproject");
-        ASSERT_EQ(getNameFromURL(parseURL("git+http://not-even-real#packages.x86_64-linux.hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("git+https://not-even-real#packages.aarch64-darwin.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("git://github.com/edolstra/dwarffs")), "dwarffs");
+    ASSERT_EQ(getNameFromURL(parseURL("git://github.com/edolstra/nix-warez?dir=blender")), "blender");
+    ASSERT_EQ(getNameFromURL(parseURL("git+file:///home/user/project")), "project");
+    ASSERT_EQ(getNameFromURL(parseURL("git+file:///home/user/project?ref=fa1e2d23a22")), "project");
+    ASSERT_EQ(getNameFromURL(parseURL("git+ssh://git@github.com/someuser/my-repo#")), "my-repo");
+    ASSERT_EQ(getNameFromURL(parseURL("git+git://github.com/someuser/my-repo?rev=v1.2.3")), "my-repo");
+    ASSERT_EQ(getNameFromURL(parseURL("git+ssh:///home/user/project?dir=subproject&rev=v2.4")), "subproject");
+    ASSERT_EQ(getNameFromURL(parseURL("git+http://not-even-real#packages.x86_64-linux.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("git+https://not-even-real#packages.aarch64-darwin.hello")), "hello");
 
-        ASSERT_EQ(getNameFromURL(parseURL("tarball+http://github.com/NixOS/nix/archive/refs/tags/2.18.1#packages.x86_64-linux.jq")), "jq");
-        ASSERT_EQ(getNameFromURL(parseURL("tarball+https://github.com/NixOS/nix/archive/refs/tags/2.18.1#packages.x86_64-linux.hg")), "hg");
-        ASSERT_EQ(getNameFromURL(parseURL("tarball+file:///home/user/Downloads/nixpkgs-2.18.1#packages.aarch64-darwin.ripgrep")), "ripgrep");
+    ASSERT_EQ(
+        getNameFromURL(
+            parseURL("tarball+http://github.com/NixOS/nix/archive/refs/tags/2.18.1#packages.x86_64-linux.jq")),
+        "jq");
+    ASSERT_EQ(
+        getNameFromURL(
+            parseURL("tarball+https://github.com/NixOS/nix/archive/refs/tags/2.18.1#packages.x86_64-linux.hg")),
+        "hg");
+    ASSERT_EQ(
+        getNameFromURL(parseURL("tarball+file:///home/user/Downloads/nixpkgs-2.18.1#packages.aarch64-darwin.ripgrep")),
+        "ripgrep");
 
-        ASSERT_EQ(getNameFromURL(parseURL("https://github.com/NixOS/nix/archive/refs/tags/2.18.1.tar.gz#packages.x86_64-linux.pv")), "pv");
-        ASSERT_EQ(getNameFromURL(parseURL("http://github.com/NixOS/nix/archive/refs/tags/2.18.1.tar.gz#packages.x86_64-linux.pv")), "pv");
+    ASSERT_EQ(
+        getNameFromURL(
+            parseURL("https://github.com/NixOS/nix/archive/refs/tags/2.18.1.tar.gz#packages.x86_64-linux.pv")),
+        "pv");
+    ASSERT_EQ(
+        getNameFromURL(
+            parseURL("http://github.com/NixOS/nix/archive/refs/tags/2.18.1.tar.gz#packages.x86_64-linux.pv")),
+        "pv");
 
-        ASSERT_EQ(getNameFromURL(parseURL("file:///home/user/project?ref=fa1e2d23a22")), "project");
-        ASSERT_EQ(getNameFromURL(parseURL("file+file:///home/user/project?ref=fa1e2d23a22")), "project");
-        ASSERT_EQ(getNameFromURL(parseURL("file+http://not-even-real#packages.x86_64-linux.hello")), "hello");
-        ASSERT_EQ(getNameFromURL(parseURL("file+http://gitfantasy.com/org/user/notaflake")), "notaflake");
-        ASSERT_EQ(getNameFromURL(parseURL("file+https://not-even-real#packages.aarch64-darwin.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("file:///home/user/project?ref=fa1e2d23a22")), "project");
+    ASSERT_EQ(getNameFromURL(parseURL("file+file:///home/user/project?ref=fa1e2d23a22")), "project");
+    ASSERT_EQ(getNameFromURL(parseURL("file+http://not-even-real#packages.x86_64-linux.hello")), "hello");
+    ASSERT_EQ(getNameFromURL(parseURL("file+http://gitfantasy.com/org/user/notaflake")), "notaflake");
+    ASSERT_EQ(getNameFromURL(parseURL("file+https://not-even-real#packages.aarch64-darwin.hello")), "hello");
 
-        ASSERT_EQ(getNameFromURL(parseURL("https://www.github.com/")), std::nullopt);
-        ASSERT_EQ(getNameFromURL(parseURL("path:.")), std::nullopt);
-        ASSERT_EQ(getNameFromURL(parseURL("file:.#")), std::nullopt);
-        ASSERT_EQ(getNameFromURL(parseURL("path:.#packages.x86_64-linux.default")), std::nullopt);
-        ASSERT_EQ(getNameFromURL(parseURL("path:.#packages.x86_64-linux.default^*")), std::nullopt);
-    }
+    ASSERT_EQ(getNameFromURL(parseURL("https://www.github.com/")), std::nullopt);
+    ASSERT_EQ(getNameFromURL(parseURL("path:.")), std::nullopt);
+    ASSERT_EQ(getNameFromURL(parseURL("file:.#")), std::nullopt);
+    ASSERT_EQ(getNameFromURL(parseURL("path:.#packages.x86_64-linux.default")), std::nullopt);
+    ASSERT_EQ(getNameFromURL(parseURL("path:.#packages.x86_64-linux.default^*", /*lenient=*/true)), std::nullopt);
 }
+} // namespace nix
diff --git a/src/libflake/config.cc b/src/libflake/config.cc
index 030104e7f..c9071f601 100644
--- a/src/libflake/config.cc
+++ b/src/libflake/config.cc
@@ -18,7 +18,8 @@ Path trustedListPath()
 static TrustedList readTrustedList()
 {
     auto path = trustedListPath();
-    if (!pathExists(path)) return {};
+    if (!pathExists(path))
+        return {};
     auto json = nlohmann::json::parse(readFile(path));
     return json;
 }
@@ -32,7 +33,13 @@ static void writeTrustedList(const TrustedList & trustedList)
 
 void ConfigFile::apply(const Settings & flakeSettings)
 {
-    StringSet whitelist{"bash-prompt", "bash-prompt-prefix", "bash-prompt-suffix", "flake-registry", "commit-lock-file-summary", "commit-lockfile-summary"};
+    StringSet whitelist{
+        "bash-prompt",
+        "bash-prompt-prefix",
+        "bash-prompt-suffix",
+        "flake-registry",
+        "commit-lock-file-summary",
+        "commit-lockfile-summary"};
 
     for (auto & [name, value] : settings) {
 
@@ -40,11 +47,11 @@ void ConfigFile::apply(const Settings & flakeSettings)
 
         // FIXME: Move into libutil/config.cc.
         std::string valueS;
-        if (auto* s = std::get_if<std::string>(&value))
+        if (auto * s = std::get_if<std::string>(&value))
             valueS = *s;
-        else if (auto* n = std::get_if<int64_t>(&value))
+        else if (auto * n = std::get_if<int64_t>(&value))
             valueS = fmt("%d", *n);
-        else if (auto* b = std::get_if<Explicit<bool>>(&value))
+        else if (auto * b = std::get_if<Explicit<bool>>(&value))
             valueS = b->t ? "true" : "false";
         else if (auto ss = std::get_if<std::vector<std::string>>(&value))
             valueS = dropEmptyInitThenConcatStringsSep(" ", *ss); // FIXME: evil
@@ -57,19 +64,35 @@ void ConfigFile::apply(const Settings & flakeSettings)
             auto tlname = get(trustedList, name);
             if (auto saved = tlname ? get(*tlname, valueS) : nullptr) {
                 trusted = *saved;
-                printInfo("Using saved setting for '%s = %s' from ~/.local/share/nix/trusted-settings.json.", name, valueS);
+                printInfo(
+                    "Using saved setting for '%s = %s' from ~/.local/share/nix/trusted-settings.json.", name, valueS);
             } else {
                 // FIXME: filter ANSI escapes, newlines, \r, etc.
-                if (std::tolower(logger->ask(fmt("do you want to allow configuration setting '%s' to be set to '" ANSI_RED "%s" ANSI_NORMAL "' (y/N)?", name, valueS)).value_or('n')) == 'y') {
+                if (std::tolower(logger
+                                     ->ask(
+                                         fmt("do you want to allow configuration setting '%s' to be set to '" ANSI_RED
+                                             "%s" ANSI_NORMAL "' (y/N)?",
+                                             name,
+                                             valueS))
+                                     .value_or('n'))
+                    == 'y') {
                     trusted = true;
                 }
-                if (std::tolower(logger->ask(fmt("do you want to permanently mark this value as %s (y/N)?",  trusted ? "trusted": "untrusted" )).value_or('n')) == 'y') {
+                if (std::tolower(logger
+                                     ->ask(
+                                         fmt("do you want to permanently mark this value as %s (y/N)?",
+                                             trusted ? "trusted" : "untrusted"))
+                                     .value_or('n'))
+                    == 'y') {
                     trustedList[name][valueS] = trusted;
                     writeTrustedList(trustedList);
                 }
             }
             if (!trusted) {
-                warn("ignoring untrusted flake configuration setting '%s'.\nPass '%s' to trust it", name, "--accept-flake-config");
+                warn(
+                    "ignoring untrusted flake configuration setting '%s'.\nPass '%s' to trust it",
+                    name,
+                    "--accept-flake-config");
                 continue;
             }
         }
@@ -78,4 +101,4 @@ void ConfigFile::apply(const Settings & flakeSettings)
     }
 }
 
-}
+} // namespace nix::flake
diff --git a/src/libflake/flake.cc b/src/libflake/flake.cc
index 322abaa4a..3acf589a5 100644
--- a/src/libflake/flake.cc
+++ b/src/libflake/flake.cc
@@ -25,10 +25,7 @@ using namespace flake;
 namespace flake {
 
 static StorePath copyInputToStore(
-    EvalState & state,
-    fetchers::Input & input,
-    const fetchers::Input & originalInput,
-    ref<SourceAccessor> accessor)
+    EvalState & state, fetchers::Input & input, const fetchers::Input & originalInput, ref<SourceAccessor> accessor)
 {
     auto storePath = fetchToStore(*input.settings, *state.store, accessor, FetchMode::Copy, input.getName());
 
@@ -48,13 +45,11 @@ static void forceTrivialValue(EvalState & state, Value & value, const PosIdx pos
         state.forceValue(value, pos);
 }
 
-static void expectType(EvalState & state, ValueType type,
-    Value & value, const PosIdx pos)
+static void expectType(EvalState & state, ValueType type, Value & value, const PosIdx pos)
 {
     forceTrivialValue(state, value, pos);
     if (value.type() != type)
-        throw Error("expected %s but got %s at %s",
-            showType(type), showType(value.type()), state.positions[pos]);
+        throw Error("expected %s but got %s at %s", showType(type), showType(value.type()), state.positions[pos]);
 }
 
 static std::pair<std::map<FlakeId, FlakeInput>, fetchers::Attrs> parseFlakeInputs(
@@ -65,38 +60,43 @@ static std::pair<std::map<FlakeId, FlakeInput>, fetchers::Attrs> parseFlakeInput
     const SourcePath & flakeDir,
     bool allowSelf);
 
-static void parseFlakeInputAttr(
-    EvalState & state,
-    const Attr & attr,
-    fetchers::Attrs & attrs)
+static void parseFlakeInputAttr(EvalState & state, const Attr & attr, fetchers::Attrs & attrs)
 {
-    // Allow selecting a subset of enum values
-    #pragma GCC diagnostic push
-    #pragma GCC diagnostic ignored "-Wswitch-enum"
+// Allow selecting a subset of enum values
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch-enum"
     switch (attr.value->type()) {
-        case nString:
-            attrs.emplace(state.symbols[attr.name], attr.value->c_str());
-            break;
-        case nBool:
-            attrs.emplace(state.symbols[attr.name], Explicit<bool> { attr.value->boolean() });
-            break;
-        case nInt: {
-            auto intValue = attr.value->integer().value;
-            if (intValue < 0)
-                state.error<EvalError>("negative value given for flake input attribute %1%: %2%", state.symbols[attr.name], intValue).debugThrow();
-            attrs.emplace(state.symbols[attr.name], uint64_t(intValue));
-            break;
-        }
-        default:
-            if (attr.name == state.symbols.create("publicKeys")) {
-                experimentalFeatureSettings.require(Xp::VerifiedFetches);
-                NixStringContext emptyContext = {};
-                attrs.emplace(state.symbols[attr.name], printValueAsJSON(state, true, *attr.value, attr.pos, emptyContext).dump());
-            } else
-                state.error<TypeError>("flake input attribute '%s' is %s while a string, Boolean, or integer is expected",
-                    state.symbols[attr.name], showType(*attr.value)).debugThrow();
+    case nString:
+        attrs.emplace(state.symbols[attr.name], attr.value->c_str());
+        break;
+    case nBool:
+        attrs.emplace(state.symbols[attr.name], Explicit<bool>{attr.value->boolean()});
+        break;
+    case nInt: {
+        auto intValue = attr.value->integer().value;
+        if (intValue < 0)
+            state
+                .error<EvalError>(
+                    "negative value given for flake input attribute %1%: %2%", state.symbols[attr.name], intValue)
+                .debugThrow();
+        attrs.emplace(state.symbols[attr.name], uint64_t(intValue));
+        break;
     }
-    #pragma GCC diagnostic pop
+    default:
+        if (attr.name == state.symbols.create("publicKeys")) {
+            experimentalFeatureSettings.require(Xp::VerifiedFetches);
+            NixStringContext emptyContext = {};
+            attrs.emplace(
+                state.symbols[attr.name], printValueAsJSON(state, true, *attr.value, attr.pos, emptyContext).dump());
+        } else
+            state
+                .error<TypeError>(
+                    "flake input attribute '%s' is %s while a string, Boolean, or integer is expected",
+                    state.symbols[attr.name],
+                    showType(*attr.value))
+                .debugThrow();
+    }
+#pragma GCC diagnostic pop
 }
 
 static FlakeInput parseFlakeInput(
@@ -127,19 +127,24 @@ static FlakeInput parseFlakeInput(
                 else if (attr.value->type() == nPath) {
                     auto path = attr.value->path();
                     if (path.accessor != flakeDir.accessor)
-                        throw Error("input attribute path '%s' at %s must be in the same source tree as %s",
-                            path, state.positions[attr.pos], flakeDir);
+                        throw Error(
+                            "input attribute path '%s' at %s must be in the same source tree as %s",
+                            path,
+                            state.positions[attr.pos],
+                            flakeDir);
                     url = "path:" + flakeDir.path.makeRelative(path.path);
-                }
-                else
-                    throw Error("expected a string or a path but got %s at %s",
-                        showType(attr.value->type()), state.positions[attr.pos]);
+                } else
+                    throw Error(
+                        "expected a string or a path but got %s at %s",
+                        showType(attr.value->type()),
+                        state.positions[attr.pos]);
                 attrs.emplace("url", *url);
             } else if (attr.name == sFlake) {
                 expectType(state, nBool, *attr.value, attr.pos);
                 input.isFlake = attr.value->boolean();
             } else if (attr.name == sInputs) {
-                input.overrides = parseFlakeInputs(state, attr.value, attr.pos, lockRootAttrPath, flakeDir, false).first;
+                input.overrides =
+                    parseFlakeInputs(state, attr.value, attr.pos, lockRootAttrPath, flakeDir, false).first;
             } else if (attr.name == sFollows) {
                 expectType(state, nString, *attr.value, attr.pos);
                 auto follows(parseInputAttrPath(attr.value->c_str()));
@@ -149,8 +154,7 @@ static FlakeInput parseFlakeInput(
                 parseFlakeInputAttr(state, attr, attrs);
         } catch (Error & e) {
             e.addTrace(
-                state.positions[attr.pos],
-                HintFmt("while evaluating flake attribute '%s'", state.symbols[attr.name]));
+                state.positions[attr.pos], HintFmt("while evaluating flake attribute '%s'", state.symbols[attr.name]));
             throw;
         }
     }
@@ -198,12 +202,8 @@ static std::pair<std::map<FlakeId, FlakeInput>, fetchers::Attrs> parseFlakeInput
             for (auto & attr : *inputAttr.value->attrs())
                 parseFlakeInputAttr(state, attr, selfAttrs);
         } else {
-            inputs.emplace(inputName,
-                parseFlakeInput(state,
-                    inputAttr.value,
-                    inputAttr.pos,
-                    lockRootAttrPath,
-                    flakeDir));
+            inputs.emplace(
+                inputName, parseFlakeInput(state, inputAttr.value, inputAttr.pos, lockRootAttrPath, flakeDir));
         }
     }
 
@@ -225,14 +225,14 @@ static Flake readFlake(
     Value vInfo;
     state.evalFile(flakePath, vInfo, true);
 
-    Flake flake {
+    Flake flake{
         .originalRef = originalRef,
         .resolvedRef = resolvedRef,
         .lockedRef = lockedRef,
         .path = flakePath,
     };
 
-    if (auto description = vInfo.attrs()->get(state.sDescription)) {
+    if (auto description = vInfo.attrs()->get(state.s.description)) {
         expectType(state, nString, *description->value, description->pos);
         flake.description = description->value->c_str();
     }
@@ -240,7 +240,8 @@ static Flake readFlake(
     auto sInputs = state.symbols.create("inputs");
 
     if (auto inputs = vInfo.attrs()->get(sInputs)) {
-        auto [flakeInputs, selfAttrs] = parseFlakeInputs(state, inputs->value, inputs->pos, lockRootAttrPath, flakeDir, true);
+        auto [flakeInputs, selfAttrs] =
+            parseFlakeInputs(state, inputs->value, inputs->pos, lockRootAttrPath, flakeDir, true);
         flake.inputs = std::move(flakeInputs);
         flake.selfAttrs = std::move(selfAttrs);
     }
@@ -252,10 +253,10 @@ static Flake readFlake(
 
         if (outputs->value->isLambda() && outputs->value->lambda().fun->hasFormals()) {
             for (auto & formal : outputs->value->lambda().fun->formals->formals) {
-                if (formal.name != state.sSelf)
-                    flake.inputs.emplace(state.symbols[formal.name], FlakeInput {
-                        .ref = parseFlakeRef(state.fetchSettings, std::string(state.symbols[formal.name]))
-                    });
+                if (formal.name != state.s.self)
+                    flake.inputs.emplace(
+                        state.symbols[formal.name],
+                        FlakeInput{.ref = parseFlakeRef(state.fetchSettings, std::string(state.symbols[formal.name]))});
             }
         }
 
@@ -271,53 +272,52 @@ static Flake readFlake(
             forceTrivialValue(state, *setting.value, setting.pos);
             if (setting.value->type() == nString)
                 flake.config.settings.emplace(
-                    state.symbols[setting.name],
-                    std::string(state.forceStringNoCtx(*setting.value, setting.pos, "")));
+                    state.symbols[setting.name], std::string(state.forceStringNoCtx(*setting.value, setting.pos, "")));
             else if (setting.value->type() == nPath) {
-                auto storePath = fetchToStore(state.fetchSettings, *state.store, setting.value->path(), FetchMode::Copy);
+                auto storePath =
+                    fetchToStore(state.fetchSettings, *state.store, setting.value->path(), FetchMode::Copy);
+                flake.config.settings.emplace(state.symbols[setting.name], state.store->printStorePath(storePath));
+            } else if (setting.value->type() == nInt)
                 flake.config.settings.emplace(
-                    state.symbols[setting.name],
-                    state.store->printStorePath(storePath));
-            }
-            else if (setting.value->type() == nInt)
-                flake.config.settings.emplace(
-                    state.symbols[setting.name],
-                    state.forceInt(*setting.value, setting.pos, "").value);
+                    state.symbols[setting.name], state.forceInt(*setting.value, setting.pos, "").value);
             else if (setting.value->type() == nBool)
                 flake.config.settings.emplace(
-                    state.symbols[setting.name],
-                    Explicit<bool> { state.forceBool(*setting.value, setting.pos, "") });
+                    state.symbols[setting.name], Explicit<bool>{state.forceBool(*setting.value, setting.pos, "")});
             else if (setting.value->type() == nList) {
                 std::vector<std::string> ss;
                 for (auto elem : setting.value->listView()) {
                     if (elem->type() != nString)
-                        state.error<TypeError>("list element in flake configuration setting '%s' is %s while a string is expected",
-                            state.symbols[setting.name], showType(*setting.value)).debugThrow();
+                        state
+                            .error<TypeError>(
+                                "list element in flake configuration setting '%s' is %s while a string is expected",
+                                state.symbols[setting.name],
+                                showType(*setting.value))
+                            .debugThrow();
                     ss.emplace_back(state.forceStringNoCtx(*elem, setting.pos, ""));
                 }
                 flake.config.settings.emplace(state.symbols[setting.name], ss);
-            }
-            else
-                state.error<TypeError>("flake configuration setting '%s' is %s",
-                    state.symbols[setting.name], showType(*setting.value)).debugThrow();
+            } else
+                state
+                    .error<TypeError>(
+                        "flake configuration setting '%s' is %s", state.symbols[setting.name], showType(*setting.value))
+                    .debugThrow();
         }
     }
 
     for (auto & attr : *vInfo.attrs()) {
-        if (attr.name != state.sDescription &&
-            attr.name != sInputs &&
-            attr.name != sOutputs &&
-            attr.name != sNixConfig)
-            throw Error("flake '%s' has an unsupported attribute '%s', at %s",
-                resolvedRef, state.symbols[attr.name], state.positions[attr.pos]);
+        if (attr.name != state.s.description && attr.name != sInputs && attr.name != sOutputs
+            && attr.name != sNixConfig)
+            throw Error(
+                "flake '%s' has an unsupported attribute '%s', at %s",
+                resolvedRef,
+                state.symbols[attr.name],
+                state.positions[attr.pos]);
     }
 
     return flake;
 }
 
-static FlakeRef applySelfAttrs(
-    const FlakeRef & ref,
-    const Flake & flake)
+static FlakeRef applySelfAttrs(const FlakeRef & ref, const Flake & flake)
 {
     auto newRef(ref);
 
@@ -341,8 +341,9 @@ static Flake getFlake(
     // Fetch a lazy tree first.
     auto cachedInput = state.inputCache->getAccessor(state.store, originalRef.input, useRegistries);
 
-    auto resolvedRef = FlakeRef(std::move(cachedInput.resolvedInput), originalRef.subdir);
-    auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), originalRef.subdir);
+    auto subdir = fetchers::maybeGetStrAttr(cachedInput.extraAttrs, "dir").value_or(originalRef.subdir);
+    auto resolvedRef = FlakeRef(std::move(cachedInput.resolvedInput), subdir);
+    auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), subdir);
 
     // Parse/eval flake.nix to get at the input.self attributes.
     auto flake = readFlake(state, originalRef, resolvedRef, lockedRef, {cachedInput.accessor}, lockRootAttrPath);
@@ -371,22 +372,16 @@ Flake getFlake(EvalState & state, const FlakeRef & originalRef, fetchers::UseReg
     return getFlake(state, originalRef, useRegistries, {});
 }
 
-static LockFile readLockFile(
-    const fetchers::Settings & fetchSettings,
-    const SourcePath & lockFilePath)
+static LockFile readLockFile(const fetchers::Settings & fetchSettings, const SourcePath & lockFilePath)
 {
-    return lockFilePath.pathExists()
-        ? LockFile(fetchSettings, lockFilePath.readFile(), fmt("%s", lockFilePath))
-        : LockFile();
+    return lockFilePath.pathExists() ? LockFile(fetchSettings, lockFilePath.readFile(), fmt("%s", lockFilePath))
+                                     : LockFile();
 }
 
 /* Compute an in-memory lock file for the specified top-level flake,
    and optionally write it to file, if the flake is writable. */
-LockedFlake lockFlake(
-    const Settings & settings,
-    EvalState & state,
-    const FlakeRef & topRef,
-    const LockFlags & lockFlags)
+LockedFlake
+lockFlake(const Settings & settings, EvalState & state, const FlakeRef & topRef, const LockFlags & lockFlags)
 {
     experimentalFeatureSettings.require(Xp::Flakes);
 
@@ -394,11 +389,7 @@ LockedFlake lockFlake(
     auto useRegistriesTop = useRegistries ? fetchers::UseRegistries::All : fetchers::UseRegistries::No;
     auto useRegistriesInputs = useRegistries ? fetchers::UseRegistries::Limited : fetchers::UseRegistries::No;
 
-    auto flake = getFlake(
-        state,
-        topRef,
-        useRegistriesTop,
-        {});
+    auto flake = getFlake(state, topRef, useRegistriesTop, {});
 
     if (lockFlags.applyNixConfig) {
         flake.config.apply(settings);
@@ -410,10 +401,8 @@ LockedFlake lockFlake(
             throw Error("reference lock file was provided, but the `allow-dirty` setting is set to false");
         }
 
-        auto oldLockFile = readLockFile(
-            state.fetchSettings,
-            lockFlags.referenceLockFilePath.value_or(
-                flake.lockFilePath()));
+        auto oldLockFile =
+            readLockFile(state.fetchSettings, lockFlags.referenceLockFilePath.value_or(flake.lockFilePath()));
 
         debug("old lock file: %s", oldLockFile);
 
@@ -432,8 +421,8 @@ LockedFlake lockFlake(
         for (auto & i : lockFlags.inputOverrides) {
             overrides.emplace(
                 i.first,
-                OverrideTarget {
-                    .input = FlakeInput { .ref = i.second },
+                OverrideTarget{
+                    .input = FlakeInput{.ref = i.second},
                     /* Note: any relative overrides
                        (e.g. `--override-input B/C "path:./foo/bar"`)
                        are interpreted relative to the top-level
@@ -458,42 +447,40 @@ LockedFlake lockFlake(
             computeLocks;
 
         computeLocks = [&](
-            /* The inputs of this node, either from flake.nix or
-               flake.lock. */
-            const FlakeInputs & flakeInputs,
-            /* The node whose locks are to be updated.*/
-            ref<Node> node,
-            /* The path to this node in the lock file graph. */
-            const InputAttrPath & inputAttrPathPrefix,
-            /* The old node, if any, from which locks can be
-               copied. */
-            std::shared_ptr<const Node> oldNode,
-            /* The prefix relative to which 'follows' should be
-               interpreted. When a node is initially locked, it's
-               relative to the node's flake; when it's already locked,
-               it's relative to the root of the lock file. */
-            const InputAttrPath & followsPrefix,
-            /* The source path of this node's flake. */
-            const SourcePath & sourcePath,
-            bool trustLock)
-        {
+                           /* The inputs of this node, either from flake.nix or
+                              flake.lock. */
+                           const FlakeInputs & flakeInputs,
+                           /* The node whose locks are to be updated.*/
+                           ref<Node> node,
+                           /* The path to this node in the lock file graph. */
+                           const InputAttrPath & inputAttrPathPrefix,
+                           /* The old node, if any, from which locks can be
+                              copied. */
+                           std::shared_ptr<const Node> oldNode,
+                           /* The prefix relative to which 'follows' should be
+                              interpreted. When a node is initially locked, it's
+                              relative to the node's flake; when it's already locked,
+                              it's relative to the root of the lock file. */
+                           const InputAttrPath & followsPrefix,
+                           /* The source path of this node's flake. */
+                           const SourcePath & sourcePath,
+                           bool trustLock) {
             debug("computing lock file node '%s'", printInputAttrPath(inputAttrPathPrefix));
 
             /* Get the overrides (i.e. attributes of the form
                'inputs.nixops.inputs.nixpkgs.url = ...'). */
             std::function<void(const FlakeInput & input, const InputAttrPath & prefix)> addOverrides;
-            addOverrides = [&](const FlakeInput & input, const InputAttrPath & prefix)
-            {
+            addOverrides = [&](const FlakeInput & input, const InputAttrPath & prefix) {
                 for (auto & [idOverride, inputOverride] : input.overrides) {
                     auto inputAttrPath(prefix);
                     inputAttrPath.push_back(idOverride);
                     if (inputOverride.ref || inputOverride.follows)
-                        overrides.emplace(inputAttrPath,
-                            OverrideTarget {
+                        overrides.emplace(
+                            inputAttrPath,
+                            OverrideTarget{
                                 .input = inputOverride,
                                 .sourcePath = sourcePath,
-                                .parentInputAttrPath = inputAttrPathPrefix
-                            });
+                                .parentInputAttrPath = inputAttrPathPrefix});
                     addOverrides(inputOverride, inputAttrPath);
                 }
             };
@@ -513,7 +500,8 @@ LockedFlake lockFlake(
                 if (inputAttrPath2 == inputAttrPathPrefix && !flakeInputs.count(follow))
                     warn(
                         "input '%s' has an override for a non-existent input '%s'",
-                        printInputAttrPath(inputAttrPathPrefix), follow);
+                        printInputAttrPath(inputAttrPathPrefix),
+                        follow);
             }
 
             /* Go over the flake inputs, resolve/fetch them if
@@ -558,36 +546,31 @@ LockedFlake lockFlake(
                     }
 
                     if (!input.ref)
-                        input.ref = FlakeRef::fromAttrs(state.fetchSettings, {{"type", "indirect"}, {"id", std::string(id)}});
+                        input.ref =
+                            FlakeRef::fromAttrs(state.fetchSettings, {{"type", "indirect"}, {"id", std::string(id)}});
 
                     auto overriddenParentPath =
                         input.ref->input.isRelative()
-                        ? std::optional<InputAttrPath>(hasOverride ? i->second.parentInputAttrPath : inputAttrPathPrefix)
-                        : std::nullopt;
+                            ? std::optional<InputAttrPath>(
+                                  hasOverride ? i->second.parentInputAttrPath : inputAttrPathPrefix)
+                            : std::nullopt;
 
-                    auto resolveRelativePath = [&]() -> std::optional<SourcePath>
-                    {
+                    auto resolveRelativePath = [&]() -> std::optional<SourcePath> {
                         if (auto relativePath = input.ref->input.isRelative()) {
-                            return SourcePath {
+                            return SourcePath{
                                 overriddenSourcePath.accessor,
-                                CanonPath(*relativePath, overriddenSourcePath.path.parent().value())
-                            };
+                                CanonPath(*relativePath, overriddenSourcePath.path.parent().value())};
                         } else
                             return std::nullopt;
                     };
 
                     /* Get the input flake, resolve 'path:./...'
                        flakerefs relative to the parent flake. */
-                    auto getInputFlake = [&](const FlakeRef & ref, const fetchers::UseRegistries useRegistries)
-                    {
+                    auto getInputFlake = [&](const FlakeRef & ref, const fetchers::UseRegistries useRegistries) {
                         if (auto resolvedPath = resolveRelativePath()) {
                             return readFlake(state, ref, ref, ref, *resolvedPath, inputAttrPath);
                         } else {
-                            return getFlake(
-                                state,
-                                ref,
-                                useRegistries,
-                                inputAttrPath);
+                            return getFlake(state, ref, useRegistries, inputAttrPath);
                         }
                     };
 
@@ -602,21 +585,15 @@ LockedFlake lockFlake(
                             if (auto oldLock3 = std::get_if<0>(&*oldLock2))
                                 oldLock = *oldLock3;
 
-                    if (oldLock
-                        && oldLock->originalRef.canonicalize() == input.ref->canonicalize()
-                        && oldLock->parentInputAttrPath == overriddenParentPath
-                        && !hasCliOverride)
-                    {
+                    if (oldLock && oldLock->originalRef.canonicalize() == input.ref->canonicalize()
+                        && oldLock->parentInputAttrPath == overriddenParentPath && !hasCliOverride) {
                         debug("keeping existing input '%s'", inputAttrPathS);
 
                         /* Copy the input from the old lock since its flakeref
                            didn't change and there is no override from a
                            higher level flake. */
                         auto childNode = make_ref<LockedNode>(
-                            oldLock->lockedRef,
-                            oldLock->originalRef,
-                            oldLock->isFlake,
-                            oldLock->parentInputAttrPath);
+                            oldLock->lockedRef, oldLock->originalRef, oldLock->isFlake, oldLock->parentInputAttrPath);
 
                         node->inputs.insert_or_assign(id, childNode);
 
@@ -624,10 +601,8 @@ LockedFlake lockFlake(
                            must fetch the flake to update it. */
                         auto lb = lockFlags.inputUpdates.lower_bound(inputAttrPath);
 
-                        auto mustRefetch =
-                            lb != lockFlags.inputUpdates.end()
-                            && lb->size() > inputAttrPath.size()
-                            && std::equal(inputAttrPath.begin(), inputAttrPath.end(), lb->begin());
+                        auto mustRefetch = lb != lockFlags.inputUpdates.end() && lb->size() > inputAttrPath.size()
+                                           && std::equal(inputAttrPath.begin(), inputAttrPath.end(), lb->begin());
 
                         FlakeInputs fakeInputs;
 
@@ -638,14 +613,17 @@ LockedFlake lockFlake(
                                those. */
                             for (auto & i : oldLock->inputs) {
                                 if (auto lockedNode = std::get_if<0>(&i.second)) {
-                                    fakeInputs.emplace(i.first, FlakeInput {
-                                        .ref = (*lockedNode)->originalRef,
-                                        .isFlake = (*lockedNode)->isFlake,
-                                    });
+                                    fakeInputs.emplace(
+                                        i.first,
+                                        FlakeInput{
+                                            .ref = (*lockedNode)->originalRef,
+                                            .isFlake = (*lockedNode)->isFlake,
+                                        });
                                 } else if (auto follows = std::get_if<1>(&i.second)) {
                                     if (!trustLock) {
                                         // It is possible that the flake has changed,
-                                        // so we must confirm all the follows that are in the lock file are also in the flake.
+                                        // so we must confirm all the follows that are in the lock file are also in the
+                                        // flake.
                                         auto overridePath(inputAttrPath);
                                         overridePath.push_back(i.first);
                                         auto o = overrides.find(overridePath);
@@ -660,9 +638,11 @@ LockedFlake lockFlake(
                                     }
                                     auto absoluteFollows(followsPrefix);
                                     absoluteFollows.insert(absoluteFollows.end(), follows->begin(), follows->end());
-                                    fakeInputs.emplace(i.first, FlakeInput {
-                                        .follows = absoluteFollows,
-                                    });
+                                    fakeInputs.emplace(
+                                        i.first,
+                                        FlakeInput{
+                                            .follows = absoluteFollows,
+                                        });
                                 }
                             }
                         }
@@ -670,10 +650,17 @@ LockedFlake lockFlake(
                         if (mustRefetch) {
                             auto inputFlake = getInputFlake(oldLock->lockedRef, useRegistriesInputs);
                             nodePaths.emplace(childNode, inputFlake.path.parent());
-                            computeLocks(inputFlake.inputs, childNode, inputAttrPath, oldLock, followsPrefix,
-                                inputFlake.path, false);
+                            computeLocks(
+                                inputFlake.inputs,
+                                childNode,
+                                inputAttrPath,
+                                oldLock,
+                                followsPrefix,
+                                inputFlake.path,
+                                false);
                         } else {
-                            computeLocks(fakeInputs, childNode, inputAttrPath, oldLock, followsPrefix, sourcePath, true);
+                            computeLocks(
+                                fakeInputs, childNode, inputAttrPath, oldLock, followsPrefix, sourcePath, true);
                         }
 
                     } else {
@@ -681,9 +668,7 @@ LockedFlake lockFlake(
                            this input. */
                         debug("creating new input '%s'", inputAttrPathS);
 
-                        if (!lockFlags.allowUnlocked
-                            && !input.ref->input.isLocked()
-                            && !input.ref->input.isRelative())
+                        if (!lockFlags.allowUnlocked && !input.ref->input.isLocked() && !input.ref->input.isRelative())
                             throw Error("cannot update unlocked flake input '%s' in pure mode", inputAttrPathS);
 
                         /* Note: in case of an --override-input, we use
@@ -697,13 +682,11 @@ LockedFlake lockFlake(
                         auto ref = (input2.ref && inputIsOverride) ? *input2.ref : *input.ref;
 
                         if (input.isFlake) {
-                            auto inputFlake = getInputFlake(*input.ref, inputIsOverride ? fetchers::UseRegistries::All : useRegistriesInputs);
+                            auto inputFlake = getInputFlake(
+                                *input.ref, inputIsOverride ? fetchers::UseRegistries::All : useRegistriesInputs);
 
-                            auto childNode = make_ref<LockedNode>(
-                                inputFlake.lockedRef,
-                                ref,
-                                true,
-                                overriddenParentPath);
+                            auto childNode =
+                                make_ref<LockedNode>(inputFlake.lockedRef, ref, true, overriddenParentPath);
 
                             node->inputs.insert_or_assign(id, childNode);
 
@@ -715,36 +698,32 @@ LockedFlake lockFlake(
                             Finally cleanup([&]() { parents.pop_back(); });
 
                             /* Recursively process the inputs of this
-                               flake. Also, unless we already have this flake
-                               in the top-level lock file, use this flake's
-                               own lock file. */
+                               flake, using its own lock file. */
                             nodePaths.emplace(childNode, inputFlake.path.parent());
                             computeLocks(
-                                inputFlake.inputs, childNode, inputAttrPath,
-                                oldLock
-                                ? std::dynamic_pointer_cast<const Node>(oldLock)
-                                : readLockFile(state.fetchSettings, inputFlake.lockFilePath()).root.get_ptr(),
-                                oldLock ? followsPrefix : inputAttrPath,
+                                inputFlake.inputs,
+                                childNode,
+                                inputAttrPath,
+                                readLockFile(state.fetchSettings, inputFlake.lockFilePath()).root.get_ptr(),
+                                inputAttrPath,
                                 inputFlake.path,
                                 false);
                         }
 
                         else {
-                            auto [path, lockedRef] = [&]() -> std::tuple<SourcePath, FlakeRef>
-                            {
+                            auto [path, lockedRef] = [&]() -> std::tuple<SourcePath, FlakeRef> {
                                 // Handle non-flake 'path:./...' inputs.
                                 if (auto resolvedPath = resolveRelativePath()) {
                                     return {*resolvedPath, *input.ref};
                                 } else {
                                     auto cachedInput = state.inputCache->getAccessor(
-                                        state.store,
-                                        input.ref->input,
-                                        useRegistriesInputs);
+                                        state.store, input.ref->input, useRegistriesInputs);
 
                                     auto lockedRef = FlakeRef(std::move(cachedInput.lockedInput), input.ref->subdir);
 
                                     // FIXME: allow input to be lazy.
-                                    auto storePath = copyInputToStore(state, lockedRef.input, input.ref->input, cachedInput.accessor);
+                                    auto storePath = copyInputToStore(
+                                        state, lockedRef.input, input.ref->input, cachedInput.accessor);
 
                                     return {state.storePath(storePath), lockedRef};
                                 }
@@ -778,8 +757,10 @@ LockedFlake lockFlake(
 
         for (auto & i : lockFlags.inputOverrides)
             if (!overridesUsed.count(i.first))
-                warn("the flag '--override-input %s %s' does not match any input",
-                    printInputAttrPath(i.first), i.second);
+                warn(
+                    "the flag '--override-input %s %s' does not match any input",
+                    printInputAttrPath(i.first),
+                    i.second);
 
         for (auto & i : lockFlags.inputUpdates)
             if (!updatesUsed.count(i))
@@ -803,12 +784,19 @@ LockedFlake lockFlake(
                         if (lockFlags.failOnUnlocked)
                             throw Error(
                                 "Not writing lock file of flake '%s' because it has an unlocked input ('%s'). "
-                                "Use '--allow-dirty-locks' to allow this anyway.", topRef, *unlockedInput);
+                                "Use '--allow-dirty-locks' to allow this anyway.",
+                                topRef,
+                                *unlockedInput);
                         if (state.fetchSettings.warnDirty)
-                            warn("not writing lock file of flake '%s' because it has an unlocked input ('%s')", topRef, *unlockedInput);
+                            warn(
+                                "not writing lock file of flake '%s' because it has an unlocked input ('%s')",
+                                topRef,
+                                *unlockedInput);
                     } else {
                         if (!lockFlags.updateLockFile)
-                            throw Error("flake '%s' requires lock file changes but they're not allowed due to '--no-update-lock-file'", topRef);
+                            throw Error(
+                                "flake '%s' requires lock file changes but they're not allowed due to '--no-update-lock-file'",
+                                topRef);
 
                         auto newLockFileS = fmt("%s\n", newLockFile);
 
@@ -849,36 +837,31 @@ LockedFlake lockFlake(
 
                             topRef.input.putFile(
                                 CanonPath((topRef.subdir == "" ? "" : topRef.subdir + "/") + "flake.lock"),
-                                newLockFileS, commitMessage);
+                                newLockFileS,
+                                commitMessage);
                         }
 
                         /* Rewriting the lockfile changed the top-level
                            repo, so we should re-read it. FIXME: we could
                            also just clear the 'rev' field... */
                         auto prevLockedRef = flake.lockedRef;
-                        flake = getFlake(
-                            state,
-                            topRef,
-                            useRegistriesTop);
+                        flake = getFlake(state, topRef, useRegistriesTop);
 
-                        if (lockFlags.commitLockFile &&
-                            flake.lockedRef.input.getRev() &&
-                            prevLockedRef.input.getRev() != flake.lockedRef.input.getRev())
+                        if (lockFlags.commitLockFile && flake.lockedRef.input.getRev()
+                            && prevLockedRef.input.getRev() != flake.lockedRef.input.getRev())
                             warn("committed new revision '%s'", flake.lockedRef.input.getRev()->gitRev());
                     }
                 } else
-                    throw Error("cannot write modified lock file of flake '%s' (use '--no-write-lock-file' to ignore)", topRef);
+                    throw Error(
+                        "cannot write modified lock file of flake '%s' (use '--no-write-lock-file' to ignore)", topRef);
             } else {
                 warn("not writing modified lock file of flake '%s':\n%s", topRef, chomp(diff));
                 flake.forceDirty = true;
             }
         }
 
-        return LockedFlake {
-            .flake = std::move(flake),
-            .lockFile = std::move(newLockFile),
-            .nodePaths = std::move(nodePaths)
-        };
+        return LockedFlake{
+            .flake = std::move(flake), .lockFile = std::move(newLockFile), .nodePaths = std::move(nodePaths)};
 
     } catch (Error & e) {
         e.addTrace({}, "while updating the lock file of flake '%s'", flake.lockedRef.to_string());
@@ -886,28 +869,28 @@ LockedFlake lockFlake(
     }
 }
 
-static ref<SourceAccessor> makeInternalFS() {
-    auto internalFS = make_ref<MemorySourceAccessor>(MemorySourceAccessor {});
+static ref<SourceAccessor> makeInternalFS()
+{
+    auto internalFS = make_ref<MemorySourceAccessor>(MemorySourceAccessor{});
     internalFS->setPathDisplay("«flakes-internal»", "");
     internalFS->addFile(
         CanonPath("call-flake.nix"),
-        #include "call-flake.nix.gen.hh"
+#include "call-flake.nix.gen.hh"
     );
     return internalFS;
 }
 
 static auto internalFS = makeInternalFS();
 
-static Value * requireInternalFile(EvalState & state, CanonPath path) {
-    SourcePath p {internalFS, path};
+static Value * requireInternalFile(EvalState & state, CanonPath path)
+{
+    SourcePath p{internalFS, path};
     auto v = state.allocValue();
     state.evalFile(p, *v); // has caching
     return v;
 }
 
-void callFlake(EvalState & state,
-    const LockedFlake & lockedFlake,
-    Value & vRes)
+void callFlake(EvalState & state, const LockedFlake & lockedFlake, Value & vRes)
 {
     experimentalFeatureSettings.require(Xp::Flakes);
 
@@ -935,9 +918,7 @@ void callFlake(EvalState & state,
         auto key = keyMap.find(node);
         assert(key != keyMap.end());
 
-        override
-            .alloc(state.symbols.create("dir"))
-            .mkString(CanonPath(subdir).rel());
+        override.alloc(state.symbols.create("dir")).mkString(CanonPath(subdir).rel());
 
         overrides.alloc(state.symbols.create(key->second)).mkAttrs(override);
     }
@@ -956,16 +937,16 @@ void callFlake(EvalState & state,
     state.callFunction(*vCallFlake, args, vRes, noPos);
 }
 
-}
+} // namespace flake
 
-std::optional<Fingerprint> LockedFlake::getFingerprint(
-    ref<Store> store,
-    const fetchers::Settings & fetchSettings) const
+std::optional<Fingerprint> LockedFlake::getFingerprint(ref<Store> store, const fetchers::Settings & fetchSettings) const
 {
-    if (lockFile.isUnlocked(fetchSettings)) return std::nullopt;
+    if (lockFile.isUnlocked(fetchSettings))
+        return std::nullopt;
 
     auto fingerprint = flake.lockedRef.input.getFingerprint(store);
-    if (!fingerprint) return std::nullopt;
+    if (!fingerprint)
+        return std::nullopt;
 
     *fingerprint += fmt(";%s;%s", flake.lockedRef.subdir, lockFile);
 
@@ -983,6 +964,6 @@ std::optional<Fingerprint> LockedFlake::getFingerprint(
     return hashString(HashAlgorithm::SHA256, *fingerprint);
 }
 
-Flake::~Flake() { }
+Flake::~Flake() {}
 
-}
+} // namespace nix
diff --git a/src/libflake/flakeref.cc b/src/libflake/flakeref.cc
index 37b7eff4c..38979783d 100644
--- a/src/libflake/flakeref.cc
+++ b/src/libflake/flakeref.cc
@@ -29,15 +29,13 @@ fetchers::Attrs FlakeRef::toAttrs() const
     return attrs;
 }
 
-std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef)
+std::ostream & operator<<(std::ostream & str, const FlakeRef & flakeRef)
 {
     str << flakeRef.to_string();
     return str;
 }
 
-FlakeRef FlakeRef::resolve(
-    ref<Store> store,
-    fetchers::UseRegistries useRegistries) const
+FlakeRef FlakeRef::resolve(ref<Store> store, fetchers::UseRegistries useRegistries) const
 {
     auto [input2, extraAttrs] = lookupInRegistries(store, input, useRegistries);
     return FlakeRef(std::move(input2), fetchers::maybeGetStrAttr(extraAttrs, "dir").value_or(subdir));
@@ -51,16 +49,15 @@ FlakeRef parseFlakeRef(
     bool isFlake,
     bool preserveRelativePaths)
 {
-    auto [flakeRef, fragment] = parseFlakeRefWithFragment(fetchSettings, url, baseDir, allowMissing, isFlake, preserveRelativePaths);
+    auto [flakeRef, fragment] =
+        parseFlakeRefWithFragment(fetchSettings, url, baseDir, allowMissing, isFlake, preserveRelativePaths);
     if (fragment != "")
         throw Error("unexpected fragment '%s' in flake reference '%s'", fragment, url);
     return flakeRef;
 }
 
-static std::pair<FlakeRef, std::string> fromParsedURL(
-    const fetchers::Settings & fetchSettings,
-    ParsedURL && parsedURL,
-    bool isFlake)
+static std::pair<FlakeRef, std::string>
+fromParsedURL(const fetchers::Settings & fetchSettings, ParsedURL && parsedURL, bool isFlake)
 {
     auto dir = getOr(parsedURL.query, "dir", "");
     parsedURL.query.erase("dir");
@@ -79,15 +76,13 @@ std::pair<FlakeRef, std::string> parsePathFlakeRefWithFragment(
     bool isFlake,
     bool preserveRelativePaths)
 {
-    static std::regex pathFlakeRegex(
-        R"(([^?#]*)(\?([^#]*))?(#(.*))?)",
-        std::regex::ECMAScript);
+    static std::regex pathFlakeRegex(R"(([^?#]*)(\?([^#]*))?(#(.*))?)", std::regex::ECMAScript);
 
     std::smatch match;
     auto succeeds = std::regex_match(url, match, pathFlakeRegex);
     assert(succeeds);
     auto path = match[1].str();
-    auto query = decodeQuery(match[3]);
+    auto query = decodeQuery(match[3].str(), /*lenient=*/true);
     auto fragment = percentDecode(match[5].str());
 
     if (baseDir) {
@@ -104,16 +99,17 @@ std::pair<FlakeRef, std::string> parsePathFlakeRefWithFragment(
                     // Be gentle with people who accidentally write `/foo/bar/flake.nix` instead of `/foo/bar`
                     warn(
                         "Path '%s' should point at the directory containing the 'flake.nix' file, not the file itself. "
-                        "Pretending that you meant '%s'"
-                        , path, dirOf(path));
+                        "Pretending that you meant '%s'",
+                        path,
+                        dirOf(path));
                     path = dirOf(path);
                 } else {
                     throw BadURL("path '%s' is not a flake (because it's not a directory)", path);
                 }
             }
 
-            if (!allowMissing && !pathExists(path + "/flake.nix")){
-                notice("path '%s' does not contain a 'flake.nix', searching up",path);
+            if (!allowMissing && !pathExists(path + "/flake.nix")) {
+                notice("path '%s' does not contain a 'flake.nix', searching up", path);
 
                 // Save device to detect filesystem boundary
                 dev_t device = lstat(path).st_dev;
@@ -123,7 +119,9 @@ std::pair<FlakeRef, std::string> parsePathFlakeRefWithFragment(
                         found = true;
                         break;
                     } else if (pathExists(path + "/.git"))
-                        throw Error("path '%s' is not part of a flake (neither it nor its parent directories contain a 'flake.nix' file)", path);
+                        throw Error(
+                            "path '%s' is not part of a flake (neither it nor its parent directories contain a 'flake.nix' file)",
+                            path);
                     else {
                         if (lstat(path).st_dev != device)
                             throw Error("unable to find a flake before encountering filesystem boundary at '%s'", path);
@@ -144,8 +142,8 @@ std::pair<FlakeRef, std::string> parsePathFlakeRefWithFragment(
                 if (pathExists(flakeRoot + "/.git")) {
                     auto parsedURL = ParsedURL{
                         .scheme = "git+file",
-                        .authority = "",
-                        .path = flakeRoot,
+                        .authority = ParsedURL::Authority{},
+                        .path = splitString<std::vector<std::string>>(flakeRoot, "/"),
                         .query = query,
                         .fragment = fragment,
                     };
@@ -172,41 +170,40 @@ std::pair<FlakeRef, std::string> parsePathFlakeRefWithFragment(
             throw BadURL("flake reference '%s' is not an absolute path", url);
     }
 
-    return fromParsedURL(fetchSettings, {
-        .scheme = "path",
-        .authority = "",
-        .path = path,
-        .query = query,
-        .fragment = fragment
-    }, isFlake);
+    return fromParsedURL(
+        fetchSettings,
+        {
+            .scheme = "path",
+            .authority = ParsedURL::Authority{},
+            .path = splitString<std::vector<std::string>>(path, "/"),
+            .query = query,
+            .fragment = fragment,
+        },
+        isFlake);
 }
 
 /**
  * Check if `url` is a flake ID. This is an abbreviated syntax for
  * `flake:<flake-id>?ref=<ref>&rev=<rev>`.
  */
-static std::optional<std::pair<FlakeRef, std::string>> parseFlakeIdRef(
-    const fetchers::Settings & fetchSettings,
-    const std::string & url,
-    bool isFlake)
+static std::optional<std::pair<FlakeRef, std::string>>
+parseFlakeIdRef(const fetchers::Settings & fetchSettings, const std::string & url, bool isFlake)
 {
     std::smatch match;
 
     static std::regex flakeRegex(
-        "((" + flakeIdRegexS + ")(?:/(?:" + refAndOrRevRegex + "))?)"
-        + "(?:#(" + fragmentRegex + "))?",
+        "((" + flakeIdRegexS + ")(?:/(?:" + refAndOrRevRegex + "))?)" + "(?:#(" + fragmentRegex + "))?",
         std::regex::ECMAScript);
 
     if (std::regex_match(url, match, flakeRegex)) {
         auto parsedURL = ParsedURL{
             .scheme = "flake",
-            .authority = "",
-            .path = match[1],
+            .authority = std::nullopt,
+            .path = splitString<std::vector<std::string>>(match[1].str(), "/"),
         };
 
         return std::make_pair(
-            FlakeRef(fetchers::Input::fromURL(fetchSettings, parsedURL, isFlake), ""),
-            percentDecode(match.str(6)));
+            FlakeRef(fetchers::Input::fromURL(fetchSettings, parsedURL, isFlake), ""), percentDecode(match.str(6)));
     }
 
     return {};
@@ -219,11 +216,13 @@ std::optional<std::pair<FlakeRef, std::string>> parseURLFlakeRef(
     bool isFlake)
 {
     try {
-        auto parsed = parseURL(url);
-        if (baseDir
-            && (parsed.scheme == "path" || parsed.scheme == "git+file")
-            && !isAbsolute(parsed.path))
-            parsed.path = absPath(parsed.path, *baseDir);
+        auto parsed = parseURL(url, /*lenient=*/true);
+        if (baseDir && (parsed.scheme == "path" || parsed.scheme == "git+file")) {
+            /* Here we know that the path must not contain encoded '/' or NUL bytes. */
+            auto path = renderUrlPathEnsureLegal(parsed.path);
+            if (!isAbsolute(path))
+                parsed.path = splitString<std::vector<std::string>>(absPath(path, *baseDir), "/");
+        }
         return fromParsedURL(fetchSettings, std::move(parsed), isFlake);
     } catch (BadURL &) {
         return std::nullopt;
@@ -249,9 +248,7 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
     }
 }
 
-FlakeRef FlakeRef::fromAttrs(
-    const fetchers::Settings & fetchSettings,
-    const fetchers::Attrs & attrs)
+FlakeRef FlakeRef::fromAttrs(const fetchers::Settings & fetchSettings, const fetchers::Attrs & attrs)
 {
     auto attrs2(attrs);
     attrs2.erase("dir");
@@ -302,7 +299,7 @@ FlakeRef FlakeRef::canonicalize() const
        filtering the `dir` query parameter from the URL. */
     if (auto url = fetchers::maybeGetStrAttr(flakeRef.input.attrs, "url")) {
         try {
-            auto parsed = parseURL(*url);
+            auto parsed = parseURL(*url, /*lenient=*/true);
             if (auto dir2 = get(parsed.query, "dir")) {
                 if (flakeRef.subdir != "" && flakeRef.subdir == *dir2)
                     parsed.query.erase("dir");
@@ -323,12 +320,11 @@ std::tuple<FlakeRef, std::string, ExtendedOutputsSpec> parseFlakeRefWithFragment
     bool isFlake)
 {
     auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse(url);
-    auto [flakeRef, fragment] = parseFlakeRefWithFragment(
-        fetchSettings,
-        std::string { prefix }, baseDir, allowMissing, isFlake);
+    auto [flakeRef, fragment] =
+        parseFlakeRefWithFragment(fetchSettings, std::string{prefix}, baseDir, allowMissing, isFlake);
     return {std::move(flakeRef), fragment, std::move(extendedOutputsSpec)};
 }
 
 std::regex flakeIdRegex(flakeIdRegexS, std::regex::ECMAScript);
 
-}
+} // namespace nix
diff --git a/src/libflake/include/nix/flake/flake-primops.hh b/src/libflake/include/nix/flake/flake-primops.hh
index e7b86b9b3..35a7128f4 100644
--- a/src/libflake/include/nix/flake/flake-primops.hh
+++ b/src/libflake/include/nix/flake/flake-primops.hh
@@ -13,4 +13,4 @@ nix::PrimOp getFlake(const Settings & settings);
 extern nix::PrimOp parseFlakeRef;
 extern nix::PrimOp flakeRefToString;
 
-} // namespace nix::flake
+} // namespace nix::flake::primops
diff --git a/src/libflake/include/nix/flake/flake.hh b/src/libflake/include/nix/flake/flake.hh
index ed34aa9c8..13002b47c 100644
--- a/src/libflake/include/nix/flake/flake.hh
+++ b/src/libflake/include/nix/flake/flake.hh
@@ -134,9 +134,7 @@ struct LockedFlake
      */
     std::map<ref<Node>, SourcePath> nodePaths;
 
-    std::optional<Fingerprint> getFingerprint(
-        ref<Store> store,
-        const fetchers::Settings & fetchSettings) const;
+    std::optional<Fingerprint> getFingerprint(ref<Store> store, const fetchers::Settings & fetchSettings) const;
 };
 
 struct LockFlags
@@ -215,18 +213,12 @@ struct LockFlags
     std::set<InputAttrPath> inputUpdates;
 };
 
-LockedFlake lockFlake(
-    const Settings & settings,
-    EvalState & state,
-    const FlakeRef & flakeRef,
-    const LockFlags & lockFlags);
+LockedFlake
+lockFlake(const Settings & settings, EvalState & state, const FlakeRef & flakeRef, const LockFlags & lockFlags);
 
-void callFlake(
-    EvalState & state,
-    const LockedFlake & lockedFlake,
-    Value & v);
+void callFlake(EvalState & state, const LockedFlake & lockedFlake, Value & v);
 
-}
+} // namespace flake
 
 void emitTreeAttrs(
     EvalState & state,
@@ -241,6 +233,6 @@ void emitTreeAttrs(
  * always treats the input as final (i.e. no attributes can be
  * added/removed/changed).
  */
-void prim_fetchFinalTree(EvalState & state, const PosIdx pos, Value * * args, Value & v);
+void prim_fetchFinalTree(EvalState & state, const PosIdx pos, Value ** args, Value & v);
 
-}
+} // namespace nix
diff --git a/src/libflake/include/nix/flake/flakeref.hh b/src/libflake/include/nix/flake/flakeref.hh
index c0045fcf3..c8c536bce 100644
--- a/src/libflake/include/nix/flake/flakeref.hh
+++ b/src/libflake/include/nix/flake/flakeref.hh
@@ -47,29 +47,27 @@ struct FlakeRef
      */
     Path subdir;
 
-    bool operator ==(const FlakeRef & other) const = default;
+    bool operator==(const FlakeRef & other) const = default;
 
-    bool operator <(const FlakeRef & other) const
+    bool operator<(const FlakeRef & other) const
     {
         return std::tie(input, subdir) < std::tie(other.input, other.subdir);
     }
 
     FlakeRef(fetchers::Input && input, const Path & subdir)
-        : input(std::move(input)), subdir(subdir)
-    { }
+        : input(std::move(input))
+        , subdir(subdir)
+    {
+    }
 
     // FIXME: change to operator <<.
     std::string to_string() const;
 
     fetchers::Attrs toAttrs() const;
 
-    FlakeRef resolve(
-        ref<Store> store,
-        fetchers::UseRegistries useRegistries = fetchers::UseRegistries::All) const;
+    FlakeRef resolve(ref<Store> store, fetchers::UseRegistries useRegistries = fetchers::UseRegistries::All) const;
 
-    static FlakeRef fromAttrs(
-        const fetchers::Settings & fetchSettings,
-        const fetchers::Attrs & attrs);
+    static FlakeRef fromAttrs(const fetchers::Settings & fetchSettings, const fetchers::Attrs & attrs);
 
     std::pair<ref<SourceAccessor>, FlakeRef> lazyFetch(ref<Store> store) const;
 
@@ -80,10 +78,10 @@ struct FlakeRef
     FlakeRef canonicalize() const;
 };
 
-std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef);
+std::ostream & operator<<(std::ostream & str, const FlakeRef & flakeRef);
 
 /**
- * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ * @param baseDir Optional [base directory](https://nix.dev/manual/nix/development/glossary.html#gloss-base-directory)
  */
 FlakeRef parseFlakeRef(
     const fetchers::Settings & fetchSettings,
@@ -94,7 +92,7 @@ FlakeRef parseFlakeRef(
     bool preserveRelativePaths = false);
 
 /**
- * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ * @param baseDir Optional [base directory](https://nix.dev/manual/nix/development/glossary.html#gloss-base-directory)
  */
 std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
     const fetchers::Settings & fetchSettings,
@@ -105,7 +103,7 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
     bool preserveRelativePaths = false);
 
 /**
- * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ * @param baseDir Optional [base directory](https://nix.dev/manual/nix/development/glossary.html#gloss-base-directory)
  */
 std::tuple<FlakeRef, std::string, ExtendedOutputsSpec> parseFlakeRefWithFragmentAndExtendedOutputsSpec(
     const fetchers::Settings & fetchSettings,
@@ -117,4 +115,4 @@ std::tuple<FlakeRef, std::string, ExtendedOutputsSpec> parseFlakeRefWithFragment
 const static std::string flakeIdRegexS = "[a-zA-Z][a-zA-Z0-9_-]*";
 extern std::regex flakeIdRegex;
 
-}
+} // namespace nix
diff --git a/src/libflake/include/nix/flake/lockfile.hh b/src/libflake/include/nix/flake/lockfile.hh
index 97bd7a495..c5740a2f1 100644
--- a/src/libflake/include/nix/flake/lockfile.hh
+++ b/src/libflake/include/nix/flake/lockfile.hh
@@ -8,7 +8,7 @@
 namespace nix {
 class Store;
 class StorePath;
-}
+} // namespace nix
 
 namespace nix::flake {
 
@@ -27,7 +27,7 @@ struct Node : std::enable_shared_from_this<Node>
 
     std::map<FlakeId, Edge> inputs;
 
-    virtual ~Node() { }
+    virtual ~Node() {}
 };
 
 /**
@@ -51,11 +51,10 @@ struct LockedNode : Node
         , originalRef(std::move(originalRef))
         , isFlake(isFlake)
         , parentInputAttrPath(std::move(parentInputAttrPath))
-    { }
+    {
+    }
 
-    LockedNode(
-        const fetchers::Settings & fetchSettings,
-        const nlohmann::json & json);
+    LockedNode(const fetchers::Settings & fetchSettings, const nlohmann::json & json);
 
     StorePath computeStorePath(Store & store) const;
 };
@@ -65,9 +64,7 @@ struct LockFile
     ref<Node> root = make_ref<Node>();
 
     LockFile() {};
-    LockFile(
-        const fetchers::Settings & fetchSettings,
-        std::string_view contents, std::string_view path);
+    LockFile(const fetchers::Settings & fetchSettings, std::string_view contents, std::string_view path);
 
     typedef std::map<ref<const Node>, std::string> KeyMap;
 
@@ -81,7 +78,7 @@ struct LockFile
      */
     std::optional<FlakeRef> isUnlocked(const fetchers::Settings & fetchSettings) const;
 
-    bool operator ==(const LockFile & other) const;
+    bool operator==(const LockFile & other) const;
 
     std::shared_ptr<Node> findInput(const InputAttrPath & path);
 
@@ -95,10 +92,10 @@ struct LockFile
     void check();
 };
 
-std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile);
+std::ostream & operator<<(std::ostream & stream, const LockFile & lockFile);
 
 InputAttrPath parseInputAttrPath(std::string_view s);
 
 std::string printInputAttrPath(const InputAttrPath & path);
 
-}
+} // namespace nix::flake
diff --git a/src/libflake/include/nix/flake/meson.build b/src/libflake/include/nix/flake/meson.build
index ece1ad4ea..fc580164e 100644
--- a/src/libflake/include/nix/flake/meson.build
+++ b/src/libflake/include/nix/flake/meson.build
@@ -1,6 +1,6 @@
 # Public headers directory
 
-include_dirs = [include_directories('../..')]
+include_dirs = [ include_directories('../..') ]
 
 headers = files(
   'flake.hh',
diff --git a/src/libflake/include/nix/flake/settings.hh b/src/libflake/include/nix/flake/settings.hh
index b3bffad4c..618ed4d38 100644
--- a/src/libflake/include/nix/flake/settings.hh
+++ b/src/libflake/include/nix/flake/settings.hh
@@ -50,4 +50,4 @@ struct Settings : public Config
         Xp::Flakes};
 };
 
-}
+} // namespace nix::flake
diff --git a/src/libflake/include/nix/flake/url-name.hh b/src/libflake/include/nix/flake/url-name.hh
index d295ca8f8..b95d2dff6 100644
--- a/src/libflake/include/nix/flake/url-name.hh
+++ b/src/libflake/include/nix/flake/url-name.hh
@@ -17,4 +17,4 @@ namespace nix {
  */
 std::optional<std::string> getNameFromURL(const ParsedURL & url);
 
-}
+} // namespace nix
diff --git a/src/libflake/lockfile.cc b/src/libflake/lockfile.cc
index 646516caf..f381a57e6 100644
--- a/src/libflake/lockfile.cc
+++ b/src/libflake/lockfile.cc
@@ -1,5 +1,3 @@
-#include <unordered_set>
-
 #include "nix/fetchers/fetch-settings.hh"
 #include "nix/flake/settings.hh"
 #include "nix/flake/lockfile.hh"
@@ -9,17 +7,14 @@
 #include <algorithm>
 #include <iomanip>
 
+#include <boost/unordered/unordered_flat_set.hpp>
 #include <iterator>
 #include <nlohmann/json.hpp>
 
-
 namespace nix::flake {
 
-static FlakeRef getFlakeRef(
-    const fetchers::Settings & fetchSettings,
-    const nlohmann::json & json,
-    const char * attr,
-    const char * info)
+static FlakeRef
+getFlakeRef(const fetchers::Settings & fetchSettings, const nlohmann::json & json, const char * attr, const char * info)
 {
     auto i = json.find(attr);
     if (i != json.end()) {
@@ -38,13 +33,12 @@ static FlakeRef getFlakeRef(
     throw Error("attribute '%s' missing in lock file", attr);
 }
 
-LockedNode::LockedNode(
-    const fetchers::Settings & fetchSettings,
-    const nlohmann::json & json)
+LockedNode::LockedNode(const fetchers::Settings & fetchSettings, const nlohmann::json & json)
     : lockedRef(getFlakeRef(fetchSettings, json, "locked", "info")) // FIXME: remove "info"
     , originalRef(getFlakeRef(fetchSettings, json, "original", nullptr))
     , isFlake(json.find("flake") != json.end() ? (bool) json["flake"] : true)
-    , parentInputAttrPath(json.find("parent") != json.end() ? (std::optional<InputAttrPath>) json["parent"] : std::nullopt)
+    , parentInputAttrPath(
+          json.find("parent") != json.end() ? (std::optional<InputAttrPath>) json["parent"] : std::nullopt)
 {
     if (!lockedRef.input.isLocked() && !lockedRef.input.isRelative()) {
         if (lockedRef.input.getNarHash())
@@ -53,7 +47,8 @@ LockedNode::LockedNode(
                 "This is deprecated since such inputs are verifiable but may not be reproducible.",
                 lockedRef.to_string());
         else
-            throw Error("Lock file contains unlocked input '%s'. Use '--allow-dirty-locks' to accept this lock file.",
+            throw Error(
+                "Lock file contains unlocked input '%s'. Use '--allow-dirty-locks' to accept this lock file.",
                 fetchers::attrsToJSON(lockedRef.input.toAttrs()));
     }
 
@@ -67,7 +62,8 @@ StorePath LockedNode::computeStorePath(Store & store) const
     return lockedRef.input.computeStorePath(store);
 }
 
-static std::shared_ptr<Node> doFind(const ref<Node> & root, const InputAttrPath & path, std::vector<InputAttrPath> & visited)
+static std::shared_ptr<Node>
+doFind(const ref<Node> & root, const InputAttrPath & path, std::vector<InputAttrPath> & visited)
 {
     auto pos = root;
 
@@ -104,9 +100,7 @@ std::shared_ptr<Node> LockFile::findInput(const InputAttrPath & path)
     return doFind(root, path, visited);
 }
 
-LockFile::LockFile(
-    const fetchers::Settings & fetchSettings,
-    std::string_view contents, std::string_view path)
+LockFile::LockFile(const fetchers::Settings & fetchSettings, std::string_view contents, std::string_view path)
 {
     auto json = [=] {
         try {
@@ -123,9 +117,9 @@ LockFile::LockFile(
 
     std::function<void(Node & node, const nlohmann::json & jsonNode)> getInputs;
 
-    getInputs = [&](Node & node, const nlohmann::json & jsonNode)
-    {
-        if (jsonNode.find("inputs") == jsonNode.end()) return;
+    getInputs = [&](Node & node, const nlohmann::json & jsonNode) {
+        if (jsonNode.find("inputs") == jsonNode.end())
+            return;
         for (auto & i : jsonNode["inputs"].items()) {
             if (i.value().is_array()) { // FIXME: remove, obsolete
                 InputAttrPath path;
@@ -167,18 +161,17 @@ std::pair<nlohmann::json, LockFile::KeyMap> LockFile::toJSON() const
 {
     nlohmann::json nodes;
     KeyMap nodeKeys;
-    std::unordered_set<std::string> keys;
+    boost::unordered_flat_set<std::string> keys;
 
     std::function<std::string(const std::string & key, ref<const Node> node)> dumpNode;
 
-    dumpNode = [&](std::string key, ref<const Node> node) -> std::string
-    {
+    dumpNode = [&](std::string key, ref<const Node> node) -> std::string {
         auto k = nodeKeys.find(node);
         if (k != nodeKeys.end())
             return k->second;
 
         if (!keys.insert(key).second) {
-            for (int n = 2; ; ++n) {
+            for (int n = 2;; ++n) {
                 auto k = fmt("%s_%d", key, n);
                 if (keys.insert(k).second) {
                     key = k;
@@ -239,7 +232,7 @@ std::pair<std::string, LockFile::KeyMap> LockFile::to_string() const
     return {json.dump(2), std::move(nodeKeys)};
 }
 
-std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile)
+std::ostream & operator<<(std::ostream & stream, const LockFile & lockFile)
 {
     stream << lockFile.toJSON().first.dump(2);
     return stream;
@@ -251,9 +244,9 @@ std::optional<FlakeRef> LockFile::isUnlocked(const fetchers::Settings & fetchSet
 
     std::function<void(ref<const Node> node)> visit;
 
-    visit = [&](ref<const Node> node)
-    {
-        if (!nodes.insert(node).second) return;
+    visit = [&](ref<const Node> node) {
+        if (!nodes.insert(node).second)
+            return;
         for (auto & i : node->inputs)
             if (auto child = std::get_if<0>(&i.second))
                 visit(*child);
@@ -265,17 +258,15 @@ std::optional<FlakeRef> LockFile::isUnlocked(const fetchers::Settings & fetchSet
        `allow-dirty-locks` is enabled, it has a NAR hash. In the
        latter case, we can verify the input but we may not be able to
        fetch it from anywhere. */
-    auto isConsideredLocked = [&](const fetchers::Input & input)
-    {
+    auto isConsideredLocked = [&](const fetchers::Input & input) {
         return input.isLocked() || (fetchSettings.allowDirtyLocks && input.getNarHash());
     };
 
     for (auto & i : nodes) {
-        if (i == ref<const Node>(root)) continue;
+        if (i == ref<const Node>(root))
+            continue;
         auto node = i.dynamic_pointer_cast<const LockedNode>();
-        if (node
-            && (!isConsideredLocked(node->lockedRef.input)
-                || !node->lockedRef.input.isFinal())
+        if (node && (!isConsideredLocked(node->lockedRef.input) || !node->lockedRef.input.isFinal())
             && !node->lockedRef.input.isRelative())
             return node->lockedRef;
     }
@@ -283,7 +274,7 @@ std::optional<FlakeRef> LockFile::isUnlocked(const fetchers::Settings & fetchSet
     return {};
 }
 
-bool LockFile::operator ==(const LockFile & other) const
+bool LockFile::operator==(const LockFile & other) const
 {
     // FIXME: slow
     return toJSON().first == other.toJSON().first;
@@ -309,11 +300,11 @@ std::map<InputAttrPath, Node::Edge> LockFile::getAllInputs() const
 
     std::function<void(const InputAttrPath & prefix, ref<Node> node)> recurse;
 
-    recurse = [&](const InputAttrPath & prefix, ref<Node> node)
-    {
-        if (!done.insert(node).second) return;
+    recurse = [&](const InputAttrPath & prefix, ref<Node> node) {
+        if (!done.insert(node).second)
+            return;
 
-        for (auto &[id, input] : node->inputs) {
+        for (auto & [id, input] : node->inputs) {
             auto inputAttrPath(prefix);
             inputAttrPath.push_back(id);
             res.emplace(inputAttrPath, input);
@@ -337,7 +328,7 @@ static std::string describe(const FlakeRef & flakeRef)
     return s;
 }
 
-std::ostream & operator <<(std::ostream & stream, const Node::Edge & edge)
+std::ostream & operator<<(std::ostream & stream, const Node::Edge & edge)
 {
     if (auto node = std::get_if<0>(&edge))
         stream << describe((*node)->lockedRef);
@@ -368,18 +359,19 @@ std::string LockFile::diff(const LockFile & oldLocks, const LockFile & newLocks)
 
     while (i != oldFlat.end() || j != newFlat.end()) {
         if (j != newFlat.end() && (i == oldFlat.end() || i->first > j->first)) {
-            res += fmt("• " ANSI_GREEN "Added input '%s':" ANSI_NORMAL "\n    %s\n",
-                printInputAttrPath(j->first), j->second);
+            res += fmt(
+                "• " ANSI_GREEN "Added input '%s':" ANSI_NORMAL "\n    %s\n", printInputAttrPath(j->first), j->second);
             ++j;
         } else if (i != oldFlat.end() && (j == newFlat.end() || i->first < j->first)) {
             res += fmt("• " ANSI_RED "Removed input '%s'" ANSI_NORMAL "\n", printInputAttrPath(i->first));
             ++i;
         } else {
             if (!equals(i->second, j->second)) {
-                res += fmt("• " ANSI_BOLD "Updated input '%s':" ANSI_NORMAL "\n    %s\n  → %s\n",
-                    printInputAttrPath(i->first),
-                    i->second,
-                    j->second);
+                res +=
+                    fmt("• " ANSI_BOLD "Updated input '%s':" ANSI_NORMAL "\n    %s\n  → %s\n",
+                        printInputAttrPath(i->first),
+                        i->second,
+                        j->second);
             }
             ++i;
             ++j;
@@ -396,7 +388,8 @@ void LockFile::check()
     for (auto & [inputAttrPath, input] : inputs) {
         if (auto follows = std::get_if<1>(&input)) {
             if (!follows->empty() && !findInput(*follows))
-                throw Error("input '%s' follows a non-existent input '%s'",
+                throw Error(
+                    "input '%s' follows a non-existent input '%s'",
                     printInputAttrPath(inputAttrPath),
                     printInputAttrPath(*follows));
         }
@@ -410,4 +403,4 @@ std::string printInputAttrPath(const InputAttrPath & path)
     return concatStringsSep("/", path);
 }
 
-}
+} // namespace nix::flake
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index bc8533e15..191d8f068 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -1,7 +1,9 @@
-project('nix-flake', 'cpp',
+project(
+  'nix-flake',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -14,8 +16,7 @@ cxx = meson.get_compiler('cpp')
 
 subdir('nix-meson-build-support/deps-lists')
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
@@ -40,10 +41,10 @@ endforeach
 
 sources = files(
   'config.cc',
+  'flake-primops.cc',
   'flake.cc',
   'flakeref.cc',
   'lockfile.cc',
-  'flake-primops.cc',
   'settings.cc',
   'url-name.cc',
 )
@@ -59,7 +60,7 @@ this_library = library(
   generated_headers,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libflake/settings.cc b/src/libflake/settings.cc
index bab7f9439..e77bded30 100644
--- a/src/libflake/settings.cc
+++ b/src/libflake/settings.cc
@@ -12,4 +12,4 @@ void Settings::configureEvalSettings(nix::EvalSettings & evalSettings) const
     evalSettings.extraPrimOps.emplace_back(primops::flakeRefToString);
 }
 
-} // namespace nix
+} // namespace nix::flake
diff --git a/src/libflake/url-name.cc b/src/libflake/url-name.cc
index 3e3311cf7..3bba3692e 100644
--- a/src/libflake/url-name.cc
+++ b/src/libflake/url-name.cc
@@ -5,10 +5,11 @@
 namespace nix {
 
 static const std::string attributeNamePattern("[a-zA-Z0-9_-]+");
-static const std::regex lastAttributeRegex("^((?:" + attributeNamePattern + "\\.)*)(" + attributeNamePattern +")(\\^.*)?$");
+static const std::regex
+    lastAttributeRegex("^((?:" + attributeNamePattern + "\\.)*)(" + attributeNamePattern + ")(\\^.*)?$");
 static const std::string pathSegmentPattern("[a-zA-Z0-9_-]+");
-static const std::regex lastPathSegmentRegex(".*/(" + pathSegmentPattern +")");
-static const std::regex secondPathSegmentRegex("(?:" + pathSegmentPattern + ")/(" + pathSegmentPattern +")(?:/.*)?");
+static const std::regex lastPathSegmentRegex(".*/(" + pathSegmentPattern + ")");
+static const std::regex secondPathSegmentRegex("(?:" + pathSegmentPattern + ")/(" + pathSegmentPattern + ")(?:/.*)?");
 static const std::regex gitProviderRegex("github|gitlab|sourcehut");
 static const std::regex gitSchemeRegex("git($|\\+.*)");
 
@@ -21,26 +22,30 @@ std::optional<std::string> getNameFromURL(const ParsedURL & url)
         return url.query.at("dir");
 
     /* If the fragment isn't a "default" and contains two attribute elements, use the last one */
-    if (std::regex_match(url.fragment, match, lastAttributeRegex)
-        && match.str(1) != "defaultPackage."
+    if (std::regex_match(url.fragment, match, lastAttributeRegex) && match.str(1) != "defaultPackage."
         && match.str(2) != "default") {
         return match.str(2);
     }
 
+    /* This is not right, because special chars like slashes within the
+       path fragments should be percent encoded, but I don't think any
+       of the regexes above care. */
+    auto path = concatStringsSep("/", url.path);
+
     /* If this is a github/gitlab/sourcehut flake, use the repo name */
-    if (std::regex_match(url.scheme, gitProviderRegex) && std::regex_match(url.path, match, secondPathSegmentRegex))
+    if (std::regex_match(url.scheme, gitProviderRegex) && std::regex_match(path, match, secondPathSegmentRegex))
         return match.str(1);
 
     /* If it is a regular git flake, use the directory name */
-    if (std::regex_match(url.scheme, gitSchemeRegex) && std::regex_match(url.path, match, lastPathSegmentRegex))
+    if (std::regex_match(url.scheme, gitSchemeRegex) && std::regex_match(path, match, lastPathSegmentRegex))
         return match.str(1);
 
     /* If there is no fragment, take the last element of the path */
-    if (std::regex_match(url.path, match, lastPathSegmentRegex))
+    if (std::regex_match(path, match, lastPathSegmentRegex))
         return match.str(1);
 
     /* If even that didn't work, the URL does not contain enough info to determine a useful name */
     return {};
 }
 
-}
+} // namespace nix
diff --git a/src/libmain-c/meson.build b/src/libmain-c/meson.build
index e420520e6..9e26ad8ad 100644
--- a/src/libmain-c/meson.build
+++ b/src/libmain-c/meson.build
@@ -1,7 +1,9 @@
-project('nix-main-c', 'cpp',
+project(
+  'nix-main-c',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -31,7 +33,7 @@ sources = files(
   'nix_api_main.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 headers = files(
   'nix_api_main.h',
@@ -45,7 +47,7 @@ this_library = library(
   sources,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libmain-c/nix_api_main.cc b/src/libmain-c/nix_api_main.cc
index eacb80455..2d4f588a8 100644
--- a/src/libmain-c/nix_api_main.cc
+++ b/src/libmain-c/nix_api_main.cc
@@ -5,6 +5,8 @@
 
 #include "nix/main/plugin.hh"
 
+extern "C" {
+
 nix_err nix_init_plugins(nix_c_context * context)
 {
     if (context)
@@ -14,3 +16,5 @@ nix_err nix_init_plugins(nix_c_context * context)
     }
     NIXC_CATCH_ERRS
 }
+
+} // extern "C"
diff --git a/src/libmain/common-args.cc b/src/libmain/common-args.cc
index dcf252a4f..6055ec0e7 100644
--- a/src/libmain/common-args.cc
+++ b/src/libmain/common-args.cc
@@ -51,15 +51,16 @@ MixCommonArgs::MixCommonArgs(const std::string & programName)
                     warn(e.what());
             }
         }},
-        .completer = [](AddCompletions & completions, size_t index, std::string_view prefix) {
-            if (index == 0) {
-                std::map<std::string, Config::SettingInfo> settings;
-                globalConfig.getSettings(settings);
-                for (auto & s : settings)
-                    if (hasPrefix(s.first, prefix))
-                        completions.add(s.first, fmt("Set the `%s` setting.", s.first));
-            }
-        },
+        .completer =
+            [](AddCompletions & completions, size_t index, std::string_view prefix) {
+                if (index == 0) {
+                    std::map<std::string, Config::SettingInfo> settings;
+                    globalConfig.getSettings(settings);
+                    for (auto & s : settings)
+                        if (hasPrefix(s.first, prefix))
+                            completions.add(s.first, fmt("Set the `%s` setting.", s.first));
+                }
+            },
     });
 
     addFlag({
@@ -75,16 +76,15 @@ MixCommonArgs::MixCommonArgs(const std::string & programName)
         .shortName = 'j',
         .description = "The maximum number of parallel builds.",
         .labels = Strings{"jobs"},
-        .handler = {[=](std::string s) {
-            settings.set("max-jobs", s);
-        }},
+        .handler = {[=](std::string s) { settings.set("max-jobs", s); }},
     });
 
     std::string cat = "Options to override configuration settings";
     globalConfig.convertToArgs(*this, cat);
 
     // Backward compatibility hack: nix-env already had a --system flag.
-    if (programName == "nix-env") longFlags.erase("system");
+    if (programName == "nix-env")
+        longFlags.erase("system");
 
     hiddenCategories.insert(cat);
 }
@@ -95,7 +95,7 @@ void MixCommonArgs::initialFlagsProcessed()
     pluginsInited();
 }
 
-template <typename T, typename>
+template<typename T, typename>
 void MixPrintJSON::printJSON(const T /* nlohmann::json */ & json)
 {
     auto suspension = logger->suspend();
@@ -108,5 +108,4 @@ void MixPrintJSON::printJSON(const T /* nlohmann::json */ & json)
 
 template void MixPrintJSON::printJSON(const nlohmann::json & json);
 
-
 } // namespace nix
diff --git a/src/libmain/include/nix/main/common-args.hh b/src/libmain/include/nix/main/common-args.hh
index cc6d3d3f0..d67fc2ad0 100644
--- a/src/libmain/include/nix/main/common-args.hh
+++ b/src/libmain/include/nix/main/common-args.hh
@@ -6,7 +6,7 @@
 
 namespace nix {
 
-//static constexpr auto commonArgsCategory = "Miscellaneous common options";
+// static constexpr auto commonArgsCategory = "Miscellaneous common options";
 static constexpr auto loggingCategory = "Logging-related options";
 static constexpr auto miscCategory = "Miscellaneous global options";
 
@@ -86,7 +86,7 @@ struct MixPrintJSON : virtual Args
      * but you _can_ print a sole JSON string by explicitly coercing it to
      * `nlohmann::json` first.
      */
-    template <typename T, typename = std::enable_if_t<std::is_same_v<T, nlohmann::json>>>
+    template<typename T, typename = std::enable_if_t<std::is_same_v<T, nlohmann::json>>>
     void printJSON(const T & json);
 };
 
@@ -113,13 +113,12 @@ struct MixRepair : virtual Args
     {
         addFlag({
             .longName = "repair",
-            .description =
-                "During evaluation, rewrite missing or corrupted files in the Nix store. "
-                "During building, rebuild missing or corrupted store paths.",
+            .description = "During evaluation, rewrite missing or corrupted files in the Nix store. "
+                           "During building, rebuild missing or corrupted store paths.",
             .category = miscCategory,
             .handler = {&repair, Repair},
         });
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libmain/include/nix/main/loggers.hh b/src/libmain/include/nix/main/loggers.hh
index 061b4a32a..b763f0b2a 100644
--- a/src/libmain/include/nix/main/loggers.hh
+++ b/src/libmain/include/nix/main/loggers.hh
@@ -6,14 +6,14 @@
 namespace nix {
 
 enum class LogFormat {
-  raw,
-  rawWithLogs,
-  internalJSON,
-  bar,
-  barWithLogs,
+    raw,
+    rawWithLogs,
+    internalJSON,
+    bar,
+    barWithLogs,
 };
 
 void setLogFormat(const std::string & logFormatStr);
 void setLogFormat(const LogFormat & logFormat);
 
-}
+} // namespace nix
diff --git a/src/libmain/include/nix/main/meson.build b/src/libmain/include/nix/main/meson.build
index 992a5ff0e..338fa8257 100644
--- a/src/libmain/include/nix/main/meson.build
+++ b/src/libmain/include/nix/main/meson.build
@@ -1,6 +1,6 @@
 # Public headers directory
 
-include_dirs = [include_directories('../..')]
+include_dirs = [ include_directories('../..') ]
 
 headers = files(
   'common-args.hh',
diff --git a/src/libmain/include/nix/main/plugin.hh b/src/libmain/include/nix/main/plugin.hh
index 4221c1b17..0c03a4bb8 100644
--- a/src/libmain/include/nix/main/plugin.hh
+++ b/src/libmain/include/nix/main/plugin.hh
@@ -1,4 +1,5 @@
 #pragma once
+
 ///@file
 
 namespace nix {
@@ -9,4 +10,4 @@ namespace nix {
  */
 void initPlugins();
 
-}
+} // namespace nix
diff --git a/src/libmain/include/nix/main/shared.hh b/src/libmain/include/nix/main/shared.hh
index 4d4b816e7..47d08a050 100644
--- a/src/libmain/include/nix/main/shared.hh
+++ b/src/libmain/include/nix/main/shared.hh
@@ -21,10 +21,12 @@ int handleExceptions(const std::string & programName, std::function<void()> fun)
  */
 void initNix(bool loadConfig = true);
 
-void parseCmdLine(int argc, char * * argv,
-    std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
+void parseCmdLine(
+    int argc, char ** argv, std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
-void parseCmdLine(const std::string & programName, const Strings & args,
+void parseCmdLine(
+    const std::string & programName,
+    const Strings & args,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
 void printVersion(const std::string & programName);
@@ -37,33 +39,27 @@ void printGCWarning();
 class Store;
 struct MissingPaths;
 
-void printMissing(
-    ref<Store> store,
-    const std::vector<DerivedPath> & paths,
-    Verbosity lvl = lvlInfo);
+void printMissing(ref<Store> store, const std::vector<DerivedPath> & paths, Verbosity lvl = lvlInfo);
 
-void printMissing(
-    ref<Store> store,
-    const MissingPaths & missing,
-    Verbosity lvl = lvlInfo);
+void printMissing(ref<Store> store, const MissingPaths & missing, Verbosity lvl = lvlInfo);
 
-std::string getArg(const std::string & opt,
-    Strings::iterator & i, const Strings::iterator & end);
+std::string getArg(const std::string & opt, Strings::iterator & i, const Strings::iterator & end);
 
-template<class N> N getIntArg(const std::string & opt,
-    Strings::iterator & i, const Strings::iterator & end, bool allowUnit)
+template<class N>
+N getIntArg(const std::string & opt, Strings::iterator & i, const Strings::iterator & end, bool allowUnit)
 {
     ++i;
-    if (i == end) throw UsageError("'%1%' requires an argument", opt);
+    if (i == end)
+        throw UsageError("'%1%' requires an argument", opt);
     return string2IntWithUnitPrefix<N>(*i);
 }
 
-
 struct LegacyArgs : public MixCommonArgs, public RootArgs
 {
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg;
 
-    LegacyArgs(const std::string & programName,
+    LegacyArgs(
+        const std::string & programName,
         std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
     bool processFlag(Strings::iterator & pos, Strings::iterator end) override;
@@ -71,7 +67,6 @@ struct LegacyArgs : public MixCommonArgs, public RootArgs
     bool processArgs(const Strings & args, bool finish) override;
 };
 
-
 /**
  * The constructor of this class starts a pager if standard output is a
  * terminal and $PAGER is set. Standard output is redirected to the
@@ -92,7 +87,6 @@ private:
 
 extern volatile ::sig_atomic_t blockInt;
 
-
 /* GC helpers. */
 
 std::string showBytes(uint64_t bytes);
@@ -103,12 +97,16 @@ struct PrintFreed
 {
     bool show;
     const GCResults & results;
+
     PrintFreed(bool show, const GCResults & results)
-        : show(show), results(results) { }
+        : show(show)
+        , results(results)
+    {
+    }
+
     ~PrintFreed();
 };
 
-
 #ifndef _WIN32
 /**
  * Install a SIGSEGV handler to detect stack overflows.
@@ -141,4 +139,4 @@ extern std::function<void(siginfo_t * info, void * ctx)> stackOverflowHandler;
 void defaultStackOverflowHandler(siginfo_t * info, void * ctx);
 #endif
 
-}
+} // namespace nix
diff --git a/src/libmain/loggers.cc b/src/libmain/loggers.cc
index c78e49b63..a3e75c535 100644
--- a/src/libmain/loggers.cc
+++ b/src/libmain/loggers.cc
@@ -53,4 +53,4 @@ void setLogFormat(const LogFormat & logFormat)
     logger = makeDefaultLogger();
 }
 
-}
+} // namespace nix
diff --git a/src/libmain/meson.build b/src/libmain/meson.build
index 65fcb6239..4a90d2d83 100644
--- a/src/libmain/meson.build
+++ b/src/libmain/meson.build
@@ -1,7 +1,9 @@
-project('nix-main', 'cpp',
+project(
+  'nix-main',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -16,8 +18,7 @@ subdir('nix-meson-build-support/deps-lists')
 
 configdata = configuration_data()
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
@@ -43,7 +44,7 @@ int main() {
 configdata.set(
   'HAVE_PUBSETBUF',
   cxx.compiles(pubsetbuf_test).to_int(),
-  description: 'Optionally used for buffering on standard error'
+  description : 'Optionally used for buffering on standard error',
 )
 
 config_priv_h = configure_file(
@@ -78,7 +79,7 @@ this_library = library(
   config_priv_h,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libmain/plugin.cc b/src/libmain/plugin.cc
index 760a096ad..321fd6a15 100644
--- a/src/libmain/plugin.cc
+++ b/src/libmain/plugin.cc
@@ -117,4 +117,4 @@ void initPlugins()
     pluginSettings.pluginFiles.pluginsLoaded = true;
 }
 
-}
+} // namespace nix
diff --git a/src/libmain/progress-bar.cc b/src/libmain/progress-bar.cc
index 173ab876c..c00f5d86b 100644
--- a/src/libmain/progress-bar.cc
+++ b/src/libmain/progress-bar.cc
@@ -133,8 +133,9 @@ public:
             updateThread.join();
     }
 
-    void pause() override {
-        auto state (state_.lock());
+    void pause() override
+    {
+        auto state(state_.lock());
         state->suspensions++;
         if (state->suspensions > 1) {
             // already paused
@@ -145,8 +146,9 @@ public:
             writeToStderr("\r\e[K");
     }
 
-    void resume() override {
-        auto state (state_.lock());
+    void resume() override
+    {
+        auto state(state_.lock());
         if (state->suspensions == 0) {
             log(lvlError, "nix::ProgressBar: resume() called without a matching preceding pause(). This is a bug.");
             return;
@@ -168,7 +170,8 @@ public:
 
     void log(Verbosity lvl, std::string_view s) override
     {
-        if (lvl > verbosity) return;
+        if (lvl > verbosity)
+            return;
         auto state(state_.lock());
         log(*state, lvl, s);
     }
@@ -193,20 +196,21 @@ public:
         }
     }
 
-    void startActivity(ActivityId act, Verbosity lvl, ActivityType type,
-        const std::string & s, const Fields & fields, ActivityId parent) override
+    void startActivity(
+        ActivityId act,
+        Verbosity lvl,
+        ActivityType type,
+        const std::string & s,
+        const Fields & fields,
+        ActivityId parent) override
     {
         auto state(state_.lock());
 
         if (lvl <= verbosity && !s.empty() && type != actBuildWaiting)
             log(*state, lvl, s + "...");
 
-        state->activities.emplace_back(ActInfo {
-            .s = s,
-            .type = type,
-            .parent = parent,
-            .startTime = std::chrono::steady_clock::now()
-        });
+        state->activities.emplace_back(
+            ActInfo{.s = s, .type = type, .parent = parent, .startTime = std::chrono::steady_clock::now()});
         auto i = std::prev(state->activities.end());
         state->its.emplace(act, i);
         state->activitiesByType[type].its.emplace(act, i);
@@ -231,11 +235,11 @@ public:
         if (type == actSubstitute) {
             auto name = storePathToName(getS(fields, 0));
             auto sub = getS(fields, 1);
-            i->s = fmt(
-                hasPrefix(sub, "local")
-                ? "copying " ANSI_BOLD "%s" ANSI_NORMAL " from %s"
-                : "fetching " ANSI_BOLD "%s" ANSI_NORMAL " from %s",
-                name, sub);
+            i->s =
+                fmt(hasPrefix(sub, "local") ? "copying " ANSI_BOLD "%s" ANSI_NORMAL " from %s"
+                                            : "fetching " ANSI_BOLD "%s" ANSI_NORMAL " from %s",
+                    name,
+                    sub);
         }
 
         if (type == actPostBuildHook) {
@@ -265,8 +269,10 @@ public:
     {
         while (act != 0) {
             auto i = state.its.find(act);
-            if (i == state.its.end()) break;
-            if (i->second->type == type) return true;
+            if (i == state.its.end())
+                break;
+            if (i->second->type == type)
+                return true;
             act = i->second->parent;
         }
         return false;
@@ -400,7 +406,8 @@ public:
         auto nextWakeup = std::chrono::milliseconds::max();
 
         state.haveUpdate = false;
-        if (state.isPaused() || !state.active) return nextWakeup;
+        if (state.isPaused() || !state.active)
+            return nextWakeup;
 
         std::string line;
 
@@ -414,7 +421,8 @@ public:
         auto now = std::chrono::steady_clock::now();
 
         if (!state.activities.empty()) {
-            if (!status.empty()) line += " ";
+            if (!status.empty())
+                line += " ";
             auto i = state.activities.rbegin();
 
             while (i != state.activities.rend()) {
@@ -426,7 +434,9 @@ public:
                     if (i->startTime + delay < now)
                         break;
                     else
-                        nextWakeup = std::min(nextWakeup, std::chrono::duration_cast<std::chrono::milliseconds>(delay - (now - i->startTime)));
+                        nextWakeup = std::min(
+                            nextWakeup,
+                            std::chrono::duration_cast<std::chrono::milliseconds>(delay - (now - i->startTime)));
                 }
                 ++i;
             }
@@ -439,14 +449,16 @@ public:
                     line += ")";
                 }
                 if (!i->lastLine.empty()) {
-                    if (!i->s.empty()) line += ": ";
+                    if (!i->s.empty())
+                        line += ": ";
                     line += i->lastLine;
                 }
             }
         }
 
         auto width = getWindowSize().second;
-        if (width <= 0) width = std::numeric_limits<decltype(width)>::max();
+        if (width <= 0)
+            width = std::numeric_limits<decltype(width)>::max();
 
         redraw("\r" + filterANSIEscapes(line, false, width) + ANSI_NORMAL + "\e[K");
 
@@ -459,51 +471,60 @@ public:
 
         std::string res;
 
-        auto renderActivity = [&](ActivityType type, const std::string & itemFmt, const std::string & numberFmt = "%d", double unit = 1) {
-            auto & act = state.activitiesByType[type];
-            uint64_t done = act.done, expected = act.done, running = 0, failed = act.failed;
-            for (auto & j : act.its) {
-                done += j.second->done;
-                expected += j.second->expected;
-                running += j.second->running;
-                failed += j.second->failed;
-            }
+        auto renderActivity =
+            [&](ActivityType type, const std::string & itemFmt, const std::string & numberFmt = "%d", double unit = 1) {
+                auto & act = state.activitiesByType[type];
+                uint64_t done = act.done, expected = act.done, running = 0, failed = act.failed;
+                for (auto & j : act.its) {
+                    done += j.second->done;
+                    expected += j.second->expected;
+                    running += j.second->running;
+                    failed += j.second->failed;
+                }
 
-            expected = std::max(expected, act.expected);
+                expected = std::max(expected, act.expected);
 
-            std::string s;
+                std::string s;
 
-            if (running || done || expected || failed) {
-                if (running)
-                    if (expected != 0)
-                        s = fmt(ANSI_BLUE + numberFmt + ANSI_NORMAL "/" ANSI_GREEN + numberFmt + ANSI_NORMAL "/" + numberFmt,
-                            running / unit, done / unit, expected / unit);
+                if (running || done || expected || failed) {
+                    if (running)
+                        if (expected != 0)
+                            s =
+                                fmt(ANSI_BLUE + numberFmt + ANSI_NORMAL "/" ANSI_GREEN + numberFmt + ANSI_NORMAL "/"
+                                        + numberFmt,
+                                    running / unit,
+                                    done / unit,
+                                    expected / unit);
+                        else
+                            s =
+                                fmt(ANSI_BLUE + numberFmt + ANSI_NORMAL "/" ANSI_GREEN + numberFmt + ANSI_NORMAL,
+                                    running / unit,
+                                    done / unit);
+                    else if (expected != done)
+                        if (expected != 0)
+                            s = fmt(ANSI_GREEN + numberFmt + ANSI_NORMAL "/" + numberFmt, done / unit, expected / unit);
+                        else
+                            s = fmt(ANSI_GREEN + numberFmt + ANSI_NORMAL, done / unit);
                     else
-                        s = fmt(ANSI_BLUE + numberFmt + ANSI_NORMAL "/" ANSI_GREEN + numberFmt + ANSI_NORMAL,
-                            running / unit, done / unit);
-                else if (expected != done)
-                    if (expected != 0)
-                        s = fmt(ANSI_GREEN + numberFmt + ANSI_NORMAL "/" + numberFmt,
-                            done / unit, expected / unit);
-                    else
-                        s = fmt(ANSI_GREEN + numberFmt + ANSI_NORMAL, done / unit);
-                else
-                    s = fmt(done ? ANSI_GREEN + numberFmt + ANSI_NORMAL : numberFmt, done / unit);
-                s = fmt(itemFmt, s);
+                        s = fmt(done ? ANSI_GREEN + numberFmt + ANSI_NORMAL : numberFmt, done / unit);
+                    s = fmt(itemFmt, s);
 
-                if (failed)
-                    s += fmt(" (" ANSI_RED "%d failed" ANSI_NORMAL ")", failed / unit);
-            }
+                    if (failed)
+                        s += fmt(" (" ANSI_RED "%d failed" ANSI_NORMAL ")", failed / unit);
+                }
 
-            return s;
-        };
+                return s;
+            };
 
-        auto showActivity = [&](ActivityType type, const std::string & itemFmt, const std::string & numberFmt = "%d", double unit = 1) {
-            auto s = renderActivity(type, itemFmt, numberFmt, unit);
-            if (s.empty()) return;
-            if (!res.empty()) res += ", ";
-            res += s;
-        };
+        auto showActivity =
+            [&](ActivityType type, const std::string & itemFmt, const std::string & numberFmt = "%d", double unit = 1) {
+                auto s = renderActivity(type, itemFmt, numberFmt, unit);
+                if (s.empty())
+                    return;
+                if (!res.empty())
+                    res += ", ";
+                res += s;
+            };
 
         showActivity(actBuilds, "%s built");
 
@@ -511,9 +532,17 @@ public:
         auto s2 = renderActivity(actCopyPath, "%s MiB", "%.1f", MiB);
 
         if (!s1.empty() || !s2.empty()) {
-            if (!res.empty()) res += ", ";
-            if (s1.empty()) res += "0 copied"; else res += s1;
-            if (!s2.empty()) { res += " ("; res += s2; res += ')'; }
+            if (!res.empty())
+                res += ", ";
+            if (s1.empty())
+                res += "0 copied";
+            else
+                res += s1;
+            if (!s2.empty()) {
+                res += " (";
+                res += s2;
+                res += ')';
+            }
         }
 
         showActivity(actFileTransfer, "%s MiB DL", "%.1f", MiB);
@@ -522,7 +551,8 @@ public:
             auto s = renderActivity(actOptimiseStore, "%s paths optimised");
             if (s != "") {
                 s += fmt(", %.1f MiB / %d inodes freed", state.bytesLinked / MiB, state.filesLinked);
-                if (!res.empty()) res += ", ";
+                if (!res.empty())
+                    res += ", ";
                 res += s;
             }
         }
@@ -531,12 +561,14 @@ public:
         showActivity(actVerifyPaths, "%s paths verified");
 
         if (state.corruptedPaths) {
-            if (!res.empty()) res += ", ";
+            if (!res.empty())
+                res += ", ";
             res += fmt(ANSI_RED "%d corrupted" ANSI_NORMAL, state.corruptedPaths);
         }
 
         if (state.untrustedPaths) {
-            if (!res.empty()) res += ", ";
+            if (!res.empty())
+                res += ", ";
             res += fmt(ANSI_RED "%d untrusted" ANSI_NORMAL, state.untrustedPaths);
         }
 
@@ -558,10 +590,12 @@ public:
     std::optional<char> ask(std::string_view msg) override
     {
         auto state(state_.lock());
-        if (!state->active) return {};
+        if (!state->active)
+            return {};
         std::cerr << fmt("\r\e[K%s ", msg);
         auto s = trim(readLine(getStandardInput(), true));
-        if (s.size() != 1) return {};
+        if (s.size() != 1)
+            return {};
         draw(*state);
         return s[0];
     }
@@ -577,4 +611,4 @@ std::unique_ptr<Logger> makeProgressBar()
     return std::make_unique<ProgressBar>(isTTY());
 }
 
-}
+} // namespace nix
diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index 0982810d1..7187e9720 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -17,7 +17,7 @@
 #include <unistd.h>
 #include <signal.h>
 #ifdef __linux__
-#include <features.h>
+#  include <features.h>
 #endif
 
 #include <openssl/crypto.h>
@@ -30,30 +30,27 @@
 
 namespace nix {
 
-char * * savedArgv;
+char ** savedArgv;
 
 static bool gcWarning = true;
 
 void printGCWarning()
 {
-    if (!gcWarning) return;
+    if (!gcWarning)
+        return;
     static bool haveWarned = false;
-    warnOnce(haveWarned,
+    warnOnce(
+        haveWarned,
         "you did not specify '--add-root'; "
         "the result might be removed by the garbage collector");
 }
 
-
 void printMissing(ref<Store> store, const std::vector<DerivedPath> & paths, Verbosity lvl)
 {
     printMissing(store, store->queryMissing(paths), lvl);
 }
 
-
-void printMissing(
-    ref<Store> store,
-    const MissingPaths & missing,
-    Verbosity lvl)
+void printMissing(ref<Store> store, const MissingPaths & missing, Verbosity lvl)
 {
     if (!missing.willBuild.empty()) {
         if (missing.willBuild.size() == 1)
@@ -70,51 +67,53 @@ void printMissing(
         const float downloadSizeMiB = missing.downloadSize / (1024.f * 1024.f);
         const float narSizeMiB = missing.narSize / (1024.f * 1024.f);
         if (missing.willSubstitute.size() == 1) {
-            printMsg(lvl, "this path will be fetched (%.2f MiB download, %.2f MiB unpacked):",
-                downloadSizeMiB,
-                narSizeMiB);
+            printMsg(
+                lvl, "this path will be fetched (%.2f MiB download, %.2f MiB unpacked):", downloadSizeMiB, narSizeMiB);
         } else {
-            printMsg(lvl, "these %d paths will be fetched (%.2f MiB download, %.2f MiB unpacked):",
+            printMsg(
+                lvl,
+                "these %d paths will be fetched (%.2f MiB download, %.2f MiB unpacked):",
                 missing.willSubstitute.size(),
                 downloadSizeMiB,
                 narSizeMiB);
         }
         std::vector<const StorePath *> willSubstituteSorted = {};
-        std::for_each(missing.willSubstitute.begin(), missing.willSubstitute.end(),
-                   [&](const StorePath &p) { willSubstituteSorted.push_back(&p); });
-        std::sort(willSubstituteSorted.begin(), willSubstituteSorted.end(),
-                  [](const StorePath *lhs, const StorePath *rhs) {
-                    if (lhs->name() == rhs->name())
-                      return lhs->to_string() < rhs->to_string();
-                    else
-                      return lhs->name() < rhs->name();
-                  });
+        std::for_each(missing.willSubstitute.begin(), missing.willSubstitute.end(), [&](const StorePath & p) {
+            willSubstituteSorted.push_back(&p);
+        });
+        std::sort(
+            willSubstituteSorted.begin(), willSubstituteSorted.end(), [](const StorePath * lhs, const StorePath * rhs) {
+                if (lhs->name() == rhs->name())
+                    return lhs->to_string() < rhs->to_string();
+                else
+                    return lhs->name() < rhs->name();
+            });
         for (auto p : willSubstituteSorted)
             printMsg(lvl, "  %s", store->printStorePath(*p));
     }
 
     if (!missing.unknown.empty()) {
-        printMsg(lvl, "don't know how to build these paths%s:",
-                (settings.readOnlyMode ? " (may be caused by read-only store access)" : ""));
+        printMsg(
+            lvl,
+            "don't know how to build these paths%s:",
+            (settings.readOnlyMode ? " (may be caused by read-only store access)" : ""));
         for (auto & i : missing.unknown)
             printMsg(lvl, "  %s", store->printStorePath(i));
     }
 }
 
-
-std::string getArg(const std::string & opt,
-    Strings::iterator & i, const Strings::iterator & end)
+std::string getArg(const std::string & opt, Strings::iterator & i, const Strings::iterator & end)
 {
     ++i;
-    if (i == end) throw UsageError("'%1%' requires an argument", opt);
+    if (i == end)
+        throw UsageError("'%1%' requires an argument", opt);
     return *i;
 }
 
 #ifndef _WIN32
-static void sigHandler(int signo) { }
+static void sigHandler(int signo) {}
 #endif
 
-
 void initNix(bool loadConfig)
 {
     /* Turn on buffering for cerr. */
@@ -139,7 +138,8 @@ void initNix(bool loadConfig)
 
     /* Install a dummy SIGUSR1 handler for use with pthread_kill(). */
     act.sa_handler = sigHandler;
-    if (sigaction(SIGUSR1, &act, 0)) throw SysError("handling SIGUSR1");
+    if (sigaction(SIGUSR1, &act, 0))
+        throw SysError("handling SIGUSR1");
 #endif
 
 #ifdef __APPLE__
@@ -147,19 +147,26 @@ void initNix(bool loadConfig)
      * Instead, add a dummy sigaction handler, and signalHandlerThread
      * can handle the rest. */
     act.sa_handler = sigHandler;
-    if (sigaction(SIGWINCH, &act, 0)) throw SysError("handling SIGWINCH");
+    if (sigaction(SIGWINCH, &act, 0))
+        throw SysError("handling SIGWINCH");
 
     /* Disable SA_RESTART for interrupts, so that system calls on this thread
      * error with EINTR like they do on Linux.
      * Most signals on BSD systems default to SA_RESTART on, but Nix
      * expects EINTR from syscalls to properly exit. */
     act.sa_handler = SIG_DFL;
-    if (sigaction(SIGINT, &act, 0)) throw SysError("handling SIGINT");
-    if (sigaction(SIGTERM, &act, 0)) throw SysError("handling SIGTERM");
-    if (sigaction(SIGHUP, &act, 0)) throw SysError("handling SIGHUP");
-    if (sigaction(SIGPIPE, &act, 0)) throw SysError("handling SIGPIPE");
-    if (sigaction(SIGQUIT, &act, 0)) throw SysError("handling SIGQUIT");
-    if (sigaction(SIGTRAP, &act, 0)) throw SysError("handling SIGTRAP");
+    if (sigaction(SIGINT, &act, 0))
+        throw SysError("handling SIGINT");
+    if (sigaction(SIGTERM, &act, 0))
+        throw SysError("handling SIGTERM");
+    if (sigaction(SIGHUP, &act, 0))
+        throw SysError("handling SIGHUP");
+    if (sigaction(SIGPIPE, &act, 0))
+        throw SysError("handling SIGPIPE");
+    if (sigaction(SIGQUIT, &act, 0))
+        throw SysError("handling SIGQUIT");
+    if (sigaction(SIGTRAP, &act, 0))
+        throw SysError("handling SIGTRAP");
 #endif
 
 #ifndef _WIN32
@@ -176,52 +183,52 @@ void initNix(bool loadConfig)
     umask(0022);
 }
 
-
-LegacyArgs::LegacyArgs(const std::string & programName,
+LegacyArgs::LegacyArgs(
+    const std::string & programName,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
-    : MixCommonArgs(programName), parseArg(parseArg)
+    : MixCommonArgs(programName)
+    , parseArg(parseArg)
 {
     addFlag({
         .longName = "no-build-output",
         .shortName = 'Q',
         .description = "Do not show build output.",
-        .handler = {[&]() {setLogFormat(LogFormat::raw); }},
+        .handler = {[&]() { setLogFormat(LogFormat::raw); }},
     });
 
     addFlag({
         .longName = "keep-failed",
-        .shortName ='K',
+        .shortName = 'K',
         .description = "Keep temporary directories of failed builds.",
-        .handler = {&(bool&) settings.keepFailed, true},
+        .handler = {&(bool &) settings.keepFailed, true},
     });
 
     addFlag({
         .longName = "keep-going",
-        .shortName ='k',
+        .shortName = 'k',
         .description = "Keep going after a build fails.",
-        .handler = {&(bool&) settings.keepGoing, true},
+        .handler = {&(bool &) settings.keepGoing, true},
     });
 
     addFlag({
         .longName = "fallback",
         .description = "Build from source if substitution fails.",
-        .handler = {&(bool&) settings.tryFallback, true},
+        .handler = {&(bool &) settings.tryFallback, true},
     });
 
-    auto intSettingAlias = [&](char shortName, const std::string & longName,
-        const std::string & description, const std::string & dest)
-    {
-        addFlag({
-            .longName = longName,
-            .shortName = shortName,
-            .description = description,
-            .labels = {"n"},
-            .handler = {[=](std::string s) {
-                auto n = string2IntWithUnitPrefix<uint64_t>(s);
-                settings.set(dest, std::to_string(n));
-            }},
-        });
-    };
+    auto intSettingAlias =
+        [&](char shortName, const std::string & longName, const std::string & description, const std::string & dest) {
+            addFlag({
+                .longName = longName,
+                .shortName = shortName,
+                .description = description,
+                .labels = {"n"},
+                .handler = {[=](std::string s) {
+                    auto n = string2IntWithUnitPrefix<uint64_t>(s);
+                    settings.set(dest, std::to_string(n));
+                }},
+            });
+        };
 
     intSettingAlias(0, "cores", "Maximum number of CPU cores to use inside a build.", "cores");
     intSettingAlias(0, "max-silent-time", "Number of seconds of silence before a build is killed.", "max-silent-time");
@@ -243,23 +250,24 @@ LegacyArgs::LegacyArgs(const std::string & programName,
         .longName = "store",
         .description = "The URL of the Nix store to use.",
         .labels = {"store-uri"},
-        .handler = {&(std::string&) settings.storeUri},
+        .handler = {&(std::string &) settings.storeUri},
     });
 }
 
-
 bool LegacyArgs::processFlag(Strings::iterator & pos, Strings::iterator end)
 {
-    if (MixCommonArgs::processFlag(pos, end)) return true;
+    if (MixCommonArgs::processFlag(pos, end))
+        return true;
     bool res = parseArg(pos, end);
-    if (res) ++pos;
+    if (res)
+        ++pos;
     return res;
 }
 
-
 bool LegacyArgs::processArgs(const Strings & args, bool finish)
 {
-    if (args.empty()) return true;
+    if (args.empty())
+        return true;
     assert(args.size() == 1);
     Strings ss(args);
     auto pos = ss.begin();
@@ -268,21 +276,20 @@ bool LegacyArgs::processArgs(const Strings & args, bool finish)
     return true;
 }
 
-
-void parseCmdLine(int argc, char * * argv,
-    std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
+void parseCmdLine(
+    int argc, char ** argv, std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
 {
     parseCmdLine(std::string(baseNameOf(argv[0])), argvToStrings(argc, argv), parseArg);
 }
 
-
-void parseCmdLine(const std::string & programName, const Strings & args,
+void parseCmdLine(
+    const std::string & programName,
+    const Strings & args,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
 {
     LegacyArgs(programName, parseArg).parseCmdline(args);
 }
 
-
 void printVersion(const std::string & programName)
 {
     std::cout << fmt("%1% (Nix) %2%", programName, nixVersion) << std::endl;
@@ -296,9 +303,7 @@ void printVersion(const std::string & programName)
         std::cout << "Additional system types: " << concatStringsSep(", ", settings.extraPlatforms.get()) << "\n";
         std::cout << "Features: " << concatStringsSep(", ", cfg) << "\n";
         std::cout << "System configuration file: " << settings.nixConfDir + "/nix.conf" << "\n";
-        std::cout << "User configuration files: " <<
-            concatStringsSep(":", settings.nixUserConfFiles)
-            << "\n";
+        std::cout << "User configuration files: " << concatStringsSep(":", settings.nixUserConfFiles) << "\n";
         std::cout << "Store directory: " << settings.nixStore << "\n";
         std::cout << "State directory: " << settings.nixStateDir << "\n";
         std::cout << "Data directory: " << settings.nixDataDir << "\n";
@@ -349,13 +354,15 @@ int handleExceptions(const std::string & programName, std::function<void()> fun)
     return 0;
 }
 
-
 RunPager::RunPager()
 {
-    if (!isatty(STDOUT_FILENO)) return;
+    if (!isatty(STDOUT_FILENO))
+        return;
     char * pager = getenv("NIX_PAGER");
-    if (!pager) pager = getenv("PAGER");
-    if (pager && ((std::string) pager == "" || (std::string) pager == "cat")) return;
+    if (!pager)
+        pager = getenv("PAGER");
+    if (pager && ((std::string) pager == "" || (std::string) pager == "cat"))
+        return;
 
     logger->stop();
 
@@ -386,7 +393,6 @@ RunPager::RunPager()
 #endif
 }
 
-
 RunPager::~RunPager()
 {
     try {
@@ -402,13 +408,10 @@ RunPager::~RunPager()
     }
 }
 
-
 PrintFreed::~PrintFreed()
 {
     if (show)
-        std::cout << fmt("%d store paths deleted, %s freed\n",
-            results.paths.size(),
-            showBytes(results.bytesFreed));
+        std::cout << fmt("%d store paths deleted, %s freed\n", results.paths.size(), showBytes(results.bytesFreed));
 }
 
-}
+} // namespace nix
diff --git a/src/libmain/unix/stack.cc b/src/libmain/unix/stack.cc
index cee21d2a2..458693407 100644
--- a/src/libmain/unix/stack.cc
+++ b/src/libmain/unix/stack.cc
@@ -10,7 +10,6 @@
 
 namespace nix {
 
-
 static void sigsegvHandler(int signo, siginfo_t * info, void * ctx)
 {
     /* Detect stack overflows by comparing the faulting address with
@@ -28,7 +27,8 @@ static void sigsegvHandler(int signo, siginfo_t * info, void * ctx)
 
     if (haveSP) {
         ptrdiff_t diff = (char *) info->si_addr - sp;
-        if (diff < 0) diff = -diff;
+        if (diff < 0)
+            diff = -diff;
         if (diff < 4096) {
             nix::stackOverflowHandler(info, ctx);
         }
@@ -39,13 +39,13 @@ static void sigsegvHandler(int signo, siginfo_t * info, void * ctx)
     sigfillset(&act.sa_mask);
     act.sa_handler = SIG_DFL;
     act.sa_flags = 0;
-    if (sigaction(SIGSEGV, &act, 0)) abort();
+    if (sigaction(SIGSEGV, &act, 0))
+        abort();
 }
 
-
 void detectStackOverflow()
 {
-#if defined(SA_SIGINFO) && defined (SA_ONSTACK)
+#if defined(SA_SIGINFO) && defined(SA_ONSTACK)
     /* Install a SIGSEGV handler to detect stack overflows.  This
        requires an alternative stack, otherwise the signal cannot be
        delivered when we're out of stack space. */
@@ -53,9 +53,11 @@ void detectStackOverflow()
     stack.ss_size = 4096 * 4 + MINSIGSTKSZ;
     static auto stackBuf = std::make_unique<std::vector<char>>(stack.ss_size);
     stack.ss_sp = stackBuf->data();
-    if (!stack.ss_sp) throw Error("cannot allocate alternative stack");
+    if (!stack.ss_sp)
+        throw Error("cannot allocate alternative stack");
     stack.ss_flags = 0;
-    if (sigaltstack(&stack, 0) == -1) throw SysError("cannot set alternative stack");
+    if (sigaltstack(&stack, 0) == -1)
+        throw SysError("cannot set alternative stack");
 
     struct sigaction act;
     sigfillset(&act.sa_mask);
@@ -68,10 +70,11 @@ void detectStackOverflow()
 
 std::function<void(siginfo_t * info, void * ctx)> stackOverflowHandler(defaultStackOverflowHandler);
 
-void defaultStackOverflowHandler(siginfo_t * info, void * ctx) {
+void defaultStackOverflowHandler(siginfo_t * info, void * ctx)
+{
     char msg[] = "error: stack overflow (possible infinite recursion)\n";
     [[gnu::unused]] auto res = write(2, msg, strlen(msg));
     _exit(1); // maybe abort instead?
 }
 
-}
+} // namespace nix
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index eb5563161..f8eaef803 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -1,7 +1,9 @@
-project('nix-store-c', 'cpp',
+project(
+  'nix-store-c',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -29,7 +31,7 @@ sources = files(
   'nix_api_store.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 headers = files(
   'nix_api_store.h',
@@ -46,7 +48,7 @@ this_library = library(
   sources,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libstore-c/nix_api_store.cc b/src/libstore-c/nix_api_store.cc
index b7b437e9c..7ce63f5c2 100644
--- a/src/libstore-c/nix_api_store.cc
+++ b/src/libstore-c/nix_api_store.cc
@@ -10,6 +10,8 @@
 
 #include "nix/store/globals.hh"
 
+extern "C" {
+
 nix_err nix_libstore_init(nix_c_context * context)
 {
     if (context)
@@ -62,7 +64,7 @@ nix_err nix_store_get_uri(nix_c_context * context, Store * store, nix_get_string
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto res = store->ptr->getUri();
+        auto res = store->ptr->config.getReference().render(/*withParams=*/true);
         return call_nix_get_string_callback(res, callback, user_data);
     }
     NIXC_CATCH_ERRS
@@ -91,7 +93,7 @@ nix_store_get_version(nix_c_context * context, Store * store, nix_get_string_cal
     NIXC_CATCH_ERRS
 }
 
-bool nix_store_is_valid_path(nix_c_context * context, Store * store, StorePath * path)
+bool nix_store_is_valid_path(nix_c_context * context, Store * store, const StorePath * path)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -129,7 +131,7 @@ nix_err nix_store_realise(
     Store * store,
     StorePath * path,
     void * userdata,
-    void (*callback)(void * userdata, const char *, const char *))
+    void (*callback)(void * userdata, const char *, const StorePath *))
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -144,8 +146,8 @@ nix_err nix_store_realise(
         if (callback) {
             for (const auto & result : results) {
                 for (const auto & [outputName, realisation] : result.builtOutputs) {
-                    auto op = store->ptr->printStorePath(realisation.outPath);
-                    callback(userdata, outputName.c_str(), op.c_str());
+                    StorePath p{realisation.outPath};
+                    callback(userdata, outputName.c_str(), &p);
                 }
             }
         }
@@ -180,3 +182,5 @@ nix_err nix_store_copy_closure(nix_c_context * context, Store * srcStore, Store
     }
     NIXC_CATCH_ERRS
 }
+
+} // extern "C"
diff --git a/src/libstore-c/nix_api_store.h b/src/libstore-c/nix_api_store.h
index e55bc3f59..51bd1bc89 100644
--- a/src/libstore-c/nix_api_store.h
+++ b/src/libstore-c/nix_api_store.h
@@ -57,14 +57,14 @@ nix_err nix_libstore_init_no_load_config(nix_c_context * context);
  * ignores `NIX_REMOTE` and the `store` option. For this reason, `NULL` is most likely the better choice.
  *
  *   For supported store URLs, see [*Store URL format* in the Nix Reference
- * Manual](https://nixos.org/manual/nix/stable/store/types/#store-url-format).
+ * Manual](https://nix.dev/manual/nix/stable/store/types/#store-url-format).
  * @endparblock
  *
  * @param[in] params @parblock
  *   optional, null-terminated array of key-value pairs, e.g. {{"endpoint",
  * "https://s3.local"}}.
  *
- *   See [*Store Types* in the Nix Reference Manual](https://nixos.org/manual/nix/stable/store/types).
+ *   See [*Store Types* in the Nix Reference Manual](https://nix.dev/manual/nix/stable/store/types).
  * @endparblock
  *
  * @return a Store pointer, NULL in case of errors
@@ -148,7 +148,7 @@ void nix_store_path_free(StorePath * p);
  * @param[in] path Path to check
  * @return true or false, error info in context
  */
-bool nix_store_is_valid_path(nix_c_context * context, Store * store, StorePath * path);
+bool nix_store_is_valid_path(nix_c_context * context, Store * store, const StorePath * path);
 
 /**
  * @brief Get the physical location of a store path
@@ -190,7 +190,7 @@ nix_err nix_store_realise(
     Store * store,
     StorePath * path,
     void * userdata,
-    void (*callback)(void * userdata, const char * outname, const char * out));
+    void (*callback)(void * userdata, const char * outname, const StorePath * out));
 
 /**
  * @brief get the version of a nix store.
diff --git a/src/libstore-c/nix_api_store_internal.h b/src/libstore-c/nix_api_store_internal.h
index b0194bfd3..cbe04b2c7 100644
--- a/src/libstore-c/nix_api_store_internal.h
+++ b/src/libstore-c/nix_api_store_internal.h
@@ -2,6 +2,8 @@
 #define NIX_API_STORE_INTERNAL_H
 #include "nix/store/store-api.hh"
 
+extern "C" {
+
 struct Store
 {
     nix::ref<nix::Store> ptr;
@@ -12,4 +14,6 @@ struct StorePath
     nix::StorePath path;
 };
 
+} // extern "C"
+
 #endif
diff --git a/src/libstore-test-support/derived-path.cc b/src/libstore-test-support/derived-path.cc
index c7714449c..cb1d23ac5 100644
--- a/src/libstore-test-support/derived-path.cc
+++ b/src/libstore-test-support/derived-path.cc
@@ -1,5 +1,6 @@
 #include <regex>
 
+#include <exception> // Needed by rapidcheck on Darwin
 #include <rapidcheck.h>
 
 #include "nix/store/tests/derived-path.hh"
@@ -68,4 +69,4 @@ Gen<DerivedPath> Arbitrary<DerivedPath>::arbitrary()
     });
 }
 
-}
+} // namespace rc
diff --git a/src/libstore-test-support/include/nix/store/tests/derived-path.hh b/src/libstore-test-support/include/nix/store/tests/derived-path.hh
index 642ce557c..b3b43474a 100644
--- a/src/libstore-test-support/include/nix/store/tests/derived-path.hh
+++ b/src/libstore-test-support/include/nix/store/tests/derived-path.hh
@@ -12,28 +12,33 @@ namespace rc {
 using namespace nix;
 
 template<>
-struct Arbitrary<SingleDerivedPath::Opaque> {
+struct Arbitrary<SingleDerivedPath::Opaque>
+{
     static Gen<SingleDerivedPath::Opaque> arbitrary();
 };
 
 template<>
-struct Arbitrary<SingleDerivedPath::Built> {
+struct Arbitrary<SingleDerivedPath::Built>
+{
     static Gen<SingleDerivedPath::Built> arbitrary();
 };
 
 template<>
-struct Arbitrary<SingleDerivedPath> {
+struct Arbitrary<SingleDerivedPath>
+{
     static Gen<SingleDerivedPath> arbitrary();
 };
 
 template<>
-struct Arbitrary<DerivedPath::Built> {
+struct Arbitrary<DerivedPath::Built>
+{
     static Gen<DerivedPath::Built> arbitrary();
 };
 
 template<>
-struct Arbitrary<DerivedPath> {
+struct Arbitrary<DerivedPath>
+{
     static Gen<DerivedPath> arbitrary();
 };
 
-}
+} // namespace rc
diff --git a/src/libstore-test-support/include/nix/store/tests/libstore.hh b/src/libstore-test-support/include/nix/store/tests/libstore.hh
index 822ec3aa8..28b29fa31 100644
--- a/src/libstore-test-support/include/nix/store/tests/libstore.hh
+++ b/src/libstore-test-support/include/nix/store/tests/libstore.hh
@@ -6,6 +6,7 @@
 
 #include "nix/store/store-api.hh"
 #include "nix/store/store-open.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
diff --git a/src/libstore-test-support/include/nix/store/tests/meson.build b/src/libstore-test-support/include/nix/store/tests/meson.build
index ae5db049e..f79769d41 100644
--- a/src/libstore-test-support/include/nix/store/tests/meson.build
+++ b/src/libstore-test-support/include/nix/store/tests/meson.build
@@ -1,6 +1,6 @@
 # Public headers directory
 
-include_dirs = [include_directories('../../..')]
+include_dirs = [ include_directories('../../..') ]
 
 headers = files(
   'derived-path.hh',
diff --git a/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh b/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh
index e51be3dab..608aa63d6 100644
--- a/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh
+++ b/src/libstore-test-support/include/nix/store/tests/nix_api_store.hh
@@ -44,8 +44,9 @@ protected:
         // no `mkdtemp` with MinGW
         auto tmpl = nix::defaultTempDir() + "/tests_nix-store.";
         for (size_t i = 0; true; ++i) {
-            nixDir = tmpl + std::string { i };
-            if (std::filesystem::create_directory(nixDir)) break;
+            nixDir = tmpl + std::string{i};
+            if (std::filesystem::create_directory(nixDir))
+                break;
         }
 #else
         // resolve any symlinks in i.e. on macOS /tmp -> /private/tmp
@@ -72,4 +73,4 @@ protected:
         };
     }
 };
-}
+} // namespace nixC
diff --git a/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh b/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh
index c13c992b6..5bbcc7340 100644
--- a/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh
+++ b/src/libstore-test-support/include/nix/store/tests/outputs-spec.hh
@@ -1,6 +1,7 @@
 #pragma once
 ///@file
 
+#include <exception> // Needed by rapidcheck on Darwin
 #include <rapidcheck/gen/Arbitrary.h>
 
 #include "nix/store/outputs-spec.hh"
@@ -11,8 +12,9 @@ namespace rc {
 using namespace nix;
 
 template<>
-struct Arbitrary<OutputsSpec> {
+struct Arbitrary<OutputsSpec>
+{
     static Gen<OutputsSpec> arbitrary();
 };
 
-}
+} // namespace rc
diff --git a/src/libstore-test-support/include/nix/store/tests/path.hh b/src/libstore-test-support/include/nix/store/tests/path.hh
index 59ff604d7..ff80b1299 100644
--- a/src/libstore-test-support/include/nix/store/tests/path.hh
+++ b/src/libstore-test-support/include/nix/store/tests/path.hh
@@ -7,26 +7,29 @@
 
 namespace nix {
 
-struct StorePathName {
+struct StorePathName
+{
     std::string name;
 };
 
 // For rapidcheck
 void showValue(const StorePath & p, std::ostream & os);
 
-}
+} // namespace nix
 
 namespace rc {
 using namespace nix;
 
 template<>
-struct Arbitrary<StorePathName> {
+struct Arbitrary<StorePathName>
+{
     static Gen<StorePathName> arbitrary();
 };
 
 template<>
-struct Arbitrary<StorePath> {
+struct Arbitrary<StorePath>
+{
     static Gen<StorePath> arbitrary();
 };
 
-}
+} // namespace rc
diff --git a/src/libstore-test-support/include/nix/store/tests/protocol.hh b/src/libstore-test-support/include/nix/store/tests/protocol.hh
index acd10bf9d..5b57c6585 100644
--- a/src/libstore-test-support/include/nix/store/tests/protocol.hh
+++ b/src/libstore-test-support/include/nix/store/tests/protocol.hh
@@ -10,13 +10,18 @@
 namespace nix {
 
 template<class Proto, const char * protocolDir>
-class ProtoTest : public CharacterizationTest, public LibStoreTest
+class ProtoTest : public CharacterizationTest
 {
     std::filesystem::path unitTestData = getUnitTestData() / protocolDir;
 
-    std::filesystem::path goldenMaster(std::string_view testStem) const override {
-        return unitTestData / (std::string { testStem + ".bin" });
+    std::filesystem::path goldenMaster(std::string_view testStem) const override
+    {
+        return unitTestData / (std::string{testStem + ".bin"});
     }
+
+public:
+    Path storeDir = "/nix/store";
+    StoreDirConfig store{storeDir};
 };
 
 template<class Proto, const char * protocolDir>
@@ -31,10 +36,10 @@ public:
     {
         CharacterizationTest::readTest(testStem, [&](const auto & encoded) {
             T got = ({
-                StringSource from { encoded };
+                StringSource from{encoded};
                 Proto::template Serialise<T>::read(
-                    *LibStoreTest::store,
-                    typename Proto::ReadConn {
+                    this->store,
+                    typename Proto::ReadConn{
                         .from = from,
                         .version = version,
                     });
@@ -53,8 +58,8 @@ public:
         CharacterizationTest::writeTest(testStem, [&]() {
             StringSink to;
             Proto::template Serialise<T>::write(
-                *LibStoreTest::store,
-                typename Proto::WriteConn {
+                this->store,
+                typename Proto::WriteConn{
                     .to = to,
                     .version = version,
                 },
@@ -65,11 +70,13 @@ public:
 };
 
 #define VERSIONED_CHARACTERIZATION_TEST(FIXTURE, NAME, STEM, VERSION, VALUE) \
-    TEST_F(FIXTURE, NAME ## _read) { \
-        readProtoTest(STEM, VERSION, VALUE); \
-    } \
-    TEST_F(FIXTURE, NAME ## _write) { \
-        writeProtoTest(STEM, VERSION, VALUE); \
+    TEST_F(FIXTURE, NAME##_read)                                             \
+    {                                                                        \
+        readProtoTest(STEM, VERSION, VALUE);                                 \
+    }                                                                        \
+    TEST_F(FIXTURE, NAME##_write)                                            \
+    {                                                                        \
+        writeProtoTest(STEM, VERSION, VALUE);                                \
     }
 
-}
+} // namespace nix
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index 779b122fa..b2977941f 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -1,7 +1,9 @@
-project('nix-store-test-support', 'cpp',
+project(
+  'nix-store-test-support',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -14,8 +16,7 @@ cxx = meson.get_compiler('cpp')
 
 subdir('nix-meson-build-support/deps-lists')
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-test-support'),
@@ -47,7 +48,7 @@ this_library = library(
   include_directories : include_dirs,
   # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
   #       is available. See also ../libutil/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libstore-test-support/outputs-spec.cc b/src/libstore-test-support/outputs-spec.cc
index 5b5251361..d5128a8bd 100644
--- a/src/libstore-test-support/outputs-spec.cc
+++ b/src/libstore-test-support/outputs-spec.cc
@@ -24,4 +24,4 @@ Gen<OutputsSpec> Arbitrary<OutputsSpec>::arbitrary()
         });
 }
 
-}
+} // namespace rc
diff --git a/src/libstore-test-support/path.cc b/src/libstore-test-support/path.cc
index 47c1d693b..145920310 100644
--- a/src/libstore-test-support/path.cc
+++ b/src/libstore-test-support/path.cc
@@ -1,6 +1,7 @@
-#include <rapidcheck/gen/Arbitrary.h>
+#include <exception> // Needed by rapidcheck on Darwin
 #include <regex>
 
+#include <rapidcheck/gen/Arbitrary.h>
 #include <rapidcheck.h>
 
 #include "nix/store/path-regex.hh"
@@ -16,15 +17,16 @@ void showValue(const StorePath & p, std::ostream & os)
     os << p.to_string();
 }
 
-}
+} // namespace nix
 
 namespace rc {
 using namespace nix;
 
 Gen<char> storePathChar()
 {
-    return rc::gen::apply([](uint8_t i) -> char {
-        switch (i) {
+    return rc::gen::apply(
+        [](uint8_t i) -> char {
+            switch (i) {
             case 0 ... 9:
                 return '0' + i;
             case 10 ... 35:
@@ -45,36 +47,23 @@ Gen<char> storePathChar()
                 return '=';
             default:
                 assert(false);
-        }
-    },
-    gen::inRange<uint8_t>(0, 10 + 2 * 26 + 6));
+            }
+        },
+        gen::inRange<uint8_t>(0, 10 + 2 * 26 + 6));
 }
 
 Gen<StorePathName> Arbitrary<StorePathName>::arbitrary()
 {
     return gen::construct<StorePathName>(
-        gen::suchThat(
-            gen::container<std::string>(storePathChar()),
-            [](const std::string & s) {
-                return
-                    !( s == ""
-                    || s == "."
-                    || s == ".."
-                    || s.starts_with(".-")
-                    || s.starts_with("..-")
-                    );
-            }
-        )
-    );
+        gen::suchThat(gen::container<std::string>(storePathChar()), [](const std::string & s) {
+            return !(s == "" || s == "." || s == ".." || s.starts_with(".-") || s.starts_with("..-"));
+        }));
 }
 
 Gen<StorePath> Arbitrary<StorePath>::arbitrary()
 {
-    return
-        gen::construct<StorePath>(
-            gen::arbitrary<Hash>(),
-            gen::apply([](StorePathName n){ return n.name; }, gen::arbitrary<StorePathName>())
-        );
+    return gen::construct<StorePath>(
+        gen::arbitrary<Hash>(), gen::apply([](StorePathName n) { return n.name; }, gen::arbitrary<StorePathName>()));
 }
 
 } // namespace rc
diff --git a/src/libstore-tests/bench-main.cc b/src/libstore-tests/bench-main.cc
new file mode 100644
index 000000000..37a72d8ab
--- /dev/null
+++ b/src/libstore-tests/bench-main.cc
@@ -0,0 +1,14 @@
+#include <benchmark/benchmark.h>
+#include "nix/store/globals.hh"
+
+// Custom main to initialize Nix before running benchmarks
+int main(int argc, char ** argv)
+{
+    // Initialize libstore
+    nix::initLibStore(false);
+
+    // Initialize and run benchmarks
+    ::benchmark::Initialize(&argc, argv);
+    ::benchmark::RunSpecifiedBenchmarks();
+    return 0;
+}
diff --git a/src/libstore-tests/common-protocol.cc b/src/libstore-tests/common-protocol.cc
index 5164f154a..35fca165d 100644
--- a/src/libstore-tests/common-protocol.cc
+++ b/src/libstore-tests/common-protocol.cc
@@ -24,10 +24,8 @@ public:
     {
         CharacterizationTest::readTest(testStem, [&](const auto & encoded) {
             T got = ({
-                StringSource from { encoded };
-                CommonProto::Serialise<T>::read(
-                    *store,
-                    CommonProto::ReadConn { .from = from });
+                StringSource from{encoded};
+                CommonProto::Serialise<T>::read(store, CommonProto::ReadConn{.from = from});
             });
 
             ASSERT_EQ(got, expected);
@@ -42,27 +40,26 @@ public:
     {
         CharacterizationTest::writeTest(testStem, [&]() -> std::string {
             StringSink to;
-            CommonProto::Serialise<T>::write(
-                *store,
-                CommonProto::WriteConn { .to = to },
-                decoded);
+            CommonProto::Serialise<T>::write(store, CommonProto::WriteConn{.to = to}, decoded);
             return to.s;
         });
     }
 };
 
 #define CHARACTERIZATION_TEST(NAME, STEM, VALUE) \
-    TEST_F(CommonProtoTest, NAME ## _read) { \
-        readProtoTest(STEM, VALUE); \
-    } \
-    TEST_F(CommonProtoTest, NAME ## _write) { \
-        writeProtoTest(STEM, VALUE); \
+    TEST_F(CommonProtoTest, NAME##_read)         \
+    {                                            \
+        readProtoTest(STEM, VALUE);              \
+    }                                            \
+    TEST_F(CommonProtoTest, NAME##_write)        \
+    {                                            \
+        writeProtoTest(STEM, VALUE);             \
     }
 
 CHARACTERIZATION_TEST(
     string,
     "string",
-    (std::tuple<std::string, std::string, std::string, std::string, std::string> {
+    (std::tuple<std::string, std::string, std::string, std::string, std::string>{
         "",
         "hi",
         "white rabbit",
@@ -73,24 +70,24 @@ CHARACTERIZATION_TEST(
 CHARACTERIZATION_TEST(
     storePath,
     "store-path",
-    (std::tuple<StorePath, StorePath> {
-        StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-        StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar" },
+    (std::tuple<StorePath, StorePath>{
+        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar"},
     }))
 
 CHARACTERIZATION_TEST(
     contentAddress,
     "content-address",
-    (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
-        ContentAddress {
+    (std::tuple<ContentAddress, ContentAddress, ContentAddress>{
+        ContentAddress{
             .method = ContentAddressMethod::Raw::Text,
             .hash = hashString(HashAlgorithm::SHA256, "Derive(...)"),
         },
-        ContentAddress {
+        ContentAddress{
             .method = ContentAddressMethod::Raw::Flat,
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
-        ContentAddress {
+        ContentAddress{
             .method = ContentAddressMethod::Raw::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
@@ -99,12 +96,12 @@ CHARACTERIZATION_TEST(
 CHARACTERIZATION_TEST(
     drvOutput,
     "drv-output",
-    (std::tuple<DrvOutput, DrvOutput> {
+    (std::tuple<DrvOutput, DrvOutput>{
         {
             .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
             .outputName = "baz",
         },
-        DrvOutput {
+        DrvOutput{
             .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
             .outputName = "quux",
         },
@@ -113,75 +110,82 @@ CHARACTERIZATION_TEST(
 CHARACTERIZATION_TEST(
     realisation,
     "realisation",
-    (std::tuple<Realisation, Realisation> {
-        Realisation {
-            .id = DrvOutput {
-                .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-                .outputName = "baz",
-            },
-            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-            .signatures = { "asdf", "qwer" },
-        },
-        Realisation {
-            .id = {
-                .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-                .outputName = "baz",
-            },
-            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-            .signatures = { "asdf", "qwer" },
-            .dependentRealisations = {
-                {
-                    DrvOutput {
-                        .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                        .outputName = "quux",
-                    },
-                    StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
+    (std::tuple<Realisation, Realisation>{
+        Realisation{
+            .id =
+                DrvOutput{
+                    .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
+                    .outputName = "baz",
+                },
+            .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+            .signatures = {"asdf", "qwer"},
+        },
+        Realisation{
+            .id =
+                {
+                    .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
+                    .outputName = "baz",
+                },
+            .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+            .signatures = {"asdf", "qwer"},
+            .dependentRealisations =
+                {
+                    {
+                        DrvOutput{
+                            .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                            .outputName = "quux",
+                        },
+                        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+                    },
                 },
-            },
         },
     }))
 
 CHARACTERIZATION_TEST(
     vector,
     "vector",
-    (std::tuple<std::vector<std::string>, std::vector<std::string>, std::vector<std::string>, std::vector<std::vector<std::string>>> {
-        { },
-        { "" },
-        { "", "foo", "bar" },
-        { {}, { "" }, { "", "1", "2" } },
+    (std::tuple<
+        std::vector<std::string>,
+        std::vector<std::string>,
+        std::vector<std::string>,
+        std::vector<std::vector<std::string>>>{
+        {},
+        {""},
+        {"", "foo", "bar"},
+        {{}, {""}, {"", "1", "2"}},
     }))
 
 CHARACTERIZATION_TEST(
     set,
     "set",
-    (std::tuple<StringSet, StringSet, StringSet, std::set<StringSet>> {
-        { },
-        { "" },
-        { "", "foo", "bar" },
-        { {}, { "" }, { "", "1", "2" } },
+    (std::tuple<StringSet, StringSet, StringSet, std::set<StringSet>>{
+        {},
+        {""},
+        {"", "foo", "bar"},
+        {{}, {""}, {"", "1", "2"}},
     }))
 
 CHARACTERIZATION_TEST(
     optionalStorePath,
     "optional-store-path",
-    (std::tuple<std::optional<StorePath>, std::optional<StorePath>> {
+    (std::tuple<std::optional<StorePath>, std::optional<StorePath>>{
         std::nullopt,
-        std::optional {
-            StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar" },
+        std::optional{
+            StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar"},
         },
     }))
 
 CHARACTERIZATION_TEST(
     optionalContentAddress,
     "optional-content-address",
-    (std::tuple<std::optional<ContentAddress>, std::optional<ContentAddress>> {
+    (std::tuple<std::optional<ContentAddress>, std::optional<ContentAddress>>{
         std::nullopt,
-        std::optional {
-            ContentAddress {
+        std::optional{
+            ContentAddress{
                 .method = ContentAddressMethod::Raw::Flat,
                 .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
             },
         },
     }))
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/content-address.cc b/src/libstore-tests/content-address.cc
index c208c944d..51d591c38 100644
--- a/src/libstore-tests/content-address.cc
+++ b/src/libstore-tests/content-address.cc
@@ -8,30 +8,33 @@ namespace nix {
  * ContentAddressMethod::parse, ContentAddressMethod::render
  * --------------------------------------------------------------------------*/
 
-TEST(ContentAddressMethod, testRoundTripPrintParse_1) {
+TEST(ContentAddressMethod, testRoundTripPrintParse_1)
+{
     for (ContentAddressMethod cam : {
-        ContentAddressMethod::Raw::Text,
-        ContentAddressMethod::Raw::Flat,
-        ContentAddressMethod::Raw::NixArchive,
-        ContentAddressMethod::Raw::Git,
-    }) {
+             ContentAddressMethod::Raw::Text,
+             ContentAddressMethod::Raw::Flat,
+             ContentAddressMethod::Raw::NixArchive,
+             ContentAddressMethod::Raw::Git,
+         }) {
         EXPECT_EQ(ContentAddressMethod::parse(cam.render()), cam);
     }
 }
 
-TEST(ContentAddressMethod, testRoundTripPrintParse_2) {
+TEST(ContentAddressMethod, testRoundTripPrintParse_2)
+{
     for (const std::string_view camS : {
-        "text",
-        "flat",
-        "nar",
-        "git",
-    }) {
+             "text",
+             "flat",
+             "nar",
+             "git",
+         }) {
         EXPECT_EQ(ContentAddressMethod::parse(camS).render(), camS);
     }
 }
 
-TEST(ContentAddressMethod, testParseContentAddressMethodOptException) {
+TEST(ContentAddressMethod, testParseContentAddressMethodOptException)
+{
     EXPECT_THROW(ContentAddressMethod::parse("narwhal"), UsageError);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/data/derivation/firefox.drv b/src/libstore-tests/data/derivation/firefox.drv
new file mode 100644
index 000000000..d746d21e8
--- /dev/null
+++ b/src/libstore-tests/data/derivation/firefox.drv
@@ -0,0 +1 @@
+Derive([("out","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-140.0.4","","")],[("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-krb5-1.21.3.drv",["lib"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libglvnd-1.7.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-make-shell-wrapper-hook.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libva-2.22.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-policies.json.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-extract-binary-wrapper-cmd.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pipewire-1.4.6.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-alsa-lib-1.2.14.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-ffmpeg-7.1.1.drv",["lib"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-mesa-libgbm-25.1.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-vulkan-loader-1.4.313.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-speech-dispatcher-0.12.1.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pciutils-3.14.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-xdg-utils-1.2.1.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-cups-2.4.12.drv",["lib"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libnotify-0.8.6.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox.desktop.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-jq-1.8.1.drv",["dev"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libXScrnSaver-1.2.4.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lndir-1.0.5.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-sndio-1.10.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libpulseaudio-17.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-systemd-minimal-libs-257.6.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bash-5.2p37.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-stdenv-linux.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-gtk+3-3.24.49.drv",["dev"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libjack2-1.9.22.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-adwaita-icon-theme-48.0.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libcanberra-0.30.drv",["out"])],["/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-default-builder.sh","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-source-stdenv.sh"],"x86_64-linux","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bash-5.2p37/bin/bash",["-e","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-source-stdenv.sh","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-default-builder.sh"],[("__json","{\"NIX_MAIN_PROGRAM\":\"firefox\",\"buildCommand\":\"if [ ! -x \\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4/bin/firefox\\\" ]\\nthen\\n    echo \\\"cannot find executable file \\\\`/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4/bin/firefox'\\\"\\n    exit 1\\nfi\\n\\n#########################\\n#                       #\\n#   EXTRA PREF CHANGES  #\\n#                       #\\n#########################\\n# Link the runtime. The executable itself has to be copied,\\n# because it will resolve paths relative to its true location.\\n# Any symbolic links have to be replicated as well.\\ncd \\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4\\\"\\nfind . -type d -exec mkdir -p \\\"$out\\\"/{} \\\\;\\n\\nfind . -type f \\\\( -not -name \\\"firefox\\\" \\\\) -exec ln -sT \\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4\\\"/{} \\\"$out\\\"/{} \\\\;\\n\\nfind . -type f \\\\( -name \\\"firefox\\\" -o -name \\\"firefox-bin\\\" \\\\) -print0 | while read -d $'\\\\0' f; do\\n  cp -P --no-preserve=mode,ownership --remove-destination \\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4/$f\\\" \\\"$out/$f\\\"\\n  chmod a+rwx \\\"$out/$f\\\"\\ndone\\n\\n# fix links and absolute references\\n\\nfind . -type l -print0 | while read -d $'\\\\0' l; do\\n  target=\\\"$(readlink \\\"$l\\\")\\\"\\n  target=${target/#\\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4\\\"/\\\"$out\\\"}\\n  ln -sfT \\\"$target\\\" \\\"$out/$l\\\"\\ndone\\n\\ncd \\\"$out\\\"\\n\\n\\n# create the wrapper\\n\\nexecutablePrefix=\\\"$out/bin\\\"\\nexecutablePath=\\\"$out/bin/firefox\\\"\\noldWrapperArgs=()\\n\\nif [[ -L $executablePath ]]; then\\n  # Symbolic link: wrap the link's target.\\n  oldExe=\\\"$(readlink -v --canonicalize-existing \\\"$executablePath\\\")\\\"\\n  rm \\\"$executablePath\\\"\\nelif wrapperCmd=$(/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-extract-binary-wrapper-cmd \\\"$executablePath\\\"); [[ $wrapperCmd ]]; then\\n  # If the executable is a binary wrapper, we need to update its target to\\n  # point to $out, but we can't just edit the binary in-place because of length\\n  # issues. So we extract the command used to create the wrapper and add the\\n  # arguments to our wrapper.\\n  parseMakeCWrapperCall() {\\n    shift # makeCWrapper\\n    oldExe=$1; shift\\n    oldWrapperArgs=(\\\"$@\\\")\\n  }\\n  eval \\\"parseMakeCWrapperCall ${wrapperCmd//\\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4\\\"/\\\"$out\\\"}\\\"\\n  rm \\\"$executablePath\\\"\\nelse\\n  if read -rn2 shebang < \\\"$executablePath\\\" && [[ $shebang == '#!' ]]; then\\n    # Shell wrapper: patch in place to point to $out.\\n    sed -i \\\"s@/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4@$out@g\\\" \\\"$executablePath\\\"\\n  fi\\n  # Suffix the executable with -old, because -wrapped might already be used by the old wrapper.\\n  oldExe=\\\"$executablePrefix/.firefox\\\"-old\\n  mv \\\"$executablePath\\\" \\\"$oldExe\\\"\\nfi\\nappendToVar makeWrapperArgs --prefix XDG_DATA_DIRS : \\\"$GSETTINGS_SCHEMAS_PATH\\\"\\nconcatTo makeWrapperArgs oldWrapperArgs\\n\\nmakeWrapper \\\"$oldExe\\\" \\\"$out/bin/firefox\\\" \\\"${makeWrapperArgs[@]}\\\"\\n\\n#############################\\n#                           #\\n#   END EXTRA PREF CHANGES  #\\n#                           #\\n#############################\\nif [ -e \\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4/share/icons\\\" ]; then\\n    mkdir -p \\\"$out/share\\\"\\n    ln -s \\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4/share/icons\\\" \\\"$out/share/icons\\\"\\nelse\\n    for res in 16 32 48 64 128; do\\n    mkdir -p \\\"$out/share/icons/hicolor/${res}x${res}/apps\\\"\\n    icon=$( find \\\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-unwrapped-140.0.4/lib/\\\" -name \\\"default${res}.png\\\" )\\n      if [ -e \\\"$icon\\\" ]; then ln -s \\\"$icon\\\" \\\\\\n        \\\"$out/share/icons/hicolor/${res}x${res}/apps/firefox.png\\\"\\n      fi\\n    done\\nfi\\n\\ninstall -m 644 -D -t $out/share/applications $desktopItem/share/applications/*\\n\\nmkdir -p $out/lib/mozilla/native-messaging-hosts\\nfor ext in ; do\\n    ln -sLt $out/lib/mozilla/native-messaging-hosts $ext/lib/mozilla/native-messaging-hosts/*\\ndone\\n\\nmkdir -p $out/lib/mozilla/pkcs11-modules\\nfor ext in ; do\\n    ln -sLt $out/lib/mozilla/pkcs11-modules $ext/lib/mozilla/pkcs11-modules/*\\ndone\\n\\n\\n#########################\\n#                       #\\n#   EXTRA PREF CHANGES  #\\n#                       #\\n#########################\\n# user customization\\nlibDir=\\\"$out/lib/firefox\\\"\\n\\n# creating policies.json\\nmkdir -p \\\"$libDir/distribution\\\"\\n\\nPOL_PATH=\\\"$libDir/distribution/policies.json\\\"\\nrm -f \\\"$POL_PATH\\\"\\ncat /nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-policies.json >> \\\"$POL_PATH\\\"\\n\\nextraPoliciesFiles=()\\nfor extraPoliciesFile in \\\"${extraPoliciesFiles[@]}\\\"; do\\n  jq -s '.[0] * .[1]' $extraPoliciesFile \\\"$POL_PATH\\\" > .tmp.json\\n  mv .tmp.json \\\"$POL_PATH\\\"\\ndone\\n\\n# preparing for autoconfig\\nprefsDir=\\\"$out/lib/firefox/defaults/pref\\\"\\nmkdir -p \\\"$prefsDir\\\"\\n\\necho 'pref(\\\"general.config.filename\\\", \\\"mozilla.cfg\\\");' > \\\"$prefsDir/autoconfig.js\\\"\\necho 'pref(\\\"general.config.obscure_value\\\", 0);' >> \\\"$prefsDir/autoconfig.js\\\"\\n\\ncat > \\\"$libDir/mozilla.cfg\\\" << EOF\\n// First line must be a comment\\n\\n// Disables addon signature checking\\n// to be able to install addons that do not have an extid\\n// Security is maintained because only user whitelisted addons\\n// with a checksum can be installed\\n\\n\\nEOF\\n\\nextraPrefsFiles=()\\nfor extraPrefsFile in \\\"${extraPrefsFiles[@]}\\\"; do\\n  cat \\\"$extraPrefsFile\\\" >> \\\"$libDir/mozilla.cfg\\\"\\ndone\\n\\ncat >> \\\"$libDir/mozilla.cfg\\\" << EOF\\n\\nEOF\\n\\nmkdir -p \\\"$libDir/distribution/extensions\\\"\\n\\n#############################\\n#                           #\\n#   END EXTRA PREF CHANGES  #\\n#                           #\\n#############################\\n\",\"buildInputs\":[\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-gtk+3-3.24.49-dev\"],\"builder\":\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bash-5.2p37/bin/bash\",\"cmakeFlags\":[],\"configureFlags\":[],\"depsBuildBuild\":[],\"depsBuildBuildPropagated\":[],\"depsBuildTarget\":[],\"depsBuildTargetPropagated\":[],\"depsHostHost\":[],\"depsHostHostPropagated\":[],\"depsTargetTarget\":[],\"depsTargetTargetPropagated\":[],\"desktopItem\":\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox.desktop\",\"doCheck\":false,\"doInstallCheck\":false,\"env\":{\"NIX_MAIN_PROGRAM\":\"firefox\"},\"gtk_modules\":[\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libcanberra-0.30/lib/gtk-3.0/\"],\"libs\":\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-systemd-minimal-libs-257.6/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libva-2.22.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-mesa-libgbm-25.1.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libnotify-0.8.6/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libXScrnSaver-1.2.4/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-cups-2.4.12-lib/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pciutils-3.14.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-vulkan-loader-1.4.313.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-speech-dispatcher-0.12.1/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pipewire-1.4.6/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-ffmpeg-7.1.1-lib/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-krb5-1.21.3-lib/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libglvnd-1.7.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libpulseaudio-17.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-alsa-lib-1.2.14/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-sndio-1.10.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libjack2-1.9.22/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libcanberra-0.30/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-systemd-minimal-libs-257.6/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libva-2.22.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-mesa-libgbm-25.1.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libnotify-0.8.6/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libXScrnSaver-1.2.4/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-cups-2.4.12-lib/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pciutils-3.14.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-vulkan-loader-1.4.313.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-speech-dispatcher-0.12.1/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pipewire-1.4.6/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-ffmpeg-7.1.1-lib/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-krb5-1.21.3-lib/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libglvnd-1.7.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libpulseaudio-17.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-alsa-lib-1.2.14/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-sndio-1.10.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libjack2-1.9.22/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libcanberra-0.30/lib64\",\"makeWrapperArgs\":[\"--prefix\",\"LD_LIBRARY_PATH\",\":\",\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-systemd-minimal-libs-257.6/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libva-2.22.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-mesa-libgbm-25.1.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libnotify-0.8.6/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libXScrnSaver-1.2.4/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-cups-2.4.12-lib/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pciutils-3.14.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-vulkan-loader-1.4.313.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-speech-dispatcher-0.12.1/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pipewire-1.4.6/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-ffmpeg-7.1.1-lib/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-krb5-1.21.3-lib/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libglvnd-1.7.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libpulseaudio-17.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-alsa-lib-1.2.14/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-sndio-1.10.0/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libjack2-1.9.22/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libcanberra-0.30/lib:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-systemd-minimal-libs-257.6/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libva-2.22.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-mesa-libgbm-25.1.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libnotify-0.8.6/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libXScrnSaver-1.2.4/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-cups-2.4.12-lib/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pciutils-3.14.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-vulkan-loader-1.4.313.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-speech-dispatcher-0.12.1/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pipewire-1.4.6/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-ffmpeg-7.1.1-lib/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-krb5-1.21.3-lib/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libglvnd-1.7.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libpulseaudio-17.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-alsa-lib-1.2.14/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-sndio-1.10.0/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libjack2-1.9.22/lib64:/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libcanberra-0.30/lib64\",\"--suffix\",\"PATH\",\":\",\"/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9/bin\",\"--set\",\"MOZ_APP_LAUNCHER\",\"firefox\",\"--set\",\"MOZ_LEGACY_PROFILES\",\"1\",\"--set\",\"MOZ_ALLOW_DOWNGRADE\",\"1\",\"--suffix\",\"GTK_PATH\",\":\",\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-libcanberra-0.30/lib/gtk-3.0/\",\"--suffix\",\"XDG_DATA_DIRS\",\":\",\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-adwaita-icon-theme-48.0/share\",\"--set-default\",\"MOZ_ENABLE_WAYLAND\",\"1\",\"--suffix\",\"PATH\",\":\",\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-xdg-utils-1.2.1/bin\",\"--set\",\"MOZ_SYSTEM_DIR\",\"/1rz4g4znpzjwh1xymhjpm42vipw92pr73vdgl6xs1hycac8kf2n9/lib/mozilla\"],\"mesonFlags\":[],\"name\":\"firefox-140.0.4\",\"nativeBuildInputs\":[\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-make-shell-wrapper-hook\",\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-lndir-1.0.5\",\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-jq-1.8.1-dev\"],\"outputChecks\":{\"out\":{\"disallowedRequisites\":[\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-gcc-wrapper-14.3.0\"]}},\"outputs\":[\"out\"],\"patches\":[],\"pname\":\"firefox\",\"preferLocalBuild\":true,\"propagatedBuildInputs\":[],\"propagatedNativeBuildInputs\":[],\"stdenv\":\"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-stdenv-linux\",\"strictDeps\":false,\"system\":\"x86_64-linux\",\"version\":\"140.0.4\"}"),("out","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-firefox-140.0.4")])
\ No newline at end of file
diff --git a/src/libstore-tests/data/derivation/hello.drv b/src/libstore-tests/data/derivation/hello.drv
new file mode 100644
index 000000000..f92a4b485
--- /dev/null
+++ b/src/libstore-tests/data/derivation/hello.drv
@@ -0,0 +1 @@
+Derive([("out","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-hello-2.12.2","","")],[("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-version-check-hook.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-hello-2.12.2.tar.gz.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bash-5.2p37.drv",["out"]),("/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-stdenv-linux.drv",["out"])],["/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-default-builder.sh","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-source-stdenv.sh"],"x86_64-linux","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bash-5.2p37/bin/bash",["-e","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-source-stdenv.sh","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-default-builder.sh"],[("NIX_MAIN_PROGRAM","hello"),("__structuredAttrs",""),("buildInputs",""),("builder","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bash-5.2p37/bin/bash"),("cmakeFlags",""),("configureFlags",""),("depsBuildBuild",""),("depsBuildBuildPropagated",""),("depsBuildTarget",""),("depsBuildTargetPropagated",""),("depsHostHost",""),("depsHostHostPropagated",""),("depsTargetTarget",""),("depsTargetTargetPropagated",""),("doCheck","1"),("doInstallCheck","1"),("mesonFlags",""),("name","hello-2.12.2"),("nativeBuildInputs","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-version-check-hook"),("out","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-hello-2.12.2"),("outputs","out"),("patches",""),("pname","hello"),("postInstallCheck","stat \"${!outputBin}/bin/hello\"\n"),("propagatedBuildInputs",""),("propagatedNativeBuildInputs",""),("src","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-hello-2.12.2.tar.gz"),("stdenv","/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-stdenv-linux"),("strictDeps",""),("system","x86_64-linux"),("version","2.12.2")])
\ No newline at end of file
diff --git a/src/libstore-tests/data/serve-protocol/handshake-to-client.bin b/src/libstore-tests/data/serve-protocol/handshake-to-client.bin
index 15ba4b5e3..465daa532 100644
Binary files a/src/libstore-tests/data/serve-protocol/handshake-to-client.bin and b/src/libstore-tests/data/serve-protocol/handshake-to-client.bin differ
diff --git a/src/libstore-tests/data/store-reference/daemon_shorthand.txt b/src/libstore-tests/data/store-reference/daemon_shorthand.txt
new file mode 100644
index 000000000..bd8c0f8c4
--- /dev/null
+++ b/src/libstore-tests/data/store-reference/daemon_shorthand.txt
@@ -0,0 +1 @@
+daemon
\ No newline at end of file
diff --git a/src/libstore-tests/data/store-reference/local_3.txt b/src/libstore-tests/data/store-reference/local_3.txt
new file mode 100644
index 000000000..2a67a3426
--- /dev/null
+++ b/src/libstore-tests/data/store-reference/local_3.txt
@@ -0,0 +1 @@
+local://?root=/foo bar/baz
\ No newline at end of file
diff --git a/src/libstore-tests/data/store-reference/local_shorthand_3.txt b/src/libstore-tests/data/store-reference/local_shorthand_3.txt
new file mode 100644
index 000000000..c2c027fec
--- /dev/null
+++ b/src/libstore-tests/data/store-reference/local_shorthand_3.txt
@@ -0,0 +1 @@
+local
\ No newline at end of file
diff --git a/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_1.txt b/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_1.txt
new file mode 100644
index 000000000..861b5bb35
--- /dev/null
+++ b/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_1.txt
@@ -0,0 +1 @@
+ssh://::1
\ No newline at end of file
diff --git a/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_2.txt b/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_2.txt
new file mode 100644
index 000000000..952d5a55d
--- /dev/null
+++ b/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_2.txt
@@ -0,0 +1 @@
+ssh://userinfo@fea5:23e1:3916:fc24:cb52:2837:2ecb:ea8e
\ No newline at end of file
diff --git a/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_3.txt b/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_3.txt
new file mode 100644
index 000000000..d1f17adac
--- /dev/null
+++ b/src/libstore-tests/data/store-reference/ssh_unbracketed_ipv6_3.txt
@@ -0,0 +1 @@
+ssh://userinfo@fea5:23e1:3916:fc24:cb52:2837:2ecb:ea8e?a=b&c=d
\ No newline at end of file
diff --git a/src/libstore-tests/derivation-advanced-attrs.cc b/src/libstore-tests/derivation-advanced-attrs.cc
index b68134cd1..37b422421 100644
--- a/src/libstore-tests/derivation-advanced-attrs.cc
+++ b/src/libstore-tests/derivation-advanced-attrs.cc
@@ -108,10 +108,9 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes_defaults)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
-        EXPECT_TRUE(!parsedDrv);
+        EXPECT_TRUE(!got.structuredAttrs);
 
         EXPECT_EQ(options.additionalSandboxProfile, "");
         EXPECT_EQ(options.noChroot, false);
@@ -143,8 +142,7 @@ TEST_F(DerivationAdvancedAttrsTest, advancedAttributes_defaults)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(options.getRequiredSystemFeatures(got), StringSet{});
     });
@@ -157,8 +155,7 @@ TEST_F(CaDerivationAdvancedAttrsTest, advancedAttributes_defaults)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(options.getRequiredSystemFeatures(got), StringSet{"ca-derivations"});
     });
@@ -171,10 +168,9 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
-        EXPECT_TRUE(!parsedDrv);
+        EXPECT_TRUE(!got.structuredAttrs);
 
         EXPECT_EQ(options.additionalSandboxProfile, "sandcastle");
         EXPECT_EQ(options.noChroot, true);
@@ -195,8 +191,7 @@ TEST_F(DerivationAdvancedAttrsTest, advancedAttributes)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(
             options.exportReferencesGraph,
@@ -245,8 +240,7 @@ TEST_F(CaDerivationAdvancedAttrsTest, advancedAttributes)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(
             options.exportReferencesGraph,
@@ -298,10 +292,9 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes_structuredAttrs_d
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
-        EXPECT_TRUE(parsedDrv);
+        EXPECT_TRUE(got.structuredAttrs);
 
         EXPECT_EQ(options.additionalSandboxProfile, "");
         EXPECT_EQ(options.noChroot, false);
@@ -332,8 +325,7 @@ TEST_F(DerivationAdvancedAttrsTest, advancedAttributes_structuredAttrs_defaults)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(options.getRequiredSystemFeatures(got), StringSet{});
     });
@@ -346,8 +338,7 @@ TEST_F(CaDerivationAdvancedAttrsTest, advancedAttributes_structuredAttrs_default
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(options.getRequiredSystemFeatures(got), StringSet{"ca-derivations"});
     });
@@ -360,10 +351,9 @@ TYPED_TEST(DerivationAdvancedAttrsBothTest, advancedAttributes_structuredAttrs)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
-        EXPECT_TRUE(parsedDrv);
+        EXPECT_TRUE(got.structuredAttrs);
 
         EXPECT_EQ(options.additionalSandboxProfile, "sandcastle");
         EXPECT_EQ(options.noChroot, true);
@@ -394,8 +384,7 @@ TEST_F(DerivationAdvancedAttrsTest, advancedAttributes_structuredAttrs)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(
             options.exportReferencesGraph,
@@ -448,8 +437,7 @@ TEST_F(CaDerivationAdvancedAttrsTest, advancedAttributes_structuredAttrs)
 
         auto drvPath = writeDerivation(*this->store, got, NoRepair, true);
 
-        auto parsedDrv = StructuredAttrs::tryParse(got.env);
-        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, parsedDrv ? &*parsedDrv : nullptr);
+        DerivationOptions options = DerivationOptions::fromStructuredAttrs(got.env, got.structuredAttrs);
 
         EXPECT_EQ(
             options.exportReferencesGraph,
@@ -497,4 +485,4 @@ TEST_F(CaDerivationAdvancedAttrsTest, advancedAttributes_structuredAttrs)
     });
 };
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/derivation-parser-bench.cc b/src/libstore-tests/derivation-parser-bench.cc
new file mode 100644
index 000000000..1709eed1c
--- /dev/null
+++ b/src/libstore-tests/derivation-parser-bench.cc
@@ -0,0 +1,60 @@
+#include <benchmark/benchmark.h>
+#include "nix/store/derivations.hh"
+#include "nix/store/store-api.hh"
+#include "nix/util/experimental-features.hh"
+#include "nix/util/environment-variables.hh"
+#include "nix/store/store-open.hh"
+#include <fstream>
+#include <sstream>
+
+using namespace nix;
+
+// Benchmark parsing real derivation files
+static void BM_ParseRealDerivationFile(benchmark::State & state, const std::string & filename)
+{
+    // Read the file once
+    std::ifstream file(filename);
+    std::stringstream buffer;
+    buffer << file.rdbuf();
+    std::string content = buffer.str();
+
+    auto store = openStore("dummy://");
+    ExperimentalFeatureSettings xpSettings;
+
+    for (auto _ : state) {
+        auto drv = parseDerivation(*store, std::string(content), "test", xpSettings);
+        benchmark::DoNotOptimize(drv);
+    }
+    state.SetBytesProcessed(state.iterations() * content.size());
+}
+
+// Benchmark unparsing real derivation files
+static void BM_UnparseRealDerivationFile(benchmark::State & state, const std::string & filename)
+{
+    // Read the file once
+    std::ifstream file(filename);
+    std::stringstream buffer;
+    buffer << file.rdbuf();
+    std::string content = buffer.str();
+
+    auto store = openStore("dummy://");
+    ExperimentalFeatureSettings xpSettings;
+    auto drv = parseDerivation(*store, std::string(content), "test", xpSettings);
+
+    for (auto _ : state) {
+        auto unparsed = drv.unparse(*store, /*maskOutputs=*/false);
+        benchmark::DoNotOptimize(unparsed);
+        assert(unparsed.size() == content.size());
+    }
+    state.SetBytesProcessed(state.iterations() * content.size());
+}
+
+// Register benchmarks for actual test derivation files if they exist
+BENCHMARK_CAPTURE(
+    BM_ParseRealDerivationFile, hello, getEnvNonEmpty("_NIX_TEST_UNIT_DATA").value() + "/derivation/hello.drv");
+BENCHMARK_CAPTURE(
+    BM_ParseRealDerivationFile, firefox, getEnvNonEmpty("_NIX_TEST_UNIT_DATA").value() + "/derivation/firefox.drv");
+BENCHMARK_CAPTURE(
+    BM_UnparseRealDerivationFile, hello, getEnvNonEmpty("_NIX_TEST_UNIT_DATA").value() + "/derivation/hello.drv");
+BENCHMARK_CAPTURE(
+    BM_UnparseRealDerivationFile, firefox, getEnvNonEmpty("_NIX_TEST_UNIT_DATA").value() + "/derivation/firefox.drv");
diff --git a/src/libstore-tests/derivation.cc b/src/libstore-tests/derivation.cc
index fa6711d40..812e1d01b 100644
--- a/src/libstore-tests/derivation.cc
+++ b/src/libstore-tests/derivation.cc
@@ -16,7 +16,8 @@ class DerivationTest : public CharacterizationTest, public LibStoreTest
     std::filesystem::path unitTestData = getUnitTestData() / "derivation";
 
 public:
-    std::filesystem::path goldenMaster(std::string_view testStem) const override {
+    std::filesystem::path goldenMaster(std::string_view testStem) const override
+    {
         return unitTestData / testStem;
     }
 
@@ -51,168 +52,169 @@ class ImpureDerivationTest : public DerivationTest
     }
 };
 
-TEST_F(DerivationTest, BadATerm_version) {
+TEST_F(DerivationTest, BadATerm_version)
+{
+    ASSERT_THROW(
+        parseDerivation(*store, readFile(goldenMaster("bad-version.drv")), "whatever", mockXpSettings), FormatError);
+}
+
+TEST_F(DynDerivationTest, BadATerm_oldVersionDynDeps)
+{
     ASSERT_THROW(
         parseDerivation(
-            *store,
-            readFile(goldenMaster("bad-version.drv")),
-            "whatever",
-            mockXpSettings),
+            *store, readFile(goldenMaster("bad-old-version-dyn-deps.drv")), "dyn-dep-derivation", mockXpSettings),
         FormatError);
 }
 
-TEST_F(DynDerivationTest, BadATerm_oldVersionDynDeps) {
-    ASSERT_THROW(
-        parseDerivation(
-            *store,
-            readFile(goldenMaster("bad-old-version-dyn-deps.drv")),
-            "dyn-dep-derivation",
-            mockXpSettings),
-        FormatError);
-}
-
-#define TEST_JSON(FIXTURE, NAME, VAL, DRV_NAME, OUTPUT_NAME)              \
-    TEST_F(FIXTURE, DerivationOutput_ ## NAME ## _from_json) {            \
-        readTest("output-" #NAME ".json", [&](const auto & encoded_) {    \
-            auto encoded = json::parse(encoded_);                         \
-            DerivationOutput got = DerivationOutput::fromJSON(            \
-                *store,                                                   \
-                DRV_NAME,                                                 \
-                OUTPUT_NAME,                                              \
-                encoded,                                                  \
-                mockXpSettings);                                          \
-            DerivationOutput expected { VAL };                            \
-            ASSERT_EQ(got, expected);                                     \
-        });                                                               \
-    }                                                                     \
-                                                                          \
-    TEST_F(FIXTURE, DerivationOutput_ ## NAME ## _to_json) {              \
-        writeTest("output-" #NAME ".json", [&]() -> json {                \
-            return DerivationOutput { (VAL) }.toJSON(                     \
-                *store,                                                   \
-                (DRV_NAME),                                               \
-                (OUTPUT_NAME));                                           \
-        }, [](const auto & file) {                                        \
-            return json::parse(readFile(file));                           \
-        }, [](const auto & file, const auto & got) {                      \
-            return writeFile(file, got.dump(2) + "\n");                   \
-        });                                                               \
+#define TEST_JSON(FIXTURE, NAME, VAL, DRV_NAME, OUTPUT_NAME)                                                           \
+    TEST_F(FIXTURE, DerivationOutput_##NAME##_from_json)                                                               \
+    {                                                                                                                  \
+        readTest("output-" #NAME ".json", [&](const auto & encoded_) {                                                 \
+            auto encoded = json::parse(encoded_);                                                                      \
+            DerivationOutput got = DerivationOutput::fromJSON(*store, DRV_NAME, OUTPUT_NAME, encoded, mockXpSettings); \
+            DerivationOutput expected{VAL};                                                                            \
+            ASSERT_EQ(got, expected);                                                                                  \
+        });                                                                                                            \
+    }                                                                                                                  \
+                                                                                                                       \
+    TEST_F(FIXTURE, DerivationOutput_##NAME##_to_json)                                                                 \
+    {                                                                                                                  \
+        writeTest(                                                                                                     \
+            "output-" #NAME ".json",                                                                                   \
+            [&]() -> json { return DerivationOutput{(VAL)}.toJSON(*store, (DRV_NAME), (OUTPUT_NAME)); },               \
+            [](const auto & file) { return json::parse(readFile(file)); },                                             \
+            [](const auto & file, const auto & got) { return writeFile(file, got.dump(2) + "\n"); });                  \
     }
 
-TEST_JSON(DerivationTest, inputAddressed,
-    (DerivationOutput::InputAddressed {
+TEST_JSON(
+    DerivationTest,
+    inputAddressed,
+    (DerivationOutput::InputAddressed{
         .path = store->parseStorePath("/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-drv-name-output-name"),
     }),
-    "drv-name", "output-name")
+    "drv-name",
+    "output-name")
 
-TEST_JSON(DerivationTest, caFixedFlat,
-    (DerivationOutput::CAFixed {
-        .ca = {
-            .method = ContentAddressMethod::Raw::Flat,
-            .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
-        },
+TEST_JSON(
+    DerivationTest,
+    caFixedFlat,
+    (DerivationOutput::CAFixed{
+        .ca =
+            {
+                .method = ContentAddressMethod::Raw::Flat,
+                .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
+            },
     }),
-    "drv-name", "output-name")
+    "drv-name",
+    "output-name")
 
-TEST_JSON(DerivationTest, caFixedNAR,
-    (DerivationOutput::CAFixed {
-        .ca = {
-            .method = ContentAddressMethod::Raw::NixArchive,
-            .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
-        },
+TEST_JSON(
+    DerivationTest,
+    caFixedNAR,
+    (DerivationOutput::CAFixed{
+        .ca =
+            {
+                .method = ContentAddressMethod::Raw::NixArchive,
+                .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
+            },
     }),
-    "drv-name", "output-name")
+    "drv-name",
+    "output-name")
 
-TEST_JSON(DynDerivationTest, caFixedText,
-    (DerivationOutput::CAFixed {
-        .ca = {
-            .method = ContentAddressMethod::Raw::Text,
-            .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
-        },
+TEST_JSON(
+    DynDerivationTest,
+    caFixedText,
+    (DerivationOutput::CAFixed{
+        .ca =
+            {
+                .method = ContentAddressMethod::Raw::Text,
+                .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
+            },
     }),
-    "drv-name", "output-name")
+    "drv-name",
+    "output-name")
 
-TEST_JSON(CaDerivationTest, caFloating,
-    (DerivationOutput::CAFloating {
+TEST_JSON(
+    CaDerivationTest,
+    caFloating,
+    (DerivationOutput::CAFloating{
         .method = ContentAddressMethod::Raw::NixArchive,
         .hashAlgo = HashAlgorithm::SHA256,
     }),
-    "drv-name", "output-name")
+    "drv-name",
+    "output-name")
 
-TEST_JSON(DerivationTest, deferred,
-    DerivationOutput::Deferred { },
-    "drv-name", "output-name")
+TEST_JSON(DerivationTest, deferred, DerivationOutput::Deferred{}, "drv-name", "output-name")
 
-TEST_JSON(ImpureDerivationTest, impure,
-    (DerivationOutput::Impure {
+TEST_JSON(
+    ImpureDerivationTest,
+    impure,
+    (DerivationOutput::Impure{
         .method = ContentAddressMethod::Raw::NixArchive,
         .hashAlgo = HashAlgorithm::SHA256,
     }),
-    "drv-name", "output-name")
+    "drv-name",
+    "output-name")
 
 #undef TEST_JSON
 
-#define TEST_JSON(FIXTURE, NAME, VAL)                                     \
-    TEST_F(FIXTURE, Derivation_ ## NAME ## _from_json) {                  \
-        readTest(#NAME ".json", [&](const auto & encoded_) {              \
-            auto encoded = json::parse(encoded_);                         \
-            Derivation expected { VAL };                                  \
-            Derivation got = Derivation::fromJSON(                        \
-                *store,                                                   \
-                encoded,                                                  \
-                mockXpSettings);                                          \
-            ASSERT_EQ(got, expected);                                     \
-        });                                                               \
-    }                                                                     \
-                                                                          \
-    TEST_F(FIXTURE, Derivation_ ## NAME ## _to_json) {                    \
-        writeTest(#NAME ".json", [&]() -> json {                          \
-            return Derivation { VAL }.toJSON(*store);                     \
-        }, [](const auto & file) {                                        \
-            return json::parse(readFile(file));                           \
-        }, [](const auto & file, const auto & got) {                      \
-            return writeFile(file, got.dump(2) + "\n");                   \
-        });                                                               \
+#define TEST_JSON(FIXTURE, NAME, VAL)                                                                 \
+    TEST_F(FIXTURE, Derivation_##NAME##_from_json)                                                    \
+    {                                                                                                 \
+        readTest(#NAME ".json", [&](const auto & encoded_) {                                          \
+            auto encoded = json::parse(encoded_);                                                     \
+            Derivation expected{VAL};                                                                 \
+            Derivation got = Derivation::fromJSON(*store, encoded, mockXpSettings);                   \
+            ASSERT_EQ(got, expected);                                                                 \
+        });                                                                                           \
+    }                                                                                                 \
+                                                                                                      \
+    TEST_F(FIXTURE, Derivation_##NAME##_to_json)                                                      \
+    {                                                                                                 \
+        writeTest(                                                                                    \
+            #NAME ".json",                                                                            \
+            [&]() -> json { return Derivation{VAL}.toJSON(*store); },                                 \
+            [](const auto & file) { return json::parse(readFile(file)); },                            \
+            [](const auto & file, const auto & got) { return writeFile(file, got.dump(2) + "\n"); }); \
     }
 
-#define TEST_ATERM(FIXTURE, NAME, VAL, DRV_NAME)                          \
-    TEST_F(FIXTURE, Derivation_ ## NAME ## _from_aterm) {                 \
-        readTest(#NAME ".drv", [&](auto encoded) {                        \
-            Derivation expected { VAL };                                  \
-            auto got = parseDerivation(                                   \
-                *store,                                                   \
-                std::move(encoded),                                       \
-                DRV_NAME,                                                 \
-                mockXpSettings);                                          \
-            ASSERT_EQ(got.toJSON(*store), expected.toJSON(*store)) ;      \
-            ASSERT_EQ(got, expected);                                     \
-        });                                                               \
-    }                                                                     \
-                                                                          \
-    TEST_F(FIXTURE, Derivation_ ## NAME ## _to_aterm) {                   \
-        writeTest(#NAME ".drv", [&]() -> std::string {                    \
-            return (VAL).unparse(*store, false);                          \
-        });                                                               \
+#define TEST_ATERM(FIXTURE, NAME, VAL, DRV_NAME)                                                \
+    TEST_F(FIXTURE, Derivation_##NAME##_from_aterm)                                             \
+    {                                                                                           \
+        readTest(#NAME ".drv", [&](auto encoded) {                                              \
+            Derivation expected{VAL};                                                           \
+            auto got = parseDerivation(*store, std::move(encoded), DRV_NAME, mockXpSettings);   \
+            ASSERT_EQ(got.toJSON(*store), expected.toJSON(*store));                             \
+            ASSERT_EQ(got, expected);                                                           \
+        });                                                                                     \
+    }                                                                                           \
+                                                                                                \
+    TEST_F(FIXTURE, Derivation_##NAME##_to_aterm)                                               \
+    {                                                                                           \
+        writeTest(#NAME ".drv", [&]() -> std::string { return (VAL).unparse(*store, false); }); \
     }
 
-Derivation makeSimpleDrv(const Store & store) {
+Derivation makeSimpleDrv(const Store & store)
+{
     Derivation drv;
     drv.name = "simple-derivation";
     drv.inputSrcs = {
         store.parseStorePath("/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep1"),
     };
     drv.inputDrvs = {
-        .map = {
+        .map =
             {
-                store.parseStorePath("/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep2.drv"),
                 {
-                    .value = {
-                        "cat",
-                        "dog",
+                    store.parseStorePath("/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep2.drv"),
+                    {
+                        .value =
+                            {
+                                "cat",
+                                "dog",
+                            },
                     },
                 },
             },
-        },
     };
     drv.platform = "wasm-sel4";
     drv.builder = "foo";
@@ -220,7 +222,7 @@ Derivation makeSimpleDrv(const Store & store) {
         "bar",
         "baz",
     };
-    drv.env = {
+    drv.env = StringPairs{
         {
             "BIG_BAD",
             "WOLF",
@@ -231,46 +233,50 @@ Derivation makeSimpleDrv(const Store & store) {
 
 TEST_JSON(DerivationTest, simple, makeSimpleDrv(*store))
 
-TEST_ATERM(DerivationTest, simple,
-    makeSimpleDrv(*store),
-    "simple-derivation")
+TEST_ATERM(DerivationTest, simple, makeSimpleDrv(*store), "simple-derivation")
 
-Derivation makeDynDepDerivation(const Store & store) {
+Derivation makeDynDepDerivation(const Store & store)
+{
     Derivation drv;
     drv.name = "dyn-dep-derivation";
     drv.inputSrcs = {
         store.parseStorePath("/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep1"),
     };
     drv.inputDrvs = {
-        .map = {
+        .map =
             {
-                store.parseStorePath("/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep2.drv"),
-                DerivedPathMap<StringSet>::ChildNode {
-                    .value = {
-                        "cat",
-                        "dog",
-                    },
-                    .childMap = {
-                        {
-                            "cat",
-                            DerivedPathMap<StringSet>::ChildNode {
-                                .value = {
-                                    "kitten",
+                {
+                    store.parseStorePath("/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-dep2.drv"),
+                    DerivedPathMap<StringSet>::ChildNode{
+                        .value =
+                            {
+                                "cat",
+                                "dog",
+                            },
+                        .childMap =
+                            {
+                                {
+                                    "cat",
+                                    DerivedPathMap<StringSet>::ChildNode{
+                                        .value =
+                                            {
+                                                "kitten",
+                                            },
+                                    },
+                                },
+                                {
+                                    "goose",
+                                    DerivedPathMap<StringSet>::ChildNode{
+                                        .value =
+                                            {
+                                                "gosling",
+                                            },
+                                    },
                                 },
                             },
-                        },
-                        {
-                            "goose",
-                            DerivedPathMap<StringSet>::ChildNode {
-                                .value = {
-                                    "gosling",
-                                },
-                            },
-                        },
                     },
                 },
             },
-        },
     };
     drv.platform = "wasm-sel4";
     drv.builder = "foo";
@@ -278,7 +284,7 @@ Derivation makeDynDepDerivation(const Store & store) {
         "bar",
         "baz",
     };
-    drv.env = {
+    drv.env = StringPairs{
         {
             "BIG_BAD",
             "WOLF",
@@ -289,11 +295,9 @@ Derivation makeDynDepDerivation(const Store & store) {
 
 TEST_JSON(DynDerivationTest, dynDerivationDeps, makeDynDepDerivation(*store))
 
-TEST_ATERM(DynDerivationTest, dynDerivationDeps,
-    makeDynDepDerivation(*store),
-    "dyn-dep-derivation")
+TEST_ATERM(DynDerivationTest, dynDerivationDeps, makeDynDepDerivation(*store), "dyn-dep-derivation")
 
 #undef TEST_JSON
 #undef TEST_ATERM
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/derived-path.cc b/src/libstore-tests/derived-path.cc
index 51df25198..c7d2c5817 100644
--- a/src/libstore-tests/derived-path.cc
+++ b/src/libstore-tests/derived-path.cc
@@ -9,14 +9,14 @@
 namespace nix {
 
 class DerivedPathTest : public LibStoreTest
-{
-};
+{};
 
 /**
  * Round trip (string <-> data structure) test for
  * `DerivedPath::Opaque`.
  */
-TEST_F(DerivedPathTest, opaque) {
+TEST_F(DerivedPathTest, opaque)
+{
     std::string_view opaque = "/nix/store/g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x";
     auto elem = DerivedPath::parse(*store, opaque);
     auto * p = std::get_if<DerivedPath::Opaque>(&elem);
@@ -29,15 +29,18 @@ TEST_F(DerivedPathTest, opaque) {
  * Round trip (string <-> data structure) test for a simpler
  * `DerivedPath::Built`.
  */
-TEST_F(DerivedPathTest, built_opaque) {
+TEST_F(DerivedPathTest, built_opaque)
+{
     std::string_view built = "/nix/store/g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x.drv^bar,foo";
     auto elem = DerivedPath::parse(*store, built);
     auto * p = std::get_if<DerivedPath::Built>(&elem);
     ASSERT_TRUE(p);
-    ASSERT_EQ(p->outputs, ((OutputsSpec) OutputsSpec::Names { "foo", "bar" }));
-    ASSERT_EQ(*p->drvPath, ((SingleDerivedPath) SingleDerivedPath::Opaque {
-        .path = store->parseStorePath(built.substr(0, 49)),
-    }));
+    ASSERT_EQ(p->outputs, ((OutputsSpec) OutputsSpec::Names{"foo", "bar"}));
+    ASSERT_EQ(
+        *p->drvPath,
+        ((SingleDerivedPath) SingleDerivedPath::Opaque{
+            .path = store->parseStorePath(built.substr(0, 49)),
+        }));
     ASSERT_EQ(elem.to_string(*store), built);
 }
 
@@ -45,7 +48,8 @@ TEST_F(DerivedPathTest, built_opaque) {
  * Round trip (string <-> data structure) test for a more complex,
  * inductive `DerivedPath::Built`.
  */
-TEST_F(DerivedPathTest, built_built) {
+TEST_F(DerivedPathTest, built_built)
+{
     /**
      * We set these in tests rather than the regular globals so we don't have
      * to worry about race conditions if the tests run concurrently.
@@ -57,13 +61,15 @@ TEST_F(DerivedPathTest, built_built) {
     auto elem = DerivedPath::parse(*store, built, mockXpSettings);
     auto * p = std::get_if<DerivedPath::Built>(&elem);
     ASSERT_TRUE(p);
-    ASSERT_EQ(p->outputs, ((OutputsSpec) OutputsSpec::Names { "bar", "baz" }));
+    ASSERT_EQ(p->outputs, ((OutputsSpec) OutputsSpec::Names{"bar", "baz"}));
     auto * drvPath = std::get_if<SingleDerivedPath::Built>(&*p->drvPath);
     ASSERT_TRUE(drvPath);
     ASSERT_EQ(drvPath->output, "foo");
-    ASSERT_EQ(*drvPath->drvPath, ((SingleDerivedPath) SingleDerivedPath::Opaque {
-        .path = store->parseStorePath(built.substr(0, 49)),
-    }));
+    ASSERT_EQ(
+        *drvPath->drvPath,
+        ((SingleDerivedPath) SingleDerivedPath::Opaque{
+            .path = store->parseStorePath(built.substr(0, 49)),
+        }));
     ASSERT_EQ(elem.to_string(*store), built);
 }
 
@@ -71,7 +77,8 @@ TEST_F(DerivedPathTest, built_built) {
  * Without the right experimental features enabled, we cannot parse a
  * complex inductive derived path.
  */
-TEST_F(DerivedPathTest, built_built_xp) {
+TEST_F(DerivedPathTest, built_built_xp)
+{
     ASSERT_THROW(
         DerivedPath::parse(*store, "/nix/store/g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-x.drv^foo^bar,baz"),
         MissingExperimentalFeature);
@@ -84,20 +91,14 @@ TEST_F(DerivedPathTest, built_built_xp) {
        path '00000000000000000000000000000000-0^0' is not a valid store path:
        name '0^0' contains illegal character '^'
 */
-RC_GTEST_FIXTURE_PROP(
-    DerivedPathTest,
-    DISABLED_prop_legacy_round_rip,
-    (const DerivedPath & o))
+RC_GTEST_FIXTURE_PROP(DerivedPathTest, DISABLED_prop_legacy_round_rip, (const DerivedPath & o))
 {
     ExperimentalFeatureSettings xpSettings;
     xpSettings.set("experimental-features", "dynamic-derivations");
     RC_ASSERT(o == DerivedPath::parseLegacy(*store, o.to_string_legacy(*store), xpSettings));
 }
 
-RC_GTEST_FIXTURE_PROP(
-    DerivedPathTest,
-    prop_round_rip,
-    (const DerivedPath & o))
+RC_GTEST_FIXTURE_PROP(DerivedPathTest, prop_round_rip, (const DerivedPath & o))
 {
     ExperimentalFeatureSettings xpSettings;
     xpSettings.set("experimental-features", "dynamic-derivations");
@@ -106,4 +107,4 @@ RC_GTEST_FIXTURE_PROP(
 
 #endif
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/downstream-placeholder.cc b/src/libstore-tests/downstream-placeholder.cc
index 604c80017..4659a0f81 100644
--- a/src/libstore-tests/downstream-placeholder.cc
+++ b/src/libstore-tests/downstream-placeholder.cc
@@ -4,7 +4,8 @@
 
 namespace nix {
 
-TEST(DownstreamPlaceholder, unknownCaOutput) {
+TEST(DownstreamPlaceholder, unknownCaOutput)
+{
     /**
      * We set these in tests rather than the regular globals so we don't have
      * to worry about race conditions if the tests run concurrently.
@@ -14,13 +15,13 @@ TEST(DownstreamPlaceholder, unknownCaOutput) {
 
     ASSERT_EQ(
         DownstreamPlaceholder::unknownCaOutput(
-            StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo.drv" },
-            "out",
-            mockXpSettings).render(),
+            StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo.drv"}, "out", mockXpSettings)
+            .render(),
         "/0c6rn30q4frawknapgwq386zq358m8r6msvywcvc89n6m5p2dgbz");
 }
 
-TEST(DownstreamPlaceholder, unknownDerivation) {
+TEST(DownstreamPlaceholder, unknownDerivation)
+{
     /**
      * Same reason as above
      */
@@ -30,12 +31,11 @@ TEST(DownstreamPlaceholder, unknownDerivation) {
     ASSERT_EQ(
         DownstreamPlaceholder::unknownDerivation(
             DownstreamPlaceholder::unknownCaOutput(
-                StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo.drv.drv" },
-                "out",
-                mockXpSettings),
+                StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo.drv.drv"}, "out", mockXpSettings),
             "out",
-            mockXpSettings).render(),
+            mockXpSettings)
+            .render(),
         "/0gn6agqxjyyalf0dpihgyf49xq5hqxgw100f0wydnj6yqrhqsb3w");
 }
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/http-binary-cache-store.cc b/src/libstore-tests/http-binary-cache-store.cc
index f4a3408b5..0e3be4ced 100644
--- a/src/libstore-tests/http-binary-cache-store.cc
+++ b/src/libstore-tests/http-binary-cache-store.cc
@@ -8,14 +8,14 @@ TEST(HttpBinaryCacheStore, constructConfig)
 {
     HttpBinaryCacheStoreConfig config{"http", "foo.bar.baz", {}};
 
-    EXPECT_EQ(config.cacheUri, "http://foo.bar.baz");
+    EXPECT_EQ(config.cacheUri.to_string(), "http://foo.bar.baz");
 }
 
 TEST(HttpBinaryCacheStore, constructConfigNoTrailingSlash)
 {
     HttpBinaryCacheStoreConfig config{"https", "foo.bar.baz/a/b/", {}};
 
-    EXPECT_EQ(config.cacheUri, "https://foo.bar.baz/a/b");
+    EXPECT_EQ(config.cacheUri.to_string(), "https://foo.bar.baz/a/b");
 }
 
 } // namespace nix
diff --git a/src/libstore-tests/legacy-ssh-store.cc b/src/libstore-tests/legacy-ssh-store.cc
index 158da2831..d60ecc424 100644
--- a/src/libstore-tests/legacy-ssh-store.cc
+++ b/src/libstore-tests/legacy-ssh-store.cc
@@ -6,21 +6,25 @@ namespace nix {
 
 TEST(LegacySSHStore, constructConfig)
 {
-    LegacySSHStoreConfig config{
+    LegacySSHStoreConfig config(
         "ssh",
-        "localhost",
+        "me@localhost:2222",
         StoreConfig::Params{
             {
                 "remote-program",
                 // TODO #11106, no more split on space
                 "foo bar",
             },
-        }};
+        });
+
     EXPECT_EQ(
         config.remoteProgram.get(),
         (Strings{
             "foo",
             "bar",
         }));
+
+    EXPECT_EQ(config.getReference().render(/*withParams=*/true), "ssh://me@localhost:2222?remote-program=foo%20bar");
+    EXPECT_EQ(config.getReference().render(/*withParams=*/false), "ssh://me@localhost:2222");
 }
-}
+} // namespace nix
diff --git a/src/libstore-tests/local-overlay-store.cc b/src/libstore-tests/local-overlay-store.cc
index fe064c3a5..175e5d0f4 100644
--- a/src/libstore-tests/local-overlay-store.cc
+++ b/src/libstore-tests/local-overlay-store.cc
@@ -1,9 +1,6 @@
-// FIXME: Odd failures for templates that are causing the PR to break
-// for now with discussion with @Ericson2314 to comment out.
-#if 0
-#  include <gtest/gtest.h>
+#include <gtest/gtest.h>
 
-#  include "nix/store/local-overlay-store.hh"
+#include "nix/store/local-overlay-store.hh"
 
 namespace nix {
 
@@ -31,4 +28,3 @@ TEST(LocalOverlayStore, constructConfig_rootPath)
 }
 
 } // namespace nix
-#endif
diff --git a/src/libstore-tests/local-store.cc b/src/libstore-tests/local-store.cc
index ece277609..d00888897 100644
--- a/src/libstore-tests/local-store.cc
+++ b/src/libstore-tests/local-store.cc
@@ -1,15 +1,12 @@
-// FIXME: Odd failures for templates that are causing the PR to break
-// for now with discussion with @Ericson2314 to comment out.
-#if 0
-#  include <gtest/gtest.h>
+#include <gtest/gtest.h>
 
-#  include "nix/store/local-store.hh"
+#include "nix/store/local-store.hh"
 
 // Needed for template specialisations. This is not good! When we
 // overhaul how store configs work, this should be fixed.
-#  include "nix/util/args.hh"
-#  include "nix/util/config-impl.hh"
-#  include "nix/util/abstract-setting-to-json.hh"
+#include "nix/util/args.hh"
+#include "nix/util/config-impl.hh"
+#include "nix/util/abstract-setting-to-json.hh"
 
 namespace nix {
 
@@ -36,5 +33,10 @@ TEST(LocalStore, constructConfig_rootPath)
     EXPECT_EQ(config.rootDir.get(), std::optional{"/foo/bar"});
 }
 
+TEST(LocalStore, constructConfig_to_string)
+{
+    LocalStoreConfig config{"local", "", {}};
+    EXPECT_EQ(config.getReference().to_string(), "local");
+}
+
 } // namespace nix
-#endif
diff --git a/src/libstore-tests/machines.cc b/src/libstore-tests/machines.cc
index f11866e08..e4186372d 100644
--- a/src/libstore-tests/machines.cc
+++ b/src/libstore-tests/machines.cc
@@ -13,16 +13,20 @@ using testing::Eq;
 using testing::Field;
 using testing::SizeIs;
 
-namespace nix::fs { using namespace std::filesystem; }
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 using namespace nix;
 
-TEST(machines, getMachinesWithEmptyBuilders) {
+TEST(machines, getMachinesWithEmptyBuilders)
+{
     auto actual = Machine::parseConfig({}, "");
     ASSERT_THAT(actual, SizeIs(0));
 }
 
-TEST(machines, getMachinesUriOnly) {
+TEST(machines, getMachinesUriOnly)
+{
     auto actual = Machine::parseConfig({"TEST_ARCH-TEST_OS"}, "nix@scratchy.labs.cs.uu.nl");
     ASSERT_THAT(actual, SizeIs(1));
     EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq(StoreReference::parse("ssh://nix@scratchy.labs.cs.uu.nl"))));
@@ -35,7 +39,16 @@ TEST(machines, getMachinesUriOnly) {
     EXPECT_THAT(actual[0], Field(&Machine::sshPublicHostKey, SizeIs(0)));
 }
 
-TEST(machines, getMachinesDefaults) {
+TEST(machines, getMachinesUriWithPort)
+{
+    auto actual = Machine::parseConfig({"TEST_ARCH-TEST_OS"}, "nix@scratchy.labs.cs.uu.nl:2222");
+    ASSERT_THAT(actual, SizeIs(1));
+    EXPECT_THAT(
+        actual[0], Field(&Machine::storeUri, Eq(StoreReference::parse("ssh://nix@scratchy.labs.cs.uu.nl:2222"))));
+}
+
+TEST(machines, getMachinesDefaults)
+{
     auto actual = Machine::parseConfig({"TEST_ARCH-TEST_OS"}, "nix@scratchy.labs.cs.uu.nl - - - - - - -");
     ASSERT_THAT(actual, SizeIs(1));
     EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq(StoreReference::parse("ssh://nix@scratchy.labs.cs.uu.nl"))));
@@ -48,33 +61,35 @@ TEST(machines, getMachinesDefaults) {
     EXPECT_THAT(actual[0], Field(&Machine::sshPublicHostKey, SizeIs(0)));
 }
 
-MATCHER_P(AuthorityMatches, authority, "") {
-    *result_listener
-        << "where the authority of "
-        << arg.render()
-        << " is "
-        << authority;
+MATCHER_P(AuthorityMatches, authority, "")
+{
+    *result_listener << "where the authority of " << arg.render() << " is " << authority;
     auto * generic = std::get_if<StoreReference::Specified>(&arg.variant);
-    if (!generic) return false;
+    if (!generic)
+        return false;
     return generic->authority == authority;
 }
 
-TEST(machines, getMachinesWithNewLineSeparator) {
+TEST(machines, getMachinesWithNewLineSeparator)
+{
     auto actual = Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl\nnix@itchy.labs.cs.uu.nl");
     ASSERT_THAT(actual, SizeIs(2));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
 }
 
-TEST(machines, getMachinesWithSemicolonSeparator) {
+TEST(machines, getMachinesWithSemicolonSeparator)
+{
     auto actual = Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl ; nix@itchy.labs.cs.uu.nl");
     EXPECT_THAT(actual, SizeIs(2));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
 }
 
-TEST(machines, getMachinesWithCommentsAndSemicolonSeparator) {
-    auto actual = Machine::parseConfig({},
+TEST(machines, getMachinesWithCommentsAndSemicolonSeparator)
+{
+    auto actual = Machine::parseConfig(
+        {},
         "# This is a comment ; this is still that comment\n"
         "nix@scratchy.labs.cs.uu.nl ; nix@itchy.labs.cs.uu.nl\n"
         "# This is also a comment ; this also is still that comment\n"
@@ -85,8 +100,10 @@ TEST(machines, getMachinesWithCommentsAndSemicolonSeparator) {
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scabby.labs.cs.uu.nl"))));
 }
 
-TEST(machines, getMachinesWithFunnyWhitespace) {
-    auto actual = Machine::parseConfig({},
+TEST(machines, getMachinesWithFunnyWhitespace)
+{
+    auto actual = Machine::parseConfig(
+        {},
         "        # comment ; comment\n"
         "   nix@scratchy.labs.cs.uu.nl ; nix@itchy.labs.cs.uu.nl   \n"
         "\n    \n"
@@ -99,8 +116,10 @@ TEST(machines, getMachinesWithFunnyWhitespace) {
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scabby.labs.cs.uu.nl"))));
 }
 
-TEST(machines, getMachinesWithCorrectCompleteSingleBuilder) {
-    auto actual = Machine::parseConfig({},
+TEST(machines, getMachinesWithCorrectCompleteSingleBuilder)
+{
+    auto actual = Machine::parseConfig(
+        {},
         "nix@scratchy.labs.cs.uu.nl     i686-linux      "
         "/home/nix/.ssh/id_scratchy_auto        8 3 kvm "
         "benchmark SSH+HOST+PUBLIC+KEY+BASE64+ENCODED==");
@@ -115,9 +134,10 @@ TEST(machines, getMachinesWithCorrectCompleteSingleBuilder) {
     EXPECT_THAT(actual[0], Field(&Machine::sshPublicHostKey, Eq("SSH+HOST+PUBLIC+KEY+BASE64+ENCODED==")));
 }
 
-TEST(machines,
-     getMachinesWithCorrectCompleteSingleBuilderWithTabColumnDelimiter) {
-    auto actual = Machine::parseConfig({},
+TEST(machines, getMachinesWithCorrectCompleteSingleBuilderWithTabColumnDelimiter)
+{
+    auto actual = Machine::parseConfig(
+        {},
         "nix@scratchy.labs.cs.uu.nl\ti686-linux\t/home/nix/.ssh/"
         "id_scratchy_auto\t8\t3\tkvm\tbenchmark\tSSH+HOST+PUBLIC+"
         "KEY+BASE64+ENCODED==");
@@ -132,8 +152,10 @@ TEST(machines,
     EXPECT_THAT(actual[0], Field(&Machine::sshPublicHostKey, Eq("SSH+HOST+PUBLIC+KEY+BASE64+ENCODED==")));
 }
 
-TEST(machines, getMachinesWithMultiOptions) {
-    auto actual = Machine::parseConfig({},
+TEST(machines, getMachinesWithMultiOptions)
+{
+    auto actual = Machine::parseConfig(
+        {},
         "nix@scratchy.labs.cs.uu.nl Arch1,Arch2 - - - "
         "SupportedFeature1,SupportedFeature2 "
         "MandatoryFeature1,MandatoryFeature2");
@@ -144,25 +166,17 @@ TEST(machines, getMachinesWithMultiOptions) {
     EXPECT_THAT(actual[0], Field(&Machine::mandatoryFeatures, ElementsAre("MandatoryFeature1", "MandatoryFeature2")));
 }
 
-TEST(machines, getMachinesWithIncorrectFormat) {
-    EXPECT_THROW(
-        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - eight"),
-        FormatError);
-    EXPECT_THROW(
-        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - -1"),
-        FormatError);
-    EXPECT_THROW(
-        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 three"),
-        FormatError);
-    EXPECT_THROW(
-        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 -3"),
-        UsageError);
-    EXPECT_THROW(
-        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 3 - - BAD_BASE64"),
-        FormatError);
+TEST(machines, getMachinesWithIncorrectFormat)
+{
+    EXPECT_THROW(Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - eight"), FormatError);
+    EXPECT_THROW(Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - -1"), FormatError);
+    EXPECT_THROW(Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 three"), FormatError);
+    EXPECT_THROW(Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 -3"), UsageError);
+    EXPECT_THROW(Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 3 - - BAD_BASE64"), FormatError);
 }
 
-TEST(machines, getMachinesWithCorrectFileReference) {
+TEST(machines, getMachinesWithCorrectFileReference)
+{
     auto path = std::filesystem::weakly_canonical(getUnitTestData() / "machines/valid");
     ASSERT_TRUE(std::filesystem::exists(path));
 
@@ -173,7 +187,8 @@ TEST(machines, getMachinesWithCorrectFileReference) {
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@poochie.labs.cs.uu.nl"))));
 }
 
-TEST(machines, getMachinesWithCorrectFileReferenceToEmptyFile) {
+TEST(machines, getMachinesWithCorrectFileReferenceToEmptyFile)
+{
     std::filesystem::path path = "/dev/null";
     ASSERT_TRUE(std::filesystem::exists(path));
 
@@ -181,15 +196,18 @@ TEST(machines, getMachinesWithCorrectFileReferenceToEmptyFile) {
     ASSERT_THAT(actual, SizeIs(0));
 }
 
-TEST(machines, getMachinesWithIncorrectFileReference) {
+TEST(machines, getMachinesWithIncorrectFileReference)
+{
     auto path = std::filesystem::weakly_canonical("/not/a/file");
     ASSERT_TRUE(!std::filesystem::exists(path));
     auto actual = Machine::parseConfig({}, "@" + path.string());
     ASSERT_THAT(actual, SizeIs(0));
 }
 
-TEST(machines, getMachinesWithCorrectFileReferenceToIncorrectFile) {
+TEST(machines, getMachinesWithCorrectFileReferenceToIncorrectFile)
+{
     EXPECT_THROW(
-        Machine::parseConfig({}, "@" + std::filesystem::weakly_canonical(getUnitTestData() / "machines" / "bad_format").string()),
+        Machine::parseConfig(
+            {}, "@" + std::filesystem::weakly_canonical(getUnitTestData() / "machines" / "bad_format").string()),
         FormatError);
 }
diff --git a/src/libstore-tests/meson.build b/src/libstore-tests/meson.build
index 8a1ff40f0..4c2840ab7 100644
--- a/src/libstore-tests/meson.build
+++ b/src/libstore-tests/meson.build
@@ -1,7 +1,9 @@
-project('nix-store-tests', 'cpp',
+project(
+  'nix-store-tests',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -21,8 +23,7 @@ deps_private_maybe_subproject = [
   dependency('nix-store-c'),
   dependency('nix-store-test-support'),
 ]
-deps_public_maybe_subproject = [
-]
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 subdir('nix-meson-build-support/export-all-symbols')
@@ -73,6 +74,7 @@ sources = files(
   'path.cc',
   'references.cc',
   's3-binary-cache-store.cc',
+  's3.cc',
   'serve-protocol.cc',
   'ssh-store.cc',
   'store-reference.cc',
@@ -80,7 +82,7 @@ sources = files(
   'worker-protocol.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 
 this_exe = executable(
@@ -90,16 +92,51 @@ this_exe = executable(
   dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
   # TODO: -lrapidcheck, see ../libutil-support/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   # get main from gtest
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 test(
   meson.project_name(),
   this_exe,
   env : {
-    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+    '_NIX_TEST_UNIT_DATA' : meson.current_source_dir() / 'data',
+    'HOME' : meson.current_build_dir() / 'test-home',
+    'NIX_REMOTE' : meson.current_build_dir() / 'test-home' / 'store',
   },
   protocol : 'gtest',
 )
+
+# Build benchmarks if enabled
+if get_option('benchmarks')
+  gbenchmark = dependency('benchmark', required : true)
+
+  benchmark_sources = files(
+    'bench-main.cc',
+    'derivation-parser-bench.cc',
+    'ref-scan-bench.cc',
+  )
+
+  benchmark_exe = executable(
+    'nix-store-benchmarks',
+    benchmark_sources,
+    config_priv_h,
+    dependencies : deps_private_subproject + deps_private + deps_other + [
+      gbenchmark,
+    ],
+    include_directories : include_dirs,
+    link_args : linker_export_flags,
+    install : true,
+    cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
+  )
+
+  benchmark(
+    'nix-store-benchmarks',
+    benchmark_exe,
+    env : {
+      '_NIX_TEST_UNIT_DATA' : meson.current_source_dir() / 'data',
+    },
+  )
+endif
diff --git a/src/libstore-tests/meson.options b/src/libstore-tests/meson.options
new file mode 100644
index 000000000..2b3c1af60
--- /dev/null
+++ b/src/libstore-tests/meson.options
@@ -0,0 +1,9 @@
+# vim: filetype=meson
+
+option(
+  'benchmarks',
+  type : 'boolean',
+  value : false,
+  description : 'Build benchmarks (requires gbenchmark)',
+  yield : true,
+)
diff --git a/src/libstore-tests/nar-info-disk-cache.cc b/src/libstore-tests/nar-info-disk-cache.cc
index 4c7354c0c..98a94b91e 100644
--- a/src/libstore-tests/nar-info-disk-cache.cc
+++ b/src/libstore-tests/nar-info-disk-cache.cc
@@ -5,10 +5,10 @@
 #include "nix/store/sqlite.hh"
 #include <sqlite3.h>
 
-
 namespace nix {
 
-TEST(NarInfoDiskCacheImpl, create_and_read) {
+TEST(NarInfoDiskCacheImpl, create_and_read)
+{
     // This is a large single test to avoid some setup overhead.
 
     int prio = 12345;
@@ -36,7 +36,8 @@ TEST(NarInfoDiskCacheImpl, create_and_read) {
 
         // Check that the fields are saved and returned correctly. This does not test
         // the select statement yet, because of in-memory caching.
-        savedId = cache->createCache("http://foo", "/nix/storedir", wantMassQuery, prio);;
+        savedId = cache->createCache("http://foo", "/nix/storedir", wantMassQuery, prio);
+        ;
         {
             auto r = cache->upToDateCacheExists("http://foo");
             ASSERT_TRUE(r);
@@ -120,4 +121,4 @@ TEST(NarInfoDiskCacheImpl, create_and_read) {
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/nar-info.cc b/src/libstore-tests/nar-info.cc
index 1979deef8..751c5e305 100644
--- a/src/libstore-tests/nar-info.cc
+++ b/src/libstore-tests/nar-info.cc
@@ -15,38 +15,41 @@ class NarInfoTest : public CharacterizationTest, public LibStoreTest
 {
     std::filesystem::path unitTestData = getUnitTestData() / "nar-info";
 
-    std::filesystem::path goldenMaster(PathView testStem) const override {
+    std::filesystem::path goldenMaster(PathView testStem) const override
+    {
         return unitTestData / (testStem + ".json");
     }
 };
 
-static NarInfo makeNarInfo(const Store & store, bool includeImpureInfo) {
-    NarInfo info = ValidPathInfo {
+static NarInfo makeNarInfo(const Store & store, bool includeImpureInfo)
+{
+    auto info = NarInfo::makeFromCA(
         store,
         "foo",
-        FixedOutputInfo {
+        FixedOutputInfo{
             .method = FileIngestionMethod::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
 
-            .references = {
-                .others = {
-                    StorePath {
-                        "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
-                    },
+            .references =
+                {
+                    .others =
+                        {
+                            StorePath{
+                                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
+                            },
+                        },
+                    .self = true,
                 },
-                .self = true,
-            },
         },
-        Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-    };
+        Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="));
     info.narSize = 34878;
     if (includeImpureInfo) {
-        info.deriver = StorePath {
+        info.deriver = StorePath{
             "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
         };
         info.registrationTime = 23423;
         info.ultimate = true;
-        info.sigs = { "asdf", "qwer" };
+        info.sigs = {"asdf", "qwer"};
 
         info.url = "nar/1w1fff338fvdw53sqgamddn1b2xgds473pv6y13gizdbqjv4i5p3.nar.xz";
         info.compression = "xz";
@@ -56,31 +59,27 @@ static NarInfo makeNarInfo(const Store & store, bool includeImpureInfo) {
     return info;
 }
 
-#define JSON_TEST(STEM, PURE)                                             \
-    TEST_F(NarInfoTest, NarInfo_ ## STEM ## _from_json) {                 \
-        readTest(#STEM, [&](const auto & encoded_) {                      \
-            auto encoded = json::parse(encoded_);                         \
-            auto expected = makeNarInfo(*store, PURE);                    \
-            NarInfo got = NarInfo::fromJSON(                              \
-                *store,                                                   \
-                expected.path,                                            \
-                encoded);                                                 \
-            ASSERT_EQ(got, expected);                                     \
-        });                                                               \
-    }                                                                     \
-                                                                          \
-    TEST_F(NarInfoTest, NarInfo_ ## STEM ## _to_json) {                   \
-        writeTest(#STEM, [&]() -> json {                                  \
-            return makeNarInfo(*store, PURE)                              \
-                .toJSON(*store, PURE, HashFormat::SRI);                   \
-        }, [](const auto & file) {                                        \
-            return json::parse(readFile(file));                           \
-        }, [](const auto & file, const auto & got) {                      \
-            return writeFile(file, got.dump(2) + "\n");                   \
-        });                                                               \
+#define JSON_TEST(STEM, PURE)                                                                          \
+    TEST_F(NarInfoTest, NarInfo_##STEM##_from_json)                                                    \
+    {                                                                                                  \
+        readTest(#STEM, [&](const auto & encoded_) {                                                   \
+            auto encoded = json::parse(encoded_);                                                      \
+            auto expected = makeNarInfo(*store, PURE);                                                 \
+            NarInfo got = NarInfo::fromJSON(*store, expected.path, encoded);                           \
+            ASSERT_EQ(got, expected);                                                                  \
+        });                                                                                            \
+    }                                                                                                  \
+                                                                                                       \
+    TEST_F(NarInfoTest, NarInfo_##STEM##_to_json)                                                      \
+    {                                                                                                  \
+        writeTest(                                                                                     \
+            #STEM,                                                                                     \
+            [&]() -> json { return makeNarInfo(*store, PURE).toJSON(*store, PURE, HashFormat::SRI); }, \
+            [](const auto & file) { return json::parse(readFile(file)); },                             \
+            [](const auto & file, const auto & got) { return writeFile(file, got.dump(2) + "\n"); });  \
     }
 
 JSON_TEST(pure, false)
 JSON_TEST(impure, true)
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/nix_api_store.cc b/src/libstore-tests/nix_api_store.cc
index 3d9f7908b..c14fb6d9f 100644
--- a/src/libstore-tests/nix_api_store.cc
+++ b/src/libstore-tests/nix_api_store.cc
@@ -1,10 +1,9 @@
 #include "nix_api_util.h"
-#include "nix_api_util_internal.h"
 #include "nix_api_store.h"
-#include "nix_api_store_internal.h"
 
 #include "nix/store/tests/nix_api_store.hh"
 #include "nix/util/tests/string_callback.hh"
+#include "nix/util/url.hh"
 
 #include "store-tests-config.hh"
 
@@ -23,15 +22,17 @@ TEST_F(nix_api_store_test, nix_store_get_uri)
     std::string str;
     auto ret = nix_store_get_uri(ctx, store, OBSERVE_STRING(str));
     ASSERT_EQ(NIX_OK, ret);
-    ASSERT_STREQ("local", str.c_str());
+    auto expectedStoreURI = "local://?"
+                            + nix::encodeQuery({
+                                {"log", nixLogDir},
+                                {"state", nixStateDir},
+                                {"store", nixStoreDir},
+                            });
+    ASSERT_EQ(expectedStoreURI, str);
 }
 
 TEST_F(nix_api_util_context, nix_store_get_storedir_default)
 {
-    if (nix::getEnv("HOME").value_or("") == "/homeless-shelter") {
-        // skipping test in sandbox because nix_store_open tries to create /nix/var/nix/profiles
-        GTEST_SKIP();
-    }
     nix_libstore_init(ctx);
     Store * store = nix_store_open(ctx, nullptr, nullptr);
     assert_ctx_ok();
@@ -62,7 +63,7 @@ TEST_F(nix_api_store_test, nix_store_get_storedir)
 TEST_F(nix_api_store_test, InvalidPathFails)
 {
     nix_store_parse_path(ctx, store, "invalid-path");
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_NIX_ERROR);
 }
 
 TEST_F(nix_api_store_test, ReturnsValidStorePath)
@@ -77,7 +78,7 @@ TEST_F(nix_api_store_test, ReturnsValidStorePath)
 TEST_F(nix_api_store_test, SetsLastErrCodeToNixOk)
 {
     StorePath * path = nix_store_parse_path(ctx, store, (nixStoreDir + PATH_SUFFIX).c_str());
-    ASSERT_EQ(ctx->last_err_code, NIX_OK);
+    ASSERT_EQ(nix_err_code(ctx), NIX_OK);
     nix_store_path_free(path);
 }
 
@@ -100,8 +101,8 @@ TEST_F(nix_api_util_context, nix_store_open_dummy)
 {
     nix_libstore_init(ctx);
     Store * store = nix_store_open(ctx, "dummy://", nullptr);
-    ASSERT_EQ(NIX_OK, ctx->last_err_code);
-    ASSERT_STREQ("dummy", store->ptr->getUri().c_str());
+    ASSERT_EQ(NIX_OK, nix_err_code(ctx));
+    ASSERT_STREQ("dummy://", store->ptr->config.getReference().render(/*withParams=*/true).c_str());
 
     std::string str;
     nix_store_get_version(ctx, store, OBSERVE_STRING(str));
@@ -114,7 +115,7 @@ TEST_F(nix_api_util_context, nix_store_open_invalid)
 {
     nix_libstore_init(ctx);
     Store * store = nix_store_open(ctx, "invalid://", nullptr);
-    ASSERT_EQ(NIX_ERR_NIX_ERROR, ctx->last_err_code);
+    ASSERT_EQ(NIX_ERR_NIX_ERROR, nix_err_code(ctx));
     ASSERT_EQ(nullptr, store);
     nix_store_free(store);
 }
@@ -141,10 +142,6 @@ TEST_F(nix_api_store_test, nix_store_real_path)
 
 TEST_F(nix_api_util_context, nix_store_real_path_relocated)
 {
-    if (nix::getEnv("HOME").value_or("") == "/homeless-shelter") {
-        // Can't open default store from within sandbox
-        GTEST_SKIP();
-    }
     auto tmp = nix::createTempDir();
     std::string storeRoot = tmp + "/store";
     std::string stateDir = tmp + "/state";
@@ -184,13 +181,7 @@ TEST_F(nix_api_util_context, nix_store_real_path_relocated)
 
 TEST_F(nix_api_util_context, nix_store_real_path_binary_cache)
 {
-    if (nix::getEnv("HOME").value_or("") == "/homeless-shelter") {
-        // TODO: override NIX_CACHE_HOME?
-        // skipping test in sandbox because narinfo cache can't be written
-        GTEST_SKIP();
-    }
-
-    Store * store = nix_store_open(ctx, "https://cache.nixos.org", nullptr);
+    Store * store = nix_store_open(ctx, nix::fmt("file://%s/binary-cache", nix::createTempDir()).c_str(), nullptr);
     assert_ctx_ok();
     ASSERT_NE(store, nullptr);
 
diff --git a/src/libstore-tests/outputs-spec.cc b/src/libstore-tests/outputs-spec.cc
index 12f285e0d..b0b80e7c4 100644
--- a/src/libstore-tests/outputs-spec.cc
+++ b/src/libstore-tests/outputs-spec.cc
@@ -6,15 +6,16 @@
 
 namespace nix {
 
-TEST(OutputsSpec, no_empty_names) {
-    ASSERT_DEATH(OutputsSpec::Names { StringSet { } }, "");
+TEST(OutputsSpec, no_empty_names)
+{
+    ASSERT_DEATH(OutputsSpec::Names{StringSet{}}, "");
 }
 
-#define TEST_DONT_PARSE(NAME, STR)           \
-    TEST(OutputsSpec, bad_ ## NAME) {        \
-        std::optional OutputsSpecOpt =       \
-            OutputsSpec::parseOpt(STR);      \
-        ASSERT_FALSE(OutputsSpecOpt);        \
+#define TEST_DONT_PARSE(NAME, STR)                                 \
+    TEST(OutputsSpec, bad_##NAME)                                  \
+    {                                                              \
+        std::optional OutputsSpecOpt = OutputsSpec::parseOpt(STR); \
+        ASSERT_FALSE(OutputsSpecOpt);                              \
     }
 
 TEST_DONT_PARSE(empty, "")
@@ -25,96 +26,109 @@ TEST_DONT_PARSE(star_second, "foo,*")
 
 #undef TEST_DONT_PARSE
 
-TEST(OutputsSpec, all) {
+TEST(OutputsSpec, all)
+{
     std::string_view str = "*";
-    OutputsSpec expected = OutputsSpec::All { };
+    OutputsSpec expected = OutputsSpec::All{};
     ASSERT_EQ(OutputsSpec::parse(str), expected);
     ASSERT_EQ(expected.to_string(), str);
 }
 
-TEST(OutputsSpec, names_out) {
+TEST(OutputsSpec, names_out)
+{
     std::string_view str = "out";
-    OutputsSpec expected = OutputsSpec::Names { "out" };
+    OutputsSpec expected = OutputsSpec::Names{"out"};
     ASSERT_EQ(OutputsSpec::parse(str), expected);
     ASSERT_EQ(expected.to_string(), str);
 }
 
-TEST(OutputsSpec, names_underscore) {
+TEST(OutputsSpec, names_underscore)
+{
     std::string_view str = "a_b";
-    OutputsSpec expected = OutputsSpec::Names { "a_b" };
+    OutputsSpec expected = OutputsSpec::Names{"a_b"};
     ASSERT_EQ(OutputsSpec::parse(str), expected);
     ASSERT_EQ(expected.to_string(), str);
 }
 
-TEST(OutputsSpec, names_numeric) {
+TEST(OutputsSpec, names_numeric)
+{
     std::string_view str = "01";
-    OutputsSpec expected = OutputsSpec::Names { "01" };
+    OutputsSpec expected = OutputsSpec::Names{"01"};
     ASSERT_EQ(OutputsSpec::parse(str), expected);
     ASSERT_EQ(expected.to_string(), str);
 }
 
-TEST(OutputsSpec, names_out_bin) {
-    OutputsSpec expected = OutputsSpec::Names { "out", "bin" };
+TEST(OutputsSpec, names_out_bin)
+{
+    OutputsSpec expected = OutputsSpec::Names{"out", "bin"};
     ASSERT_EQ(OutputsSpec::parse("out,bin"), expected);
     // N.B. This normalization is OK.
     ASSERT_EQ(expected.to_string(), "bin,out");
 }
 
-#define TEST_SUBSET(X, THIS, THAT) \
-    X((OutputsSpec { THIS }).isSubsetOf(THAT));
+#define TEST_SUBSET(X, THIS, THAT) X((OutputsSpec{THIS}).isSubsetOf(THAT));
 
-TEST(OutputsSpec, subsets_all_all) {
-    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::All { }, OutputsSpec::All { });
+TEST(OutputsSpec, subsets_all_all)
+{
+    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::All{}, OutputsSpec::All{});
 }
 
-TEST(OutputsSpec, subsets_names_all) {
-    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::Names { "a" }, OutputsSpec::All { });
+TEST(OutputsSpec, subsets_names_all)
+{
+    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::Names{"a"}, OutputsSpec::All{});
 }
 
-TEST(OutputsSpec, subsets_names_names_eq) {
-    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::Names { "a" }, OutputsSpec::Names { "a" });
+TEST(OutputsSpec, subsets_names_names_eq)
+{
+    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::Names{"a"}, OutputsSpec::Names{"a"});
 }
 
-TEST(OutputsSpec, subsets_names_names_noneq) {
-    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::Names { "a" }, (OutputsSpec::Names { "a", "b" }));
+TEST(OutputsSpec, subsets_names_names_noneq)
+{
+    TEST_SUBSET(ASSERT_TRUE, OutputsSpec::Names{"a"}, (OutputsSpec::Names{"a", "b"}));
 }
 
-TEST(OutputsSpec, not_subsets_all_names) {
-    TEST_SUBSET(ASSERT_FALSE, OutputsSpec::All { }, OutputsSpec::Names { "a" });
+TEST(OutputsSpec, not_subsets_all_names)
+{
+    TEST_SUBSET(ASSERT_FALSE, OutputsSpec::All{}, OutputsSpec::Names{"a"});
 }
 
-TEST(OutputsSpec, not_subsets_names_names) {
-    TEST_SUBSET(ASSERT_FALSE, (OutputsSpec::Names { "a", "b" }), (OutputsSpec::Names { "a" }));
+TEST(OutputsSpec, not_subsets_names_names)
+{
+    TEST_SUBSET(ASSERT_FALSE, (OutputsSpec::Names{"a", "b"}), (OutputsSpec::Names{"a"}));
 }
 
 #undef TEST_SUBSET
 
-#define TEST_UNION(RES, THIS, THAT) \
-    ASSERT_EQ(OutputsSpec { RES }, (OutputsSpec { THIS }).union_(THAT));
+#define TEST_UNION(RES, THIS, THAT) ASSERT_EQ(OutputsSpec{RES}, (OutputsSpec{THIS}).union_(THAT));
 
-TEST(OutputsSpec, union_all_all) {
-    TEST_UNION(OutputsSpec::All { }, OutputsSpec::All { }, OutputsSpec::All { });
+TEST(OutputsSpec, union_all_all)
+{
+    TEST_UNION(OutputsSpec::All{}, OutputsSpec::All{}, OutputsSpec::All{});
 }
 
-TEST(OutputsSpec, union_all_names) {
-    TEST_UNION(OutputsSpec::All { }, OutputsSpec::All { }, OutputsSpec::Names { "a" });
+TEST(OutputsSpec, union_all_names)
+{
+    TEST_UNION(OutputsSpec::All{}, OutputsSpec::All{}, OutputsSpec::Names{"a"});
 }
 
-TEST(OutputsSpec, union_names_all) {
-    TEST_UNION(OutputsSpec::All { }, OutputsSpec::Names { "a" }, OutputsSpec::All { });
+TEST(OutputsSpec, union_names_all)
+{
+    TEST_UNION(OutputsSpec::All{}, OutputsSpec::Names{"a"}, OutputsSpec::All{});
 }
 
-TEST(OutputsSpec, union_names_names) {
-    TEST_UNION((OutputsSpec::Names { "a", "b" }), OutputsSpec::Names { "a" }, OutputsSpec::Names { "b" });
+TEST(OutputsSpec, union_names_names)
+{
+    TEST_UNION((OutputsSpec::Names{"a", "b"}), OutputsSpec::Names{"a"}, OutputsSpec::Names{"b"});
 }
 
 #undef TEST_UNION
 
-#define TEST_DONT_PARSE(NAME, STR)                   \
-    TEST(ExtendedOutputsSpec, bad_ ## NAME) {        \
-        std::optional extendedOutputsSpecOpt =       \
-            ExtendedOutputsSpec::parseOpt(STR);      \
-        ASSERT_FALSE(extendedOutputsSpecOpt);        \
+#define TEST_DONT_PARSE(NAME, STR)                                                 \
+    TEST(ExtendedOutputsSpec, bad_##NAME)                                          \
+    {                                                                              \
+        std::optional extendedOutputsSpecOpt = ExtendedOutputsSpec::parseOpt(STR); \
+        ASSERT_FALSE(extendedOutputsSpecOpt);                                      \
     }
 
 TEST_DONT_PARSE(carot_empty, "^")
@@ -126,87 +140,86 @@ TEST_DONT_PARSE(star_second, "^foo,*")
 
 #undef TEST_DONT_PARSE
 
-TEST(ExtendedOutputsSpec, default) {
+TEST(ExtendedOutputsSpec, default)
+{
     std::string_view str = "foo";
     auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse(str);
     ASSERT_EQ(prefix, "foo");
-    ExtendedOutputsSpec expected = ExtendedOutputsSpec::Default { };
+    ExtendedOutputsSpec expected = ExtendedOutputsSpec::Default{};
     ASSERT_EQ(extendedOutputsSpec, expected);
-    ASSERT_EQ(std::string { prefix } + expected.to_string(), str);
+    ASSERT_EQ(std::string{prefix} + expected.to_string(), str);
 }
 
-TEST(ExtendedOutputsSpec, all) {
+TEST(ExtendedOutputsSpec, all)
+{
     std::string_view str = "foo^*";
     auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse(str);
     ASSERT_EQ(prefix, "foo");
-    ExtendedOutputsSpec expected = OutputsSpec::All { };
+    ExtendedOutputsSpec expected = OutputsSpec::All{};
     ASSERT_EQ(extendedOutputsSpec, expected);
-    ASSERT_EQ(std::string { prefix } + expected.to_string(), str);
+    ASSERT_EQ(std::string{prefix} + expected.to_string(), str);
 }
 
-TEST(ExtendedOutputsSpec, out) {
+TEST(ExtendedOutputsSpec, out)
+{
     std::string_view str = "foo^out";
     auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse(str);
     ASSERT_EQ(prefix, "foo");
-    ExtendedOutputsSpec expected = OutputsSpec::Names { "out" };
+    ExtendedOutputsSpec expected = OutputsSpec::Names{"out"};
     ASSERT_EQ(extendedOutputsSpec, expected);
-    ASSERT_EQ(std::string { prefix } + expected.to_string(), str);
+    ASSERT_EQ(std::string{prefix} + expected.to_string(), str);
 }
 
-TEST(ExtendedOutputsSpec, out_bin) {
+TEST(ExtendedOutputsSpec, out_bin)
+{
     auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse("foo^out,bin");
     ASSERT_EQ(prefix, "foo");
-    ExtendedOutputsSpec expected = OutputsSpec::Names { "out", "bin" };
+    ExtendedOutputsSpec expected = OutputsSpec::Names{"out", "bin"};
     ASSERT_EQ(extendedOutputsSpec, expected);
-    ASSERT_EQ(std::string { prefix } + expected.to_string(), "foo^bin,out");
+    ASSERT_EQ(std::string{prefix} + expected.to_string(), "foo^bin,out");
 }
 
-TEST(ExtendedOutputsSpec, many_carrot) {
+TEST(ExtendedOutputsSpec, many_carrot)
+{
     auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse("foo^bar^out,bin");
     ASSERT_EQ(prefix, "foo^bar");
-    ExtendedOutputsSpec expected = OutputsSpec::Names { "out", "bin" };
+    ExtendedOutputsSpec expected = OutputsSpec::Names{"out", "bin"};
     ASSERT_EQ(extendedOutputsSpec, expected);
-    ASSERT_EQ(std::string { prefix } + expected.to_string(), "foo^bar^bin,out");
+    ASSERT_EQ(std::string{prefix} + expected.to_string(), "foo^bar^bin,out");
 }
 
-
-#define TEST_JSON(TYPE, NAME, STR, VAL)                    \
-                                                           \
-    TEST(TYPE, NAME ## _to_json) {                         \
-        using nlohmann::literals::operator "" _json;       \
-        ASSERT_EQ(                                         \
-            STR ## _json,                                  \
-            ((nlohmann::json) TYPE { VAL }));              \
-    }                                                      \
-                                                           \
-    TEST(TYPE, NAME ## _from_json) {                       \
-        using nlohmann::literals::operator "" _json;       \
-        ASSERT_EQ(                                         \
-            TYPE { VAL },                                  \
-            (STR ## _json).get<TYPE>());                   \
+#define TEST_JSON(TYPE, NAME, STR, VAL)                      \
+                                                             \
+    TEST(TYPE, NAME##_to_json)                               \
+    {                                                        \
+        using nlohmann::literals::operator"" _json;          \
+        ASSERT_EQ(STR##_json, ((nlohmann::json) TYPE{VAL})); \
+    }                                                        \
+                                                             \
+    TEST(TYPE, NAME##_from_json)                             \
+    {                                                        \
+        using nlohmann::literals::operator"" _json;          \
+        ASSERT_EQ(TYPE{VAL}, (STR##_json).get<TYPE>());      \
     }
 
-TEST_JSON(OutputsSpec, all, R"(["*"])", OutputsSpec::All { })
-TEST_JSON(OutputsSpec, name, R"(["a"])", OutputsSpec::Names { "a" })
-TEST_JSON(OutputsSpec, names, R"(["a","b"])", (OutputsSpec::Names { "a", "b" }))
+TEST_JSON(OutputsSpec, all, R"(["*"])", OutputsSpec::All{})
+TEST_JSON(OutputsSpec, name, R"(["a"])", OutputsSpec::Names{"a"})
+TEST_JSON(OutputsSpec, names, R"(["a","b"])", (OutputsSpec::Names{"a", "b"}))
 
-TEST_JSON(ExtendedOutputsSpec, def, R"(null)", ExtendedOutputsSpec::Default { })
-TEST_JSON(ExtendedOutputsSpec, all, R"(["*"])", ExtendedOutputsSpec::Explicit { OutputsSpec::All { } })
-TEST_JSON(ExtendedOutputsSpec, name, R"(["a"])", ExtendedOutputsSpec::Explicit { OutputsSpec::Names { "a" } })
-TEST_JSON(ExtendedOutputsSpec, names, R"(["a","b"])", (ExtendedOutputsSpec::Explicit { OutputsSpec::Names { "a", "b" } }))
+TEST_JSON(ExtendedOutputsSpec, def, R"(null)", ExtendedOutputsSpec::Default{})
+TEST_JSON(ExtendedOutputsSpec, all, R"(["*"])", ExtendedOutputsSpec::Explicit{OutputsSpec::All{}})
+TEST_JSON(ExtendedOutputsSpec, name, R"(["a"])", ExtendedOutputsSpec::Explicit{OutputsSpec::Names{"a"}})
+TEST_JSON(ExtendedOutputsSpec, names, R"(["a","b"])", (ExtendedOutputsSpec::Explicit{OutputsSpec::Names{"a", "b"}}))
 
 #undef TEST_JSON
 
 #ifndef COVERAGE
 
-RC_GTEST_PROP(
-    OutputsSpec,
-    prop_round_rip,
-    (const OutputsSpec & o))
+RC_GTEST_PROP(OutputsSpec, prop_round_rip, (const OutputsSpec & o))
 {
     RC_ASSERT(o == OutputsSpec::parse(o.to_string()));
 }
 
 #endif
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/package.nix b/src/libstore-tests/package.nix
index b39ee7fa7..90e6af519 100644
--- a/src/libstore-tests/package.nix
+++ b/src/libstore-tests/package.nix
@@ -3,6 +3,7 @@
   buildPackages,
   stdenv,
   mkMesonExecutable,
+  writableTmpDirAsHomeHook,
 
   nix-store,
   nix-store-c,
@@ -11,12 +12,14 @@
 
   rapidcheck,
   gtest,
+  gbenchmark,
   runCommand,
 
   # Configuration Options
 
   version,
   filesetToSource,
+  withBenchmarks ? false,
 }:
 
 let
@@ -34,7 +37,7 @@ mkMesonExecutable (finalAttrs: {
     ../../.version
     ./.version
     ./meson.build
-    # ./meson.options
+    ./meson.options
     (fileset.fileFilter (file: file.hasExt "cc") ./.)
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
   ];
@@ -44,6 +47,9 @@ mkMesonExecutable (finalAttrs: {
     sqlite
     rapidcheck
     gtest
+  ]
+  ++ lib.optionals withBenchmarks [
+    gbenchmark
   ];
 
   buildInputs = finalAttrs.passthru.externalBuildInputs ++ [
@@ -53,6 +59,7 @@ mkMesonExecutable (finalAttrs: {
   ];
 
   mesonFlags = [
+    (lib.mesonBool "benchmarks" withBenchmarks)
   ];
 
   passthru = {
@@ -72,15 +79,18 @@ mkMesonExecutable (finalAttrs: {
         runCommand "${finalAttrs.pname}-run"
           {
             meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+            buildInputs = [ writableTmpDirAsHomeHook ];
           }
           (
-            lib.optionalString stdenv.hostPlatform.isWindows ''
-              export HOME="$PWD/home-dir"
-              mkdir -p "$HOME"
+            ''
+              export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
+              export NIX_REMOTE=$HOME/store
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+            ''
+            + lib.optionalString withBenchmarks ''
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe' finalAttrs.finalPackage "nix-store-benchmarks"}
             ''
             + ''
-              export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
-              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
               touch $out
             ''
           );
diff --git a/src/libstore-tests/path-info.cc b/src/libstore-tests/path-info.cc
index a7699f7ad..63310c1c3 100644
--- a/src/libstore-tests/path-info.cc
+++ b/src/libstore-tests/path-info.cc
@@ -14,7 +14,8 @@ class PathInfoTest : public CharacterizationTest, public LibStoreTest
 {
     std::filesystem::path unitTestData = getUnitTestData() / "path-info";
 
-    std::filesystem::path goldenMaster(PathView testStem) const override {
+    std::filesystem::path goldenMaster(PathView testStem) const override
+    {
         return unitTestData / (testStem + ".json");
     }
 };
@@ -28,59 +29,60 @@ static UnkeyedValidPathInfo makeEmpty()
 
 static ValidPathInfo makeFullKeyed(const Store & store, bool includeImpureInfo)
 {
-    ValidPathInfo info = ValidPathInfo {
+    auto info = ValidPathInfo::makeFromCA(
         store,
         "foo",
-        FixedOutputInfo {
+        FixedOutputInfo{
             .method = FileIngestionMethod::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
 
-            .references = {
-                .others = {
-                    StorePath {
-                        "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
-                    },
+            .references =
+                {
+                    .others =
+                        {
+                            StorePath{
+                                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
+                            },
+                        },
+                    .self = true,
                 },
-                .self = true,
-            },
         },
-        Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-    };
+        Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="));
     info.narSize = 34878;
     if (includeImpureInfo) {
-        info.deriver = StorePath {
+        info.deriver = StorePath{
             "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
         };
         info.registrationTime = 23423;
         info.ultimate = true;
-        info.sigs = { "asdf", "qwer" };
+        info.sigs = {"asdf", "qwer"};
     }
     return info;
 }
-static UnkeyedValidPathInfo makeFull(const Store & store, bool includeImpureInfo) {
+
+static UnkeyedValidPathInfo makeFull(const Store & store, bool includeImpureInfo)
+{
     return makeFullKeyed(store, includeImpureInfo);
 }
 
-#define JSON_TEST(STEM, OBJ, PURE)                                        \
-    TEST_F(PathInfoTest, PathInfo_ ## STEM ## _from_json) {               \
-        readTest(#STEM, [&](const auto & encoded_) {                      \
-            auto encoded = json::parse(encoded_);                         \
-            UnkeyedValidPathInfo got = UnkeyedValidPathInfo::fromJSON(    \
-                *store,                                                   \
-                encoded);                                                 \
-            auto expected = OBJ;                                          \
-            ASSERT_EQ(got, expected);                                     \
-        });                                                               \
-    }                                                                     \
-                                                                          \
-    TEST_F(PathInfoTest, PathInfo_ ## STEM ## _to_json) {                 \
-        writeTest(#STEM, [&]() -> json {                                  \
-            return OBJ.toJSON(*store, PURE, HashFormat::SRI);             \
-        }, [](const auto & file) {                                        \
-            return json::parse(readFile(file));                           \
-        }, [](const auto & file, const auto & got) {                      \
-            return writeFile(file, got.dump(2) + "\n");                   \
-        });                                                               \
+#define JSON_TEST(STEM, OBJ, PURE)                                                                    \
+    TEST_F(PathInfoTest, PathInfo_##STEM##_from_json)                                                 \
+    {                                                                                                 \
+        readTest(#STEM, [&](const auto & encoded_) {                                                  \
+            auto encoded = json::parse(encoded_);                                                     \
+            UnkeyedValidPathInfo got = UnkeyedValidPathInfo::fromJSON(*store, encoded);               \
+            auto expected = OBJ;                                                                      \
+            ASSERT_EQ(got, expected);                                                                 \
+        });                                                                                           \
+    }                                                                                                 \
+                                                                                                      \
+    TEST_F(PathInfoTest, PathInfo_##STEM##_to_json)                                                   \
+    {                                                                                                 \
+        writeTest(                                                                                    \
+            #STEM,                                                                                    \
+            [&]() -> json { return OBJ.toJSON(*store, PURE, HashFormat::SRI); },                      \
+            [](const auto & file) { return json::parse(readFile(file)); },                            \
+            [](const auto & file, const auto & got) { return writeFile(file, got.dump(2) + "\n"); }); \
     }
 
 JSON_TEST(empty_pure, makeEmpty(), false)
@@ -89,7 +91,8 @@ JSON_TEST(empty_impure, makeEmpty(), true)
 JSON_TEST(pure, makeFull(*store, false), false)
 JSON_TEST(impure, makeFull(*store, true), true)
 
-TEST_F(PathInfoTest, PathInfo_full_shortRefs) {
+TEST_F(PathInfoTest, PathInfo_full_shortRefs)
+{
     ValidPathInfo it = makeFullKeyed(*store, true);
     // it.references = unkeyed.references;
     auto refs = it.shortRefs();
diff --git a/src/libstore-tests/path.cc b/src/libstore-tests/path.cc
index 4da73a0ad..01d1ca792 100644
--- a/src/libstore-tests/path.cc
+++ b/src/libstore-tests/path.cc
@@ -17,29 +17,20 @@ namespace nix {
 #define HASH_PART "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q"
 
 class StorePathTest : public LibStoreTest
-{
-};
+{};
 
-static std::regex nameRegex { std::string { nameRegexStr } };
+static std::regex nameRegex{std::string{nameRegexStr}};
 
-#define TEST_DONT_PARSE(NAME, STR)                           \
-    TEST_F(StorePathTest, bad_ ## NAME) {                    \
-        std::string_view str =                               \
-            STORE_DIR HASH_PART "-" STR;                     \
-        /* ASSERT_THROW generates a duplicate goto label */  \
-        /* A lambda isolates those labels. */                \
-        [&](){                                               \
-            ASSERT_THROW(                                    \
-                store->parseStorePath(str),                  \
-                BadStorePath);                               \
-        }();                                                 \
-        std::string name { STR };                            \
-        [&](){                                               \
-            ASSERT_THROW(                                    \
-                nix::checkName(name),                        \
-                BadStorePathName);                           \
-        }();                                                 \
-        EXPECT_FALSE(std::regex_match(name, nameRegex));     \
+#define TEST_DONT_PARSE(NAME, STR)                                           \
+    TEST_F(StorePathTest, bad_##NAME)                                        \
+    {                                                                        \
+        std::string_view str = STORE_DIR HASH_PART "-" STR;                  \
+        /* ASSERT_THROW generates a duplicate goto label */                  \
+        /* A lambda isolates those labels. */                                \
+        [&]() { ASSERT_THROW(store->parseStorePath(str), BadStorePath); }(); \
+        std::string name{STR};                                               \
+        [&]() { ASSERT_THROW(nix::checkName(name), BadStorePathName); }();   \
+        EXPECT_FALSE(std::regex_match(name, nameRegex));                     \
     }
 
 TEST_DONT_PARSE(empty, "")
@@ -57,14 +48,14 @@ TEST_DONT_PARSE(dot_dash_a, ".-a")
 
 #undef TEST_DONT_PARSE
 
-#define TEST_DO_PARSE(NAME, STR)                             \
-    TEST_F(StorePathTest, good_ ## NAME) {                   \
-        std::string_view str =                               \
-            STORE_DIR HASH_PART "-" STR;                     \
-        auto p = store->parseStorePath(str);                 \
-        std::string name { p.name() };                       \
-        EXPECT_EQ(p.name(), STR);                            \
-        EXPECT_TRUE(std::regex_match(name, nameRegex));      \
+#define TEST_DO_PARSE(NAME, STR)                            \
+    TEST_F(StorePathTest, good_##NAME)                      \
+    {                                                       \
+        std::string_view str = STORE_DIR HASH_PART "-" STR; \
+        auto p = store->parseStorePath(str);                \
+        std::string name{p.name()};                         \
+        EXPECT_EQ(p.name(), STR);                           \
+        EXPECT_TRUE(std::regex_match(name, nameRegex));     \
     }
 
 // 0-9 a-z A-Z + - . _ ? =
@@ -88,67 +79,46 @@ TEST_DO_PARSE(triple_dot, "...")
 
 #ifndef COVERAGE
 
-RC_GTEST_FIXTURE_PROP(
-    StorePathTest,
-    prop_regex_accept,
-    (const StorePath & p))
+RC_GTEST_FIXTURE_PROP(StorePathTest, prop_regex_accept, (const StorePath & p))
 {
-    RC_ASSERT(std::regex_match(std::string { p.name() }, nameRegex));
+    RC_ASSERT(std::regex_match(std::string{p.name()}, nameRegex));
 }
 
-RC_GTEST_FIXTURE_PROP(
-    StorePathTest,
-    prop_round_rip,
-    (const StorePath & p))
+RC_GTEST_FIXTURE_PROP(StorePathTest, prop_round_rip, (const StorePath & p))
 {
     RC_ASSERT(p == store->parseStorePath(store->printStorePath(p)));
 }
 
-
-RC_GTEST_FIXTURE_PROP(
-    StorePathTest,
-    prop_check_regex_eq_parse,
-    ())
+RC_GTEST_FIXTURE_PROP(StorePathTest, prop_check_regex_eq_parse, ())
 {
-    static auto nameFuzzer =
-        rc::gen::container<std::string>(
-            rc::gen::oneOf(
-                // alphanum, repeated to weigh heavier
-                rc::gen::oneOf(
-                    rc::gen::inRange('0', '9'),
-                    rc::gen::inRange('a', 'z'),
-                    rc::gen::inRange('A', 'Z')
-                ),
-                // valid symbols
-                rc::gen::oneOf(
-                    rc::gen::just('+'),
-                    rc::gen::just('-'),
-                    rc::gen::just('.'),
-                    rc::gen::just('_'),
-                    rc::gen::just('?'),
-                    rc::gen::just('=')
-                ),
-                // symbols for scary .- and ..- cases, repeated for weight
-                rc::gen::just('.'), rc::gen::just('.'),
-                rc::gen::just('.'), rc::gen::just('.'),
-                rc::gen::just('-'), rc::gen::just('-'),
-                // ascii symbol ranges
-                rc::gen::oneOf(
-                    rc::gen::inRange(' ', '/'),
-                    rc::gen::inRange(':', '@'),
-                    rc::gen::inRange('[', '`'),
-                    rc::gen::inRange('{', '~')
-                ),
-                // typical whitespace
-                rc::gen::oneOf(
-                    rc::gen::just(' '),
-                    rc::gen::just('\t'),
-                    rc::gen::just('\n'),
-                    rc::gen::just('\r')
-                ),
-                // some chance of control codes, non-ascii or other garbage we missed
-                rc::gen::inRange('\0', '\xff')
-        ));
+    static auto nameFuzzer = rc::gen::container<std::string>(rc::gen::oneOf(
+        // alphanum, repeated to weigh heavier
+        rc::gen::oneOf(rc::gen::inRange('0', '9'), rc::gen::inRange('a', 'z'), rc::gen::inRange('A', 'Z')),
+        // valid symbols
+        rc::gen::oneOf(
+            rc::gen::just('+'),
+            rc::gen::just('-'),
+            rc::gen::just('.'),
+            rc::gen::just('_'),
+            rc::gen::just('?'),
+            rc::gen::just('=')),
+        // symbols for scary .- and ..- cases, repeated for weight
+        rc::gen::just('.'),
+        rc::gen::just('.'),
+        rc::gen::just('.'),
+        rc::gen::just('.'),
+        rc::gen::just('-'),
+        rc::gen::just('-'),
+        // ascii symbol ranges
+        rc::gen::oneOf(
+            rc::gen::inRange(' ', '/'),
+            rc::gen::inRange(':', '@'),
+            rc::gen::inRange('[', '`'),
+            rc::gen::inRange('{', '~')),
+        // typical whitespace
+        rc::gen::oneOf(rc::gen::just(' '), rc::gen::just('\t'), rc::gen::just('\n'), rc::gen::just('\r')),
+        // some chance of control codes, non-ascii or other garbage we missed
+        rc::gen::inRange('\0', '\xff')));
 
     auto name = *nameFuzzer;
 
@@ -159,9 +129,9 @@ RC_GTEST_FIXTURE_PROP(
         parsed = true;
     } catch (const BadStorePath &) {
     }
-    RC_ASSERT(parsed == std::regex_match(std::string { name }, nameRegex));
+    RC_ASSERT(parsed == std::regex_match(std::string{name}, nameRegex));
 }
 
 #endif
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/pch/precompiled-headers.hh b/src/libstore-tests/pch/precompiled-headers.hh
new file mode 100644
index 000000000..3eaa45261
--- /dev/null
+++ b/src/libstore-tests/pch/precompiled-headers.hh
@@ -0,0 +1,9 @@
+#include "nix/store/store-api.hh"
+#include "nix/store/tests/libstore.hh"
+#include "nix/util/util.hh"
+
+#include <gtest/gtest.h>
+#include <nlohmann/json.hpp>
+#include <rapidcheck/gtest.h>
+
+#include <regex>
diff --git a/src/libstore-tests/ref-scan-bench.cc b/src/libstore-tests/ref-scan-bench.cc
new file mode 100644
index 000000000..ff0aa1815
--- /dev/null
+++ b/src/libstore-tests/ref-scan-bench.cc
@@ -0,0 +1,93 @@
+#include "nix/store/references.hh"
+#include "nix/store/path.hh"
+#include "nix/util/base-nix-32.hh"
+
+#include <benchmark/benchmark.h>
+
+#include <random>
+
+using namespace nix;
+
+template<typename OIt>
+static void randomReference(std::mt19937 & urng, OIt outIter)
+{
+    auto dist = std::uniform_int_distribution<std::size_t>(0, BaseNix32::characters.size() - 1);
+    dist(urng);
+    std::generate_n(outIter, StorePath::HashLen, [&]() { return BaseNix32::characters[dist(urng)]; });
+}
+
+/**
+ * Generate a random byte sequence with interleaved
+ *
+ * @param charWeight relative frequency of a byte not belonging to a reference (hash part of the store path)
+ */
+static std::string
+randomBytesWithReferences(std::mt19937 & urng, std::size_t size, double charWeight, StringSet & hashes)
+{
+    std::string res;
+    res.reserve(size);
+
+    /* NOTE: std::uniform_int_distribution isn't guaranteed to be implemented for char. */
+    auto charGen = [&,
+                    charDist = std::uniform_int_distribution<int>{
+                        std::numeric_limits<char>::min(),
+                        std::numeric_limits<char>::max(),
+                    }]() mutable { res.push_back(charDist(urng)); };
+
+    auto refGen = [&]() {
+        std::string ref;
+        randomReference(urng, std::back_inserter(ref));
+        hashes.insert(ref);
+        res += ref;
+    };
+
+    std::discrete_distribution<std::size_t> genDist{1.0, StorePath::HashLen * charWeight};
+
+    while (res.size() < size) {
+        auto c = genDist(urng);
+        if (c == 0)
+            refGen();
+        else
+            charGen();
+    }
+
+    res.resize(size);
+    return res;
+}
+
+// Benchmark reference scanning
+static void BM_RefScanSinkRandom(benchmark::State & state)
+{
+    auto size = state.range();
+    auto chunkSize = 4199;
+
+    std::mt19937 urng(0);
+    StringSet hashes;
+    auto bytes = randomBytesWithReferences(urng, size, /*charWeight=*/100.0, hashes);
+    assert(hashes.size() > 0);
+
+    std::size_t processed = 0;
+
+    for (auto _ : state) {
+        state.PauseTiming();
+        RefScanSink Sink{StringSet(hashes)};
+        state.ResumeTiming();
+
+        auto data = std::string_view(bytes);
+        while (!data.empty()) {
+            auto chunk = data.substr(0, std::min<std::string_view::size_type>(chunkSize, data.size()));
+            data = data.substr(chunk.size());
+            Sink(chunk);
+            processed += chunk.size();
+        }
+
+        benchmark::DoNotOptimize(Sink.getResult());
+        state.PauseTiming();
+        assert(Sink.getResult() == hashes);
+        state.ResumeTiming();
+    }
+
+    state.SetBytesProcessed(processed);
+}
+
+BENCHMARK(BM_RefScanSinkRandom)->Arg(10'000)->Arg(100'000)->Arg(1'000'000)->Arg(5'000'000)->Arg(10'000'000);
diff --git a/src/libstore-tests/references.cc b/src/libstore-tests/references.cc
index 59993727d..27ecad08f 100644
--- a/src/libstore-tests/references.cc
+++ b/src/libstore-tests/references.cc
@@ -1,9 +1,46 @@
-#include "nix/util/references.hh"
+#include "nix/store/references.hh"
 
 #include <gtest/gtest.h>
 
 namespace nix {
 
+struct RewriteParams
+{
+    std::string originalString, finalString;
+    StringMap rewrites;
+
+    friend std::ostream & operator<<(std::ostream & os, const RewriteParams & bar)
+    {
+        StringSet strRewrites;
+        for (auto & [from, to] : bar.rewrites)
+            strRewrites.insert(from + "->" + to);
+        return os << "OriginalString: " << bar.originalString << std::endl
+                  << "Rewrites: " << dropEmptyInitThenConcatStringsSep(",", strRewrites) << std::endl
+                  << "Expected result: " << bar.finalString;
+    }
+};
+
+class RewriteTest : public ::testing::TestWithParam<RewriteParams>
+{};
+
+TEST_P(RewriteTest, IdentityRewriteIsIdentity)
+{
+    RewriteParams param = GetParam();
+    StringSink rewritten;
+    auto rewriter = RewritingSink(param.rewrites, rewritten);
+    rewriter(param.originalString);
+    rewriter.flush();
+    ASSERT_EQ(rewritten.s, param.finalString);
+}
+
+INSTANTIATE_TEST_CASE_P(
+    references,
+    RewriteTest,
+    ::testing::Values(
+        RewriteParams{"foooo", "baroo", {{"foo", "bar"}, {"bar", "baz"}}},
+        RewriteParams{"foooo", "bazoo", {{"fou", "bar"}, {"foo", "baz"}}},
+        RewriteParams{"foooo", "foooo", {}}));
+
 TEST(references, scan)
 {
     std::string hash1 = "dc04vv14dak1c1r48qa0m23vr9jy8sm0";
@@ -42,4 +79,4 @@ TEST(references, scan)
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/s3.cc b/src/libstore-tests/s3.cc
new file mode 100644
index 000000000..44a31ddc9
--- /dev/null
+++ b/src/libstore-tests/s3.cc
@@ -0,0 +1,205 @@
+#include "nix/store/s3.hh"
+#include "nix/util/tests/gmock-matchers.hh"
+
+#if NIX_WITH_S3_SUPPORT
+
+#  include <gtest/gtest.h>
+#  include <gmock/gmock.h>
+
+namespace nix {
+
+struct ParsedS3URLTestCase
+{
+    std::string url;
+    ParsedS3URL expected;
+    std::string description;
+};
+
+class ParsedS3URLTest : public ::testing::WithParamInterface<ParsedS3URLTestCase>, public ::testing::Test
+{};
+
+TEST_P(ParsedS3URLTest, parseS3URLSuccessfully)
+{
+    const auto & testCase = GetParam();
+    auto parsed = ParsedS3URL::parse(parseURL(testCase.url));
+    ASSERT_EQ(parsed, testCase.expected);
+}
+
+INSTANTIATE_TEST_SUITE_P(
+    QueryParams,
+    ParsedS3URLTest,
+    ::testing::Values(
+        ParsedS3URLTestCase{
+            "s3://my-bucket/my-key.txt",
+            {
+                .bucket = "my-bucket",
+                .key = {"my-key.txt"},
+            },
+            "basic_s3_bucket",
+        },
+        ParsedS3URLTestCase{
+            "s3://prod-cache/nix/store/abc123.nar.xz?region=eu-west-1",
+            {
+                .bucket = "prod-cache",
+                .key = {"nix", "store", "abc123.nar.xz"},
+                .region = "eu-west-1",
+            },
+            "with_region",
+        },
+        ParsedS3URLTestCase{
+            "s3://bucket/key?region=us-west-2&profile=prod&endpoint=custom.s3.com&scheme=https&region=us-east-1",
+            {
+                .bucket = "bucket",
+                .key = {"key"},
+                .profile = "prod",
+                .region = "us-west-2", //< using the first parameter (decodeQuery ignores dupicates)
+                .scheme = "https",
+                .endpoint = ParsedURL::Authority{.host = "custom.s3.com"},
+            },
+            "complex",
+        },
+        ParsedS3URLTestCase{
+            "s3://cache/file.txt?profile=production&region=ap-southeast-2",
+            {
+                .bucket = "cache",
+                .key = {"file.txt"},
+                .profile = "production",
+                .region = "ap-southeast-2",
+            },
+            "with_profile_and_region",
+        },
+        ParsedS3URLTestCase{
+            "s3://bucket/key?endpoint=https://minio.local&scheme=http",
+            {
+                .bucket = "bucket",
+                .key = {"key"},
+                /* TODO: Figure out what AWS SDK is doing when both endpointOverride and scheme are set. */
+                .scheme = "http",
+                .endpoint =
+                    ParsedURL{
+                        .scheme = "https",
+                        .authority = ParsedURL::Authority{.host = "minio.local"},
+                        .path = {""},
+                    },
+            },
+            "with_absolute_endpoint_uri",
+        }),
+    [](const ::testing::TestParamInfo<ParsedS3URLTestCase> & info) { return info.param.description; });
+
+TEST(InvalidParsedS3URLTest, parseS3URLErrors)
+{
+    auto invalidBucketMatcher = ::testing::ThrowsMessage<BadURL>(
+        testing::HasSubstrIgnoreANSIMatcher("error: URI has a missing or invalid bucket name"));
+
+    /* Empty bucket (authority) */
+    ASSERT_THAT([]() { ParsedS3URL::parse(parseURL("s3:///key")); }, invalidBucketMatcher);
+    /* Invalid bucket name */
+    ASSERT_THAT([]() { ParsedS3URL::parse(parseURL("s3://127.0.0.1")); }, invalidBucketMatcher);
+}
+
+// Parameterized test for s3ToHttpsUrl conversion
+struct S3ToHttpsConversionTestCase
+{
+    ParsedS3URL input;
+    ParsedURL expected;
+    std::string expectedRendered;
+    std::string description;
+};
+
+class S3ToHttpsConversionTest : public ::testing::WithParamInterface<S3ToHttpsConversionTestCase>,
+                                public ::testing::Test
+{};
+
+TEST_P(S3ToHttpsConversionTest, ConvertsCorrectly)
+{
+    const auto & testCase = GetParam();
+    auto result = testCase.input.toHttpsUrl();
+    EXPECT_EQ(result, testCase.expected) << "Failed for: " << testCase.description;
+    EXPECT_EQ(result.to_string(), testCase.expectedRendered);
+}
+
+INSTANTIATE_TEST_SUITE_P(
+    S3ToHttpsConversion,
+    S3ToHttpsConversionTest,
+    ::testing::Values(
+        S3ToHttpsConversionTestCase{
+            ParsedS3URL{
+                .bucket = "my-bucket",
+                .key = {"my-key.txt"},
+            },
+            ParsedURL{
+                .scheme = "https",
+                .authority = ParsedURL::Authority{.host = "s3.us-east-1.amazonaws.com"},
+                .path = {"", "my-bucket", "my-key.txt"},
+            },
+            "https://s3.us-east-1.amazonaws.com/my-bucket/my-key.txt",
+            "basic_s3_default_region",
+        },
+        S3ToHttpsConversionTestCase{
+            ParsedS3URL{
+                .bucket = "prod-cache",
+                .key = {"nix", "store", "abc123.nar.xz"},
+                .region = "eu-west-1",
+            },
+            ParsedURL{
+                .scheme = "https",
+                .authority = ParsedURL::Authority{.host = "s3.eu-west-1.amazonaws.com"},
+                .path = {"", "prod-cache", "nix", "store", "abc123.nar.xz"},
+            },
+            "https://s3.eu-west-1.amazonaws.com/prod-cache/nix/store/abc123.nar.xz",
+            "with_eu_west_1_region",
+        },
+        S3ToHttpsConversionTestCase{
+            ParsedS3URL{
+                .bucket = "bucket",
+                .key = {"key"},
+                .scheme = "http",
+                .endpoint = ParsedURL::Authority{.host = "custom.s3.com"},
+            },
+            ParsedURL{
+                .scheme = "http",
+                .authority = ParsedURL::Authority{.host = "custom.s3.com"},
+                .path = {"", "bucket", "key"},
+            },
+            "http://custom.s3.com/bucket/key",
+            "custom_endpoint_authority",
+        },
+        S3ToHttpsConversionTestCase{
+            ParsedS3URL{
+                .bucket = "bucket",
+                .key = {"key"},
+                .endpoint =
+                    ParsedURL{
+                        .scheme = "http",
+                        .authority = ParsedURL::Authority{.host = "server", .port = 9000},
+                        .path = {""},
+                    },
+            },
+            ParsedURL{
+                .scheme = "http",
+                .authority = ParsedURL::Authority{.host = "server", .port = 9000},
+                .path = {"", "bucket", "key"},
+            },
+            "http://server:9000/bucket/key",
+            "custom_endpoint_with_port",
+        },
+        S3ToHttpsConversionTestCase{
+            ParsedS3URL{
+                .bucket = "bucket",
+                .key = {"path", "to", "file.txt"},
+                .region = "ap-southeast-2",
+                .scheme = "https",
+            },
+            ParsedURL{
+                .scheme = "https",
+                .authority = ParsedURL::Authority{.host = "s3.ap-southeast-2.amazonaws.com"},
+                .path = {"", "bucket", "path", "to", "file.txt"},
+            },
+            "https://s3.ap-southeast-2.amazonaws.com/bucket/path/to/file.txt",
+            "complex_path_and_region",
+        }),
+    [](const ::testing::TestParamInfo<S3ToHttpsConversionTestCase> & info) { return info.param.description; });
+
+} // namespace nix
+
+#endif
diff --git a/src/libstore-tests/serve-protocol.cc b/src/libstore-tests/serve-protocol.cc
index 69dab5488..b513e1365 100644
--- a/src/libstore-tests/serve-protocol.cc
+++ b/src/libstore-tests/serve-protocol.cc
@@ -20,9 +20,9 @@ struct ServeProtoTest : VersionedProtoTest<ServeProto, serveProtoDir>
 {
     /**
      * For serializers that don't care about the minimum version, we
-     * used the oldest one: 1.0.
+     * used the oldest one: 2.5.
      */
-    ServeProto::Version defaultVersion = 2 << 8 | 0;
+    ServeProto::Version defaultVersion = 2 << 8 | 5;
 };
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -30,7 +30,7 @@ VERSIONED_CHARACTERIZATION_TEST(
     string,
     "string",
     defaultVersion,
-    (std::tuple<std::string, std::string, std::string, std::string, std::string> {
+    (std::tuple<std::string, std::string, std::string, std::string, std::string>{
         "",
         "hi",
         "white rabbit",
@@ -45,9 +45,9 @@ VERSIONED_CHARACTERIZATION_TEST(
     storePath,
     "store-path",
     defaultVersion,
-    (std::tuple<StorePath, StorePath> {
-        StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-        StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar" },
+    (std::tuple<StorePath, StorePath>{
+        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar"},
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -55,16 +55,16 @@ VERSIONED_CHARACTERIZATION_TEST(
     contentAddress,
     "content-address",
     defaultVersion,
-    (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
-        ContentAddress {
+    (std::tuple<ContentAddress, ContentAddress, ContentAddress>{
+        ContentAddress{
             .method = ContentAddressMethod::Raw::Text,
             .hash = hashString(HashAlgorithm::SHA256, "Derive(...)"),
         },
-        ContentAddress {
+        ContentAddress{
             .method = ContentAddressMethod::Raw::Flat,
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
-        ContentAddress {
+        ContentAddress{
             .method = ContentAddressMethod::Raw::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
@@ -75,12 +75,12 @@ VERSIONED_CHARACTERIZATION_TEST(
     drvOutput,
     "drv-output",
     defaultVersion,
-    (std::tuple<DrvOutput, DrvOutput> {
+    (std::tuple<DrvOutput, DrvOutput>{
         {
             .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
             .outputName = "baz",
         },
-        DrvOutput {
+        DrvOutput{
             .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
             .outputName = "quux",
         },
@@ -93,70 +93,88 @@ VERSIONED_CHARACTERIZATION_TEST(
     realisation,
     "realisation",
     defaultVersion,
-    (std::tuple<Realisation, Realisation> {
-        Realisation {
-            .id = DrvOutput {
-                .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-                .outputName = "baz",
-            },
-            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-            .signatures = { "asdf", "qwer" },
-        },
-        Realisation {
-            .id = {
-                .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-                .outputName = "baz",
-            },
-            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-            .signatures = { "asdf", "qwer" },
-            .dependentRealisations = {
-                {
-                    DrvOutput {
-                        .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                        .outputName = "quux",
-                    },
-                    StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
+    (std::tuple<Realisation, Realisation>{
+        Realisation{
+            .id =
+                DrvOutput{
+                    .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
+                    .outputName = "baz",
+                },
+            .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+            .signatures = {"asdf", "qwer"},
+        },
+        Realisation{
+            .id =
+                {
+                    .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
+                    .outputName = "baz",
+                },
+            .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+            .signatures = {"asdf", "qwer"},
+            .dependentRealisations =
+                {
+                    {
+                        DrvOutput{
+                            .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                            .outputName = "quux",
+                        },
+                        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+                    },
                 },
-            },
         },
     }))
 
-VERSIONED_CHARACTERIZATION_TEST(
-    ServeProtoTest,
-    buildResult_2_2,
-    "build-result-2.2",
-    2 << 8 | 2,
-    ({
-        using namespace std::literals::chrono_literals;
-        std::tuple<BuildResult, BuildResult, BuildResult> t {
-            BuildResult {
-                .status = BuildResult::OutputRejected,
-                .errorMsg = "no idea why",
-            },
-            BuildResult {
-                .status = BuildResult::NotDeterministic,
-                .errorMsg = "no idea why",
-            },
-            BuildResult {
-                .status = BuildResult::Built,
-            },
-        };
-        t;
-    }))
+VERSIONED_CHARACTERIZATION_TEST(ServeProtoTest, buildResult_2_2, "build-result-2.2", 2 << 8 | 2, ({
+                                    using namespace std::literals::chrono_literals;
+                                    std::tuple<BuildResult, BuildResult, BuildResult> t{
+                                        BuildResult{
+                                            .status = BuildResult::OutputRejected,
+                                            .errorMsg = "no idea why",
+                                        },
+                                        BuildResult{
+                                            .status = BuildResult::NotDeterministic,
+                                            .errorMsg = "no idea why",
+                                        },
+                                        BuildResult{
+                                            .status = BuildResult::Built,
+                                        },
+                                    };
+                                    t;
+                                }))
+
+VERSIONED_CHARACTERIZATION_TEST(ServeProtoTest, buildResult_2_3, "build-result-2.3", 2 << 8 | 3, ({
+                                    using namespace std::literals::chrono_literals;
+                                    std::tuple<BuildResult, BuildResult, BuildResult> t{
+                                        BuildResult{
+                                            .status = BuildResult::OutputRejected,
+                                            .errorMsg = "no idea why",
+                                        },
+                                        BuildResult{
+                                            .status = BuildResult::NotDeterministic,
+                                            .errorMsg = "no idea why",
+                                            .timesBuilt = 3,
+                                            .isNonDeterministic = true,
+                                            .startTime = 30,
+                                            .stopTime = 50,
+                                        },
+                                        BuildResult{
+                                            .status = BuildResult::Built,
+                                            .startTime = 30,
+                                            .stopTime = 50,
+                                        },
+                                    };
+                                    t;
+                                }))
 
 VERSIONED_CHARACTERIZATION_TEST(
-    ServeProtoTest,
-    buildResult_2_3,
-    "build-result-2.3",
-    2 << 8 | 3,
-    ({
+    ServeProtoTest, buildResult_2_6, "build-result-2.6", 2 << 8 | 6, ({
         using namespace std::literals::chrono_literals;
-        std::tuple<BuildResult, BuildResult, BuildResult> t {
-            BuildResult {
+        std::tuple<BuildResult, BuildResult, BuildResult> t{
+            BuildResult{
                 .status = BuildResult::OutputRejected,
                 .errorMsg = "no idea why",
             },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::NotDeterministic,
                 .errorMsg = "no idea why",
                 .timesBuilt = 3,
@@ -164,60 +182,36 @@ VERSIONED_CHARACTERIZATION_TEST(
                 .startTime = 30,
                 .stopTime = 50,
             },
-            BuildResult {
-                .status = BuildResult::Built,
-                .startTime = 30,
-                .stopTime = 50,
-            },
-        };
-        t;
-    }))
-
-VERSIONED_CHARACTERIZATION_TEST(
-    ServeProtoTest,
-    buildResult_2_6,
-    "build-result-2.6",
-    2 << 8 | 6,
-    ({
-        using namespace std::literals::chrono_literals;
-        std::tuple<BuildResult, BuildResult, BuildResult> t {
-            BuildResult {
-                .status = BuildResult::OutputRejected,
-                .errorMsg = "no idea why",
-            },
-            BuildResult {
-                .status = BuildResult::NotDeterministic,
-                .errorMsg = "no idea why",
-                .timesBuilt = 3,
-                .isNonDeterministic = true,
-                .startTime = 30,
-                .stopTime = 50,
-            },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::Built,
                 .timesBuilt = 1,
-                .builtOutputs = {
+                .builtOutputs =
                     {
-                        "foo",
                         {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "foo",
+                            "foo",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "foo",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+                            },
+                        },
+                        {
+                            "bar",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "bar",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar"},
                             },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
                         },
                     },
-                    {
-                        "bar",
-                        {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "bar",
-                            },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar" },
-                        },
-                    },
-                },
                 .startTime = 30,
                 .stopTime = 50,
 #if 0
@@ -237,19 +231,19 @@ VERSIONED_CHARACTERIZATION_TEST(
     unkeyedValidPathInfo_2_3,
     "unkeyed-valid-path-info-2.3",
     2 << 8 | 3,
-    (std::tuple<UnkeyedValidPathInfo, UnkeyedValidPathInfo> {
+    (std::tuple<UnkeyedValidPathInfo, UnkeyedValidPathInfo>{
         ({
-            UnkeyedValidPathInfo info { Hash::dummy };
+            UnkeyedValidPathInfo info{Hash::dummy};
             info.narSize = 34878;
             info;
         }),
         ({
-            UnkeyedValidPathInfo info { Hash::dummy };
-            info.deriver = StorePath {
+            UnkeyedValidPathInfo info{Hash::dummy};
+            info.deriver = StorePath{
                 "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
             };
             info.references = {
-                StorePath {
+                StorePath{
                     "g1w7hyyyy1w7hy3qg1w7hy3qgqqqqy3q-foo.drv",
                 },
             };
@@ -263,16 +257,16 @@ VERSIONED_CHARACTERIZATION_TEST(
     unkeyedValidPathInfo_2_4,
     "unkeyed-valid-path-info-2.4",
     2 << 8 | 4,
-    (std::tuple<UnkeyedValidPathInfo, UnkeyedValidPathInfo> {
+    (std::tuple<UnkeyedValidPathInfo, UnkeyedValidPathInfo>{
         ({
-            UnkeyedValidPathInfo info {
+            UnkeyedValidPathInfo info{
                 Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
             };
-            info.deriver = StorePath {
+            info.deriver = StorePath{
                 "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
             };
             info.references = {
-                StorePath {
+                StorePath{
                     "g1w7hyyyy1w7hy3qg1w7hy3qgqqqqy3q-foo.drv",
                 },
             };
@@ -280,31 +274,33 @@ VERSIONED_CHARACTERIZATION_TEST(
             info;
         }),
         ({
-            ValidPathInfo info {
-                *LibStoreTest::store,
+            auto info = ValidPathInfo::makeFromCA(
+                store,
                 "foo",
-                FixedOutputInfo {
+                FixedOutputInfo{
                     .method = FileIngestionMethod::NixArchive,
                     .hash = hashString(HashAlgorithm::SHA256, "(...)"),
-                    .references = {
-                        .others = {
-                            StorePath {
-                                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
-                            },
+                    .references =
+                        {
+                            .others =
+                                {
+                                    StorePath{
+                                        "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
+                                    },
+                                },
+                            .self = true,
                         },
-                        .self = true,
-                    },
                 },
-                Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-            };
-            info.deriver = StorePath {
+                Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="));
+            info.deriver = StorePath{
                 "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
             };
             info.narSize = 34878;
-            info.sigs = {
-                "fake-sig-1",
-                "fake-sig-2",
-            },
+            info.sigs =
+                {
+                    "fake-sig-1",
+                    "fake-sig-2",
+                },
             static_cast<UnkeyedValidPathInfo>(std::move(info));
         }),
     }))
@@ -314,7 +310,7 @@ VERSIONED_CHARACTERIZATION_TEST(
     build_options_2_1,
     "build-options-2.1",
     2 << 8 | 1,
-    (ServeProto::BuildOptions {
+    (ServeProto::BuildOptions{
         .maxSilentTime = 5,
         .buildTimeout = 6,
     }))
@@ -324,7 +320,7 @@ VERSIONED_CHARACTERIZATION_TEST(
     build_options_2_2,
     "build-options-2.2",
     2 << 8 | 2,
-    (ServeProto::BuildOptions {
+    (ServeProto::BuildOptions{
         .maxSilentTime = 5,
         .buildTimeout = 6,
         .maxLogSize = 7,
@@ -335,7 +331,7 @@ VERSIONED_CHARACTERIZATION_TEST(
     build_options_2_3,
     "build-options-2.3",
     2 << 8 | 3,
-    (ServeProto::BuildOptions {
+    (ServeProto::BuildOptions{
         .maxSilentTime = 5,
         .buildTimeout = 6,
         .maxLogSize = 7,
@@ -348,7 +344,7 @@ VERSIONED_CHARACTERIZATION_TEST(
     build_options_2_7,
     "build-options-2.7",
     2 << 8 | 7,
-    (ServeProto::BuildOptions {
+    (ServeProto::BuildOptions{
         .maxSilentTime = 5,
         .buildTimeout = 6,
         .maxLogSize = 7,
@@ -362,11 +358,15 @@ VERSIONED_CHARACTERIZATION_TEST(
     vector,
     "vector",
     defaultVersion,
-    (std::tuple<std::vector<std::string>, std::vector<std::string>, std::vector<std::string>, std::vector<std::vector<std::string>>> {
-        { },
-        { "" },
-        { "", "foo", "bar" },
-        { {}, { "" }, { "", "1", "2" } },
+    (std::tuple<
+        std::vector<std::string>,
+        std::vector<std::string>,
+        std::vector<std::string>,
+        std::vector<std::vector<std::string>>>{
+        {},
+        {""},
+        {"", "foo", "bar"},
+        {{}, {""}, {"", "1", "2"}},
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -374,11 +374,11 @@ VERSIONED_CHARACTERIZATION_TEST(
     set,
     "set",
     defaultVersion,
-    (std::tuple<StringSet, StringSet, StringSet, std::set<StringSet>> {
-        { },
-        { "" },
-        { "", "foo", "bar" },
-        { {}, { "" }, { "", "1", "2" } },
+    (std::tuple<StringSet, StringSet, StringSet, std::set<StringSet>>{
+        {},
+        {""},
+        {"", "foo", "bar"},
+        {{}, {""}, {"", "1", "2"}},
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -386,10 +386,10 @@ VERSIONED_CHARACTERIZATION_TEST(
     optionalStorePath,
     "optional-store-path",
     defaultVersion,
-    (std::tuple<std::optional<StorePath>, std::optional<StorePath>> {
+    (std::tuple<std::optional<StorePath>, std::optional<StorePath>>{
         std::nullopt,
-        std::optional {
-            StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar" },
+        std::optional{
+            StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar"},
         },
     }))
 
@@ -398,10 +398,10 @@ VERSIONED_CHARACTERIZATION_TEST(
     optionalContentAddress,
     "optional-content-address",
     defaultVersion,
-    (std::tuple<std::optional<ContentAddress>, std::optional<ContentAddress>> {
+    (std::tuple<std::optional<ContentAddress>, std::optional<ContentAddress>>{
         std::nullopt,
-        std::optional {
-            ContentAddress {
+        std::optional{
+            ContentAddress{
                 .method = ContentAddressMethod::Raw::Flat,
                 .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
             },
@@ -420,18 +420,16 @@ TEST_F(ServeProtoTest, handshake_log)
         ServeProto::Version clientResult;
 
         auto thread = std::thread([&]() {
-            FdSink out { toServer.writeSide.get() };
-            FdSource in0 { toClient.readSide.get() };
-            TeeSource in { in0, toClientLog };
-            clientResult = ServeProto::BasicClientConnection::handshake(
-                out, in, defaultVersion, "blah");
+            FdSink out{toServer.writeSide.get()};
+            FdSource in0{toClient.readSide.get()};
+            TeeSource in{in0, toClientLog};
+            clientResult = ServeProto::BasicClientConnection::handshake(out, in, defaultVersion, "blah");
         });
 
         {
-            FdSink out { toClient.writeSide.get() };
-            FdSource in { toServer.readSide.get() };
-            ServeProto::BasicServerConnection::handshake(
-                out, in, defaultVersion);
+            FdSink out{toClient.writeSide.get()};
+            FdSource in{toServer.readSide.get()};
+            ServeProto::BasicServerConnection::handshake(out, in, defaultVersion);
         };
 
         thread.join();
@@ -441,8 +439,9 @@ TEST_F(ServeProtoTest, handshake_log)
 }
 
 /// Has to be a `BufferedSink` for handshake.
-struct NullBufferedSink : BufferedSink {
-    void writeUnbuffered(std::string_view data) override { }
+struct NullBufferedSink : BufferedSink
+{
+    void writeUnbuffered(std::string_view data) override {}
 };
 
 TEST_F(ServeProtoTest, handshake_client_replay)
@@ -450,9 +449,8 @@ TEST_F(ServeProtoTest, handshake_client_replay)
     CharacterizationTest::readTest("handshake-to-client", [&](std::string toClientLog) {
         NullBufferedSink nullSink;
 
-        StringSource in { toClientLog };
-        auto clientResult = ServeProto::BasicClientConnection::handshake(
-            nullSink, in, defaultVersion, "blah");
+        StringSource in{toClientLog};
+        auto clientResult = ServeProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, "blah");
 
         EXPECT_EQ(clientResult, defaultVersion);
     });
@@ -486,23 +484,18 @@ TEST_F(ServeProtoTest, handshake_client_corrupted_throws)
             ++toClientLogCorrupt[idx];
 
             NullBufferedSink nullSink;
-            StringSource in { toClientLogCorrupt };
+            StringSource in{toClientLogCorrupt};
 
             if (idx < 4 || idx == 9) {
                 // magic bytes don't match
-                EXPECT_THROW(
-                    ServeProto::BasicClientConnection::handshake(
-                        nullSink, in, defaultVersion, "blah"),
-                    Error);
+                EXPECT_THROW(ServeProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, "blah"), Error);
             } else if (idx < 8 || idx >= 12) {
                 // Number out of bounds
                 EXPECT_THROW(
-                    ServeProto::BasicClientConnection::handshake(
-                        nullSink, in, defaultVersion, "blah"),
+                    ServeProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, "blah"),
                     SerialisationError);
             } else {
-                auto ver = ServeProto::BasicClientConnection::handshake(
-                    nullSink, in, defaultVersion, "blah");
+                auto ver = ServeProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, "blah");
                 // `std::min` of this and the other version saves us
                 EXPECT_EQ(ver, defaultVersion);
             }
@@ -510,4 +503,4 @@ TEST_F(ServeProtoTest, handshake_client_corrupted_throws)
     });
 }
 
-}
+} // namespace nix
diff --git a/src/libstore-tests/ssh-store.cc b/src/libstore-tests/ssh-store.cc
index ccb87b767..a156da52b 100644
--- a/src/libstore-tests/ssh-store.cc
+++ b/src/libstore-tests/ssh-store.cc
@@ -1,17 +1,16 @@
-// FIXME: Odd failures for templates that are causing the PR to break
-// for now with discussion with @Ericson2314 to comment out.
-#if 0
-#  include <gtest/gtest.h>
+#include <gtest/gtest.h>
 
-#  include "nix/store/ssh-store.hh"
+#include "nix/store/ssh-store.hh"
+#include "nix/util/config-impl.hh"
+#include "nix/util/abstract-setting-to-json.hh"
 
 namespace nix {
 
 TEST(SSHStore, constructConfig)
 {
     SSHStoreConfig config{
-        "ssh",
-        "localhost",
+        "ssh-ng",
+        "me@localhost:2222",
         StoreConfig::Params{
             {
                 "remote-program",
@@ -27,6 +26,10 @@ TEST(SSHStore, constructConfig)
             "foo",
             "bar",
         }));
+
+    EXPECT_EQ(config.getReference().render(/*withParams=*/true), "ssh-ng://me@localhost:2222?remote-program=foo%20bar");
+    config.resetOverridden();
+    EXPECT_EQ(config.getReference().render(/*withParams=*/true), "ssh-ng://me@localhost:2222");
 }
 
 TEST(MountedSSHStore, constructConfig)
@@ -51,5 +54,4 @@ TEST(MountedSSHStore, constructConfig)
         }));
 }
 
-}
-#endif
+} // namespace nix
diff --git a/src/libstore-tests/store-reference.cc b/src/libstore-tests/store-reference.cc
index dd1b83090..7b42b45a2 100644
--- a/src/libstore-tests/store-reference.cc
+++ b/src/libstore-tests/store-reference.cc
@@ -85,14 +85,35 @@ static StoreReference localExample_2{
         },
 };
 
+static StoreReference localExample_3{
+    .variant =
+        StoreReference::Specified{
+            .scheme = "local",
+        },
+    .params =
+        {
+            {"root", "/foo bar/baz"},
+        },
+};
+
 URI_TEST(local_1, localExample_1)
 
 URI_TEST(local_2, localExample_2)
 
+/* Test path with spaces */
+URI_TEST(local_3, localExample_3)
+
 URI_TEST_READ(local_shorthand_1, localExample_1)
 
 URI_TEST_READ(local_shorthand_2, localExample_2)
 
+URI_TEST(
+    local_shorthand_3,
+    (StoreReference{
+        .variant = StoreReference::Local{},
+        .params = {},
+    }))
+
 static StoreReference unixExample{
     .variant =
         StoreReference::Specified{
@@ -120,4 +141,46 @@ URI_TEST(
         .params = {},
     }))
 
-}
+URI_TEST(
+    daemon_shorthand,
+    (StoreReference{
+        .variant = StoreReference::Daemon{},
+        .params = {},
+    }))
+
+static StoreReference sshLoopbackIPv6{
+    .variant =
+        StoreReference::Specified{
+            .scheme = "ssh",
+            .authority = "[::1]",
+        },
+};
+
+URI_TEST_READ(ssh_unbracketed_ipv6_1, sshLoopbackIPv6)
+
+static StoreReference sshIPv6AuthorityWithUserinfo{
+    .variant =
+        StoreReference::Specified{
+            .scheme = "ssh",
+            .authority = "userinfo@[fea5:23e1:3916:fc24:cb52:2837:2ecb:ea8e]",
+        },
+};
+
+URI_TEST_READ(ssh_unbracketed_ipv6_2, sshIPv6AuthorityWithUserinfo)
+
+static StoreReference sshIPv6AuthorityWithUserinfoAndParams{
+    .variant =
+        StoreReference::Specified{
+            .scheme = "ssh",
+            .authority = "userinfo@[fea5:23e1:3916:fc24:cb52:2837:2ecb:ea8e]",
+        },
+    .params =
+        {
+            {"a", "b"},
+            {"c", "d"},
+        },
+};
+
+URI_TEST_READ(ssh_unbracketed_ipv6_3, sshIPv6AuthorityWithUserinfoAndParams)
+
+} // namespace nix
diff --git a/src/libstore-tests/uds-remote-store.cc b/src/libstore-tests/uds-remote-store.cc
index c6a926668..11e6b04a3 100644
--- a/src/libstore-tests/uds-remote-store.cc
+++ b/src/libstore-tests/uds-remote-store.cc
@@ -1,9 +1,6 @@
-// FIXME: Odd failures for templates that are causing the PR to break
-// for now with discussion with @Ericson2314 to comment out.
-#if 0
-#  include <gtest/gtest.h>
+#include <gtest/gtest.h>
 
-#  include "nix/store/uds-remote-store.hh"
+#include "nix/store/uds-remote-store.hh"
 
 namespace nix {
 
@@ -19,5 +16,10 @@ TEST(UDSRemoteStore, constructConfigWrongScheme)
     EXPECT_THROW(UDSRemoteStoreConfig("http", "/tmp/socket", {}), UsageError);
 }
 
+TEST(UDSRemoteStore, constructConfig_to_string)
+{
+    UDSRemoteStoreConfig config{"unix", "", {}};
+    EXPECT_EQ(config.getReference().to_string(), "daemon");
+}
+
 } // namespace nix
-#endif
diff --git a/src/libstore-tests/worker-protocol.cc b/src/libstore-tests/worker-protocol.cc
index 4baf8a325..823d8d85a 100644
--- a/src/libstore-tests/worker-protocol.cc
+++ b/src/libstore-tests/worker-protocol.cc
@@ -25,13 +25,12 @@ struct WorkerProtoTest : VersionedProtoTest<WorkerProto, workerProtoDir>
     WorkerProto::Version defaultVersion = 1 << 8 | 10;
 };
 
-
 VERSIONED_CHARACTERIZATION_TEST(
     WorkerProtoTest,
     string,
     "string",
     defaultVersion,
-    (std::tuple<std::string, std::string, std::string, std::string, std::string> {
+    (std::tuple<std::string, std::string, std::string, std::string, std::string>{
         "",
         "hi",
         "white rabbit",
@@ -46,9 +45,9 @@ VERSIONED_CHARACTERIZATION_TEST(
     storePath,
     "store-path",
     defaultVersion,
-    (std::tuple<StorePath, StorePath> {
-        StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-        StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar" },
+    (std::tuple<StorePath, StorePath>{
+        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar"},
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -56,16 +55,16 @@ VERSIONED_CHARACTERIZATION_TEST(
     contentAddress,
     "content-address",
     defaultVersion,
-    (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
-        ContentAddress {
+    (std::tuple<ContentAddress, ContentAddress, ContentAddress>{
+        ContentAddress{
             .method = ContentAddressMethod::Raw::Text,
             .hash = hashString(HashAlgorithm::SHA256, "Derive(...)"),
         },
-        ContentAddress {
+        ContentAddress{
             .method = ContentAddressMethod::Raw::Flat,
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
-        ContentAddress {
+        ContentAddress{
             .method = ContentAddressMethod::Raw::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
@@ -78,21 +77,23 @@ VERSIONED_CHARACTERIZATION_TEST(
     derivedPath_1_29,
     "derived-path-1.29",
     1 << 8 | 29,
-    (std::tuple<DerivedPath, DerivedPath, DerivedPath> {
-        DerivedPath::Opaque {
-            .path = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
+    (std::tuple<DerivedPath, DerivedPath, DerivedPath>{
+        DerivedPath::Opaque{
+            .path = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
         },
-        DerivedPath::Built {
-            .drvPath = makeConstantStorePathRef(StorePath {
-                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
-            }),
-            .outputs = OutputsSpec::All { },
+        DerivedPath::Built{
+            .drvPath = makeConstantStorePathRef(
+                StorePath{
+                    "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
+                }),
+            .outputs = OutputsSpec::All{},
         },
-        DerivedPath::Built {
-            .drvPath = makeConstantStorePathRef(StorePath {
-                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
-            }),
-            .outputs = OutputsSpec::Names { "x", "y" },
+        DerivedPath::Built{
+            .drvPath = makeConstantStorePathRef(
+                StorePath{
+                    "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
+                }),
+            .outputs = OutputsSpec::Names{"x", "y"},
         },
     }))
 
@@ -101,24 +102,26 @@ VERSIONED_CHARACTERIZATION_TEST(
     derivedPath_1_30,
     "derived-path-1.30",
     1 << 8 | 30,
-    (std::tuple<DerivedPath, DerivedPath, DerivedPath, DerivedPath> {
-        DerivedPath::Opaque {
-            .path = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
+    (std::tuple<DerivedPath, DerivedPath, DerivedPath, DerivedPath>{
+        DerivedPath::Opaque{
+            .path = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
         },
-        DerivedPath::Opaque {
-            .path = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo.drv" },
+        DerivedPath::Opaque{
+            .path = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo.drv"},
         },
-        DerivedPath::Built {
-            .drvPath = makeConstantStorePathRef(StorePath {
-                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
-            }),
-            .outputs = OutputsSpec::All { },
+        DerivedPath::Built{
+            .drvPath = makeConstantStorePathRef(
+                StorePath{
+                    "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
+                }),
+            .outputs = OutputsSpec::All{},
         },
-        DerivedPath::Built {
-            .drvPath = makeConstantStorePathRef(StorePath {
-                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
-            }),
-            .outputs = OutputsSpec::Names { "x", "y" },
+        DerivedPath::Built{
+            .drvPath = makeConstantStorePathRef(
+                StorePath{
+                    "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
+                }),
+            .outputs = OutputsSpec::Names{"x", "y"},
         },
     }))
 
@@ -127,12 +130,12 @@ VERSIONED_CHARACTERIZATION_TEST(
     drvOutput,
     "drv-output",
     defaultVersion,
-    (std::tuple<DrvOutput, DrvOutput> {
+    (std::tuple<DrvOutput, DrvOutput>{
         {
             .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
             .outputName = "baz",
         },
-        DrvOutput {
+        DrvOutput{
             .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
             .outputName = "quux",
         },
@@ -143,115 +146,110 @@ VERSIONED_CHARACTERIZATION_TEST(
     realisation,
     "realisation",
     defaultVersion,
-    (std::tuple<Realisation, Realisation> {
-        Realisation {
-            .id = DrvOutput {
-                .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-                .outputName = "baz",
-            },
-            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-            .signatures = { "asdf", "qwer" },
+    (std::tuple<Realisation, Realisation>{
+        Realisation{
+            .id =
+                DrvOutput{
+                    .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
+                    .outputName = "baz",
+                },
+            .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+            .signatures = {"asdf", "qwer"},
         },
-        Realisation {
-            .id = {
-                .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-                .outputName = "baz",
-            },
-            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-            .signatures = { "asdf", "qwer" },
-            .dependentRealisations = {
+        Realisation{
+            .id =
                 {
-                    DrvOutput {
-                        .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                        .outputName = "quux",
-                    },
-                    StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
+                    .drvHash = Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
+                    .outputName = "baz",
+                },
+            .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+            .signatures = {"asdf", "qwer"},
+            .dependentRealisations =
+                {
+                    {
+                        DrvOutput{
+                            .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                            .outputName = "quux",
+                        },
+                        StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+                    },
                 },
-            },
         },
     }))
 
+VERSIONED_CHARACTERIZATION_TEST(WorkerProtoTest, buildResult_1_27, "build-result-1.27", 1 << 8 | 27, ({
+                                    using namespace std::literals::chrono_literals;
+                                    std::tuple<BuildResult, BuildResult, BuildResult> t{
+                                        BuildResult{
+                                            .status = BuildResult::OutputRejected,
+                                            .errorMsg = "no idea why",
+                                        },
+                                        BuildResult{
+                                            .status = BuildResult::NotDeterministic,
+                                            .errorMsg = "no idea why",
+                                        },
+                                        BuildResult{
+                                            .status = BuildResult::Built,
+                                        },
+                                    };
+                                    t;
+                                }))
+
 VERSIONED_CHARACTERIZATION_TEST(
-    WorkerProtoTest,
-    buildResult_1_27,
-    "build-result-1.27",
-    1 << 8 | 27,
-    ({
+    WorkerProtoTest, buildResult_1_28, "build-result-1.28", 1 << 8 | 28, ({
         using namespace std::literals::chrono_literals;
-        std::tuple<BuildResult, BuildResult, BuildResult> t {
-            BuildResult {
+        std::tuple<BuildResult, BuildResult, BuildResult> t{
+            BuildResult{
                 .status = BuildResult::OutputRejected,
                 .errorMsg = "no idea why",
             },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::NotDeterministic,
                 .errorMsg = "no idea why",
             },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::Built,
+                .builtOutputs =
+                    {
+                        {
+                            "foo",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "foo",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+                            },
+                        },
+                        {
+                            "bar",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "bar",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar"},
+                            },
+                        },
+                    },
             },
         };
         t;
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
-    WorkerProtoTest,
-    buildResult_1_28,
-    "build-result-1.28",
-    1 << 8 | 28,
-    ({
+    WorkerProtoTest, buildResult_1_29, "build-result-1.29", 1 << 8 | 29, ({
         using namespace std::literals::chrono_literals;
-        std::tuple<BuildResult, BuildResult, BuildResult> t {
-            BuildResult {
+        std::tuple<BuildResult, BuildResult, BuildResult> t{
+            BuildResult{
                 .status = BuildResult::OutputRejected,
                 .errorMsg = "no idea why",
             },
-            BuildResult {
-                .status = BuildResult::NotDeterministic,
-                .errorMsg = "no idea why",
-            },
-            BuildResult {
-                .status = BuildResult::Built,
-                .builtOutputs = {
-                    {
-                        "foo",
-                        {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "foo",
-                            },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
-                        },
-                    },
-                    {
-                        "bar",
-                        {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "bar",
-                            },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar" },
-                        },
-                    },
-                },
-            },
-        };
-        t;
-    }))
-
-VERSIONED_CHARACTERIZATION_TEST(
-    WorkerProtoTest,
-    buildResult_1_29,
-    "build-result-1.29",
-    1 << 8 | 29,
-    ({
-        using namespace std::literals::chrono_literals;
-        std::tuple<BuildResult, BuildResult, BuildResult> t {
-            BuildResult {
-                .status = BuildResult::OutputRejected,
-                .errorMsg = "no idea why",
-            },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::NotDeterministic,
                 .errorMsg = "no idea why",
                 .timesBuilt = 3,
@@ -259,31 +257,36 @@ VERSIONED_CHARACTERIZATION_TEST(
                 .startTime = 30,
                 .stopTime = 50,
             },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::Built,
                 .timesBuilt = 1,
-                .builtOutputs = {
+                .builtOutputs =
                     {
-                        "foo",
                         {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "foo",
+                            "foo",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "foo",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+                            },
+                        },
+                        {
+                            "bar",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "bar",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar"},
                             },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
                         },
                     },
-                    {
-                        "bar",
-                        {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "bar",
-                            },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar" },
-                        },
-                    },
-                },
                 .startTime = 30,
                 .stopTime = 50,
             },
@@ -292,18 +295,14 @@ VERSIONED_CHARACTERIZATION_TEST(
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
-    WorkerProtoTest,
-    buildResult_1_37,
-    "build-result-1.37",
-    1 << 8 | 37,
-    ({
+    WorkerProtoTest, buildResult_1_37, "build-result-1.37", 1 << 8 | 37, ({
         using namespace std::literals::chrono_literals;
-        std::tuple<BuildResult, BuildResult, BuildResult> t {
-            BuildResult {
+        std::tuple<BuildResult, BuildResult, BuildResult> t{
+            BuildResult{
                 .status = BuildResult::OutputRejected,
                 .errorMsg = "no idea why",
             },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::NotDeterministic,
                 .errorMsg = "no idea why",
                 .timesBuilt = 3,
@@ -311,31 +310,36 @@ VERSIONED_CHARACTERIZATION_TEST(
                 .startTime = 30,
                 .stopTime = 50,
             },
-            BuildResult {
+            BuildResult{
                 .status = BuildResult::Built,
                 .timesBuilt = 1,
-                .builtOutputs = {
+                .builtOutputs =
                     {
-                        "foo",
                         {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "foo",
+                            "foo",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "foo",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo"},
+                            },
+                        },
+                        {
+                            "bar",
+                            {
+                                .id =
+                                    DrvOutput{
+                                        .drvHash =
+                                            Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
+                                        .outputName = "bar",
+                                    },
+                                .outPath = StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar"},
                             },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo" },
                         },
                     },
-                    {
-                        "bar",
-                        {
-                            .id = DrvOutput {
-                                .drvHash = Hash::parseSRI("sha256-b4afnqKCO9oWXgYHb9DeQ2berSwOjS27rSd9TxXDc/U="),
-                                .outputName = "bar",
-                            },
-                            .outPath = StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar" },
-                        },
-                    },
-                },
                 .startTime = 30,
                 .stopTime = 50,
                 .cpuUser = std::chrono::microseconds(500s),
@@ -345,51 +349,49 @@ VERSIONED_CHARACTERIZATION_TEST(
         t;
     }))
 
-VERSIONED_CHARACTERIZATION_TEST(
-    WorkerProtoTest,
-    keyedBuildResult_1_29,
-    "keyed-build-result-1.29",
-    1 << 8 | 29,
-    ({
-        using namespace std::literals::chrono_literals;
-        std::tuple<KeyedBuildResult, KeyedBuildResult/*, KeyedBuildResult*/> t {
-            KeyedBuildResult {
-                {
-                    .status = KeyedBuildResult::OutputRejected,
-                    .errorMsg = "no idea why",
-                },
-                /* .path = */ DerivedPath::Opaque {
-                    StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-xxx" },
-                },
-            },
-            KeyedBuildResult {
-                {
-                    .status = KeyedBuildResult::NotDeterministic,
-                    .errorMsg = "no idea why",
-                    .timesBuilt = 3,
-                    .isNonDeterministic = true,
-                    .startTime = 30,
-                    .stopTime = 50,
-                },
-                /* .path = */ DerivedPath::Built {
-                    .drvPath = makeConstantStorePathRef(StorePath {
-                        "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
-                    }),
-                    .outputs = OutputsSpec::Names { "out" },
-                },
-            },
-        };
-        t;
-    }))
+VERSIONED_CHARACTERIZATION_TEST(WorkerProtoTest, keyedBuildResult_1_29, "keyed-build-result-1.29", 1 << 8 | 29, ({
+                                    using namespace std::literals::chrono_literals;
+                                    std::tuple<KeyedBuildResult, KeyedBuildResult /*, KeyedBuildResult*/> t{
+                                        KeyedBuildResult{
+                                            {
+                                                .status = KeyedBuildResult::OutputRejected,
+                                                .errorMsg = "no idea why",
+                                            },
+                                            /* .path = */
+                                            DerivedPath::Opaque{
+                                                StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-xxx"},
+                                            },
+                                        },
+                                        KeyedBuildResult{
+                                            {
+                                                .status = KeyedBuildResult::NotDeterministic,
+                                                .errorMsg = "no idea why",
+                                                .timesBuilt = 3,
+                                                .isNonDeterministic = true,
+                                                .startTime = 30,
+                                                .stopTime = 50,
+                                            },
+                                            /* .path = */
+                                            DerivedPath::Built{
+                                                .drvPath = makeConstantStorePathRef(
+                                                    StorePath{
+                                                        "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
+                                                    }),
+                                                .outputs = OutputsSpec::Names{"out"},
+                                            },
+                                        },
+                                    };
+                                    t;
+                                }))
 
 VERSIONED_CHARACTERIZATION_TEST(
     WorkerProtoTest,
     unkeyedValidPathInfo_1_15,
     "unkeyed-valid-path-info-1.15",
     1 << 8 | 15,
-    (std::tuple<UnkeyedValidPathInfo, UnkeyedValidPathInfo> {
+    (std::tuple<UnkeyedValidPathInfo, UnkeyedValidPathInfo>{
         ({
-            UnkeyedValidPathInfo info {
+            UnkeyedValidPathInfo info{
                 Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
             };
             info.registrationTime = 23423;
@@ -397,14 +399,14 @@ VERSIONED_CHARACTERIZATION_TEST(
             info;
         }),
         ({
-            UnkeyedValidPathInfo info {
+            UnkeyedValidPathInfo info{
                 Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
             };
-            info.deriver = StorePath {
+            info.deriver = StorePath{
                 "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
             };
             info.references = {
-                StorePath {
+                StorePath{
                     "g1w7hyyyy1w7hy3qg1w7hy3qgqqqqy3q-foo.drv",
                 },
             };
@@ -419,13 +421,13 @@ VERSIONED_CHARACTERIZATION_TEST(
     validPathInfo_1_15,
     "valid-path-info-1.15",
     1 << 8 | 15,
-    (std::tuple<ValidPathInfo, ValidPathInfo> {
+    (std::tuple<ValidPathInfo, ValidPathInfo>{
         ({
-            ValidPathInfo info {
-                StorePath {
+            ValidPathInfo info{
+                StorePath{
                     "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
                 },
-                UnkeyedValidPathInfo {
+                UnkeyedValidPathInfo{
                     Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
                 },
             };
@@ -434,24 +436,24 @@ VERSIONED_CHARACTERIZATION_TEST(
             info;
         }),
         ({
-            ValidPathInfo info {
-                StorePath {
+            ValidPathInfo info{
+                StorePath{
                     "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
                 },
-                UnkeyedValidPathInfo {
+                UnkeyedValidPathInfo{
                     Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
                 },
             };
-            info.deriver = StorePath {
+            info.deriver = StorePath{
                 "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
             };
             info.references = {
                 // other reference
-                StorePath {
+                StorePath{
                     "g1w7hyyyy1w7hy3qg1w7hy3qgqqqqy3q-foo",
                 },
                 // self reference
-                StorePath {
+                StorePath{
                     "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
                 },
             };
@@ -466,13 +468,13 @@ VERSIONED_CHARACTERIZATION_TEST(
     validPathInfo_1_16,
     "valid-path-info-1.16",
     1 << 8 | 16,
-    (std::tuple<ValidPathInfo, ValidPathInfo, ValidPathInfo> {
+    (std::tuple<ValidPathInfo, ValidPathInfo, ValidPathInfo>{
         ({
-            ValidPathInfo info {
-                StorePath {
+            ValidPathInfo info{
+                StorePath{
                     "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
                 },
-                UnkeyedValidPathInfo {
+                UnkeyedValidPathInfo{
                     Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
                 },
             };
@@ -482,53 +484,55 @@ VERSIONED_CHARACTERIZATION_TEST(
             info;
         }),
         ({
-            ValidPathInfo info {
-                StorePath {
+            ValidPathInfo info{
+                StorePath{
                     "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
                 },
-                UnkeyedValidPathInfo {
+                UnkeyedValidPathInfo{
                     Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
                 },
             };
-            info.deriver = StorePath {
+            info.deriver = StorePath{
                 "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar.drv",
             };
             info.references = {
                 // other reference
-                StorePath {
+                StorePath{
                     "g1w7hyyyy1w7hy3qg1w7hy3qgqqqqy3q-foo",
                 },
                 // self reference
-                StorePath {
+                StorePath{
                     "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
                 },
             };
             info.registrationTime = 23423;
             info.narSize = 34878;
-            info.sigs = {
-                "fake-sig-1",
-                "fake-sig-2",
-            },
+            info.sigs =
+                {
+                    "fake-sig-1",
+                    "fake-sig-2",
+                },
             info;
         }),
         ({
-            ValidPathInfo info {
-                *LibStoreTest::store,
+            auto info = ValidPathInfo::makeFromCA(
+                store,
                 "foo",
-                FixedOutputInfo {
+                FixedOutputInfo{
                     .method = FileIngestionMethod::NixArchive,
                     .hash = hashString(HashAlgorithm::SHA256, "(...)"),
-                    .references = {
-                        .others = {
-                            StorePath {
-                                "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
-                            },
+                    .references =
+                        {
+                            .others =
+                                {
+                                    StorePath{
+                                        "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-bar",
+                                    },
+                                },
+                            .self = true,
                         },
-                        .self = true,
-                    },
                 },
-                Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
-            };
+                Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="));
             info.registrationTime = 23423;
             info.narSize = 34878;
             info;
@@ -540,7 +544,7 @@ VERSIONED_CHARACTERIZATION_TEST(
     buildMode,
     "build-mode",
     defaultVersion,
-    (std::tuple<BuildMode, BuildMode, BuildMode> {
+    (std::tuple<BuildMode, BuildMode, BuildMode>{
         bmNormal,
         bmRepair,
         bmCheck,
@@ -551,10 +555,10 @@ VERSIONED_CHARACTERIZATION_TEST(
     optionalTrustedFlag,
     "optional-trusted-flag",
     defaultVersion,
-    (std::tuple<std::optional<TrustedFlag>, std::optional<TrustedFlag>, std::optional<TrustedFlag>> {
+    (std::tuple<std::optional<TrustedFlag>, std::optional<TrustedFlag>, std::optional<TrustedFlag>>{
         std::nullopt,
-        std::optional { Trusted },
-        std::optional { NotTrusted },
+        std::optional{Trusted},
+        std::optional{NotTrusted},
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -562,11 +566,15 @@ VERSIONED_CHARACTERIZATION_TEST(
     vector,
     "vector",
     defaultVersion,
-    (std::tuple<std::vector<std::string>, std::vector<std::string>, std::vector<std::string>, std::vector<std::vector<std::string>>> {
-        { },
-        { "" },
-        { "", "foo", "bar" },
-        { {}, { "" }, { "", "1", "2" } },
+    (std::tuple<
+        std::vector<std::string>,
+        std::vector<std::string>,
+        std::vector<std::string>,
+        std::vector<std::vector<std::string>>>{
+        {},
+        {""},
+        {"", "foo", "bar"},
+        {{}, {""}, {"", "1", "2"}},
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -574,11 +582,11 @@ VERSIONED_CHARACTERIZATION_TEST(
     set,
     "set",
     defaultVersion,
-    (std::tuple<StringSet, StringSet, StringSet, std::set<StringSet>> {
-        { },
-        { "" },
-        { "", "foo", "bar" },
-        { {}, { "" }, { "", "1", "2" } },
+    (std::tuple<StringSet, StringSet, StringSet, std::set<StringSet>>{
+        {},
+        {""},
+        {"", "foo", "bar"},
+        {{}, {""}, {"", "1", "2"}},
     }))
 
 VERSIONED_CHARACTERIZATION_TEST(
@@ -586,10 +594,10 @@ VERSIONED_CHARACTERIZATION_TEST(
     optionalStorePath,
     "optional-store-path",
     defaultVersion,
-    (std::tuple<std::optional<StorePath>, std::optional<StorePath>> {
+    (std::tuple<std::optional<StorePath>, std::optional<StorePath>>{
         std::nullopt,
-        std::optional {
-            StorePath { "g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar" },
+        std::optional{
+            StorePath{"g1w7hy3qg1w7hy3qg1w7hy3qg1w7hy3q-foo-bar"},
         },
     }))
 
@@ -598,10 +606,10 @@ VERSIONED_CHARACTERIZATION_TEST(
     optionalContentAddress,
     "optional-content-address",
     defaultVersion,
-    (std::tuple<std::optional<ContentAddress>, std::optional<ContentAddress>> {
+    (std::tuple<std::optional<ContentAddress>, std::optional<ContentAddress>>{
         std::nullopt,
-        std::optional {
-            ContentAddress {
+        std::optional{
+            ContentAddress{
                 .method = ContentAddressMethod::Raw::Flat,
                 .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
             },
@@ -613,7 +621,7 @@ VERSIONED_CHARACTERIZATION_TEST(
     clientHandshakeInfo_1_30,
     "client-handshake-info_1_30",
     1 << 8 | 30,
-    (std::tuple<WorkerProto::ClientHandshakeInfo> {
+    (std::tuple<WorkerProto::ClientHandshakeInfo>{
         {},
     }))
 
@@ -622,12 +630,12 @@ VERSIONED_CHARACTERIZATION_TEST(
     clientHandshakeInfo_1_33,
     "client-handshake-info_1_33",
     1 << 8 | 33,
-    (std::tuple<WorkerProto::ClientHandshakeInfo, WorkerProto::ClientHandshakeInfo> {
+    (std::tuple<WorkerProto::ClientHandshakeInfo, WorkerProto::ClientHandshakeInfo>{
         {
-            .daemonNixVersion = std::optional { "foo" },
+            .daemonNixVersion = std::optional{"foo"},
         },
         {
-            .daemonNixVersion = std::optional { "bar" },
+            .daemonNixVersion = std::optional{"bar"},
         },
     }))
 
@@ -636,14 +644,14 @@ VERSIONED_CHARACTERIZATION_TEST(
     clientHandshakeInfo_1_35,
     "client-handshake-info_1_35",
     1 << 8 | 35,
-    (std::tuple<WorkerProto::ClientHandshakeInfo, WorkerProto::ClientHandshakeInfo> {
+    (std::tuple<WorkerProto::ClientHandshakeInfo, WorkerProto::ClientHandshakeInfo>{
         {
-            .daemonNixVersion = std::optional { "foo" },
-            .remoteTrustsUs = std::optional { NotTrusted },
+            .daemonNixVersion = std::optional{"foo"},
+            .remoteTrustsUs = std::optional{NotTrusted},
         },
         {
-            .daemonNixVersion = std::optional { "bar" },
-            .remoteTrustsUs = std::optional { Trusted },
+            .daemonNixVersion = std::optional{"bar"},
+            .remoteTrustsUs = std::optional{Trusted},
         },
     }))
 
@@ -659,18 +667,16 @@ TEST_F(WorkerProtoTest, handshake_log)
         WorkerProto::Version clientResult;
 
         auto thread = std::thread([&]() {
-            FdSink out { toServer.writeSide.get() };
-            FdSource in0 { toClient.readSide.get() };
-            TeeSource in { in0, toClientLog };
-            clientResult = std::get<0>(WorkerProto::BasicClientConnection::handshake(
-                    out, in, defaultVersion, {}));
+            FdSink out{toServer.writeSide.get()};
+            FdSource in0{toClient.readSide.get()};
+            TeeSource in{in0, toClientLog};
+            clientResult = std::get<0>(WorkerProto::BasicClientConnection::handshake(out, in, defaultVersion, {}));
         });
 
         {
-            FdSink out { toClient.writeSide.get() };
-            FdSource in { toServer.readSide.get() };
-            WorkerProto::BasicServerConnection::handshake(
-                out, in, defaultVersion, {});
+            FdSink out{toClient.writeSide.get()};
+            FdSource in{toServer.readSide.get()};
+            WorkerProto::BasicServerConnection::handshake(out, in, defaultVersion, {});
         };
 
         thread.join();
@@ -688,16 +694,14 @@ TEST_F(WorkerProtoTest, handshake_features)
     std::tuple<WorkerProto::Version, WorkerProto::FeatureSet> clientResult;
 
     auto clientThread = std::thread([&]() {
-        FdSink out { toServer.writeSide.get() };
-        FdSource in { toClient.readSide.get() };
-        clientResult = WorkerProto::BasicClientConnection::handshake(
-            out, in, 123, {"bar", "aap", "mies", "xyzzy"});
+        FdSink out{toServer.writeSide.get()};
+        FdSource in{toClient.readSide.get()};
+        clientResult = WorkerProto::BasicClientConnection::handshake(out, in, 123, {"bar", "aap", "mies", "xyzzy"});
     });
 
-    FdSink out { toClient.writeSide.get() };
-    FdSource in { toServer.readSide.get() };
-    auto daemonResult = WorkerProto::BasicServerConnection::handshake(
-        out, in, 456, {"foo", "bar", "xyzzy"});
+    FdSink out{toClient.writeSide.get()};
+    FdSource in{toServer.readSide.get()};
+    auto daemonResult = WorkerProto::BasicServerConnection::handshake(out, in, 456, {"foo", "bar", "xyzzy"});
 
     clientThread.join();
 
@@ -707,8 +711,9 @@ TEST_F(WorkerProtoTest, handshake_features)
 }
 
 /// Has to be a `BufferedSink` for handshake.
-struct NullBufferedSink : BufferedSink {
-    void writeUnbuffered(std::string_view data) override { }
+struct NullBufferedSink : BufferedSink
+{
+    void writeUnbuffered(std::string_view data) override {}
 };
 
 TEST_F(WorkerProtoTest, handshake_client_replay)
@@ -716,9 +721,9 @@ TEST_F(WorkerProtoTest, handshake_client_replay)
     CharacterizationTest::readTest("handshake-to-client", [&](std::string toClientLog) {
         NullBufferedSink nullSink;
 
-        StringSource in { toClientLog };
-        auto clientResult = std::get<0>(WorkerProto::BasicClientConnection::handshake(
-                nullSink, in, defaultVersion, {}));
+        StringSource in{toClientLog};
+        auto clientResult =
+            std::get<0>(WorkerProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, {}));
 
         EXPECT_EQ(clientResult, defaultVersion);
     });
@@ -752,23 +757,18 @@ TEST_F(WorkerProtoTest, handshake_client_corrupted_throws)
             ++toClientLogCorrupt[idx];
 
             NullBufferedSink nullSink;
-            StringSource in { toClientLogCorrupt };
+            StringSource in{toClientLogCorrupt};
 
             if (idx < 4 || idx == 9) {
                 // magic bytes don't match
-                EXPECT_THROW(
-                    WorkerProto::BasicClientConnection::handshake(
-                        nullSink, in, defaultVersion, {}),
-                    Error);
+                EXPECT_THROW(WorkerProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, {}), Error);
             } else if (idx < 8 || idx >= 12) {
                 // Number out of bounds
                 EXPECT_THROW(
-                    WorkerProto::BasicClientConnection::handshake(
-                        nullSink, in, defaultVersion, {}),
+                    WorkerProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, {}),
                     SerialisationError);
             } else {
-                auto ver = std::get<0>(WorkerProto::BasicClientConnection::handshake(
-                        nullSink, in, defaultVersion, {}));
+                auto ver = std::get<0>(WorkerProto::BasicClientConnection::handshake(nullSink, in, defaultVersion, {}));
                 // `std::min` of this and the other version saves us
                 EXPECT_EQ(ver, defaultVersion);
             }
@@ -776,4 +776,4 @@ TEST_F(WorkerProtoTest, handshake_client_corrupted_throws)
     });
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index 4df9651f0..e08a1449b 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -28,15 +28,13 @@ BinaryCacheStore::BinaryCacheStore(Config & config)
     : config{config}
 {
     if (config.secretKeyFile != "")
-        signers.push_back(std::make_unique<LocalSigner>(
-            SecretKey { readFile(config.secretKeyFile) }));
+        signers.push_back(std::make_unique<LocalSigner>(SecretKey{readFile(config.secretKeyFile)}));
 
     if (config.secretKeyFiles != "") {
         std::stringstream ss(config.secretKeyFiles);
         Path keyPath;
         while (std::getline(ss, keyPath, ',')) {
-            signers.push_back(std::make_unique<LocalSigner>(
-                SecretKey { readFile(keyPath) }));
+            signers.push_back(std::make_unique<LocalSigner>(SecretKey{readFile(keyPath)}));
         }
     }
 
@@ -53,13 +51,17 @@ void BinaryCacheStore::init()
     } else {
         for (auto & line : tokenizeString<Strings>(*cacheInfo, "\n")) {
             size_t colon = line.find(':');
-            if (colon == std::string::npos) continue;
+            if (colon == std::string::npos)
+                continue;
             auto name = line.substr(0, colon);
             auto value = trim(line.substr(colon + 1, std::string::npos));
             if (name == "StoreDir") {
                 if (value != storeDir)
-                    throw Error("binary cache '%s' is for Nix stores with prefix '%s', not '%s'",
-                        getUri(), value, storeDir);
+                    throw Error(
+                        "binary cache '%s' is for Nix stores with prefix '%s', not '%s'",
+                        config.getHumanReadableURI(),
+                        value,
+                        storeDir);
             } else if (name == "WantMassQuery") {
                 config.wantMassQuery.setDefault(value == "1");
             } else if (name == "Priority") {
@@ -74,32 +76,30 @@ std::optional<std::string> BinaryCacheStore::getNixCacheInfo()
     return getFile(cacheInfoFile);
 }
 
-void BinaryCacheStore::upsertFile(const std::string & path,
-    std::string && data,
-    const std::string & mimeType)
+void BinaryCacheStore::upsertFile(const std::string & path, std::string && data, const std::string & mimeType)
 {
     upsertFile(path, std::make_shared<std::stringstream>(std::move(data)), mimeType);
 }
 
-void BinaryCacheStore::getFile(const std::string & path,
-    Callback<std::optional<std::string>> callback) noexcept
+void BinaryCacheStore::getFile(const std::string & path, Callback<std::optional<std::string>> callback) noexcept
 {
     try {
         callback(getFile(path));
-    } catch (...) { callback.rethrow(); }
+    } catch (...) {
+        callback.rethrow();
+    }
 }
 
 void BinaryCacheStore::getFile(const std::string & path, Sink & sink)
 {
     std::promise<std::optional<std::string>> promise;
-    getFile(path,
-        {[&](std::future<std::optional<std::string>> result) {
-            try {
-                promise.set_value(result.get());
-            } catch (...) {
-                promise.set_exception(std::current_exception());
-            }
-        }});
+    getFile(path, {[&](std::future<std::optional<std::string>> result) {
+                try {
+                    promise.set_value(result.get());
+                } catch (...) {
+                    promise.set_exception(std::current_exception());
+                }
+            }});
     sink(*promise.get_future().get());
 }
 
@@ -125,20 +125,18 @@ void BinaryCacheStore::writeNarInfo(ref<NarInfo> narInfo)
 
     upsertFile(narInfoFile, narInfo->to_string(*this), "text/x-nix-narinfo");
 
-    {
-        auto state_(state.lock());
-        state_->pathInfoCache.upsert(
-            std::string(narInfo->path.to_string()),
-            PathInfoCacheValue { .value = std::shared_ptr<NarInfo>(narInfo) });
-    }
+    pathInfoCache->lock()->upsert(
+        std::string(narInfo->path.to_string()), PathInfoCacheValue{.value = std::shared_ptr<NarInfo>(narInfo)});
 
     if (diskCache)
-        diskCache->upsertNarInfo(getUri(), std::string(narInfo->path.hashPart()), std::shared_ptr<NarInfo>(narInfo));
+        diskCache->upsertNarInfo(
+            config.getReference().render(/*FIXME withParams=*/false),
+            std::string(narInfo->path.hashPart()),
+            std::shared_ptr<NarInfo>(narInfo));
 }
 
 ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
-    Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs,
-    std::function<ValidPathInfo(HashResult)> mkInfo)
+    Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs, std::function<ValidPathInfo(HashResult)> mkInfo)
 {
     auto [fdTemp, fnTemp] = createTempFile();
 
@@ -149,22 +147,19 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
     /* Read the NAR simultaneously into a CompressionSink+FileSink (to
        write the compressed NAR to disk), into a HashSink (to get the
        NAR hash), and into a NarAccessor (to get the NAR listing). */
-    HashSink fileHashSink { HashAlgorithm::SHA256 };
+    HashSink fileHashSink{HashAlgorithm::SHA256};
     std::shared_ptr<SourceAccessor> narAccessor;
-    HashSink narHashSink { HashAlgorithm::SHA256 };
+    HashSink narHashSink{HashAlgorithm::SHA256};
     {
-    FdSink fileSink(fdTemp.get());
-    TeeSink teeSinkCompressed { fileSink, fileHashSink };
-    auto compressionSink = makeCompressionSink(
-        config.compression,
-        teeSinkCompressed,
-        config.parallelCompression,
-        config.compressionLevel);
-    TeeSink teeSinkUncompressed { *compressionSink, narHashSink };
-    TeeSource teeSource { narSource, teeSinkUncompressed };
-    narAccessor = makeNarAccessor(teeSource);
-    compressionSink->finish();
-    fileSink.flush();
+        FdSink fileSink(fdTemp.get());
+        TeeSink teeSinkCompressed{fileSink, fileHashSink};
+        auto compressionSink = makeCompressionSink(
+            config.compression, teeSinkCompressed, config.parallelCompression, config.compressionLevel);
+        TeeSink teeSinkUncompressed{*compressionSink, narHashSink};
+        TeeSource teeSource{narSource, teeSinkUncompressed};
+        narAccessor = makeNarAccessor(teeSource);
+        compressionSink->finish();
+        fileSink.flush();
     }
 
     auto now2 = std::chrono::steady_clock::now();
@@ -176,17 +171,20 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
     narInfo->fileHash = fileHash;
     narInfo->fileSize = fileSize;
     narInfo->url = "nar/" + narInfo->fileHash->to_string(HashFormat::Nix32, false) + ".nar"
-                   + (config.compression == "xz" ? ".xz" :
-           config.compression == "bzip2" ? ".bz2" :
-           config.compression == "zstd" ? ".zst" :
-           config.compression == "lzip" ? ".lzip" :
-           config.compression == "lz4" ? ".lz4" :
-           config.compression == "br" ? ".br" :
-           "");
+                   + (config.compression == "xz"      ? ".xz"
+                      : config.compression == "bzip2" ? ".bz2"
+                      : config.compression == "zstd"  ? ".zst"
+                      : config.compression == "lzip"  ? ".lzip"
+                      : config.compression == "lz4"   ? ".lz4"
+                      : config.compression == "br"    ? ".br"
+                                                      : "");
 
     auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(now2 - now1).count();
-    printMsg(lvlTalkative, "copying path '%1%' (%2% bytes, compressed %3$.1f%% in %4% ms) to binary cache",
-        printStorePath(narInfo->path), info.narSize,
+    printMsg(
+        lvlTalkative,
+        "copying path '%1%' (%2% bytes, compressed %3$.1f%% in %4% ms) to binary cache",
+        printStorePath(narInfo->path),
+        info.narSize,
         ((1.0 - (double) fileSize / info.narSize) * 100.0),
         duration);
 
@@ -197,8 +195,10 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
             if (ref != info.path)
                 queryPathInfo(ref);
         } catch (InvalidPath &) {
-            throw Error("cannot add '%s' to the binary cache because the reference '%s' is not valid",
-                printStorePath(info.path), printStorePath(ref));
+            throw Error(
+                "cannot add '%s' to the binary cache because the reference '%s' is not valid",
+                printStorePath(info.path),
+                printStorePath(ref));
         }
 
     /* Optionally write a JSON file containing a listing of the
@@ -232,7 +232,8 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
 
                 // FIXME: or should we overwrite? The previous link may point
                 // to a GC'ed file, so overwriting might be useful...
-                if (fileExists(key)) return;
+                if (fileExists(key))
+                    return;
 
                 printMsg(lvlTalkative, "creating debuginfo link from '%s' to '%s'", key, target);
 
@@ -245,15 +246,13 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
             for (auto & [s1, _type] : narAccessor->readDirectory(buildIdDir)) {
                 auto dir = buildIdDir / s1;
 
-                if (narAccessor->lstat(dir).type != SourceAccessor::tDirectory
-                    || !std::regex_match(s1, regex1))
+                if (narAccessor->lstat(dir).type != SourceAccessor::tDirectory || !std::regex_match(s1, regex1))
                     continue;
 
                 for (auto & [s2, _type] : narAccessor->readDirectory(dir)) {
                     auto debugPath = dir / s2;
 
-                    if (narAccessor->lstat(debugPath).type != SourceAccessor::tRegular
-                        || !std::regex_match(s2, regex2))
+                    if (narAccessor->lstat(debugPath).type != SourceAccessor::tRegular || !std::regex_match(s2, regex2))
                         continue;
 
                     auto buildId = s1 + s2;
@@ -272,7 +271,8 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
     /* Atomically write the NAR file. */
     if (repair || !fileExists(narInfo->url)) {
         stats.narWrite++;
-        upsertFile(narInfo->url,
+        upsertFile(
+            narInfo->url,
             std::make_shared<std::fstream>(fnTemp, std::ios_base::in | std::ios_base::binary),
             "application/x-nix-nar");
     } else
@@ -292,8 +292,8 @@ ref<const ValidPathInfo> BinaryCacheStore::addToStoreCommon(
     return narInfo;
 }
 
-void BinaryCacheStore::addToStore(const ValidPathInfo & info, Source & narSource,
-    RepairFlag repair, CheckSigsFlag checkSigs)
+void BinaryCacheStore::addToStore(
+    const ValidPathInfo & info, Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     if (!repair && isValidPath(info.path)) {
         // FIXME: copyNAR -> null sink
@@ -302,12 +302,12 @@ void BinaryCacheStore::addToStore(const ValidPathInfo & info, Source & narSource
     }
 
     addToStoreCommon(narSource, repair, checkSigs, {[&](HashResult nar) {
-        /* FIXME reinstate these, once we can correctly do hash modulo sink as
-           needed. We need to throw here in case we uploaded a corrupted store path. */
-        // assert(info.narHash == nar.first);
-        // assert(info.narSize == nar.second);
-        return info;
-    }});
+                         /* FIXME reinstate these, once we can correctly do hash modulo sink as
+                            needed. We need to throw here in case we uploaded a corrupted store path. */
+                         // assert(info.narHash == nar.first);
+                         // assert(info.narSize == nar.second);
+                         return info;
+                     }});
 }
 
 StorePath BinaryCacheStore::addToStoreFromDump(
@@ -341,8 +341,7 @@ StorePath BinaryCacheStore::addToStoreFromDump(
             // The dump is already NAR in this case, just use it.
             nar = dump2.s;
             break;
-        case FileSerialisationMethod::Flat:
-        {
+        case FileSerialisationMethod::Flat: {
             // The dump is Flat, so we need to convert it to NAR with a
             // single file.
             StringSink s;
@@ -357,30 +356,33 @@ StorePath BinaryCacheStore::addToStoreFromDump(
         if (dumpMethod != FileSerialisationMethod::NixArchive || hashAlgo != HashAlgorithm::SHA256)
             unsupported("addToStoreFromDump");
     }
-    StringSource narDump { nar };
+    StringSource narDump{nar};
 
     // Use `narDump` if we wrote to `nar`.
-    Source & narDump2 = nar.size() > 0
-        ? static_cast<Source &>(narDump)
-        : dump;
+    Source & narDump2 = nar.size() > 0 ? static_cast<Source &>(narDump) : dump;
 
-    return addToStoreCommon(narDump2, repair, CheckSigs, [&](HashResult nar) {
-        ValidPathInfo info {
-            *this,
-            name,
-            ContentAddressWithReferences::fromParts(
-                hashMethod,
-                caHash ? *caHash : nar.first,
-                {
-                    .others = references,
-                    // caller is not capable of creating a self-reference, because this is content-addressed without modulus
-                    .self = false,
-                }),
-            nar.first,
-        };
-        info.narSize = nar.second;
-        return info;
-    })->path;
+    return addToStoreCommon(
+               narDump2,
+               repair,
+               CheckSigs,
+               [&](HashResult nar) {
+                   auto info = ValidPathInfo::makeFromCA(
+                       *this,
+                       name,
+                       ContentAddressWithReferences::fromParts(
+                           hashMethod,
+                           caHash ? *caHash : nar.hash,
+                           {
+                               .others = references,
+                               // caller is not capable of creating a self-reference, because this is content-addressed
+                               // without modulus
+                               .self = false,
+                           }),
+                       nar.hash);
+                   info.narSize = nar.numBytesDigested;
+                   return info;
+               })
+        ->path;
 }
 
 bool BinaryCacheStore::isValidPathUncached(const StorePath & storePath)
@@ -407,7 +409,7 @@ void BinaryCacheStore::narFromPath(const StorePath & storePath, Sink & sink)
     auto info = queryPathInfo(storePath).cast<const NarInfo>();
 
     LengthSink narSize;
-    TeeSink tee { sink, narSize };
+    TeeSink tee{sink, narSize};
 
     auto decompressor = makeDecompressionSink(info->compression, tee);
 
@@ -420,40 +422,44 @@ void BinaryCacheStore::narFromPath(const StorePath & storePath, Sink & sink)
     decompressor->finish();
 
     stats.narRead++;
-    //stats.narReadCompressedBytes += nar->size(); // FIXME
+    // stats.narReadCompressedBytes += nar->size(); // FIXME
     stats.narReadBytes += narSize.length;
 }
 
-void BinaryCacheStore::queryPathInfoUncached(const StorePath & storePath,
-    Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
+void BinaryCacheStore::queryPathInfoUncached(
+    const StorePath & storePath, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
 {
-    auto uri = getUri();
+    auto uri = config.getReference().render(/*FIXME withParams=*/false);
     auto storePathS = printStorePath(storePath);
-    auto act = std::make_shared<Activity>(*logger, lvlTalkative, actQueryPathInfo,
-        fmt("querying info about '%s' on '%s'", storePathS, uri), Logger::Fields{storePathS, uri});
+    auto act = std::make_shared<Activity>(
+        *logger,
+        lvlTalkative,
+        actQueryPathInfo,
+        fmt("querying info about '%s' on '%s'", storePathS, uri),
+        Logger::Fields{storePathS, uri});
     PushActivity pact(act->id);
 
     auto narInfoFile = narInfoFileFor(storePath);
 
     auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback));
 
-    getFile(narInfoFile,
-        {[=,this](std::future<std::optional<std::string>> fut) {
-            try {
-                auto data = fut.get();
+    getFile(narInfoFile, {[=, this](std::future<std::optional<std::string>> fut) {
+                try {
+                    auto data = fut.get();
 
-                if (!data) return (*callbackPtr)({});
+                    if (!data)
+                        return (*callbackPtr)({});
 
-                stats.narInfoRead++;
+                    stats.narInfoRead++;
 
-                (*callbackPtr)((std::shared_ptr<ValidPathInfo>)
-                    std::make_shared<NarInfo>(*this, *data, narInfoFile));
+                    (*callbackPtr)(
+                        (std::shared_ptr<ValidPathInfo>) std::make_shared<NarInfo>(*this, *data, narInfoFile));
 
-                (void) act; // force Activity into this lambda to ensure it stays alive
-            } catch (...) {
-                callbackPtr->rethrow();
-            }
-        }});
+                    (void) act; // force Activity into this lambda to ensure it stays alive
+                } catch (...) {
+                    callbackPtr->rethrow();
+                }
+            }});
 }
 
 StorePath BinaryCacheStore::addToStore(
@@ -471,56 +477,58 @@ StorePath BinaryCacheStore::addToStore(
 
     auto h = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter).first;
 
-    auto source = sinkToSource([&](Sink & sink) {
-        path.dumpPath(sink, filter);
-    });
-    return addToStoreCommon(*source, repair, CheckSigs, [&](HashResult nar) {
-        ValidPathInfo info {
-            *this,
-            name,
-            ContentAddressWithReferences::fromParts(
-                method,
-                h,
-                {
-                    .others = references,
-                    // caller is not capable of creating a self-reference, because this is content-addressed without modulus
-                    .self = false,
-                }),
-            nar.first,
-        };
-        info.narSize = nar.second;
-        return info;
-    })->path;
+    auto source = sinkToSource([&](Sink & sink) { path.dumpPath(sink, filter); });
+    return addToStoreCommon(
+               *source,
+               repair,
+               CheckSigs,
+               [&](HashResult nar) {
+                   auto info = ValidPathInfo::makeFromCA(
+                       *this,
+                       name,
+                       ContentAddressWithReferences::fromParts(
+                           method,
+                           h,
+                           {
+                               .others = references,
+                               // caller is not capable of creating a self-reference, because this is content-addressed
+                               // without modulus
+                               .self = false,
+                           }),
+                       nar.hash);
+                   info.narSize = nar.numBytesDigested;
+                   return info;
+               })
+        ->path;
 }
 
-void BinaryCacheStore::queryRealisationUncached(const DrvOutput & id,
-    Callback<std::shared_ptr<const Realisation>> callback) noexcept
+void BinaryCacheStore::queryRealisationUncached(
+    const DrvOutput & id, Callback<std::shared_ptr<const Realisation>> callback) noexcept
 {
     auto outputInfoFilePath = realisationsPrefix + "/" + id.to_string() + ".doi";
 
     auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback));
 
-    Callback<std::optional<std::string>> newCallback = {
-        [=](std::future<std::optional<std::string>> fut) {
-            try {
-                auto data = fut.get();
-                if (!data) return (*callbackPtr)({});
+    Callback<std::optional<std::string>> newCallback = {[=](std::future<std::optional<std::string>> fut) {
+        try {
+            auto data = fut.get();
+            if (!data)
+                return (*callbackPtr)({});
 
-                auto realisation = Realisation::fromJSON(
-                    nlohmann::json::parse(*data), outputInfoFilePath);
-                return (*callbackPtr)(std::make_shared<const Realisation>(realisation));
-            } catch (...) {
-                callbackPtr->rethrow();
-            }
+            auto realisation = Realisation::fromJSON(nlohmann::json::parse(*data), outputInfoFilePath);
+            return (*callbackPtr)(std::make_shared<const Realisation>(realisation));
+        } catch (...) {
+            callbackPtr->rethrow();
         }
-    };
+    }};
 
     getFile(outputInfoFilePath, std::move(newCallback));
 }
 
-void BinaryCacheStore::registerDrvOutput(const Realisation& info) {
+void BinaryCacheStore::registerDrvOutput(const Realisation & info)
+{
     if (diskCache)
-        diskCache->upsertRealisation(getUri(), info);
+        diskCache->upsertRealisation(config.getReference().render(/*FIXME withParams=*/false), info);
     auto filePath = realisationsPrefix + "/" + info.id.to_string() + ".doi";
     upsertFile(filePath, info.toJSON().dump(), "application/json");
 }
@@ -548,7 +556,7 @@ std::optional<std::string> BinaryCacheStore::getBuildLogExact(const StorePath &
 {
     auto logPath = "log/" + std::string(baseNameOf(printStorePath(path)));
 
-    debug("fetching build log from binary cache '%s/%s'", getUri(), logPath);
+    debug("fetching build log from binary cache '%s/%s'", config.getHumanReadableURI(), logPath);
 
     return getFile(logPath);
 }
@@ -563,4 +571,4 @@ void BinaryCacheStore::addBuildLog(const StorePath & drvPath, std::string_view l
         "text/plain; charset=utf-8");
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/build-result.cc b/src/libstore/build-result.cc
index 091661337..43c7adb11 100644
--- a/src/libstore/build-result.cc
+++ b/src/libstore/build-result.cc
@@ -5,4 +5,4 @@ namespace nix {
 bool BuildResult::operator==(const BuildResult &) const noexcept = default;
 std::strong_ordering BuildResult::operator<=>(const BuildResult &) const noexcept = default;
 
-}
+} // namespace nix
diff --git a/src/libstore/build/derivation-building-goal.cc b/src/libstore/build/derivation-building-goal.cc
index 3019d9d72..ebef2a375 100644
--- a/src/libstore/build/derivation-building-goal.cc
+++ b/src/libstore/build/derivation-building-goal.cc
@@ -1,4 +1,5 @@
 #include "nix/store/build/derivation-building-goal.hh"
+#include "nix/store/build/derivation-env-desugar.hh"
 #include "nix/store/build/derivation-trampoline-goal.hh"
 #ifndef _WIN32 // TODO enable build hook on Windows
 #  include "nix/store/build/hook-instance.hh"
@@ -12,6 +13,7 @@
 #include "nix/store/common-protocol.hh"
 #include "nix/store/common-protocol-impl.hh"
 #include "nix/store/local-store.hh" // TODO remove, along with remaining downcasts
+#include "nix/store/globals.hh"
 
 #include <fstream>
 #include <sys/types.h>
@@ -24,20 +26,17 @@
 
 namespace nix {
 
-DerivationBuildingGoal::DerivationBuildingGoal(const StorePath & drvPath, const Derivation & drv_,
-    Worker & worker, BuildMode buildMode)
+DerivationBuildingGoal::DerivationBuildingGoal(
+    const StorePath & drvPath, const Derivation & drv_, Worker & worker, BuildMode buildMode)
     : Goal(worker, gaveUpOnSubstitution())
     , drvPath(drvPath)
     , buildMode(buildMode)
 {
     drv = std::make_unique<Derivation>(drv_);
 
-    if (auto parsedOpt = StructuredAttrs::tryParse(drv->env)) {
-        parsedDrv = std::make_unique<StructuredAttrs>(*parsedOpt);
-    }
     try {
-        drvOptions = std::make_unique<DerivationOptions>(
-            DerivationOptions::fromStructuredAttrs(drv->env, parsedDrv.get()));
+        drvOptions =
+            std::make_unique<DerivationOptions>(DerivationOptions::fromStructuredAttrs(drv->env, drv->structuredAttrs));
     } catch (Error & e) {
         e.addTrace({}, "while parsing derivation '%s'", worker.store.printStorePath(drvPath));
         throw;
@@ -51,22 +50,21 @@ DerivationBuildingGoal::DerivationBuildingGoal(const StorePath & drvPath, const
     worker.store.addTempRoot(this->drvPath);
 }
 
-
 DerivationBuildingGoal::~DerivationBuildingGoal()
 {
     /* Careful: we should never ever throw an exception from a
        destructor. */
-    try { killChild(); } catch (...) { ignoreExceptionInDestructor(); }
 #ifndef _WIN32 // TODO enable `DerivationBuilder` on Windows
-    if (builder) {
-        try { builder->stopDaemon(); } catch (...) { ignoreExceptionInDestructor(); }
-        try { builder->deleteTmpDir(false); } catch (...) { ignoreExceptionInDestructor(); }
-    }
+    if (builder)
+        builder.reset();
 #endif
-    try { closeLogFile(); } catch (...) { ignoreExceptionInDestructor(); }
+    try {
+        closeLogFile();
+    } catch (...) {
+        ignoreExceptionInDestructor();
+    }
 }
 
-
 std::string DerivationBuildingGoal::key()
 {
     /* Ensure that derivations get built in order of their name,
@@ -76,55 +74,38 @@ std::string DerivationBuildingGoal::key()
     return "bd$" + std::string(drvPath.name()) + "$" + worker.store.printStorePath(drvPath);
 }
 
-
 void DerivationBuildingGoal::killChild()
 {
 #ifndef _WIN32 // TODO enable build hook on Windows
     hook.reset();
 #endif
 #ifndef _WIN32 // TODO enable `DerivationBuilder` on Windows
-    if (builder && builder->pid != -1) {
+    if (builder && builder->killChild())
         worker.childTerminated(this);
-
-        // FIXME: move this into DerivationBuilder.
-
-        /* If we're using a build user, then there is a tricky race
-           condition: if we kill the build user before the child has
-           done its setuid() to the build user uid, then it won't be
-           killed, and we'll potentially lock up in pid.wait().  So
-           also send a conventional kill to the child. */
-        ::kill(-builder->pid, SIGKILL); /* ignore the result */
-
-        builder->killSandbox(true);
-
-        builder->pid.wait();
-    }
 #endif
 }
 
-
 void DerivationBuildingGoal::timedOut(Error && ex)
 {
     killChild();
     // We're not inside a coroutine, hence we can't use co_return here.
     // Thus we ignore the return value.
-    [[maybe_unused]] Done _ = done(BuildResult::TimedOut, {}, std::move(ex));
+    [[maybe_unused]] Done _ = doneFailure({BuildResult::TimedOut, std::move(ex)});
 }
 
-
 /**
  * Used for `inputGoals` local variable below
  */
 struct value_comparison
 {
-    template <typename T>
-    bool operator()(const ref<T> & lhs, const ref<T> & rhs) const {
+    template<typename T>
+    bool operator()(const ref<T> & lhs, const ref<T> & rhs) const
+    {
         return *lhs < *rhs;
     }
 };
 
-
-std::string showKnownOutputs(Store & store, const Derivation & drv)
+std::string showKnownOutputs(const StoreDirConfig & store, const Derivation & drv)
 {
     std::string msg;
     StorePathSet expectedOutputPaths;
@@ -139,6 +120,8 @@ std::string showKnownOutputs(Store & store, const Derivation & drv)
     return msg;
 }
 
+static void runPostBuildHook(
+    const StoreDirConfig & store, Logger & logger, const StorePath & drvPath, const StorePathSet & outputPaths);
 
 /* At least one of the output paths could not be
    produced using a substitute.  So we have to build instead. */
@@ -149,12 +132,14 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
     std::map<ref<const SingleDerivedPath>, GoalPtr, value_comparison> inputGoals;
 
     {
-        std::function<void(ref<const SingleDerivedPath>, const DerivedPathMap<StringSet>::ChildNode &)> addWaiteeDerivedPath;
+        std::function<void(ref<const SingleDerivedPath>, const DerivedPathMap<StringSet>::ChildNode &)>
+            addWaiteeDerivedPath;
 
-        addWaiteeDerivedPath = [&](ref<const SingleDerivedPath> inputDrv, const DerivedPathMap<StringSet>::ChildNode & inputNode) {
+        addWaiteeDerivedPath = [&](ref<const SingleDerivedPath> inputDrv,
+                                   const DerivedPathMap<StringSet>::ChildNode & inputNode) {
             if (!inputNode.value.empty()) {
                 auto g = worker.makeGoal(
-                    DerivedPath::Built {
+                    DerivedPath::Built{
                         .drvPath = inputDrv,
                         .outputs = inputNode.value,
                     },
@@ -164,17 +149,18 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
             }
             for (const auto & [outputName, childNode] : inputNode.childMap)
                 addWaiteeDerivedPath(
-                    make_ref<SingleDerivedPath>(SingleDerivedPath::Built { inputDrv, outputName }),
-                    childNode);
+                    make_ref<SingleDerivedPath>(SingleDerivedPath::Built{inputDrv, outputName}), childNode);
         };
 
         for (const auto & [inputDrvPath, inputNode] : drv->inputDrvs.map) {
             /* Ensure that pure, non-fixed-output derivations don't
                depend on impure derivations. */
-            if (experimentalFeatureSettings.isEnabled(Xp::ImpureDerivations) && !drv->type().isImpure() && !drv->type().isFixed()) {
+            if (experimentalFeatureSettings.isEnabled(Xp::ImpureDerivations) && !drv->type().isImpure()
+                && !drv->type().isFixed()) {
                 auto inputDrv = worker.evalStore.readDerivation(inputDrvPath);
                 if (inputDrv.type().isImpure())
-                    throw Error("pure derivation '%s' depends on impure derivation '%s'",
+                    throw Error(
+                        "pure derivation '%s' depends on impure derivation '%s'",
                         worker.store.printStorePath(drvPath),
                         worker.store.printStorePath(inputDrvPath));
             }
@@ -197,27 +183,29 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
     }
 
     for (auto & i : drv->inputSrcs) {
-        if (worker.store.isValidPath(i)) continue;
+        if (worker.store.isValidPath(i))
+            continue;
         if (!settings.useSubstitutes)
-            throw Error("dependency '%s' of '%s' does not exist, and substitution is disabled",
-                worker.store.printStorePath(i), worker.store.printStorePath(drvPath));
+            throw Error(
+                "dependency '%s' of '%s' does not exist, and substitution is disabled",
+                worker.store.printStorePath(i),
+                worker.store.printStorePath(drvPath));
         waitees.insert(upcast_goal(worker.makePathSubstitutionGoal(i)));
     }
 
     co_await await(std::move(waitees));
 
-
     trace("all inputs realised");
 
     if (nrFailed != 0) {
-        auto msg = fmt(
-            "Cannot build '%s'.\n"
-            "Reason: " ANSI_RED "%d %s failed" ANSI_NORMAL ".",
-            Magenta(worker.store.printStorePath(drvPath)),
-            nrFailed,
-            nrFailed == 1 ? "dependency" : "dependencies");
+        auto msg =
+            fmt("Cannot build '%s'.\n"
+                "Reason: " ANSI_RED "%d %s failed" ANSI_NORMAL ".",
+                Magenta(worker.store.printStorePath(drvPath)),
+                nrFailed,
+                nrFailed == 1 ? "dependency" : "dependencies");
         msg += showKnownOutputs(worker.store, *drv);
-        co_return done(BuildResult::DependencyFailed, {}, Error(msg));
+        co_return doneFailure(BuildError(BuildResult::DependencyFailed, msg));
     }
 
     /* Gather information necessary for computing the closure and/or
@@ -230,30 +218,29 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
         auto & fullDrv = *drv;
 
         auto drvType = fullDrv.type();
-        bool resolveDrv = std::visit(overloaded {
-            [&](const DerivationType::InputAddressed & ia) {
-                /* must resolve if deferred. */
-                return ia.deferred;
-            },
-            [&](const DerivationType::ContentAddressed & ca) {
-                return !fullDrv.inputDrvs.map.empty() && (
-                    ca.fixed
-                    /* Can optionally resolve if fixed, which is good
-                       for avoiding unnecessary rebuilds. */
-                    ? experimentalFeatureSettings.isEnabled(Xp::CaDerivations)
-                    /* Must resolve if floating and there are any inputs
-                       drvs. */
-                    : true);
-            },
-            [&](const DerivationType::Impure &) {
-                return true;
-            }
-        }, drvType.raw)
+        bool resolveDrv =
+            std::visit(
+                overloaded{
+                    [&](const DerivationType::InputAddressed & ia) {
+                        /* must resolve if deferred. */
+                        return ia.deferred;
+                    },
+                    [&](const DerivationType::ContentAddressed & ca) {
+                        return !fullDrv.inputDrvs.map.empty()
+                               && (ca.fixed
+                                       /* Can optionally resolve if fixed, which is good
+                                          for avoiding unnecessary rebuilds. */
+                                       ? experimentalFeatureSettings.isEnabled(Xp::CaDerivations)
+                                       /* Must resolve if floating and there are any inputs
+                                          drvs. */
+                                       : true);
+                    },
+                    [&](const DerivationType::Impure &) { return true; }},
+                drvType.raw)
             /* no inputs are outputs of dynamic derivations */
-            || std::ranges::any_of(
-                fullDrv.inputDrvs.map.begin(),
-                fullDrv.inputDrvs.map.end(),
-                [](auto & pair) { return !pair.second.childMap.empty(); });
+            || std::ranges::any_of(fullDrv.inputDrvs.map.begin(), fullDrv.inputDrvs.map.end(), [](auto & pair) {
+                   return !pair.second.childMap.empty();
+               });
 
         if (resolveDrv && !fullDrv.inputDrvs.map.empty()) {
             experimentalFeatureSettings.require(Xp::CaDerivations);
@@ -261,46 +248,55 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
             /* We are be able to resolve this derivation based on the
                now-known results of dependencies. If so, we become a
                stub goal aliasing that resolved derivation goal. */
-            std::optional attempt = fullDrv.tryResolve(worker.store,
+            std::optional attempt = fullDrv.tryResolve(
+                worker.store,
                 [&](ref<const SingleDerivedPath> drvPath, const std::string & outputName) -> std::optional<StorePath> {
                     auto mEntry = get(inputGoals, drvPath);
-                    if (!mEntry) return std::nullopt;
+                    if (!mEntry)
+                        return std::nullopt;
 
                     auto & buildResult = (*mEntry)->buildResult;
-                    if (!buildResult.success()) return std::nullopt;
+                    if (!buildResult.success())
+                        return std::nullopt;
 
                     auto i = get(buildResult.builtOutputs, outputName);
-                    if (!i) return std::nullopt;
+                    if (!i)
+                        return std::nullopt;
 
                     return i->outPath;
                 });
             if (!attempt) {
-              /* TODO (impure derivations-induced tech debt) (see below):
-                 The above attempt should have found it, but because we manage
-                 inputDrvOutputs statefully, sometimes it gets out of sync with
-                 the real source of truth (store). So we query the store
-                 directly if there's a problem. */
-              attempt = fullDrv.tryResolve(worker.store, &worker.evalStore);
+                /* TODO (impure derivations-induced tech debt) (see below):
+                   The above attempt should have found it, but because we manage
+                   inputDrvOutputs statefully, sometimes it gets out of sync with
+                   the real source of truth (store). So we query the store
+                   directly if there's a problem. */
+                attempt = fullDrv.tryResolve(worker.store, &worker.evalStore);
             }
             assert(attempt);
-            Derivation drvResolved { std::move(*attempt) };
+            Derivation drvResolved{std::move(*attempt)};
 
             auto pathResolved = writeDerivation(worker.store, drvResolved);
 
-            auto msg = fmt("resolved derivation: '%s' -> '%s'",
-                worker.store.printStorePath(drvPath),
-                worker.store.printStorePath(pathResolved));
-            act = std::make_unique<Activity>(*logger, lvlInfo, actBuildWaiting, msg,
-                Logger::Fields {
-                       worker.store.printStorePath(drvPath),
-                       worker.store.printStorePath(pathResolved),
-                   });
+            auto msg =
+                fmt("resolved derivation: '%s' -> '%s'",
+                    worker.store.printStorePath(drvPath),
+                    worker.store.printStorePath(pathResolved));
+            act = std::make_unique<Activity>(
+                *logger,
+                lvlInfo,
+                actBuildWaiting,
+                msg,
+                Logger::Fields{
+                    worker.store.printStorePath(drvPath),
+                    worker.store.printStorePath(pathResolved),
+                });
 
             /* TODO https://github.com/NixOS/nix/issues/13247 we should
                let the calling goal do this, so it has a change to pass
                just the output(s) it cares about. */
-            auto resolvedDrvGoal = worker.makeDerivationTrampolineGoal(
-                pathResolved, OutputsSpec::All{}, drvResolved, buildMode);
+            auto resolvedDrvGoal =
+                worker.makeDerivationTrampolineGoal(pathResolved, OutputsSpec::All{}, drvResolved, buildMode);
             {
                 Goals waitees{resolvedDrvGoal};
                 co_await await(std::move(waitees));
@@ -310,46 +306,50 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
 
             auto resolvedResult = resolvedDrvGoal->buildResult;
 
-            SingleDrvOutputs builtOutputs;
-
             if (resolvedResult.success()) {
+                SingleDrvOutputs builtOutputs;
+
+                auto outputHashes = staticOutputHashes(worker.evalStore, *drv);
                 auto resolvedHashes = staticOutputHashes(worker.store, drvResolved);
 
                 StorePathSet outputPaths;
 
                 for (auto & outputName : drvResolved.outputNames()) {
-                    auto initialOutput = get(initialOutputs, outputName);
+                    auto outputHash = get(outputHashes, outputName);
                     auto resolvedHash = get(resolvedHashes, outputName);
-                    if ((!initialOutput) || (!resolvedHash))
+                    if ((!outputHash) || (!resolvedHash))
                         throw Error(
                             "derivation '%s' doesn't have expected output '%s' (derivation-goal.cc/resolve)",
-                            worker.store.printStorePath(drvPath), outputName);
+                            worker.store.printStorePath(drvPath),
+                            outputName);
 
-                    auto realisation = [&]{
-                      auto take1 = get(resolvedResult.builtOutputs, outputName);
-                      if (take1) return *take1;
+                    auto realisation = [&] {
+                        auto take1 = get(resolvedResult.builtOutputs, outputName);
+                        if (take1)
+                            return *take1;
 
-                      /* The above `get` should work. But stateful tracking of
-                         outputs in resolvedResult, this can get out of sync with the
-                         store, which is our actual source of truth. For now we just
-                         check the store directly if it fails. */
-                      auto take2 = worker.evalStore.queryRealisation(DrvOutput { *resolvedHash, outputName });
-                      if (take2) return *take2;
+                        /* The above `get` should work. But stateful tracking of
+                           outputs in resolvedResult, this can get out of sync with the
+                           store, which is our actual source of truth. For now we just
+                           check the store directly if it fails. */
+                        auto take2 = worker.evalStore.queryRealisation(DrvOutput{*resolvedHash, outputName});
+                        if (take2)
+                            return *take2;
 
-                      throw Error(
-                          "derivation '%s' doesn't have expected output '%s' (derivation-goal.cc/realisation)",
-                          worker.store.printStorePath(pathResolved), outputName);
+                        throw Error(
+                            "derivation '%s' doesn't have expected output '%s' (derivation-goal.cc/realisation)",
+                            worker.store.printStorePath(pathResolved),
+                            outputName);
                     }();
 
                     if (!drv->type().isImpure()) {
                         auto newRealisation = realisation;
-                        newRealisation.id = DrvOutput { initialOutput->outputHash, outputName };
+                        newRealisation.id = DrvOutput{*outputHash, outputName};
                         newRealisation.signatures.clear();
                         if (!drv->type().isFixed()) {
-                            auto & drvStore = worker.evalStore.isValidPath(drvPath)
-                                ? worker.evalStore
-                                : worker.store;
-                            newRealisation.dependentRealisations = drvOutputReferences(worker.store, *drv, realisation.outPath, &drvStore);
+                            auto & drvStore = worker.evalStore.isValidPath(drvPath) ? worker.evalStore : worker.store;
+                            newRealisation.dependentRealisations =
+                                drvOutputReferences(worker.store, *drv, realisation.outPath, &drvStore);
                         }
                         worker.store.signRealisation(newRealisation);
                         worker.store.registerDrvOutput(newRealisation);
@@ -358,19 +358,20 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
                     builtOutputs.emplace(outputName, realisation);
                 }
 
-                runPostBuildHook(
-                    worker.store,
-                    *logger,
-                    drvPath,
-                    outputPaths
-                );
+                runPostBuildHook(worker.store, *logger, drvPath, outputPaths);
+
+                auto status = resolvedResult.status;
+                if (status == BuildResult::AlreadyValid)
+                    status = BuildResult::ResolvesToAlreadyValid;
+
+                co_return doneSuccess(status, std::move(builtOutputs));
+            } else {
+                co_return doneFailure({
+                    BuildResult::DependencyFailed,
+                    "build of resolved derivation '%s' failed",
+                    worker.store.printStorePath(pathResolved),
+                });
             }
-
-            auto status = resolvedResult.status;
-            if (status == BuildResult::AlreadyValid)
-                status = BuildResult::ResolvesToAlreadyValid;
-
-            co_return done(status, std::move(builtOutputs));
         }
 
         /* If we get this far, we know no dynamic drvs inputs */
@@ -381,8 +382,8 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
                    impure derivations are always resolved above. Can
                    just use DB. This case only happens in the (older)
                    input addressed and fixed output derivation cases. */
-                auto outMap = [&]{
-                    for (auto * drvStore : { &worker.evalStore, &worker.store })
+                auto outMap = [&] {
+                    for (auto * drvStore : {&worker.evalStore, &worker.store})
                         if (drvStore->isValidPath(depDrvPath))
                             return worker.store.queryDerivationOutputMap(depDrvPath, drvStore);
                     assert(false);
@@ -392,7 +393,9 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
                 if (outMapPath == outMap.end()) {
                     throw Error(
                         "derivation '%s' requires non-existent output '%s' from input derivation '%s'",
-                        worker.store.printStorePath(drvPath), outputName, worker.store.printStorePath(depDrvPath));
+                        worker.store.printStorePath(drvPath),
+                        outputName,
+                        worker.store.printStorePath(depDrvPath));
                 }
 
                 worker.store.computeFSClosure(outMapPath->second, inputPaths);
@@ -412,130 +415,263 @@ Goal::Co DerivationBuildingGoal::gaveUpOnSubstitution()
     co_return tryToBuild();
 }
 
-void DerivationBuildingGoal::started()
-{
-    auto msg = fmt(
-        buildMode == bmRepair ? "repairing outputs of '%s'" :
-        buildMode == bmCheck ? "checking outputs of '%s'" :
-        "building '%s'", worker.store.printStorePath(drvPath));
-    fmt("building '%s'", worker.store.printStorePath(drvPath));
-#ifndef _WIN32 // TODO enable build hook on Windows
-    if (hook) msg += fmt(" on '%s'", machineName);
-#endif
-    act = std::make_unique<Activity>(*logger, lvlInfo, actBuild, msg,
-        Logger::Fields{worker.store.printStorePath(drvPath),
-#ifndef _WIN32 // TODO enable build hook on Windows
-        hook ? machineName :
-#endif
-            "",
-        1,
-        1});
-    mcRunningBuilds = std::make_unique<MaintainCount<uint64_t>>(worker.runningBuilds);
-    worker.updateProgress();
-}
-
 Goal::Co DerivationBuildingGoal::tryToBuild()
 {
-    trace("trying to build");
+    std::map<std::string, InitialOutput> initialOutputs;
 
-    /* Obtain locks on all output paths, if the paths are known a priori.
+    /* Recheck at this point. In particular, whereas before we were
+       given this information by the downstream goal, that cannot happen
+       anymore if the downstream goal only cares about one output, but
+       we care about all outputs. */
+    auto outputHashes = staticOutputHashes(worker.evalStore, *drv);
+    for (auto & [outputName, outputHash] : outputHashes) {
+        InitialOutput v{.outputHash = outputHash};
 
-       The locks are automatically released when we exit this function or Nix
-       crashes.  If we can't acquire the lock, then continue; hopefully some
-       other goal can start a build, and if not, the main loop will sleep a few
-       seconds and then retry this goal. */
-    PathSet lockFiles;
-    /* FIXME: Should lock something like the drv itself so we don't build same
-       CA drv concurrently */
-    if (dynamic_cast<LocalStore *>(&worker.store)) {
-        /* If we aren't a local store, we might need to use the local store as
-           a build remote, but that would cause a deadlock. */
-        /* FIXME: Make it so we can use ourselves as a build remote even if we
-           are the local store (separate locking for building vs scheduling? */
-        /* FIXME: find some way to lock for scheduling for the other stores so
-           a forking daemon with --store still won't farm out redundant builds.
-           */
-        for (auto & i : drv->outputsAndOptPaths(worker.store)) {
-            if (i.second.second)
-                lockFiles.insert(worker.store.Store::toRealPath(*i.second.second));
-            else
-                lockFiles.insert(
-                    worker.store.Store::toRealPath(drvPath) + "." + i.first
-                );
+        /* TODO we might want to also allow randomizing the paths
+           for regular CA derivations, e.g. for sake of checking
+           determinism. */
+        if (drv->type().isImpure()) {
+            v.known = InitialOutputStatus{
+                .path = StorePath::random(outputPathName(drv->name, outputName)),
+                .status = PathStatus::Absent,
+            };
         }
+
+        initialOutputs.insert({
+            outputName,
+            std::move(v),
+        });
     }
+    checkPathValidity(initialOutputs);
 
-    if (!outputLocks.lockPaths(lockFiles, "", false))
-    {
-        Activity act(*logger, lvlWarn, actBuildWaiting,
-                fmt("waiting for lock on %s", Magenta(showPaths(lockFiles))));
+    auto started = [&]() {
+        auto msg =
+            fmt(buildMode == bmRepair  ? "repairing outputs of '%s'"
+                : buildMode == bmCheck ? "checking outputs of '%s'"
+                                       : "building '%s'",
+                worker.store.printStorePath(drvPath));
+        fmt("building '%s'", worker.store.printStorePath(drvPath));
+#ifndef _WIN32 // TODO enable build hook on Windows
+        if (hook)
+            msg += fmt(" on '%s'", hook->machineName);
+#endif
+        act = std::make_unique<Activity>(
+            *logger,
+            lvlInfo,
+            actBuild,
+            msg,
+            Logger::Fields{
+                worker.store.printStorePath(drvPath),
+#ifndef _WIN32 // TODO enable build hook on Windows
+                hook ? hook->machineName :
+#endif
+                     "",
+                1,
+                1});
+        mcRunningBuilds = std::make_unique<MaintainCount<uint64_t>>(worker.runningBuilds);
+        worker.updateProgress();
+    };
 
-        /* Wait then try locking again, repeat until success (returned
-           boolean is true). */
-        do {
-            co_await waitForAWhile();
-        } while (!outputLocks.lockPaths(lockFiles, "", false));
-    }
+    /**
+     * Activity that denotes waiting for a lock.
+     */
+    std::unique_ptr<Activity> actLock;
 
-    /* Now check again whether the outputs are valid.  This is because
-       another process may have started building in parallel.  After
-       it has finished and released the locks, we can (and should)
-       reuse its results.  (Strictly speaking the first check can be
-       omitted, but that would be less efficient.)  Note that since we
-       now hold the locks on the output paths, no other process can
-       build this derivation, so no further checks are necessary. */
-    auto [allValid, validOutputs] = checkPathValidity();
+    /**
+     * Locks on (fixed) output paths.
+     */
+    PathLocks outputLocks;
 
-    if (buildMode != bmCheck && allValid) {
-        debug("skipping build of derivation '%s', someone beat us to it", worker.store.printStorePath(drvPath));
-        outputLocks.setDeletion(true);
-        outputLocks.unlock();
-        co_return done(BuildResult::AlreadyValid, std::move(validOutputs));
-    }
+    bool useHook;
 
-    /* If any of the outputs already exist but are not valid, delete
-       them. */
-    for (auto & [_, status] : initialOutputs) {
-        if (!status.known || status.known->isValid()) continue;
-        auto storePath = status.known->path;
-        debug("removing invalid path '%s'", worker.store.printStorePath(status.known->path));
-        deletePath(worker.store.Store::toRealPath(storePath));
-    }
+    while (true) {
+        trace("trying to build");
 
-    /* Don't do a remote build if the derivation has the attribute
-       `preferLocalBuild' set.  Also, check and repair modes are only
-       supported for local builds. */
-    bool buildLocally =
-        (buildMode != bmNormal || drvOptions->willBuildLocally(worker.store, *drv))
-        && settings.maxBuildJobs.get() != 0;
+        /* Obtain locks on all output paths, if the paths are known a priori.
 
-    if (!buildLocally) {
-        switch (tryBuildHook()) {
+           The locks are automatically released when we exit this function or Nix
+           crashes.  If we can't acquire the lock, then continue; hopefully some
+           other goal can start a build, and if not, the main loop will sleep a few
+           seconds and then retry this goal. */
+        PathSet lockFiles;
+        /* FIXME: Should lock something like the drv itself so we don't build same
+           CA drv concurrently */
+        if (dynamic_cast<LocalStore *>(&worker.store)) {
+            /* If we aren't a local store, we might need to use the local store as
+               a build remote, but that would cause a deadlock. */
+            /* FIXME: Make it so we can use ourselves as a build remote even if we
+               are the local store (separate locking for building vs scheduling? */
+            /* FIXME: find some way to lock for scheduling for the other stores so
+               a forking daemon with --store still won't farm out redundant builds.
+               */
+            for (auto & i : drv->outputsAndOptPaths(worker.store)) {
+                if (i.second.second)
+                    lockFiles.insert(worker.store.Store::toRealPath(*i.second.second));
+                else
+                    lockFiles.insert(worker.store.Store::toRealPath(drvPath) + "." + i.first);
+            }
+        }
+
+        if (!outputLocks.lockPaths(lockFiles, "", false)) {
+            Activity act(
+                *logger, lvlWarn, actBuildWaiting, fmt("waiting for lock on %s", Magenta(showPaths(lockFiles))));
+
+            /* Wait then try locking again, repeat until success (returned
+               boolean is true). */
+            do {
+                co_await waitForAWhile();
+            } while (!outputLocks.lockPaths(lockFiles, "", false));
+        }
+
+        /* Now check again whether the outputs are valid.  This is because
+           another process may have started building in parallel.  After
+           it has finished and released the locks, we can (and should)
+           reuse its results.  (Strictly speaking the first check can be
+           omitted, but that would be less efficient.)  Note that since we
+           now hold the locks on the output paths, no other process can
+           build this derivation, so no further checks are necessary. */
+        auto [allValid, validOutputs] = checkPathValidity(initialOutputs);
+
+        if (buildMode != bmCheck && allValid) {
+            debug("skipping build of derivation '%s', someone beat us to it", worker.store.printStorePath(drvPath));
+            outputLocks.setDeletion(true);
+            outputLocks.unlock();
+            co_return doneSuccess(BuildResult::AlreadyValid, std::move(validOutputs));
+        }
+
+        /* If any of the outputs already exist but are not valid, delete
+           them. */
+        for (auto & [_, status] : initialOutputs) {
+            if (!status.known || status.known->isValid())
+                continue;
+            auto storePath = status.known->path;
+            debug("removing invalid path '%s'", worker.store.printStorePath(status.known->path));
+            deletePath(worker.store.Store::toRealPath(storePath));
+        }
+
+        /* Don't do a remote build if the derivation has the attribute
+           `preferLocalBuild' set.  Also, check and repair modes are only
+           supported for local builds. */
+        bool buildLocally = (buildMode != bmNormal || drvOptions->willBuildLocally(worker.store, *drv))
+                            && settings.maxBuildJobs.get() != 0;
+
+        if (buildLocally) {
+            useHook = false;
+        } else {
+            switch (tryBuildHook(initialOutputs)) {
             case rpAccept:
                 /* Yes, it has started doing so.  Wait until we get
                    EOF from the hook. */
-                actLock.reset();
-                buildResult.startTime = time(0); // inexact
-                started();
-                co_await Suspend{};
-                co_return hookDone();
+                useHook = true;
+                break;
             case rpPostpone:
                 /* Not now; wait until at least one child finishes or
                    the wake-up timeout expires. */
                 if (!actLock)
-                    actLock = std::make_unique<Activity>(*logger, lvlWarn, actBuildWaiting,
+                    actLock = std::make_unique<Activity>(
+                        *logger,
+                        lvlWarn,
+                        actBuildWaiting,
                         fmt("waiting for a machine to build '%s'", Magenta(worker.store.printStorePath(drvPath))));
                 outputLocks.unlock();
                 co_await waitForAWhile();
-                co_return tryToBuild();
+                continue;
             case rpDecline:
                 /* We should do it ourselves. */
+                useHook = false;
                 break;
+            }
         }
+        break;
     }
 
     actLock.reset();
 
+    if (useHook) {
+        buildResult.startTime = time(0); // inexact
+        started();
+        co_await Suspend{};
+
+#ifndef _WIN32
+        assert(hook);
+#endif
+
+        trace("hook build done");
+
+        /* Since we got an EOF on the logger pipe, the builder is presumed
+           to have terminated.  In fact, the builder could also have
+           simply have closed its end of the pipe, so just to be sure,
+           kill it. */
+        int status =
+#ifndef _WIN32 // TODO enable build hook on Windows
+            hook->pid.kill();
+#else
+            0;
+#endif
+
+        debug("build hook for '%s' finished", worker.store.printStorePath(drvPath));
+
+        buildResult.timesBuilt++;
+        buildResult.stopTime = time(0);
+
+        /* So the child is gone now. */
+        worker.childTerminated(this);
+
+        /* Close the read side of the logger pipe. */
+#ifndef _WIN32 // TODO enable build hook on Windows
+        hook->builderOut.readSide.close();
+        hook->fromHook.readSide.close();
+#endif
+
+        /* Close the log file. */
+        closeLogFile();
+
+        /* Check the exit status. */
+        if (!statusOk(status)) {
+            auto e = fixupBuilderFailureErrorMessage({BuildResult::MiscFailure, status, ""});
+
+            outputLocks.unlock();
+
+            /* TODO (once again) support fine-grained error codes, see issue #12641. */
+
+            co_return doneFailure(std::move(e));
+        }
+
+        /* Compute the FS closure of the outputs and register them as
+           being valid. */
+        auto builtOutputs =
+            /* When using a build hook, the build hook can register the output
+               as valid (by doing `nix-store --import').  If so we don't have
+               to do anything here.
+
+               We can only early return when the outputs are known a priori. For
+               floating content-addressing derivations this isn't the case.
+
+               Aborts if any output is not valid or corrupt, and otherwise
+               returns a 'SingleDrvOutputs' structure containing all outputs.
+             */
+            [&] {
+                auto [allValid, validOutputs] = checkPathValidity(initialOutputs);
+                if (!allValid)
+                    throw Error("some outputs are unexpectedly invalid");
+                return validOutputs;
+            }();
+
+        StorePathSet outputPaths;
+        for (auto & [_, output] : builtOutputs)
+            outputPaths.insert(output.outPath);
+        runPostBuildHook(worker.store, *logger, drvPath, outputPaths);
+
+        /* It is now safe to delete the lock files, since all future
+           lockers will see that the output paths are valid; they will
+           not create new lock files with the same names as the old
+           (unlinked) lock files. */
+        outputLocks.setDeletion(true);
+        outputLocks.unlock();
+
+        co_return doneSuccess(BuildResult::Built, std::move(builtOutputs));
+    }
+
     co_await yield();
 
     if (!dynamic_cast<LocalStore *>(&worker.store)) {
@@ -545,19 +681,19 @@ Goal::Co DerivationBuildingGoal::tryToBuild()
             either pass a different '--store' or enable remote builds.
 
             For more information check 'man nix.conf' and search for '/machines'.
-            )"
-        );
+            )");
     }
 
 #ifdef _WIN32 // TODO enable `DerivationBuilder` on Windows
     throw UnimplementedError("building derivations is not yet implemented on Windows");
 #else
+    assert(!hook);
+
+    Descriptor builderOut;
 
     // Will continue here while waiting for a build user below
     while (true) {
 
-        assert(!hook);
-
         unsigned int curBuilds = worker.getNrLocalBuilds();
         if (curBuilds >= settings.maxBuildJobs) {
             outputLocks.unlock();
@@ -574,128 +710,180 @@ Goal::Co DerivationBuildingGoal::tryToBuild()
             {
                 DerivationBuildingGoal & goal;
 
-                DerivationBuildingGoalCallbacks(DerivationBuildingGoal & goal, std::unique_ptr<DerivationBuilder> & builder)
+                DerivationBuildingGoalCallbacks(
+                    DerivationBuildingGoal & goal, std::unique_ptr<DerivationBuilder> & builder)
                     : goal{goal}
-                {}
+                {
+                }
 
                 ~DerivationBuildingGoalCallbacks() override = default;
 
-                void childStarted(Descriptor builderOut) override
-                {
-                    goal.worker.childStarted(goal.shared_from_this(), {builderOut}, true, true);
-                }
-
                 void childTerminated() override
                 {
                     goal.worker.childTerminated(&goal);
                 }
 
-                void noteHashMismatch() override
+                Path openLogFile() override
                 {
-                    goal.worker.hashMismatch = true;
-                }
-
-                void noteCheckMismatch() override
-                {
-                    goal.worker.checkMismatch = true;
-                }
-
-                void markContentsGood(const StorePath & path) override
-                {
-                    goal.worker.markContentsGood(path);
-                }
-
-                Path openLogFile() override {
                     return goal.openLogFile();
                 }
-                void closeLogFile() override {
+
+                void closeLogFile() override
+                {
                     goal.closeLogFile();
                 }
-                void appendLogTailErrorMsg(std::string & msg) override {
-                    goal.appendLogTailErrorMsg(msg);
-                }
             };
 
+            auto * localStoreP = dynamic_cast<LocalStore *>(&worker.store);
+            assert(localStoreP);
+
+            decltype(DerivationBuilderParams::defaultPathsInChroot) defaultPathsInChroot = settings.sandboxPaths.get();
+            DesugaredEnv desugaredEnv;
+
+            /* Add the closure of store paths to the chroot. */
+            StorePathSet closure;
+            for (auto & i : defaultPathsInChroot)
+                try {
+                    if (worker.store.isInStore(i.second.source))
+                        worker.store.computeFSClosure(worker.store.toStorePath(i.second.source).first, closure);
+                } catch (InvalidPath & e) {
+                } catch (Error & e) {
+                    e.addTrace({}, "while processing sandbox path '%s'", i.second.source);
+                    throw;
+                }
+            for (auto & i : closure) {
+                auto p = worker.store.printStorePath(i);
+                defaultPathsInChroot.insert_or_assign(p, ChrootPath{.source = p});
+            }
+
+            try {
+                desugaredEnv = DesugaredEnv::create(worker.store, *drv, *drvOptions, inputPaths);
+            } catch (BuildError & e) {
+                outputLocks.unlock();
+                worker.permanentFailure = true;
+                co_return doneFailure(std::move(e));
+            }
+
             /* If we have to wait and retry (see below), then `builder` will
                already be created, so we don't need to create it again. */
             builder = makeDerivationBuilder(
-                worker.store,
+                *localStoreP,
                 std::make_unique<DerivationBuildingGoalCallbacks>(*this, builder),
-                DerivationBuilderParams {
-                    drvPath,
-                    buildMode,
-                    buildResult,
-                    *drv,
-                    parsedDrv.get(),
-                    *drvOptions,
-                    inputPaths,
-                    initialOutputs,
+                DerivationBuilderParams{
+                    .drvPath = drvPath,
+                    .buildResult = buildResult,
+                    .drv = *drv,
+                    .drvOptions = *drvOptions,
+                    .inputPaths = inputPaths,
+                    .initialOutputs = initialOutputs,
+                    .buildMode = buildMode,
+                    .defaultPathsInChroot = std::move(defaultPathsInChroot),
+                    .systemFeatures = worker.store.config.systemFeatures.get(),
+                    .desugaredEnv = std::move(desugaredEnv),
                 });
         }
 
-        if (!builder->prepareBuild()) {
+        std::optional<Descriptor> builderOutOpt;
+        try {
+            /* Okay, we have to build. */
+            builderOutOpt = builder->startBuild();
+        } catch (BuildError & e) {
+            builder.reset();
+            outputLocks.unlock();
+            worker.permanentFailure = true;
+            co_return doneFailure(std::move(e)); // InputRejected
+        }
+        if (!builderOutOpt) {
             if (!actLock)
-                actLock = std::make_unique<Activity>(*logger, lvlWarn, actBuildWaiting,
+                actLock = std::make_unique<Activity>(
+                    *logger,
+                    lvlWarn,
+                    actBuildWaiting,
                     fmt("waiting for a free build user ID for '%s'", Magenta(worker.store.printStorePath(drvPath))));
             co_await waitForAWhile();
             continue;
-        }
+        } else {
+            builderOut = *std::move(builderOutOpt);
+        };
 
         break;
     }
 
     actLock.reset();
 
-    try {
-
-        /* Okay, we have to build. */
-        builder->startBuilder();
-
-    } catch (BuildError & e) {
-        builder.reset();
-        outputLocks.unlock();
-        worker.permanentFailure = true;
-        co_return done(BuildResult::InputRejected, {}, std::move(e));
-    }
+    worker.childStarted(shared_from_this(), {builderOut}, true, true);
 
     started();
     co_await Suspend{};
 
     trace("build done");
 
-    auto res = builder->unprepareBuild();
-    // N.B. cannot use `std::visit` with co-routine return
-    if (auto * ste = std::get_if<0>(&res)) {
+    SingleDrvOutputs builtOutputs;
+    try {
+        builtOutputs = builder->unprepareBuild();
+    } catch (BuilderFailureError & e) {
+        builder.reset();
         outputLocks.unlock();
-        co_return done(std::move(ste->first), {}, std::move(ste->second));
-    } else if (auto * builtOutputs = std::get_if<1>(&res)) {
+        co_return doneFailure(fixupBuilderFailureErrorMessage(std::move(e)));
+    } catch (BuildError & e) {
+        builder.reset();
+        outputLocks.unlock();
+// Allow selecting a subset of enum values
+#  pragma GCC diagnostic push
+#  pragma GCC diagnostic ignored "-Wswitch-enum"
+        switch (e.status) {
+        case BuildResult::HashMismatch:
+            worker.hashMismatch = true;
+            /* See header, the protocols don't know about `HashMismatch`
+               yet, so change it to `OutputRejected`, which they expect
+               for this case (hash mismatch is a type of output
+               rejection). */
+            e.status = BuildResult::OutputRejected;
+            break;
+        case BuildResult::NotDeterministic:
+            worker.checkMismatch = true;
+            break;
+        default:
+            /* Other statuses need no adjusting */
+            break;
+        }
+#  pragma GCC diagnostic pop
+        co_return doneFailure(std::move(e));
+    }
+    {
+        builder.reset();
+        StorePathSet outputPaths;
+        for (auto & [_, output] : builtOutputs) {
+            // for sake of `bmRepair`
+            worker.markContentsGood(output.outPath);
+            outputPaths.insert(output.outPath);
+        }
+        runPostBuildHook(worker.store, *logger, drvPath, outputPaths);
+
         /* It is now safe to delete the lock files, since all future
            lockers will see that the output paths are valid; they will
            not create new lock files with the same names as the old
            (unlinked) lock files. */
         outputLocks.setDeletion(true);
         outputLocks.unlock();
-        co_return done(BuildResult::Built, std::move(*builtOutputs));
-    } else {
-        unreachable();
+        co_return doneSuccess(BuildResult::Built, std::move(builtOutputs));
     }
 #endif
 }
 
-
-void runPostBuildHook(
-    Store & store,
-    Logger & logger,
-    const StorePath & drvPath,
-    const StorePathSet & outputPaths)
+static void runPostBuildHook(
+    const StoreDirConfig & store, Logger & logger, const StorePath & drvPath, const StorePathSet & outputPaths)
 {
     auto hook = settings.postBuildHook;
     if (hook == "")
         return;
 
-    Activity act(logger, lvlTalkative, actPostBuildHook,
-            fmt("running post-build-hook '%s'", settings.postBuildHook),
-            Logger::Fields{store.printStorePath(drvPath)});
+    Activity act(
+        logger,
+        lvlTalkative,
+        actPostBuildHook,
+        fmt("running post-build-hook '%s'", settings.postBuildHook),
+        Logger::Fields{store.printStorePath(drvPath)});
     PushActivity pact(act.id);
     StringMap hookEnvironment = getEnv();
 
@@ -703,13 +891,18 @@ void runPostBuildHook(
     hookEnvironment.emplace("OUT_PATHS", chomp(concatStringsSep(" ", store.printStorePathSet(outputPaths))));
     hookEnvironment.emplace("NIX_CONFIG", globalConfig.toKeyValue());
 
-    struct LogSink : Sink {
+    struct LogSink : Sink
+    {
         Activity & act;
         std::string currentLine;
 
-        LogSink(Activity & act) : act(act) { }
+        LogSink(Activity & act)
+            : act(act)
+        {
+        }
 
-        void operator() (std::string_view data) override {
+        void operator()(std::string_view data) override
+        {
             for (auto c : data) {
                 if (c == '\n') {
                     flushLine();
@@ -719,18 +912,21 @@ void runPostBuildHook(
             }
         }
 
-        void flushLine() {
+        void flushLine()
+        {
             act.result(resPostBuildLogLine, currentLine);
             currentLine.clear();
         }
 
-        ~LogSink() {
+        ~LogSink()
+        {
             if (currentLine != "") {
                 currentLine += '\n';
                 flushLine();
             }
         }
     };
+
     LogSink sink(act);
 
     runProgram2({
@@ -741,9 +937,16 @@ void runPostBuildHook(
     });
 }
 
-
-void DerivationBuildingGoal::appendLogTailErrorMsg(std::string & msg)
+BuildError DerivationBuildingGoal::fixupBuilderFailureErrorMessage(BuilderFailureError e)
 {
+    auto msg =
+        fmt("Cannot build '%s'.\n"
+            "Reason: " ANSI_RED "builder %s" ANSI_NORMAL ".",
+            Magenta(worker.store.printStorePath(drvPath)),
+            statusToString(e.builderStatus));
+
+    msg += showKnownOutputs(worker.store, *drv);
+
     if (!logger->isVerbose() && !logTail.empty()) {
         msg += fmt("\nLast %d log lines:\n", logTail.size());
         for (auto & line : logTail) {
@@ -751,114 +954,30 @@ void DerivationBuildingGoal::appendLogTailErrorMsg(std::string & msg)
             msg += line;
             msg += "\n";
         }
-        auto nixLogCommand = experimentalFeatureSettings.isEnabled(Xp::NixCommand)
-            ? "nix log"
-            : "nix-store -l";
+        auto nixLogCommand = experimentalFeatureSettings.isEnabled(Xp::NixCommand) ? "nix log" : "nix-store -l";
         // The command is on a separate line for easy copying, such as with triple click.
         // This message will be indented elsewhere, so removing the indentation before the
         // command will not put it at the start of the line unfortunately.
-        msg += fmt("For full logs, run:\n  " ANSI_BOLD "%s %s" ANSI_NORMAL,
-            nixLogCommand,
-            worker.store.printStorePath(drvPath));
-    }
-}
-
-
-Goal::Co DerivationBuildingGoal::hookDone()
-{
-#ifndef _WIN32
-    assert(hook);
-#endif
-
-    trace("hook build done");
-
-    /* Since we got an EOF on the logger pipe, the builder is presumed
-       to have terminated.  In fact, the builder could also have
-       simply have closed its end of the pipe, so just to be sure,
-       kill it. */
-    int status =
-#ifndef _WIN32 // TODO enable build hook on Windows
-        hook->pid.kill();
-#else
-        0;
-#endif
-
-    debug("build hook for '%s' finished", worker.store.printStorePath(drvPath));
-
-    buildResult.timesBuilt++;
-    buildResult.stopTime = time(0);
-
-    /* So the child is gone now. */
-    worker.childTerminated(this);
-
-    /* Close the read side of the logger pipe. */
-#ifndef _WIN32 // TODO enable build hook on Windows
-    hook->builderOut.readSide.close();
-    hook->fromHook.readSide.close();
-#endif
-
-    /* Close the log file. */
-    closeLogFile();
-
-    /* Check the exit status. */
-    if (!statusOk(status)) {
-        auto msg = fmt(
-            "Cannot build '%s'.\n"
-            "Reason: " ANSI_RED "builder %s" ANSI_NORMAL ".",
-            Magenta(worker.store.printStorePath(drvPath)),
-            statusToString(status));
-
-        msg += showKnownOutputs(worker.store, *drv);
-
-        appendLogTailErrorMsg(msg);
-
-        outputLocks.unlock();
-
-        /* TODO (once again) support fine-grained error codes, see issue #12641. */
-
-        co_return done(BuildResult::MiscFailure, {}, BuildError(msg));
+        msg +=
+            fmt("For full logs, run:\n  " ANSI_BOLD "%s %s" ANSI_NORMAL,
+                nixLogCommand,
+                worker.store.printStorePath(drvPath));
     }
 
-    /* Compute the FS closure of the outputs and register them as
-       being valid. */
-    auto builtOutputs =
-        /* When using a build hook, the build hook can register the output
-           as valid (by doing `nix-store --import').  If so we don't have
-           to do anything here.
+    msg += e.extraMsgAfter;
 
-           We can only early return when the outputs are known a priori. For
-           floating content-addressing derivations this isn't the case.
-         */
-        assertPathValidity();
-
-    StorePathSet outputPaths;
-    for (auto & [_, output] : builtOutputs)
-        outputPaths.insert(output.outPath);
-    runPostBuildHook(
-        worker.store,
-        *logger,
-        drvPath,
-        outputPaths
-    );
-
-    /* It is now safe to delete the lock files, since all future
-       lockers will see that the output paths are valid; they will
-       not create new lock files with the same names as the old
-       (unlinked) lock files. */
-    outputLocks.setDeletion(true);
-    outputLocks.unlock();
-
-    co_return done(BuildResult::Built, std::move(builtOutputs));
+    return BuildError{e.status, msg};
 }
 
-HookReply DerivationBuildingGoal::tryBuildHook()
+HookReply DerivationBuildingGoal::tryBuildHook(const std::map<std::string, InitialOutput> & initialOutputs)
 {
 #ifdef _WIN32 // TODO enable build hook on Windows
     return rpDecline;
 #else
     /* This should use `worker.evalStore`, but per #13179 the build hook
        doesn't work with eval store anyways. */
-    if (settings.buildHook.get().empty() || !worker.tryBuildHook || !worker.store.isValidPath(drvPath)) return rpDecline;
+    if (settings.buildHook.get().empty() || !worker.tryBuildHook || !worker.store.isValidPath(drvPath))
+        return rpDecline;
 
     if (!worker.hook)
         worker.hook = std::make_unique<HookInstance>();
@@ -866,12 +985,8 @@ HookReply DerivationBuildingGoal::tryBuildHook()
     try {
 
         /* Send the request to the hook. */
-        worker.hook->sink
-            << "try"
-            << (worker.getNrLocalBuilds() < settings.maxBuildJobs ? 1 : 0)
-            << drv->platform
-            << worker.store.printStorePath(drvPath)
-            << drvOptions->getRequiredSystemFeatures(*drv);
+        worker.hook->sink << "try" << (worker.getNrLocalBuilds() < settings.maxBuildJobs ? 1 : 0) << drv->platform
+                          << worker.store.printStorePath(drvPath) << drvOptions->getRequiredSystemFeatures(*drv);
         worker.hook->sink.flush();
 
         /* Read the first line of input, which should be a word indicating
@@ -891,8 +1006,7 @@ HookReply DerivationBuildingGoal::tryBuildHook()
             else if (s.substr(0, 2) == "# ") {
                 reply = s.substr(2);
                 break;
-            }
-            else {
+            } else {
                 s += "\n";
                 writeToStderr(s);
             }
@@ -906,17 +1020,14 @@ HookReply DerivationBuildingGoal::tryBuildHook()
             worker.tryBuildHook = false;
             worker.hook = 0;
             return rpDecline;
-        }
-        else if (reply == "postpone")
+        } else if (reply == "postpone")
             return rpPostpone;
         else if (reply != "accept")
             throw Error("bad hook reply '%s'", reply);
 
     } catch (SysError & e) {
         if (e.errNo == EPIPE) {
-            printError(
-                "build hook died unexpectedly: %s",
-                chomp(drainFD(worker.hook->fromHook.readSide.get())));
+            printError("build hook died unexpectedly: %s", chomp(drainFD(worker.hook->fromHook.readSide.get())));
             worker.hook = 0;
             return rpDecline;
         } else
@@ -926,13 +1037,13 @@ HookReply DerivationBuildingGoal::tryBuildHook()
     hook = std::move(worker.hook);
 
     try {
-        machineName = readLine(hook->fromHook.readSide.get());
+        hook->machineName = readLine(hook->fromHook.readSide.get());
     } catch (Error & e) {
         e.addTrace({}, "while reading the machine name from the build hook");
         throw;
     }
 
-    CommonProto::WriteConn conn { hook->sink };
+    CommonProto::WriteConn conn{hook->sink};
 
     /* Tell the hook all the inputs that have to be copied to the
        remote system. */
@@ -944,7 +1055,8 @@ HookReply DerivationBuildingGoal::tryBuildHook()
         StringSet missingOutputs;
         for (auto & [outputName, status] : initialOutputs) {
             // XXX: Does this include known CA outputs?
-            if (buildMode != bmCheck && status.known && status.known->isValid()) continue;
+            if (buildMode != bmCheck && status.known && status.known->isValid())
+                continue;
             missingOutputs.insert(outputName);
         }
         CommonProto::write(worker.store, conn, missingOutputs);
@@ -965,12 +1077,12 @@ HookReply DerivationBuildingGoal::tryBuildHook()
 #endif
 }
 
-
 Path DerivationBuildingGoal::openLogFile()
 {
     logSize = 0;
 
-    if (!settings.keepLog) return "";
+    if (!settings.keepLog)
+        return "";
 
     auto baseName = std::string(baseNameOf(worker.store.printStorePath(drvPath)));
 
@@ -983,15 +1095,18 @@ Path DerivationBuildingGoal::openLogFile()
     Path dir = fmt("%s/%s/%s/", logDir, LocalFSStore::drvsLogDir, baseName.substr(0, 2));
     createDirs(dir);
 
-    Path logFileName = fmt("%s/%s%s", dir, baseName.substr(2),
-        settings.compressLog ? ".bz2" : "");
+    Path logFileName = fmt("%s/%s%s", dir, baseName.substr(2), settings.compressLog ? ".bz2" : "");
 
-    fdLogFile = toDescriptor(open(logFileName.c_str(), O_CREAT | O_WRONLY | O_TRUNC
+    fdLogFile = toDescriptor(open(
+        logFileName.c_str(),
+        O_CREAT | O_WRONLY | O_TRUNC
 #ifndef _WIN32
-        | O_CLOEXEC
+            | O_CLOEXEC
 #endif
-        , 0666));
-    if (!fdLogFile) throw SysError("creating log file '%1%'", logFileName);
+        ,
+        0666));
+    if (!fdLogFile)
+        throw SysError("creating log file '%1%'", logFileName);
 
     logFileSink = std::make_shared<FdSink>(fdLogFile.get());
 
@@ -1003,26 +1118,23 @@ Path DerivationBuildingGoal::openLogFile()
     return logFileName;
 }
 
-
 void DerivationBuildingGoal::closeLogFile()
 {
     auto logSink2 = std::dynamic_pointer_cast<CompressionSink>(logSink);
-    if (logSink2) logSink2->finish();
-    if (logFileSink) logFileSink->flush();
+    if (logSink2)
+        logSink2->finish();
+    if (logFileSink)
+        logFileSink->flush();
     logSink = logFileSink = 0;
     fdLogFile.close();
 }
 
-
 bool DerivationBuildingGoal::isReadDesc(Descriptor fd)
 {
 #ifdef _WIN32 // TODO enable build hook on Windows
     return false;
 #else
-    return
-        (hook && fd == hook->builderOut.readSide.get())
-        ||
-        (builder && fd == builder->builderOut.get());
+    return (hook && fd == hook->builderOut.readSide.get()) || (builder && fd == builder->builderOut.get());
 #endif
 }
 
@@ -1030,17 +1142,17 @@ void DerivationBuildingGoal::handleChildOutput(Descriptor fd, std::string_view d
 {
     // local & `ssh://`-builds are dealt with here.
     auto isWrittenToLog = isReadDesc(fd);
-    if (isWrittenToLog)
-    {
+    if (isWrittenToLog) {
         logSize += data.size();
         if (settings.maxLogSize && logSize > settings.maxLogSize) {
             killChild();
             // We're not inside a coroutine, hence we can't use co_return here.
             // Thus we ignore the return value.
-            [[maybe_unused]] Done _ = done(
-                BuildResult::LogLimitExceeded, {},
-                Error("%s killed after writing more than %d bytes of log output",
-                    getName(), settings.maxLogSize));
+            [[maybe_unused]] Done _ = doneFailure(BuildError(
+                BuildResult::LogLimitExceeded,
+                "%s killed after writing more than %d bytes of log output",
+                getName(),
+                settings.maxLogSize));
             return;
         }
 
@@ -1055,7 +1167,8 @@ void DerivationBuildingGoal::handleChildOutput(Descriptor fd, std::string_view d
                 currentLogLine[currentLogLinePos++] = c;
             }
 
-        if (logSink) (*logSink)(data);
+        if (logSink)
+            (*logSink)(data);
     }
 
 #ifndef _WIN32 // TODO enable build hook on Windows
@@ -1072,19 +1185,18 @@ void DerivationBuildingGoal::handleChildOutput(Descriptor fd, std::string_view d
                         const auto fields = (*json)["fields"];
                         if (type == resBuildLogLine) {
                             (*logSink)((fields.size() > 0 ? fields[0].get<std::string>() : "") + "\n");
-                        } else if (type == resSetPhase && ! fields.is_null()) {
+                        } else if (type == resSetPhase && !fields.is_null()) {
                             const auto phase = fields[0];
-                            if (! phase.is_null()) {
+                            if (!phase.is_null()) {
                                 // nixpkgs' stdenv produces lines in the log to signal
                                 // phase changes.
                                 // We want to get the same lines in case of remote builds.
                                 // The format is:
                                 //   @nix { "action": "setPhase", "phase": "$curPhase" }
-                                const auto logLine = nlohmann::json::object({
-                                    {"action", "setPhase"},
-                                    {"phase", phase}
-                                });
-                                (*logSink)("@nix " + logLine.dump(-1, ' ', false, nlohmann::json::error_handler_t::replace) + "\n");
+                                const auto logLine = nlohmann::json::object({{"action", "setPhase"}, {"phase", phase}});
+                                (*logSink)(
+                                    "@nix " + logLine.dump(-1, ' ', false, nlohmann::json::error_handler_t::replace)
+                                    + "\n");
                             }
                         }
                     }
@@ -1096,14 +1208,13 @@ void DerivationBuildingGoal::handleChildOutput(Descriptor fd, std::string_view d
 #endif
 }
 
-
 void DerivationBuildingGoal::handleEOF(Descriptor fd)
 {
-    if (!currentLogLine.empty()) flushLine();
+    if (!currentLogLine.empty())
+        flushLine();
     worker.wakeUp(shared_from_this());
 }
 
-
 void DerivationBuildingGoal::flushLine()
 {
     if (handleJSONLogMessage(currentLogLine, *act, builderActivities, "the derivation builder", false))
@@ -1111,7 +1222,8 @@ void DerivationBuildingGoal::flushLine()
 
     else {
         logTail.push_back(currentLogLine);
-        if (logTail.size() > settings.logLines) logTail.pop_front();
+        if (logTail.size() > settings.logLines)
+            logTail.pop_front();
 
         act->result(resBuildLogLine, currentLogLine);
     }
@@ -1120,12 +1232,11 @@ void DerivationBuildingGoal::flushLine()
     currentLogLinePos = 0;
 }
 
-
 std::map<std::string, std::optional<StorePath>> DerivationBuildingGoal::queryPartialDerivationOutputMap()
 {
     assert(!drv->type().isImpure());
 
-    for (auto * drvStore : { &worker.evalStore, &worker.store })
+    for (auto * drvStore : {&worker.evalStore, &worker.store})
         if (drvStore->isValidPath(drvPath))
             return worker.store.queryPartialDerivationOutputMap(drvPath, drvStore);
 
@@ -1137,9 +1248,11 @@ std::map<std::string, std::optional<StorePath>> DerivationBuildingGoal::queryPar
     return res;
 }
 
-std::pair<bool, SingleDrvOutputs> DerivationBuildingGoal::checkPathValidity()
+std::pair<bool, SingleDrvOutputs>
+DerivationBuildingGoal::checkPathValidity(std::map<std::string, InitialOutput> & initialOutputs)
 {
-    if (drv->type().isImpure()) return { false, {} };
+    if (drv->type().isImpure())
+        return {false, {}};
 
     bool checkHash = buildMode == bmRepair;
     SingleDrvOutputs validOutputs;
@@ -1150,16 +1263,13 @@ std::pair<bool, SingleDrvOutputs> DerivationBuildingGoal::checkPathValidity()
             // this is an invalid output, gets caught with (!wantedOutputsLeft.empty())
             continue;
         auto & info = *initialOutput;
-        info.wanted = true;
         if (i.second) {
             auto outputPath = *i.second;
             info.known = {
                 .path = outputPath,
-                .status = !worker.store.isValidPath(outputPath)
-                    ? PathStatus::Absent
-                    : !checkHash || worker.pathContentsGood(outputPath)
-                    ? PathStatus::Valid
-                    : PathStatus::Corrupt,
+                .status = !worker.store.isValidPath(outputPath)               ? PathStatus::Absent
+                          : !checkHash || worker.pathContentsGood(outputPath) ? PathStatus::Valid
+                                                                              : PathStatus::Corrupt,
             };
         }
         auto drvOutput = DrvOutput{info.outputHash, i.first};
@@ -1175,48 +1285,48 @@ std::pair<bool, SingleDrvOutputs> DerivationBuildingGoal::checkPathValidity()
                 // its realisation stored (probably because it has been built
                 // without the `ca-derivations` experimental flag).
                 worker.store.registerDrvOutput(
-                    Realisation {
+                    Realisation{
                         drvOutput,
                         info.known->path,
-                    }
-                );
+                    });
             }
         }
         if (info.known && info.known->isValid())
-            validOutputs.emplace(i.first, Realisation { drvOutput, info.known->path });
+            validOutputs.emplace(i.first, Realisation{drvOutput, info.known->path});
     }
 
     bool allValid = true;
     for (auto & [_, status] : initialOutputs) {
-        if (!status.wanted) continue;
         if (!status.known || !status.known->isValid()) {
             allValid = false;
             break;
         }
     }
 
-    return { allValid, validOutputs };
+    return {allValid, validOutputs};
 }
 
-
-SingleDrvOutputs DerivationBuildingGoal::assertPathValidity()
+Goal::Done DerivationBuildingGoal::doneSuccess(BuildResult::Status status, SingleDrvOutputs builtOutputs)
 {
-    auto [allValid, validOutputs] = checkPathValidity();
-    if (!allValid)
-        throw Error("some outputs are unexpectedly invalid");
-    return validOutputs;
-}
-
-
-Goal::Done DerivationBuildingGoal::done(
-    BuildResult::Status status,
-    SingleDrvOutputs builtOutputs,
-    std::optional<Error> ex)
-{
-    outputLocks.unlock();
     buildResult.status = status;
-    if (ex)
-        buildResult.errorMsg = fmt("%s", Uncolored(ex->info().msg));
+
+    assert(buildResult.success());
+
+    mcRunningBuilds.reset();
+
+    buildResult.builtOutputs = std::move(builtOutputs);
+    if (status == BuildResult::Built)
+        worker.doneBuilds++;
+
+    worker.updateProgress();
+
+    return amDone(ecSuccess, std::nullopt);
+}
+
+Goal::Done DerivationBuildingGoal::doneFailure(BuildError ex)
+{
+    buildResult.status = ex.status;
+    buildResult.errorMsg = fmt("%s", Uncolored(ex.info().msg));
     if (buildResult.status == BuildResult::TimedOut)
         worker.timedOut = true;
     if (buildResult.status == BuildResult::PermanentFailure)
@@ -1224,25 +1334,12 @@ Goal::Done DerivationBuildingGoal::done(
 
     mcRunningBuilds.reset();
 
-    if (buildResult.success()) {
-        buildResult.builtOutputs = std::move(builtOutputs);
-        if (status == BuildResult::Built)
-            worker.doneBuilds++;
-    } else {
-        if (status != BuildResult::DependencyFailed)
-            worker.failedBuilds++;
-    }
+    if (ex.status != BuildResult::DependencyFailed)
+        worker.failedBuilds++;
 
     worker.updateProgress();
 
-    auto traceBuiltOutputsFile = getEnv("_NIX_TRACE_BUILT_OUTPUTS").value_or("");
-    if (traceBuiltOutputsFile != "") {
-        std::fstream fs;
-        fs.open(traceBuiltOutputsFile, std::fstream::out);
-        fs << worker.store.printStorePath(drvPath) << "\t" << buildResult.toString() << std::endl;
-    }
-
-    return amDone(buildResult.success() ? ecSuccess : ecFailed, std::move(ex));
+    return amDone(ecFailed, {std::move(ex)});
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/build/derivation-check.cc b/src/libstore/build/derivation-check.cc
new file mode 100644
index 000000000..82e92e1f3
--- /dev/null
+++ b/src/libstore/build/derivation-check.cc
@@ -0,0 +1,190 @@
+#include <queue>
+
+#include "nix/store/store-api.hh"
+#include "nix/store/build-result.hh"
+
+#include "derivation-check.hh"
+
+namespace nix {
+
+void checkOutputs(
+    Store & store,
+    const StorePath & drvPath,
+    const decltype(Derivation::outputs) & drvOutputs,
+    const decltype(DerivationOptions::outputChecks) & outputChecks,
+    const std::map<std::string, ValidPathInfo> & outputs)
+{
+    std::map<Path, const ValidPathInfo &> outputsByPath;
+    for (auto & output : outputs)
+        outputsByPath.emplace(store.printStorePath(output.second.path), output.second);
+
+    for (auto & [outputName, info] : outputs) {
+
+        auto * outputSpec = get(drvOutputs, outputName);
+        assert(outputSpec);
+
+        if (const auto * dof = std::get_if<DerivationOutput::CAFixed>(&outputSpec->raw)) {
+            auto & wanted = dof->ca.hash;
+
+            /* Check wanted hash */
+            assert(info.ca);
+            auto & got = info.ca->hash;
+            if (wanted != got) {
+                /* Throw an error after registering the path as
+                   valid. */
+                throw BuildError(
+                    BuildResult::HashMismatch,
+                    "hash mismatch in fixed-output derivation '%s':\n  specified: %s\n     got:    %s",
+                    store.printStorePath(drvPath),
+                    wanted.to_string(HashFormat::SRI, true),
+                    got.to_string(HashFormat::SRI, true));
+            }
+            if (!info.references.empty()) {
+                auto numViolations = info.references.size();
+                throw BuildError(
+                    BuildResult::HashMismatch,
+                    "fixed-output derivations must not reference store paths: '%s' references %d distinct paths, e.g. '%s'",
+                    store.printStorePath(drvPath),
+                    numViolations,
+                    store.printStorePath(*info.references.begin()));
+            }
+        }
+
+        /* Compute the closure and closure size of some output. This
+           is slightly tricky because some of its references (namely
+           other outputs) may not be valid yet. */
+        auto getClosure = [&](const StorePath & path) {
+            uint64_t closureSize = 0;
+            StorePathSet pathsDone;
+            std::queue<StorePath> pathsLeft;
+            pathsLeft.push(path);
+
+            while (!pathsLeft.empty()) {
+                auto path = pathsLeft.front();
+                pathsLeft.pop();
+                if (!pathsDone.insert(path).second)
+                    continue;
+
+                auto i = outputsByPath.find(store.printStorePath(path));
+                if (i != outputsByPath.end()) {
+                    closureSize += i->second.narSize;
+                    for (auto & ref : i->second.references)
+                        pathsLeft.push(ref);
+                } else {
+                    auto info = store.queryPathInfo(path);
+                    closureSize += info->narSize;
+                    for (auto & ref : info->references)
+                        pathsLeft.push(ref);
+                }
+            }
+
+            return std::make_pair(std::move(pathsDone), closureSize);
+        };
+
+        auto applyChecks = [&](const DerivationOptions::OutputChecks & checks) {
+            if (checks.maxSize && info.narSize > *checks.maxSize)
+                throw BuildError(
+                    BuildResult::OutputRejected,
+                    "path '%s' is too large at %d bytes; limit is %d bytes",
+                    store.printStorePath(info.path),
+                    info.narSize,
+                    *checks.maxSize);
+
+            if (checks.maxClosureSize) {
+                uint64_t closureSize = getClosure(info.path).second;
+                if (closureSize > *checks.maxClosureSize)
+                    throw BuildError(
+                        BuildResult::OutputRejected,
+                        "closure of path '%s' is too large at %d bytes; limit is %d bytes",
+                        store.printStorePath(info.path),
+                        closureSize,
+                        *checks.maxClosureSize);
+            }
+
+            auto checkRefs = [&](const StringSet & value, bool allowed, bool recursive) {
+                /* Parse a list of reference specifiers.  Each element must
+                   either be a store path, or the symbolic name of the output
+                   of the derivation (such as `out'). */
+                StorePathSet spec;
+                for (auto & i : value) {
+                    if (store.isStorePath(i))
+                        spec.insert(store.parseStorePath(i));
+                    else if (auto output = get(outputs, i))
+                        spec.insert(output->path);
+                    else {
+                        std::string outputsListing =
+                            concatMapStringsSep(", ", outputs, [](auto & o) { return o.first; });
+                        throw BuildError(
+                            BuildResult::OutputRejected,
+                            "derivation '%s' output check for '%s' contains an illegal reference specifier '%s',"
+                            " expected store path or output name (one of [%s])",
+                            store.printStorePath(drvPath),
+                            outputName,
+                            i,
+                            outputsListing);
+                    }
+                }
+
+                auto used = recursive ? getClosure(info.path).first : info.references;
+
+                if (recursive && checks.ignoreSelfRefs)
+                    used.erase(info.path);
+
+                StorePathSet badPaths;
+
+                for (auto & i : used)
+                    if (allowed) {
+                        if (!spec.count(i))
+                            badPaths.insert(i);
+                    } else {
+                        if (spec.count(i))
+                            badPaths.insert(i);
+                    }
+
+                if (!badPaths.empty()) {
+                    std::string badPathsStr;
+                    for (auto & i : badPaths) {
+                        badPathsStr += "\n  ";
+                        badPathsStr += store.printStorePath(i);
+                    }
+                    throw BuildError(
+                        BuildResult::OutputRejected,
+                        "output '%s' is not allowed to refer to the following paths:%s",
+                        store.printStorePath(info.path),
+                        badPathsStr);
+                }
+            };
+
+            /* Mandatory check: absent whitelist, and present but empty
+               whitelist mean very different things. */
+            if (auto & refs = checks.allowedReferences) {
+                checkRefs(*refs, true, false);
+            }
+            if (auto & refs = checks.allowedRequisites) {
+                checkRefs(*refs, true, true);
+            }
+
+            /* Optimization: don't need to do anything when
+               disallowed and empty set. */
+            if (!checks.disallowedReferences.empty()) {
+                checkRefs(checks.disallowedReferences, false, false);
+            }
+            if (!checks.disallowedRequisites.empty()) {
+                checkRefs(checks.disallowedRequisites, false, true);
+            }
+        };
+
+        std::visit(
+            overloaded{
+                [&](const DerivationOptions::OutputChecks & checks) { applyChecks(checks); },
+                [&](const std::map<std::string, DerivationOptions::OutputChecks> & checksPerOutput) {
+                    if (auto outputChecks = get(checksPerOutput, outputName))
+
+                        applyChecks(*outputChecks);
+                },
+            },
+            outputChecks);
+    }
+}
+
+} // namespace nix
diff --git a/src/libstore/build/derivation-check.hh b/src/libstore/build/derivation-check.hh
new file mode 100644
index 000000000..b425c2ac5
--- /dev/null
+++ b/src/libstore/build/derivation-check.hh
@@ -0,0 +1,27 @@
+#pragma once
+///@file
+
+#include "nix/store/derivations.hh"
+#include "nix/store/derivation-options.hh"
+#include "nix/store/path-info.hh"
+
+namespace nix {
+
+/**
+ * Check that outputs meets the requirements specified by the
+ * 'outputChecks' attribute (or the legacy
+ * '{allowed,disallowed}{References,Requisites}' attributes).
+ *
+ * The outputs may not be valid yet, hence outputs needs to contain all
+ * needed info like the NAR size. However, the external (not other
+ * output) references of the output must be valid, so we can compute the
+ * closure size.
+ */
+void checkOutputs(
+    Store & store,
+    const StorePath & drvPath,
+    const decltype(Derivation::outputs) & drvOutputs,
+    const decltype(DerivationOptions::outputChecks) & drvOptions,
+    const std::map<std::string, ValidPathInfo> & outputs);
+
+} // namespace nix
diff --git a/src/libstore/build/derivation-env-desugar.cc b/src/libstore/build/derivation-env-desugar.cc
new file mode 100644
index 000000000..d6e002d91
--- /dev/null
+++ b/src/libstore/build/derivation-env-desugar.cc
@@ -0,0 +1,59 @@
+#include "nix/store/build/derivation-env-desugar.hh"
+#include "nix/store/store-api.hh"
+#include "nix/store/derivations.hh"
+#include "nix/store/derivation-options.hh"
+
+namespace nix {
+
+std::string & DesugaredEnv::atFileEnvPair(std::string_view name, std::string fileName)
+{
+    auto & ret = extraFiles[fileName];
+    variables.insert_or_assign(
+        std::string{name},
+        EnvEntry{
+            .prependBuildDirectory = true,
+            .value = std::move(fileName),
+        });
+    return ret;
+}
+
+DesugaredEnv DesugaredEnv::create(
+    Store & store, const Derivation & drv, const DerivationOptions & drvOptions, const StorePathSet & inputPaths)
+{
+    DesugaredEnv res;
+
+    if (drv.structuredAttrs) {
+        auto json = drv.structuredAttrs->prepareStructuredAttrs(store, drvOptions, inputPaths, drv.outputs);
+        res.atFileEnvPair("NIX_ATTRS_SH_FILE", ".attrs.sh") = StructuredAttrs::writeShell(json);
+        res.atFileEnvPair("NIX_ATTRS_JSON_FILE", ".attrs.json") = json.dump();
+    } else {
+        /* In non-structured mode, set all bindings either directory in the
+           environment or via a file, as specified by
+           `DerivationOptions::passAsFile`. */
+        for (auto & [envName, envValue] : drv.env) {
+            if (!drvOptions.passAsFile.contains(envName)) {
+                res.variables.insert_or_assign(
+                    envName,
+                    EnvEntry{
+                        .value = envValue,
+                    });
+            } else {
+                res.atFileEnvPair(
+                    envName + "Path",
+                    ".attr-" + hashString(HashAlgorithm::SHA256, envName).to_string(HashFormat::Nix32, false)) =
+                    envValue;
+            }
+        }
+
+        /* Handle exportReferencesGraph(), if set. */
+        for (auto & [fileName, storePaths] : drvOptions.getParsedExportReferencesGraph(store)) {
+            /* Write closure info to <fileName>. */
+            res.extraFiles.insert_or_assign(
+                fileName, store.makeValidityRegistration(store.exportReferences(storePaths, inputPaths), false, false));
+        }
+    }
+
+    return res;
+}
+
+} // namespace nix
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 128d360c9..b9046744a 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -11,7 +11,7 @@
 #include "nix/util/compression.hh"
 #include "nix/store/common-protocol.hh"
 #include "nix/store/common-protocol-impl.hh" // Don't remove is actually needed
-#include "nix/store/local-store.hh" // TODO remove, along with remaining downcasts
+#include "nix/store/globals.hh"
 
 #include <fstream>
 #include <sys/types.h>
@@ -24,26 +24,34 @@
 
 namespace nix {
 
-DerivationGoal::DerivationGoal(const StorePath & drvPath, const Derivation & drv,
-    const OutputName & wantedOutput, Worker & worker, BuildMode buildMode)
+DerivationGoal::DerivationGoal(
+    const StorePath & drvPath,
+    const Derivation & drv,
+    const OutputName & wantedOutput,
+    Worker & worker,
+    BuildMode buildMode)
     : Goal(worker, haveDerivation())
     , drvPath(drvPath)
     , wantedOutput(wantedOutput)
+    , outputHash{[&] {
+        auto outputHashes = staticOutputHashes(worker.evalStore, drv);
+        if (auto * mOutputHash = get(outputHashes, wantedOutput))
+            return *mOutputHash;
+        throw Error("derivation '%s' does not have output '%s'", worker.store.printStorePath(drvPath), wantedOutput);
+    }()}
     , buildMode(buildMode)
 {
     this->drv = std::make_unique<Derivation>(drv);
 
-    name = fmt(
-        "building of '%s' from in-memory derivation",
-        DerivedPath::Built { makeConstantStorePathRef(drvPath), drv.outputNames() }.to_string(worker.store));
+    name =
+        fmt("building of '%s' from in-memory derivation",
+            DerivedPath::Built{makeConstantStorePathRef(drvPath), drv.outputNames()}.to_string(worker.store));
     trace("created");
 
     mcExpectedBuilds = std::make_unique<MaintainCount<uint64_t>>(worker.expectedBuilds);
     worker.updateProgress();
-
 }
 
-
 std::string DerivationGoal::key()
 {
     /* Ensure that derivations get built in order of their name,
@@ -56,15 +64,13 @@ std::string DerivationGoal::key()
     }.to_string(worker.store);
 }
 
-
 Goal::Co DerivationGoal::haveDerivation()
 {
     trace("have derivation");
 
     auto drvOptions = [&]() -> DerivationOptions {
-        auto parsedOpt = StructuredAttrs::tryParse(drv->env);
         try {
-            return DerivationOptions::fromStructuredAttrs(drv->env, parsedOpt ? &*parsedOpt : nullptr);
+            return DerivationOptions::fromStructuredAttrs(drv->env, drv->structuredAttrs);
         } catch (Error & e) {
             e.addTrace({}, "while parsing derivation '%s'", worker.store.printStorePath(drvPath));
             throw;
@@ -74,36 +80,99 @@ Goal::Co DerivationGoal::haveDerivation()
     if (!drv->type().hasKnownOutputPaths())
         experimentalFeatureSettings.require(Xp::CaDerivations);
 
-    /* At least one of the output paths could not be
-       produced using a substitute.  So we have to build instead. */
-    auto gaveUpOnSubstitution = [&]() -> Goal::Co
+    for (auto & i : drv->outputsAndOptPaths(worker.store))
+        if (i.second.second)
+            worker.store.addTempRoot(*i.second.second);
+
+    /* We don't yet have any safe way to cache an impure derivation at
+       this step. */
+    if (drv->type().isImpure()) {
+        experimentalFeatureSettings.require(Xp::ImpureDerivations);
+    } else {
+        /* Check what outputs paths are not already valid. */
+        auto checkResult = checkPathValidity();
+
+        /* If they are all valid, then we're done. */
+        if (checkResult && checkResult->second == PathStatus::Valid && buildMode == bmNormal) {
+            co_return doneSuccess(BuildResult::AlreadyValid, checkResult->first);
+        }
+
+        Goals waitees;
+
+        /* We are first going to try to create the invalid output paths
+           through substitutes.  If that doesn't work, we'll build
+           them. */
+        if (settings.useSubstitutes && drvOptions.substitutesAllowed()) {
+            if (!checkResult)
+                waitees.insert(upcast_goal(worker.makeDrvOutputSubstitutionGoal(
+                    DrvOutput{outputHash, wantedOutput}, buildMode == bmRepair ? Repair : NoRepair)));
+            else {
+                auto * cap = getDerivationCA(*drv);
+                waitees.insert(upcast_goal(worker.makePathSubstitutionGoal(
+                    checkResult->first.outPath,
+                    buildMode == bmRepair ? Repair : NoRepair,
+                    cap ? std::optional{*cap} : std::nullopt)));
+            }
+        }
+
+        co_await await(std::move(waitees));
+
+        trace("all outputs substituted (maybe)");
+
+        assert(!drv->type().isImpure());
+
+        if (nrFailed > 0 && nrFailed > nrNoSubstituters && !settings.tryFallback) {
+            co_return doneFailure(BuildError(
+                BuildResult::TransientFailure,
+                "some substitutes for the outputs of derivation '%s' failed (usually happens due to networking issues); try '--fallback' to build derivation from source ",
+                worker.store.printStorePath(drvPath)));
+        }
+
+        nrFailed = nrNoSubstituters = 0;
+
+        checkResult = checkPathValidity();
+
+        bool allValid = checkResult && checkResult->second == PathStatus::Valid;
+
+        if (buildMode == bmNormal && allValid) {
+            co_return doneSuccess(BuildResult::Substituted, checkResult->first);
+        }
+        if (buildMode == bmRepair && allValid) {
+            co_return repairClosure();
+        }
+        if (buildMode == bmCheck && !allValid)
+            throw Error(
+                "some outputs of '%s' are not valid, so checking is not possible",
+                worker.store.printStorePath(drvPath));
+    }
+
+    /* Give up on substitution for the output we want, actually build this derivation */
+
+    auto g = worker.makeDerivationBuildingGoal(drvPath, *drv, buildMode);
+
+    /* We will finish with it ourselves, as if we were the derivational goal. */
+    g->preserveException = true;
+
     {
-        auto g = worker.makeDerivationBuildingGoal(drvPath, *drv, buildMode);
+        Goals waitees;
+        waitees.insert(g);
+        co_await await(std::move(waitees));
+    }
 
-        /* We will finish with it ourselves, as if we were the derivational goal. */
-        g->preserveException = true;
+    trace("outer build done");
 
-        // TODO move into constructor
-        g->initialOutputs = initialOutputs;
+    buildResult = g->buildResult;
 
-        {
-            Goals waitees;
-            waitees.insert(g);
-            co_await await(std::move(waitees));
-        }
-
-        trace("outer build done");
-
-        buildResult = g->buildResult;
-
-        if (buildMode == bmCheck) {
-            /* In checking mode, the builder will not register any outputs.
-               So we want to make sure the ones that we wanted to check are
-               properly there. */
-            buildResult.builtOutputs = assertPathValidity();
-        }
-
-        for (auto it = buildResult.builtOutputs.begin(); it != buildResult.builtOutputs.end(); ) {
+    if (buildMode == bmCheck) {
+        /* In checking mode, the builder will not register any outputs.
+           So we want to make sure the ones that we wanted to check are
+           properly there. */
+        buildResult.builtOutputs = {{wantedOutput, assertPathValidity()}};
+    } else {
+        /* Otherwise the builder will give us info for out output, but
+           also for other outputs. Filter down to just our output so as
+           not to leak info on unrelated things. */
+        for (auto it = buildResult.builtOutputs.begin(); it != buildResult.builtOutputs.end();) {
             if (it->first != wantedOutput) {
                 it = buildResult.builtOutputs.erase(it);
             } else {
@@ -113,128 +182,23 @@ Goal::Co DerivationGoal::haveDerivation()
 
         if (buildResult.success())
             assert(buildResult.builtOutputs.count(wantedOutput) > 0);
-
-        co_return amDone(g->exitCode, g->ex);
-    };
-
-    for (auto & i : drv->outputsAndOptPaths(worker.store))
-        if (i.second.second)
-            worker.store.addTempRoot(*i.second.second);
-
-    {
-        bool impure = drv->type().isImpure();
-
-        if (impure) experimentalFeatureSettings.require(Xp::ImpureDerivations);
-
-        auto outputHashes = staticOutputHashes(worker.evalStore, *drv);
-        for (auto & [outputName, outputHash] : outputHashes) {
-            InitialOutput v{
-                .wanted = true, // Will be refined later
-                .outputHash = outputHash
-            };
-
-            /* TODO we might want to also allow randomizing the paths
-               for regular CA derivations, e.g. for sake of checking
-               determinism. */
-            if (impure) {
-                v.known = InitialOutputStatus {
-                    .path = StorePath::random(outputPathName(drv->name, outputName)),
-                    .status = PathStatus::Absent,
-                };
-            }
-
-            initialOutputs.insert({
-                outputName,
-                std::move(v),
-            });
-        }
-
-        if (impure) {
-            /* We don't yet have any safe way to cache an impure derivation at
-               this step. */
-            co_return gaveUpOnSubstitution();
-        }
     }
 
-    {
-        /* Check what outputs paths are not already valid. */
-        auto [allValid, validOutputs] = checkPathValidity();
-
-        /* If they are all valid, then we're done. */
-        if (allValid && buildMode == bmNormal) {
-            co_return done(BuildResult::AlreadyValid, std::move(validOutputs));
-        }
-    }
-
-    Goals waitees;
-
-    /* We are first going to try to create the invalid output paths
-       through substitutes.  If that doesn't work, we'll build
-       them. */
-    if (settings.useSubstitutes && drvOptions.substitutesAllowed())
-        for (auto & [outputName, status] : initialOutputs) {
-            if (!status.wanted) continue;
-            if (!status.known)
-                waitees.insert(
-                    upcast_goal(
-                        worker.makeDrvOutputSubstitutionGoal(
-                            DrvOutput{status.outputHash, outputName},
-                            buildMode == bmRepair ? Repair : NoRepair
-                        )
-                    )
-                );
-            else {
-                auto * cap = getDerivationCA(*drv);
-                waitees.insert(upcast_goal(worker.makePathSubstitutionGoal(
-                    status.known->path,
-                    buildMode == bmRepair ? Repair : NoRepair,
-                    cap ? std::optional { *cap } : std::nullopt)));
-            }
-        }
-
-    co_await await(std::move(waitees));
-
-    trace("all outputs substituted (maybe)");
-
-    assert(!drv->type().isImpure());
-
-    if (nrFailed > 0 && nrFailed > nrNoSubstituters && !settings.tryFallback) {
-        co_return done(BuildResult::TransientFailure, {},
-            Error("some substitutes for the outputs of derivation '%s' failed (usually happens due to networking issues); try '--fallback' to build derivation from source ",
-                worker.store.printStorePath(drvPath)));
-    }
-
-    nrFailed = nrNoSubstituters = 0;
-
-    auto [allValid, validOutputs] = checkPathValidity();
-
-    if (buildMode == bmNormal && allValid) {
-        co_return done(BuildResult::Substituted, std::move(validOutputs));
-    }
-    if (buildMode == bmRepair && allValid) {
-        co_return repairClosure();
-    }
-    if (buildMode == bmCheck && !allValid)
-        throw Error("some outputs of '%s' are not valid, so checking is not possible",
-            worker.store.printStorePath(drvPath));
-
-    /* Nothing to wait for; tail call */
-    co_return gaveUpOnSubstitution();
+    co_return amDone(g->exitCode, g->ex);
 }
 
-
 /**
  * Used for `inputGoals` local variable below
  */
 struct value_comparison
 {
-    template <typename T>
-    bool operator()(const ref<T> & lhs, const ref<T> & rhs) const {
+    template<typename T>
+    bool operator()(const ref<T> & lhs, const ref<T> & rhs) const
+    {
         return *lhs < *rhs;
     }
 };
 
-
 Goal::Co DerivationGoal::repairClosure()
 {
     assert(!drv->type().isImpure());
@@ -245,9 +209,19 @@ Goal::Co DerivationGoal::repairClosure()
        that produced those outputs. */
 
     /* Get the output closure. */
-    auto outputs = queryDerivationOutputMap();
+    auto outputs = [&] {
+        for (auto * drvStore : {&worker.evalStore, &worker.store})
+            if (drvStore->isValidPath(drvPath))
+                return worker.store.queryDerivationOutputMap(drvPath, drvStore);
+
+        OutputPathMap res;
+        for (auto & [name, output] : drv->outputsAndOptPaths(worker.store))
+            res.insert_or_assign(name, *output.second);
+        return res;
+    }();
+
     StorePathSet outputClosure;
-    if (auto mPath = get(outputs, wantedOutput)) {
+    if (auto * mPath = get(outputs, wantedOutput)) {
         worker.store.computeFSClosure(*mPath, outputClosure);
     }
 
@@ -278,18 +252,20 @@ Goal::Co DerivationGoal::repairClosure()
 
     /* Check each path (slow!). */
     for (auto & i : outputClosure) {
-        if (worker.pathContentsGood(i)) continue;
+        if (worker.pathContentsGood(i))
+            continue;
         printError(
             "found corrupted or missing path '%s' in the output closure of '%s'",
-            worker.store.printStorePath(i), worker.store.printStorePath(drvPath));
+            worker.store.printStorePath(i),
+            worker.store.printStorePath(drvPath));
         auto drvPath2 = outputsToDrv.find(i);
         if (drvPath2 == outputsToDrv.end())
             waitees.insert(upcast_goal(worker.makePathSubstitutionGoal(i, Repair)));
         else
             waitees.insert(worker.makeGoal(
-                DerivedPath::Built {
+                DerivedPath::Built{
                     .drvPath = makeConstantStorePathRef(drvPath2->second),
-                    .outputs = OutputsSpec::All { },
+                    .outputs = OutputsSpec::All{},
                 },
                 bmRepair));
     }
@@ -299,135 +275,89 @@ Goal::Co DerivationGoal::repairClosure()
     if (!waitees.empty()) {
         trace("closure repaired");
         if (nrFailed > 0)
-            throw Error("some paths in the output closure of derivation '%s' could not be repaired",
+            throw Error(
+                "some paths in the output closure of derivation '%s' could not be repaired",
                 worker.store.printStorePath(drvPath));
     }
-    co_return done(BuildResult::AlreadyValid, assertPathValidity());
+    co_return doneSuccess(BuildResult::AlreadyValid, assertPathValidity());
 }
 
-
-std::map<std::string, std::optional<StorePath>> DerivationGoal::queryPartialDerivationOutputMap()
+std::optional<std::pair<Realisation, PathStatus>> DerivationGoal::checkPathValidity()
 {
-    assert(!drv->type().isImpure());
+    if (drv->type().isImpure())
+        return std::nullopt;
 
-    for (auto * drvStore : { &worker.evalStore, &worker.store })
-        if (drvStore->isValidPath(drvPath))
-            return worker.store.queryPartialDerivationOutputMap(drvPath, drvStore);
+    auto drvOutput = DrvOutput{outputHash, wantedOutput};
 
-    /* In-memory derivation will naturally fall back on this case, where
-       we do best-effort with static information. */
-    std::map<std::string, std::optional<StorePath>> res;
-    for (auto & [name, output] : drv->outputs)
-        res.insert_or_assign(name, output.path(worker.store, drv->name, name));
-    return res;
-}
+    std::optional<Realisation> mRealisation;
 
-OutputPathMap DerivationGoal::queryDerivationOutputMap()
-{
-    assert(!drv->type().isImpure());
-
-    for (auto * drvStore : { &worker.evalStore, &worker.store })
-        if (drvStore->isValidPath(drvPath))
-            return worker.store.queryDerivationOutputMap(drvPath, drvStore);
-
-    // See comment in `DerivationGoal::queryPartialDerivationOutputMap`.
-    OutputPathMap res;
-    for (auto & [name, output] : drv->outputsAndOptPaths(worker.store))
-        res.insert_or_assign(name, *output.second);
-    return res;
-}
-
-
-std::pair<bool, SingleDrvOutputs> DerivationGoal::checkPathValidity()
-{
-    if (drv->type().isImpure()) return { false, {} };
-
-    bool checkHash = buildMode == bmRepair;
-    StringSet wantedOutputsLeft{wantedOutput};
-    SingleDrvOutputs validOutputs;
-
-    for (auto & i : queryPartialDerivationOutputMap()) {
-        auto initialOutput = get(initialOutputs, i.first);
-        if (!initialOutput)
-            // this is an invalid output, gets caught with (!wantedOutputsLeft.empty())
-            continue;
-        auto & info = *initialOutput;
-        info.wanted = wantedOutput == i.first;
-        if (info.wanted)
-            wantedOutputsLeft.erase(i.first);
-        if (i.second) {
-            auto outputPath = *i.second;
-            info.known = {
-                .path = outputPath,
-                .status = !worker.store.isValidPath(outputPath)
-                    ? PathStatus::Absent
-                    : !checkHash || worker.pathContentsGood(outputPath)
-                    ? PathStatus::Valid
-                    : PathStatus::Corrupt,
-            };
+    if (auto * mOutput = get(drv->outputs, wantedOutput)) {
+        if (auto mPath = mOutput->path(worker.store, drv->name, wantedOutput)) {
+            mRealisation = Realisation{drvOutput, std::move(*mPath)};
         }
-        auto drvOutput = DrvOutput{info.outputHash, i.first};
-        if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
-            if (auto real = worker.store.queryRealisation(drvOutput)) {
-                info.known = {
-                    .path = real->outPath,
-                    .status = PathStatus::Valid,
-                };
-            } else if (info.known && info.known->isValid()) {
-                // We know the output because it's a static output of the
-                // derivation, and the output path is valid, but we don't have
-                // its realisation stored (probably because it has been built
-                // without the `ca-derivations` experimental flag).
-                worker.store.registerDrvOutput(
-                    Realisation {
-                        drvOutput,
-                        info.known->path,
-                    }
-                );
+    } else {
+        throw Error(
+            "derivation '%s' does not have wanted outputs '%s'", worker.store.printStorePath(drvPath), wantedOutput);
+    }
+
+    if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
+        for (auto * drvStore : {&worker.evalStore, &worker.store}) {
+            if (auto real = drvStore->queryRealisation(drvOutput)) {
+                mRealisation = *real;
+                break;
             }
         }
-        if (info.known && info.known->isValid())
-            validOutputs.emplace(i.first, Realisation { drvOutput, info.known->path });
     }
 
-    // If we requested all the outputs, we are always fine.
-    // If we requested specific elements, the loop above removes all the valid
-    // ones, so any that are left must be invalid.
-    if (!wantedOutputsLeft.empty())
-        throw Error("derivation '%s' does not have wanted outputs %s",
-            worker.store.printStorePath(drvPath),
-            concatStringsSep(", ", quoteStrings(wantedOutputsLeft)));
+    if (mRealisation) {
+        auto & outputPath = mRealisation->outPath;
+        bool checkHash = buildMode == bmRepair;
+        PathStatus status = !worker.store.isValidPath(outputPath)               ? PathStatus::Absent
+                            : !checkHash || worker.pathContentsGood(outputPath) ? PathStatus::Valid
+                                                                                : PathStatus::Corrupt;
 
-    bool allValid = true;
-    for (auto & [_, status] : initialOutputs) {
-        if (!status.wanted) continue;
-        if (!status.known || !status.known->isValid()) {
-            allValid = false;
-            break;
+        if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations) && status == PathStatus::Valid) {
+            // We know the output because it's a static output of the
+            // derivation, and the output path is valid, but we don't have
+            // its realisation stored (probably because it has been built
+            // without the `ca-derivations` experimental flag).
+            worker.store.registerDrvOutput(*mRealisation);
         }
-    }
 
-    return { allValid, validOutputs };
+        return {{*mRealisation, status}};
+    } else
+        return std::nullopt;
 }
 
-
-SingleDrvOutputs DerivationGoal::assertPathValidity()
+Realisation DerivationGoal::assertPathValidity()
 {
-    auto [allValid, validOutputs] = checkPathValidity();
-    if (!allValid)
+    auto checkResult = checkPathValidity();
+    if (!(checkResult && checkResult->second == PathStatus::Valid))
         throw Error("some outputs are unexpectedly invalid");
-    return validOutputs;
+    return checkResult->first;
 }
 
-
-Goal::Done DerivationGoal::done(
-    BuildResult::Status status,
-    SingleDrvOutputs builtOutputs,
-    std::optional<Error> ex)
+Goal::Done DerivationGoal::doneSuccess(BuildResult::Status status, Realisation builtOutput)
 {
     buildResult.status = status;
-    if (ex)
-        buildResult.errorMsg = fmt("%s", Uncolored(ex->info().msg));
+
+    assert(buildResult.success());
+
+    mcExpectedBuilds.reset();
+
+    buildResult.builtOutputs = {{wantedOutput, std::move(builtOutput)}};
+    if (status == BuildResult::Built)
+        worker.doneBuilds++;
+
+    worker.updateProgress();
+
+    return amDone(ecSuccess, std::nullopt);
+}
+
+Goal::Done DerivationGoal::doneFailure(BuildError ex)
+{
+    buildResult.status = ex.status;
+    buildResult.errorMsg = fmt("%s", Uncolored(ex.info().msg));
     if (buildResult.status == BuildResult::TimedOut)
         worker.timedOut = true;
     if (buildResult.status == BuildResult::PermanentFailure)
@@ -435,27 +365,12 @@ Goal::Done DerivationGoal::done(
 
     mcExpectedBuilds.reset();
 
-    if (buildResult.success()) {
-        auto wantedBuiltOutputs = filterDrvOutputs(OutputsSpec::Names{wantedOutput}, std::move(builtOutputs));
-        assert(!wantedBuiltOutputs.empty());
-        buildResult.builtOutputs = std::move(wantedBuiltOutputs);
-        if (status == BuildResult::Built)
-            worker.doneBuilds++;
-    } else {
-        if (status != BuildResult::DependencyFailed)
-            worker.failedBuilds++;
-    }
+    if (ex.status != BuildResult::DependencyFailed)
+        worker.failedBuilds++;
 
     worker.updateProgress();
 
-    auto traceBuiltOutputsFile = getEnv("_NIX_TRACE_BUILT_OUTPUTS").value_or("");
-    if (traceBuiltOutputsFile != "") {
-        std::fstream fs;
-        fs.open(traceBuiltOutputsFile, std::fstream::out);
-        fs << worker.store.printStorePath(drvPath) << "\t" << buildResult.toString() << std::endl;
-    }
-
-    return amDone(buildResult.success() ? ecSuccess : ecFailed, std::move(ex));
+    return amDone(ecFailed, {std::move(ex)});
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/build/derivation-trampoline-goal.cc b/src/libstore/build/derivation-trampoline-goal.cc
index e8ca47dfe..5038a4ea0 100644
--- a/src/libstore/build/derivation-trampoline-goal.cc
+++ b/src/libstore/build/derivation-trampoline-goal.cc
@@ -172,4 +172,4 @@ Goal::Co DerivationTrampolineGoal::haveDerivation(StorePath drvPath, Derivation
     co_return amDone(g->exitCode, g->ex);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/build/drv-output-substitution-goal.cc b/src/libstore/build/drv-output-substitution-goal.cc
index e87a796f6..b6ace4784 100644
--- a/src/libstore/build/drv-output-substitution-goal.cc
+++ b/src/libstore/build/drv-output-substitution-goal.cc
@@ -4,14 +4,12 @@
 #include "nix/store/build/substitution-goal.hh"
 #include "nix/util/callback.hh"
 #include "nix/store/store-open.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
 DrvOutputSubstitutionGoal::DrvOutputSubstitutionGoal(
-    const DrvOutput & id,
-    Worker & worker,
-    RepairFlag repair,
-    std::optional<ContentAddress> ca)
+    const DrvOutput & id, Worker & worker, RepairFlag repair, std::optional<ContentAddress> ca)
     : Goal(worker, init())
     , id(id)
 {
@@ -19,7 +17,6 @@ DrvOutputSubstitutionGoal::DrvOutputSubstitutionGoal(
     trace("created");
 }
 
-
 Goal::Co DrvOutputSubstitutionGoal::init()
 {
     trace("init");
@@ -40,32 +37,35 @@ Goal::Co DrvOutputSubstitutionGoal::init()
            some other error occurs), so it must not touch `this`. So put
            the shared state in a separate refcounted object. */
         auto outPipe = std::make_shared<MuxablePipe>();
-    #ifndef _WIN32
+#ifndef _WIN32
         outPipe->create();
-    #else
+#else
         outPipe->createAsyncPipe(worker.ioport.get());
-    #endif
+#endif
 
         auto promise = std::make_shared<std::promise<std::shared_ptr<const Realisation>>>();
 
         sub->queryRealisation(
-            id,
-            { [outPipe(outPipe), promise(promise)](std::future<std::shared_ptr<const Realisation>> res) {
+            id, {[outPipe(outPipe), promise(promise)](std::future<std::shared_ptr<const Realisation>> res) {
                 try {
                     Finally updateStats([&]() { outPipe->writeSide.close(); });
                     promise->set_value(res.get());
                 } catch (...) {
                     promise->set_exception(std::current_exception());
                 }
-            } });
+            }});
 
-        worker.childStarted(shared_from_this(), {
-    #ifndef _WIN32
-            outPipe->readSide.get()
-    #else
-            &*outPipe
-    #endif
-        }, true, false);
+        worker.childStarted(
+            shared_from_this(),
+            {
+#ifndef _WIN32
+                outPipe->readSide.get()
+#else
+                &*outPipe
+#endif
+            },
+            true,
+            false);
 
         co_await Suspend{};
 
@@ -84,7 +84,8 @@ Goal::Co DrvOutputSubstitutionGoal::init()
             substituterFailed = true;
         }
 
-        if (!outputInfo) continue;
+        if (!outputInfo)
+            continue;
 
         bool failed = false;
 
@@ -98,11 +99,10 @@ Goal::Co DrvOutputSubstitutionGoal::init()
                         "substituter '%s' has an incompatible realisation for '%s', ignoring.\n"
                         "Local:  %s\n"
                         "Remote: %s",
-                        sub->getUri(),
+                        sub->config.getHumanReadableURI(),
                         depId.to_string(),
                         worker.store.printStorePath(localOutputInfo->outPath),
-                        worker.store.printStorePath(depPath)
-                    );
+                        worker.store.printStorePath(depPath));
                     failed = true;
                     break;
                 }
@@ -110,7 +110,8 @@ Goal::Co DrvOutputSubstitutionGoal::init()
             }
         }
 
-        if (failed) continue;
+        if (failed)
+            continue;
 
         co_return realisationFetched(std::move(waitees), outputInfo, sub);
     }
@@ -130,7 +131,9 @@ Goal::Co DrvOutputSubstitutionGoal::init()
     co_return amDone(substituterFailed ? ecFailed : ecNoSubstituters);
 }
 
-Goal::Co DrvOutputSubstitutionGoal::realisationFetched(Goals waitees, std::shared_ptr<const Realisation> outputInfo, nix::ref<nix::Store> sub) {
+Goal::Co DrvOutputSubstitutionGoal::realisationFetched(
+    Goals waitees, std::shared_ptr<const Realisation> outputInfo, nix::ref<nix::Store> sub)
+{
     waitees.insert(worker.makePathSubstitutionGoal(outputInfo->outPath));
 
     co_await await(std::move(waitees));
@@ -160,5 +163,4 @@ void DrvOutputSubstitutionGoal::handleEOF(Descriptor fd)
     worker.wakeUp(shared_from_this());
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/build/entry-points.cc b/src/libstore/build/entry-points.cc
index 6c842554c..1dd540265 100644
--- a/src/libstore/build/entry-points.cc
+++ b/src/libstore/build/entry-points.cc
@@ -38,15 +38,14 @@ void Store::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMod
         ex->withExitStatus(worker.failingExitStatus());
         throw std::move(*ex);
     } else if (!failed.empty()) {
-        if (ex) logError(ex->info());
+        if (ex)
+            logError(ex->info());
         throw Error(worker.failingExitStatus(), "build of %s failed", concatStringsSep(", ", quoteStrings(failed)));
     }
 }
 
 std::vector<KeyedBuildResult> Store::buildPathsWithResults(
-    const std::vector<DerivedPath> & reqs,
-    BuildMode buildMode,
-    std::shared_ptr<Store> evalStore)
+    const std::vector<DerivedPath> & reqs, BuildMode buildMode, std::shared_ptr<Store> evalStore)
 {
     Worker worker(*this, evalStore ? *evalStore : *this);
 
@@ -65,36 +64,36 @@ std::vector<KeyedBuildResult> Store::buildPathsWithResults(
     results.reserve(state.size());
 
     for (auto & [req, goalPtr] : state)
-        results.emplace_back(KeyedBuildResult {
-            goalPtr->buildResult,
-            /* .path = */ req,
-        });
+        results.emplace_back(
+            KeyedBuildResult{
+                goalPtr->buildResult,
+                /* .path = */ req,
+            });
 
     return results;
 }
 
-BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
-    BuildMode buildMode)
+BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
 {
     Worker worker(*this, *this);
-    auto goal = worker.makeDerivationTrampolineGoal(drvPath, OutputsSpec::All {}, drv, buildMode);
+    auto goal = worker.makeDerivationTrampolineGoal(drvPath, OutputsSpec::All{}, drv, buildMode);
 
     try {
         worker.run(Goals{goal});
         return goal->buildResult;
     } catch (Error & e) {
-        return BuildResult {
+        return BuildResult{
             .status = BuildResult::MiscFailure,
             .errorMsg = e.msg(),
         };
     };
 }
 
-
 void Store::ensurePath(const StorePath & path)
 {
     /* If the path is already valid, we're done. */
-    if (isValidPath(path)) return;
+    if (isValidPath(path))
+        return;
 
     Worker worker(*this, *this);
     GoalPtr goal = worker.makePathSubstitutionGoal(path);
@@ -107,11 +106,11 @@ void Store::ensurePath(const StorePath & path)
             goal->ex->withExitStatus(worker.failingExitStatus());
             throw std::move(*goal->ex);
         } else
-            throw Error(worker.failingExitStatus(), "path '%s' does not exist and cannot be created", printStorePath(path));
+            throw Error(
+                worker.failingExitStatus(), "path '%s' does not exist and cannot be created", printStorePath(path));
     }
 }
 
-
 void Store::repairPath(const StorePath & path)
 {
     Worker worker(*this, *this);
@@ -126,15 +125,17 @@ void Store::repairPath(const StorePath & path)
         auto info = queryPathInfo(path);
         if (info->deriver && isValidPath(*info->deriver)) {
             goals.clear();
-            goals.insert(worker.makeGoal(DerivedPath::Built {
-                .drvPath = makeConstantStorePathRef(*info->deriver),
-                // FIXME: Should just build the specific output we need.
-                .outputs = OutputsSpec::All { },
-            }, bmRepair));
+            goals.insert(worker.makeGoal(
+                DerivedPath::Built{
+                    .drvPath = makeConstantStorePathRef(*info->deriver),
+                    // FIXME: Should just build the specific output we need.
+                    .outputs = OutputsSpec::All{},
+                },
+                bmRepair));
             worker.run(goals);
         } else
             throw Error(worker.failingExitStatus(), "cannot repair path '%s'", printStorePath(path));
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/build/goal.cc b/src/libstore/build/goal.cc
index 88b0c28c0..6266329e7 100644
--- a/src/libstore/build/goal.cc
+++ b/src/libstore/build/goal.cc
@@ -1,5 +1,6 @@
 #include "nix/store/build/goal.hh"
 #include "nix/store/build/worker.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
@@ -8,28 +9,35 @@ using promise_type = nix::Goal::promise_type;
 using handle_type = nix::Goal::handle_type;
 using Suspend = nix::Goal::Suspend;
 
-Co::Co(Co&& rhs) {
+Co::Co(Co && rhs)
+{
     this->handle = rhs.handle;
     rhs.handle = nullptr;
 }
-void Co::operator=(Co&& rhs) {
+
+void Co::operator=(Co && rhs)
+{
     this->handle = rhs.handle;
     rhs.handle = nullptr;
 }
-Co::~Co() {
+
+Co::~Co()
+{
     if (handle) {
         handle.promise().alive = false;
         handle.destroy();
     }
 }
 
-Co promise_type::get_return_object() {
+Co promise_type::get_return_object()
+{
     auto handle = handle_type::from_promise(*this);
     return Co{handle};
 };
 
-std::coroutine_handle<> promise_type::final_awaiter::await_suspend(handle_type h) noexcept {
-    auto& p = h.promise();
+std::coroutine_handle<> promise_type::final_awaiter::await_suspend(handle_type h) noexcept
+{
+    auto & p = h.promise();
     auto goal = p.goal;
     assert(goal);
     goal->trace("in final_awaiter");
@@ -39,9 +47,9 @@ std::coroutine_handle<> promise_type::final_awaiter::await_suspend(handle_type h
         // We still have a continuation, i.e. work to do.
         // We assert that the goal is still busy.
         assert(goal->exitCode == ecBusy);
-        assert(goal->top_co); // Goal must have an active coroutine.
+        assert(goal->top_co);              // Goal must have an active coroutine.
         assert(goal->top_co->handle == h); // The active coroutine must be us.
-        assert(p.alive); // We must not have been destructed.
+        assert(p.alive);                   // We must not have been destructed.
 
         // we move continuation to the top,
         // note: previous top_co is actually h, so by moving into it,
@@ -68,7 +76,8 @@ std::coroutine_handle<> promise_type::final_awaiter::await_suspend(handle_type h
     }
 }
 
-void promise_type::return_value(Co&& next) {
+void promise_type::return_value(Co && next)
+{
     goal->trace("return_value(Co&&)");
     // Save old continuation.
     auto old_continuation = std::move(continuation);
@@ -82,20 +91,22 @@ void promise_type::return_value(Co&& next) {
     continuation->handle.promise().continuation = std::move(old_continuation);
 }
 
-std::coroutine_handle<> nix::Goal::Co::await_suspend(handle_type caller) {
+std::coroutine_handle<> nix::Goal::Co::await_suspend(handle_type caller)
+{
     assert(handle); // we must be a valid coroutine
-    auto& p = handle.promise();
+    auto & p = handle.promise();
     assert(!p.continuation); // we must have no continuation
-    assert(!p.goal); // we must not have a goal yet
+    assert(!p.goal);         // we must not have a goal yet
     auto goal = caller.promise().goal;
     assert(goal);
     p.goal = goal;
     p.continuation = std::move(goal->top_co); // we set our continuation to be top_co (i.e. caller)
-    goal->top_co = std::move(*this); // we set top_co to ourselves, don't use this anymore after this!
-    return p.goal->top_co->handle; // we execute ourselves
+    goal->top_co = std::move(*this);          // we set top_co to ourselves, don't use this anymore after this!
+    return p.goal->top_co->handle;            // we execute ourselves
 }
 
-bool CompareGoalPtrs::operator() (const GoalPtr & a, const GoalPtr & b) const {
+bool CompareGoalPtrs::operator()(const GoalPtr & a, const GoalPtr & b) const
+{
     std::string s1 = a->key();
     std::string s2 = b->key();
     return s1 < s2;
@@ -146,9 +157,11 @@ Goal::Done Goal::amDone(ExitCode result, std::optional<Error> ex)
 
             goal->trace(fmt("waitee '%s' done; %d left", name, goal->waitees.size()));
 
-            if (result == ecFailed || result == ecNoSubstituters) ++goal->nrFailed;
+            if (result == ecFailed || result == ecNoSubstituters)
+                ++goal->nrFailed;
 
-            if (result == ecNoSubstituters) ++goal->nrNoSubstituters;
+            if (result == ecNoSubstituters)
+                ++goal->nrNoSubstituters;
 
             if (goal->waitees.empty()) {
                 worker.wakeUp(goal);
@@ -177,7 +190,6 @@ Goal::Done Goal::amDone(ExitCode result, std::optional<Error> ex)
     return Done{};
 }
 
-
 void Goal::trace(std::string_view s)
 {
     debug("%1%: %2%", name, s);
@@ -194,22 +206,25 @@ void Goal::work()
     assert(top_co || exitCode != ecBusy);
 }
 
-Goal::Co Goal::yield() {
+Goal::Co Goal::yield()
+{
     worker.wakeUp(shared_from_this());
     co_await Suspend{};
     co_return Return{};
 }
 
-Goal::Co Goal::waitForAWhile() {
+Goal::Co Goal::waitForAWhile()
+{
     worker.waitForAWhile(shared_from_this());
     co_await Suspend{};
     co_return Return{};
 }
 
-Goal::Co Goal::waitForBuildSlot() {
+Goal::Co Goal::waitForBuildSlot()
+{
     worker.waitForBuildSlot(shared_from_this());
     co_await Suspend{};
     co_return Return{};
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
index 9ffc8219d..d219834f2 100644
--- a/src/libstore/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -4,11 +4,14 @@
 #include "nix/store/nar-info.hh"
 #include "nix/util/finally.hh"
 #include "nix/util/signals.hh"
+#include "nix/store/globals.hh"
+
 #include <coroutine>
 
 namespace nix {
 
-PathSubstitutionGoal::PathSubstitutionGoal(const StorePath & storePath, Worker & worker, RepairFlag repair, std::optional<ContentAddress> ca)
+PathSubstitutionGoal::PathSubstitutionGoal(
+    const StorePath & storePath, Worker & worker, RepairFlag repair, std::optional<ContentAddress> ca)
     : Goal(worker, init())
     , storePath(storePath)
     , repair(repair)
@@ -19,17 +22,12 @@ PathSubstitutionGoal::PathSubstitutionGoal(const StorePath & storePath, Worker &
     maintainExpectedSubstitutions = std::make_unique<MaintainCount<uint64_t>>(worker.expectedSubstitutions);
 }
 
-
 PathSubstitutionGoal::~PathSubstitutionGoal()
 {
     cleanup();
 }
 
-
-Goal::Done PathSubstitutionGoal::done(
-    ExitCode result,
-    BuildResult::Status status,
-    std::optional<std::string> errorMsg)
+Goal::Done PathSubstitutionGoal::done(ExitCode result, BuildResult::Status status, std::optional<std::string> errorMsg)
 {
     buildResult.status = status;
     if (errorMsg) {
@@ -39,7 +37,6 @@ Goal::Done PathSubstitutionGoal::done(
     return amDone(result);
 }
 
-
 Goal::Co PathSubstitutionGoal::init()
 {
     trace("init");
@@ -52,14 +49,20 @@ Goal::Co PathSubstitutionGoal::init()
     }
 
     if (settings.readOnlyMode)
-        throw Error("cannot substitute path '%s' - no write access to the Nix store", worker.store.printStorePath(storePath));
+        throw Error(
+            "cannot substitute path '%s' - no write access to the Nix store", worker.store.printStorePath(storePath));
 
     auto subs = settings.useSubstitutes ? getDefaultSubstituters() : std::list<ref<Store>>();
 
     bool substituterFailed = false;
+    std::optional<Error> lastStoresException = std::nullopt;
 
     for (const auto & sub : subs) {
         trace("trying next substituter");
+        if (lastStoresException.has_value()) {
+            logError(lastStoresException->info());
+            lastStoresException.reset();
+        }
 
         cleanup();
 
@@ -72,8 +75,7 @@ Goal::Co PathSubstitutionGoal::init()
 
         if (ca) {
             subPath = sub->makeFixedOutputPathFromCA(
-                std::string { storePath.name() },
-                ContentAddressWithReferences::withoutRefs(*ca));
+                std::string{storePath.name()}, ContentAddressWithReferences::withoutRefs(*ca));
             if (sub->storeDir == worker.store.storeDir)
                 assert(subPath == storePath);
         } else if (sub->storeDir != worker.store.storeDir) {
@@ -83,16 +85,13 @@ Goal::Co PathSubstitutionGoal::init()
         try {
             // FIXME: make async
             info = sub->queryPathInfo(subPath ? *subPath : storePath);
-        } catch (InvalidPath &) {
+        } catch (InvalidPath & e) {
             continue;
         } catch (SubstituterDisabled & e) {
-            if (settings.tryFallback) continue;
-            else throw e;
+            continue;
         } catch (Error & e) {
-            if (settings.tryFallback) {
-                logError(e.info());
-                continue;
-            } else throw e;
+            lastStoresException = std::make_optional(std::move(e));
+            continue;
         }
 
         if (info->path != storePath) {
@@ -101,8 +100,11 @@ Goal::Co PathSubstitutionGoal::init()
                 info2->path = storePath;
                 info = info2;
             } else {
-                printError("asked '%s' for '%s' but got '%s'",
-                    sub->getUri(), worker.store.printStorePath(storePath), sub->printStorePath(info->path));
+                printError(
+                    "asked '%s' for '%s' but got '%s'",
+                    sub->config.getHumanReadableURI(),
+                    worker.store.printStorePath(storePath),
+                    sub->printStorePath(info->path));
                 continue;
             }
         }
@@ -114,18 +116,19 @@ Goal::Co PathSubstitutionGoal::init()
 
         maintainExpectedDownload =
             narInfo && narInfo->fileSize
-            ? std::make_unique<MaintainCount<uint64_t>>(worker.expectedDownloadSize, narInfo->fileSize)
-            : nullptr;
+                ? std::make_unique<MaintainCount<uint64_t>>(worker.expectedDownloadSize, narInfo->fileSize)
+                : nullptr;
 
         worker.updateProgress();
 
         /* Bail out early if this substituter lacks a valid
            signature. LocalStore::addToStore() also checks for this, but
            only after we've downloaded the path. */
-        if (!sub->config.isTrusted && worker.store.pathInfoIsUntrusted(*info))
-        {
-            warn("ignoring substitute for '%s' from '%s', as it's not signed by any of the keys in 'trusted-public-keys'",
-                worker.store.printStorePath(storePath), sub->getUri());
+        if (!sub->config.isTrusted && worker.store.pathInfoIsUntrusted(*info)) {
+            warn(
+                "ignoring substitute for '%s' from '%s', as it's not signed by any of the keys in 'trusted-public-keys'",
+                worker.store.printStorePath(storePath),
+                sub->config.getHumanReadableURI());
             continue;
         }
 
@@ -152,6 +155,12 @@ Goal::Co PathSubstitutionGoal::init()
         worker.failedSubstitutions++;
         worker.updateProgress();
     }
+    if (lastStoresException.has_value()) {
+        if (!settings.tryFallback) {
+            throw *lastStoresException;
+        } else
+            logError(lastStoresException->info());
+    }
 
     /* Hack: don't indicate failure if there were no substituters.
        In that case the calling derivation should just do a
@@ -159,11 +168,12 @@ Goal::Co PathSubstitutionGoal::init()
     co_return done(
         substituterFailed ? ecFailed : ecNoSubstituters,
         BuildResult::NoSubstituters,
-        fmt("path '%s' is required, but there is no substituter that can build it", worker.store.printStorePath(storePath)));
+        fmt("path '%s' is required, but there is no substituter that can build it",
+            worker.store.printStorePath(storePath)));
 }
 
-
-Goal::Co PathSubstitutionGoal::tryToRun(StorePath subPath, nix::ref<Store> sub, std::shared_ptr<const ValidPathInfo> info, bool & substituterFailed)
+Goal::Co PathSubstitutionGoal::tryToRun(
+    StorePath subPath, nix::ref<Store> sub, std::shared_ptr<const ValidPathInfo> info, bool & substituterFailed)
 {
     trace("all references realised");
 
@@ -175,11 +185,13 @@ Goal::Co PathSubstitutionGoal::tryToRun(StorePath subPath, nix::ref<Store> sub,
     }
 
     for (auto & i : info->references)
-         /* ignore self-references */
+        /* ignore self-references */
         if (i != storePath) {
             if (!worker.store.isValidPath(i)) {
-                throw Error("reference '%s' of path '%s' is not a valid path",
-                            worker.store.printStorePath(i), worker.store.printStorePath(storePath));
+                throw Error(
+                    "reference '%s' of path '%s' is not a valid path",
+                    worker.store.printStorePath(i),
+                    worker.store.printStorePath(storePath));
             }
         }
 
@@ -212,11 +224,13 @@ Goal::Co PathSubstitutionGoal::tryToRun(StorePath subPath, nix::ref<Store> sub,
             /* Wake up the worker loop when we're done. */
             Finally updateStats([this]() { outPipe.writeSide.close(); });
 
-            Activity act(*logger, actSubstitute, Logger::Fields{worker.store.printStorePath(storePath), sub->getUri()});
+            Activity act(
+                *logger,
+                actSubstitute,
+                Logger::Fields{worker.store.printStorePath(storePath), sub->config.getHumanReadableURI()});
             PushActivity pact(act.id);
 
-            copyStorePath(*sub, worker.store,
-                subPath, repair, sub->config.isTrusted ? NoCheckSigs : CheckSigs);
+            copyStorePath(*sub, worker.store, subPath, repair, sub->config.isTrusted ? NoCheckSigs : CheckSigs);
 
             promise.set_value();
         } catch (...) {
@@ -224,13 +238,17 @@ Goal::Co PathSubstitutionGoal::tryToRun(StorePath subPath, nix::ref<Store> sub,
         }
     });
 
-    worker.childStarted(shared_from_this(), {
+    worker.childStarted(
+        shared_from_this(),
+        {
 #ifndef _WIN32
-        outPipe.readSide.get()
+            outPipe.readSide.get()
 #else
-        &outPipe
+            &outPipe
 #endif
-    }, true, false);
+        },
+        true,
+        false);
 
     co_await Suspend{};
 
@@ -282,13 +300,11 @@ Goal::Co PathSubstitutionGoal::tryToRun(StorePath subPath, nix::ref<Store> sub,
     co_return done(ecSuccess, BuildResult::Substituted);
 }
 
-
 void PathSubstitutionGoal::handleEOF(Descriptor fd)
 {
     worker.wakeUp(shared_from_this());
 }
 
-
 void PathSubstitutionGoal::cleanup()
 {
     try {
@@ -304,5 +320,4 @@ void PathSubstitutionGoal::cleanup()
     }
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index 2b901f818..3e6e0bef0 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -10,6 +10,7 @@
 #  include "nix/store/build/hook-instance.hh"
 #endif
 #include "nix/util/signals.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
@@ -29,7 +30,6 @@ Worker::Worker(Store & store, Store & evalStore)
     checkMismatch = false;
 }
 
-
 Worker::~Worker()
 {
     /* Explicitly get rid of all strong pointers now.  After this all
@@ -44,9 +44,10 @@ Worker::~Worker()
 }
 
 template<class G, typename... Args>
-std::shared_ptr<G> Worker::initGoalIfNeeded(std::weak_ptr<G> & goal_weak, Args && ...args)
+std::shared_ptr<G> Worker::initGoalIfNeeded(std::weak_ptr<G> & goal_weak, Args &&... args)
 {
-    if (auto goal = goal_weak.lock()) return goal;
+    if (auto goal = goal_weak.lock())
+        return goal;
 
     auto goal = std::make_shared<G>(args...);
     goal_weak = goal;
@@ -55,64 +56,60 @@ std::shared_ptr<G> Worker::initGoalIfNeeded(std::weak_ptr<G> & goal_weak, Args &
 }
 
 std::shared_ptr<DerivationTrampolineGoal> Worker::makeDerivationTrampolineGoal(
-    ref<const SingleDerivedPath> drvReq,
-    const OutputsSpec & wantedOutputs,
-    BuildMode buildMode)
+    ref<const SingleDerivedPath> drvReq, const OutputsSpec & wantedOutputs, BuildMode buildMode)
 {
     return initGoalIfNeeded(
-        derivationTrampolineGoals.ensureSlot(*drvReq).value[wantedOutputs],
-        drvReq, wantedOutputs, *this, buildMode);
+        derivationTrampolineGoals.ensureSlot(*drvReq).value[wantedOutputs], drvReq, wantedOutputs, *this, buildMode);
 }
 
-
 std::shared_ptr<DerivationTrampolineGoal> Worker::makeDerivationTrampolineGoal(
-    const StorePath & drvPath,
-    const OutputsSpec & wantedOutputs,
-    const Derivation & drv,
-    BuildMode buildMode)
+    const StorePath & drvPath, const OutputsSpec & wantedOutputs, const Derivation & drv, BuildMode buildMode)
 {
     return initGoalIfNeeded(
         derivationTrampolineGoals.ensureSlot(DerivedPath::Opaque{drvPath}).value[wantedOutputs],
-        drvPath, wantedOutputs, drv, *this, buildMode);
+        drvPath,
+        wantedOutputs,
+        drv,
+        *this,
+        buildMode);
 }
 
-
-std::shared_ptr<DerivationGoal> Worker::makeDerivationGoal(const StorePath & drvPath,
-    const Derivation & drv, const OutputName & wantedOutput, BuildMode buildMode)
+std::shared_ptr<DerivationGoal> Worker::makeDerivationGoal(
+    const StorePath & drvPath, const Derivation & drv, const OutputName & wantedOutput, BuildMode buildMode)
 {
     return initGoalIfNeeded(derivationGoals[drvPath][wantedOutput], drvPath, drv, wantedOutput, *this, buildMode);
 }
 
-
-std::shared_ptr<DerivationBuildingGoal> Worker::makeDerivationBuildingGoal(const StorePath & drvPath,
-    const Derivation & drv, BuildMode buildMode)
+std::shared_ptr<DerivationBuildingGoal>
+Worker::makeDerivationBuildingGoal(const StorePath & drvPath, const Derivation & drv, BuildMode buildMode)
 {
     return initGoalIfNeeded(derivationBuildingGoals[drvPath], drvPath, drv, *this, buildMode);
 }
 
-
-std::shared_ptr<PathSubstitutionGoal> Worker::makePathSubstitutionGoal(const StorePath & path, RepairFlag repair, std::optional<ContentAddress> ca)
+std::shared_ptr<PathSubstitutionGoal>
+Worker::makePathSubstitutionGoal(const StorePath & path, RepairFlag repair, std::optional<ContentAddress> ca)
 {
     return initGoalIfNeeded(substitutionGoals[path], path, *this, repair, ca);
 }
 
-
-std::shared_ptr<DrvOutputSubstitutionGoal> Worker::makeDrvOutputSubstitutionGoal(const DrvOutput& id, RepairFlag repair, std::optional<ContentAddress> ca)
+std::shared_ptr<DrvOutputSubstitutionGoal>
+Worker::makeDrvOutputSubstitutionGoal(const DrvOutput & id, RepairFlag repair, std::optional<ContentAddress> ca)
 {
     return initGoalIfNeeded(drvOutputSubstitutionGoals[id], id, *this, repair, ca);
 }
 
-
 GoalPtr Worker::makeGoal(const DerivedPath & req, BuildMode buildMode)
 {
-    return std::visit(overloaded {
-        [&](const DerivedPath::Built & bfd) -> GoalPtr {
-            return makeDerivationTrampolineGoal(bfd.drvPath, bfd.outputs, buildMode);
+    return std::visit(
+        overloaded{
+            [&](const DerivedPath::Built & bfd) -> GoalPtr {
+                return makeDerivationTrampolineGoal(bfd.drvPath, bfd.outputs, buildMode);
+            },
+            [&](const DerivedPath::Opaque & bo) -> GoalPtr {
+                return makePathSubstitutionGoal(bo.path, buildMode == bmRepair ? Repair : NoRepair);
+            },
         },
-        [&](const DerivedPath::Opaque & bo) -> GoalPtr {
-            return makePathSubstitutionGoal(bo.path, buildMode == bmRepair ? Repair : NoRepair);
-        },
-    }, req.raw());
+        req.raw());
 }
 
 /**
@@ -149,12 +146,12 @@ static bool removeGoal(std::shared_ptr<G> goal, std::map<K, Inner> & goalMap)
 }
 
 template<typename G>
-static bool removeGoal(std::shared_ptr<G> goal, typename DerivedPathMap<std::map<OutputsSpec, std::weak_ptr<G>>>::ChildNode & node)
+static bool
+removeGoal(std::shared_ptr<G> goal, typename DerivedPathMap<std::map<OutputsSpec, std::weak_ptr<G>>>::ChildNode & node)
 {
     return removeGoal(goal, node.value) || removeGoal(goal, node.childMap);
 }
 
-
 void Worker::removeGoal(GoalPtr goal)
 {
     if (auto drvGoal = std::dynamic_pointer_cast<DerivationTrampolineGoal>(goal))
@@ -181,34 +178,31 @@ void Worker::removeGoal(GoalPtr goal)
     /* Wake up goals waiting for any goal to finish. */
     for (auto & i : waitingForAnyGoal) {
         GoalPtr goal = i.lock();
-        if (goal) wakeUp(goal);
+        if (goal)
+            wakeUp(goal);
     }
 
     waitingForAnyGoal.clear();
 }
 
-
 void Worker::wakeUp(GoalPtr goal)
 {
     goal->trace("woken up");
     addToWeakGoals(awake, goal);
 }
 
-
 size_t Worker::getNrLocalBuilds()
 {
     return nrLocalBuilds;
 }
 
-
 size_t Worker::getNrSubstitutions()
 {
     return nrSubstitutions;
 }
 
-
-void Worker::childStarted(GoalPtr goal, const std::set<MuxablePipePollState::CommChannel> & channels,
-    bool inBuildSlot, bool respectTimeouts)
+void Worker::childStarted(
+    GoalPtr goal, const std::set<MuxablePipePollState::CommChannel> & channels, bool inBuildSlot, bool respectTimeouts)
 {
     Child child;
     child.goal = goal;
@@ -235,12 +229,11 @@ void Worker::childStarted(GoalPtr goal, const std::set<MuxablePipePollState::Com
     }
 }
 
-
 void Worker::childTerminated(Goal * goal, bool wakeSleepers)
 {
-    auto i = std::find_if(children.begin(), children.end(),
-        [&](const Child & child) { return child.goal2 == goal; });
-    if (i == children.end()) return;
+    auto i = std::find_if(children.begin(), children.end(), [&](const Child & child) { return child.goal2 == goal; });
+    if (i == children.end())
+        return;
 
     if (i->inBuildSlot) {
         switch (goal->jobCategory()) {
@@ -267,40 +260,37 @@ void Worker::childTerminated(Goal * goal, bool wakeSleepers)
         /* Wake up goals waiting for a build slot. */
         for (auto & j : wantingToBuild) {
             GoalPtr goal = j.lock();
-            if (goal) wakeUp(goal);
+            if (goal)
+                wakeUp(goal);
         }
 
         wantingToBuild.clear();
     }
 }
 
-
 void Worker::waitForBuildSlot(GoalPtr goal)
 {
     goal->trace("wait for build slot");
     bool isSubstitutionGoal = goal->jobCategory() == JobCategory::Substitution;
-    if ((!isSubstitutionGoal && getNrLocalBuilds() < settings.maxBuildJobs) ||
-        (isSubstitutionGoal && getNrSubstitutions() < settings.maxSubstitutionJobs))
+    if ((!isSubstitutionGoal && getNrLocalBuilds() < settings.maxBuildJobs)
+        || (isSubstitutionGoal && getNrSubstitutions() < settings.maxSubstitutionJobs))
         wakeUp(goal); /* we can do it right away */
     else
         addToWeakGoals(wantingToBuild, goal);
 }
 
-
 void Worker::waitForAnyGoal(GoalPtr goal)
 {
     debug("wait for any goal");
     addToWeakGoals(waitingForAnyGoal, goal);
 }
 
-
 void Worker::waitForAWhile(GoalPtr goal)
 {
     debug("wait for a while");
     addToWeakGoals(waitingForAWhile, goal);
 }
 
-
 void Worker::run(const Goals & _topGoals)
 {
     std::vector<nix::DerivedPath> topPaths;
@@ -308,10 +298,11 @@ void Worker::run(const Goals & _topGoals)
     for (auto & i : _topGoals) {
         topGoals.insert(i);
         if (auto goal = dynamic_cast<DerivationTrampolineGoal *>(i.get())) {
-            topPaths.push_back(DerivedPath::Built {
-                .drvPath = goal->drvReq,
-                .outputs = goal->wantedOutputs,
-            });
+            topPaths.push_back(
+                DerivedPath::Built{
+                    .drvPath = goal->drvReq,
+                    .outputs = goal->wantedOutputs,
+                });
         } else if (auto goal = dynamic_cast<PathSubstitutionGoal *>(i.get())) {
             topPaths.push_back(DerivedPath::Opaque{goal->storePath});
         }
@@ -336,33 +327,37 @@ void Worker::run(const Goals & _topGoals)
             Goals awake2;
             for (auto & i : awake) {
                 GoalPtr goal = i.lock();
-                if (goal) awake2.insert(goal);
+                if (goal)
+                    awake2.insert(goal);
             }
             awake.clear();
             for (auto & goal : awake2) {
                 checkInterrupt();
                 goal->work();
-                if (topGoals.empty()) break; // stuff may have been cancelled
+                if (topGoals.empty())
+                    break; // stuff may have been cancelled
             }
         }
 
-        if (topGoals.empty()) break;
+        if (topGoals.empty())
+            break;
 
         /* Wait for input. */
         if (!children.empty() || !waitingForAWhile.empty())
             waitForInput();
         else if (awake.empty() && 0U == settings.maxBuildJobs) {
             if (getMachines().empty())
-               throw Error(
-                   "Unable to start any build; either increase '--max-jobs' or enable remote builds.\n"
-                   "\n"
-                   "For more information run 'man nix.conf' and search for '/machines'.");
+                throw Error(
+                    "Unable to start any build; either increase '--max-jobs' or enable remote builds.\n"
+                    "\n"
+                    "For more information run 'man nix.conf' and search for '/machines'.");
             else
-               throw Error(
-                   "Unable to start any build; remote machines may not have all required system features.\n"
-                   "\n"
-                   "For more information run 'man nix.conf' and search for '/machines'.");
-        } else assert(!awake.empty());
+                throw Error(
+                    "Unable to start any build; remote machines may not have all required system features.\n"
+                    "\n"
+                    "For more information run 'man nix.conf' and search for '/machines'.");
+        } else
+            assert(!awake.empty());
     }
 
     /* If --keep-going is not set, it's possible that the main goal
@@ -395,7 +390,8 @@ void Worker::waitForInput()
         // Periodicallty wake up to see if we need to run the garbage collector.
         nearest = before + std::chrono::seconds(10);
     for (auto & i : children) {
-        if (!i.respectTimeouts) continue;
+        if (!i.respectTimeouts)
+            continue;
         if (0 != settings.maxSilentTime)
             nearest = std::min(nearest, i.lastOutput + std::chrono::seconds(settings.maxSilentTime));
         if (0 != settings.buildTimeout)
@@ -410,11 +406,15 @@ void Worker::waitForInput()
        up after a few seconds at most. */
     if (!waitingForAWhile.empty()) {
         useTimeout = true;
-        if (lastWokenUp == steady_time_point::min() || lastWokenUp > before) lastWokenUp = before;
-        timeout = std::max(1L,
+        if (lastWokenUp == steady_time_point::min() || lastWokenUp > before)
+            lastWokenUp = before;
+        timeout = std::max(
+            1L,
             (long) std::chrono::duration_cast<std::chrono::seconds>(
-                lastWokenUp + std::chrono::seconds(settings.pollInterval) - before).count());
-    } else lastWokenUp = steady_time_point::min();
+                lastWokenUp + std::chrono::seconds(settings.pollInterval) - before)
+                .count());
+    } else
+        lastWokenUp = steady_time_point::min();
 
     if (useTimeout)
         vomit("sleeping %d seconds", timeout);
@@ -427,7 +427,7 @@ void Worker::waitForInput()
        includes EOF. */
     for (auto & i : children) {
         for (auto & j : i.channels) {
-            state.pollStatus.push_back((struct pollfd) { .fd = j, .events = POLLIN });
+            state.pollStatus.push_back((struct pollfd) {.fd = j, .events = POLLIN});
             state.fdToPollStatus[j] = state.pollStatus.size() - 1;
         }
     }
@@ -437,7 +437,7 @@ void Worker::waitForInput()
 #ifdef _WIN32
         ioport.get(),
 #endif
-        useTimeout ? (std::optional { timeout * 1000 }) : std::nullopt);
+        useTimeout ? (std::optional{timeout * 1000}) : std::nullopt);
 
     auto after = steady_time_point::clock::now();
 
@@ -455,8 +455,7 @@ void Worker::waitForInput()
         state.iterate(
             j->channels,
             [&](Descriptor k, std::string_view data) {
-                printMsg(lvlVomit, "%1%: read %2% bytes",
-                    goal->getName(), data.size());
+                printMsg(lvlVomit, "%1%: read %2% bytes", goal->getName(), data.size());
                 j->lastOutput = after;
                 goal->handleChildOutput(k, data);
             },
@@ -465,24 +464,16 @@ void Worker::waitForInput()
                 goal->handleEOF(k);
             });
 
-        if (goal->exitCode == Goal::ecBusy &&
-            0 != settings.maxSilentTime &&
-            j->respectTimeouts &&
-            after - j->lastOutput >= std::chrono::seconds(settings.maxSilentTime))
-        {
-            goal->timedOut(Error(
-                    "%1% timed out after %2% seconds of silence",
-                    goal->getName(), settings.maxSilentTime));
+        if (goal->exitCode == Goal::ecBusy && 0 != settings.maxSilentTime && j->respectTimeouts
+            && after - j->lastOutput >= std::chrono::seconds(settings.maxSilentTime)) {
+            goal->timedOut(
+                Error("%1% timed out after %2% seconds of silence", goal->getName(), settings.maxSilentTime));
         }
 
-        else if (goal->exitCode == Goal::ecBusy &&
-            0 != settings.buildTimeout &&
-            j->respectTimeouts &&
-            after - j->timeStarted >= std::chrono::seconds(settings.buildTimeout))
-        {
-            goal->timedOut(Error(
-                    "%1% timed out after %2% seconds",
-                    goal->getName(), settings.buildTimeout));
+        else if (
+            goal->exitCode == Goal::ecBusy && 0 != settings.buildTimeout && j->respectTimeouts
+            && after - j->timeStarted >= std::chrono::seconds(settings.buildTimeout)) {
+            goal->timedOut(Error("%1% timed out after %2% seconds", goal->getName(), settings.buildTimeout));
         }
     }
 
@@ -490,26 +481,26 @@ void Worker::waitForInput()
         lastWokenUp = after;
         for (auto & i : waitingForAWhile) {
             GoalPtr goal = i.lock();
-            if (goal) wakeUp(goal);
+            if (goal)
+                wakeUp(goal);
         }
         waitingForAWhile.clear();
     }
 }
 
-
 unsigned int Worker::failingExitStatus()
 {
     // See API docs in header for explanation
     unsigned int mask = 0;
     bool buildFailure = permanentFailure || timedOut || hashMismatch;
     if (buildFailure)
-        mask |= 0x04;  // 100
+        mask |= 0x04; // 100
     if (timedOut)
-        mask |= 0x01;  // 101
+        mask |= 0x01; // 101
     if (hashMismatch)
-        mask |= 0x02;  // 102
+        mask |= 0x02; // 102
     if (checkMismatch) {
-        mask |= 0x08;  // 104
+        mask |= 0x08; // 104
     }
 
     if (mask)
@@ -517,11 +508,11 @@ unsigned int Worker::failingExitStatus()
     return mask ? mask : 1;
 }
 
-
 bool Worker::pathContentsGood(const StorePath & path)
 {
     auto i = pathContentsGoodCache.find(path);
-    if (i != pathContentsGoodCache.end()) return i->second;
+    if (i != pathContentsGoodCache.end())
+        return i->second;
     printInfo("checking path '%s'...", store.printStorePath(path));
     auto info = store.queryPathInfo(path);
     bool res;
@@ -529,8 +520,10 @@ bool Worker::pathContentsGood(const StorePath & path)
         res = false;
     else {
         auto current = hashPath(
-            {store.getFSAccessor(), CanonPath(path.to_string())},
-            FileIngestionMethod::NixArchive, info->narHash.algo).first;
+                           {store.getFSAccessor(), CanonPath(path.to_string())},
+                           FileIngestionMethod::NixArchive,
+                           info->narHash.algo)
+                           .first;
         Hash nullHash(HashAlgorithm::SHA256);
         res = info->narHash == nullHash || info->narHash == current;
     }
@@ -540,13 +533,11 @@ bool Worker::pathContentsGood(const StorePath & path)
     return res;
 }
 
-
 void Worker::markContentsGood(const StorePath & path)
 {
     pathContentsGoodCache.insert_or_assign(path, true);
 }
 
-
 GoalPtr upcast_goal(std::shared_ptr<PathSubstitutionGoal> subGoal)
 {
     return subGoal;
@@ -562,4 +553,4 @@ GoalPtr upcast_goal(std::shared_ptr<DerivationGoal> subGoal)
     return subGoal;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index 0e99ca0e5..22ed8d807 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -10,12 +10,16 @@
 
 namespace nix {
 
+namespace {
+
 struct State
 {
     std::map<Path, int> priorities;
     unsigned long symlinks = 0;
 };
 
+} // namespace
+
 /* For each activated package, create symlinks */
 static void createLinks(State & state, const Path & srcDir, const Path & dstDir, int priority)
 {
@@ -58,13 +62,9 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
          * Python package brings its own
          * `$out/lib/pythonX.Y/site-packages/easy-install.pth'.)
          */
-        if (hasSuffix(srcFile, "/propagated-build-inputs") ||
-            hasSuffix(srcFile, "/nix-support") ||
-            hasSuffix(srcFile, "/perllocal.pod") ||
-            hasSuffix(srcFile, "/info/dir") ||
-            hasSuffix(srcFile, "/log") ||
-            hasSuffix(srcFile, "/manifest.nix") ||
-            hasSuffix(srcFile, "/manifest.json"))
+        if (hasSuffix(srcFile, "/propagated-build-inputs") || hasSuffix(srcFile, "/nix-support")
+            || hasSuffix(srcFile, "/perllocal.pod") || hasSuffix(srcFile, "/info/dir") || hasSuffix(srcFile, "/log")
+            || hasSuffix(srcFile, "/manifest.nix") || hasSuffix(srcFile, "/manifest.json"))
             continue;
 
         else if (S_ISDIR(srcSt.st_mode)) {
@@ -80,11 +80,14 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
                         throw Error("collision between '%1%' and non-directory '%2%'", srcFile, target);
                     if (unlink(dstFile.c_str()) == -1)
                         throw SysError("unlinking '%1%'", dstFile);
-                    if (mkdir(dstFile.c_str()
-                #ifndef _WIN32 // TODO abstract mkdir perms for Windows
-                            , 0755
-                #endif
-                            ) == -1)
+                    if (mkdir(
+                            dstFile.c_str()
+#ifndef _WIN32 // TODO abstract mkdir perms for Windows
+                                ,
+                            0755
+#endif
+                            )
+                        == -1)
                         throw SysError("creating directory '%1%'", dstFile);
                     createLinks(state, target, dstFile, state.priorities[dstFile]);
                     createLinks(state, srcFile, dstFile, priority);
@@ -100,11 +103,7 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
                 if (S_ISLNK(dstSt.st_mode)) {
                     auto prevPriority = state.priorities[dstFile];
                     if (prevPriority == priority)
-                        throw BuildEnvFileConflictError(
-                            readLink(dstFile),
-                            srcFile,
-                            priority
-                        );
+                        throw BuildEnvFileConflictError(readLink(dstFile), srcFile, priority);
                     if (prevPriority < priority)
                         continue;
                     if (unlink(dstFile.c_str()) == -1)
@@ -127,16 +126,18 @@ void buildProfile(const Path & out, Packages && pkgs)
     PathSet done, postponed;
 
     auto addPkg = [&](const Path & pkgDir, int priority) {
-        if (!done.insert(pkgDir).second) return;
+        if (!done.insert(pkgDir).second)
+            return;
         createLinks(state, pkgDir, out, priority);
 
         try {
             for (const auto & p : tokenizeString<std::vector<std::string>>(
-                    readFile(pkgDir + "/nix-support/propagated-user-env-packages"), " \n"))
+                     readFile(pkgDir + "/nix-support/propagated-user-env-packages"), " \n"))
                 if (!done.count(p))
                     postponed.insert(p);
         } catch (SysError & e) {
-            if (e.errNo != ENOENT && e.errNo != ENOTDIR) throw;
+            if (e.errNo != ENOENT && e.errNo != ENOTDIR)
+                throw;
         }
     };
 
@@ -171,7 +172,8 @@ static void builtinBuildenv(const BuiltinBuilderContext & ctx)
 {
     auto getAttr = [&](const std::string & name) {
         auto i = ctx.drv.env.find(name);
-        if (i == ctx.drv.env.end()) throw Error("attribute '%s' missing", name);
+        if (i == ctx.drv.env.end())
+            throw Error("attribute '%s' missing", name);
         return i->second;
     };
 
@@ -191,7 +193,7 @@ static void builtinBuildenv(const BuiltinBuilderContext & ctx)
             const int priority = stoi(*itemIt++);
             const size_t outputs = stoul(*itemIt++);
 
-            for (size_t n {0}; n < outputs; n++) {
+            for (size_t n{0}; n < outputs; n++) {
                 pkgs.emplace_back(std::move(*itemIt++), active, priority);
             }
         }
@@ -204,4 +206,4 @@ static void builtinBuildenv(const BuiltinBuilderContext & ctx)
 
 static RegisterBuiltinBuilder registerBuildenv("buildenv", builtinBuildenv);
 
-}
+} // namespace nix
diff --git a/src/libstore/builtins/fetchurl.cc b/src/libstore/builtins/fetchurl.cc
index 18fa75558..7abfa4495 100644
--- a/src/libstore/builtins/fetchurl.cc
+++ b/src/libstore/builtins/fetchurl.cc
@@ -1,6 +1,7 @@
 #include "nix/store/builtins.hh"
 #include "nix/store/filetransfer.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/globals.hh"
 #include "nix/util/archive.hh"
 #include "nix/util/compression.hh"
 
@@ -35,14 +36,11 @@ static void builtinFetchurl(const BuiltinBuilderContext & ctx)
     auto fileTransfer = makeFileTransfer();
 
     auto fetch = [&](const std::string & url) {
-
         auto source = sinkToSource([&](Sink & sink) {
-
-            FileTransferRequest request(url);
+            FileTransferRequest request(ValidURL{url});
             request.decompress = false;
 
-            auto decompressor = makeDecompressionSink(
-                unpack && hasSuffix(mainUrl, ".xz") ? "xz" : "none", sink);
+            auto decompressor = makeDecompressionSink(unpack && hasSuffix(mainUrl, ".xz") ? "xz" : "none", sink);
             fileTransfer->download(std::move(request), *decompressor);
             decompressor->finish();
         });
@@ -64,8 +62,11 @@ static void builtinFetchurl(const BuiltinBuilderContext & ctx)
     if (dof && dof->ca.method.getFileIngestionMethod() == FileIngestionMethod::Flat)
         for (auto hashedMirror : settings.hashedMirrors.get())
             try {
-                if (!hasSuffix(hashedMirror, "/")) hashedMirror += '/';
-                fetch(hashedMirror + printHashAlgo(dof->ca.hash.algo) + "/" + dof->ca.hash.to_string(HashFormat::Base16, false));
+                if (!hasSuffix(hashedMirror, "/"))
+                    hashedMirror += '/';
+                fetch(
+                    hashedMirror + printHashAlgo(dof->ca.hash.algo) + "/"
+                    + dof->ca.hash.to_string(HashFormat::Base16, false));
                 return;
             } catch (Error & e) {
                 debug(e.what());
@@ -77,4 +78,4 @@ static void builtinFetchurl(const BuiltinBuilderContext & ctx)
 
 static RegisterBuiltinBuilder registerFetchurl("fetchurl", builtinFetchurl);
 
-}
+} // namespace nix
diff --git a/src/libstore/builtins/unpack-channel.cc b/src/libstore/builtins/unpack-channel.cc
index dd6b8bb71..317cbe9ef 100644
--- a/src/libstore/builtins/unpack-channel.cc
+++ b/src/libstore/builtins/unpack-channel.cc
@@ -7,7 +7,8 @@ static void builtinUnpackChannel(const BuiltinBuilderContext & ctx)
 {
     auto getAttr = [&](const std::string & name) -> const std::string & {
         auto i = ctx.drv.env.find(name);
-        if (i == ctx.drv.env.end()) throw Error("attribute '%s' missing", name);
+        if (i == ctx.drv.env.end())
+            throw Error("attribute '%s' missing", name);
         return i->second;
     };
 
@@ -42,4 +43,4 @@ static void builtinUnpackChannel(const BuiltinBuilderContext & ctx)
 
 static RegisterBuiltinBuilder registerUnpackChannel("unpack-channel", builtinUnpackChannel);
 
-}
+} // namespace nix
diff --git a/src/libstore/common-protocol.cc b/src/libstore/common-protocol.cc
index 311f4888c..d4f3efc9b 100644
--- a/src/libstore/common-protocol.cc
+++ b/src/libstore/common-protocol.cc
@@ -18,80 +18,80 @@ std::string CommonProto::Serialise<std::string>::read(const StoreDirConfig & sto
     return readString(conn.from);
 }
 
-void CommonProto::Serialise<std::string>::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const std::string & str)
+void CommonProto::Serialise<std::string>::write(
+    const StoreDirConfig & store, CommonProto::WriteConn conn, const std::string & str)
 {
     conn.to << str;
 }
 
-
 StorePath CommonProto::Serialise<StorePath>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
 {
     return store.parseStorePath(readString(conn.from));
 }
 
-void CommonProto::Serialise<StorePath>::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const StorePath & storePath)
+void CommonProto::Serialise<StorePath>::write(
+    const StoreDirConfig & store, CommonProto::WriteConn conn, const StorePath & storePath)
 {
     conn.to << store.printStorePath(storePath);
 }
 
-
 ContentAddress CommonProto::Serialise<ContentAddress>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
 {
     return ContentAddress::parse(readString(conn.from));
 }
 
-void CommonProto::Serialise<ContentAddress>::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const ContentAddress & ca)
+void CommonProto::Serialise<ContentAddress>::write(
+    const StoreDirConfig & store, CommonProto::WriteConn conn, const ContentAddress & ca)
 {
     conn.to << renderContentAddress(ca);
 }
 
-
 Realisation CommonProto::Serialise<Realisation>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
 {
     std::string rawInput = readString(conn.from);
-    return Realisation::fromJSON(
-        nlohmann::json::parse(rawInput),
-        "remote-protocol"
-    );
+    return Realisation::fromJSON(nlohmann::json::parse(rawInput), "remote-protocol");
 }
 
-void CommonProto::Serialise<Realisation>::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const Realisation & realisation)
+void CommonProto::Serialise<Realisation>::write(
+    const StoreDirConfig & store, CommonProto::WriteConn conn, const Realisation & realisation)
 {
     conn.to << realisation.toJSON().dump();
 }
 
-
 DrvOutput CommonProto::Serialise<DrvOutput>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
 {
     return DrvOutput::parse(readString(conn.from));
 }
 
-void CommonProto::Serialise<DrvOutput>::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const DrvOutput & drvOutput)
+void CommonProto::Serialise<DrvOutput>::write(
+    const StoreDirConfig & store, CommonProto::WriteConn conn, const DrvOutput & drvOutput)
 {
     conn.to << drvOutput.to_string();
 }
 
-
-std::optional<StorePath> CommonProto::Serialise<std::optional<StorePath>>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
+std::optional<StorePath>
+CommonProto::Serialise<std::optional<StorePath>>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
 {
     auto s = readString(conn.from);
-    return s == "" ? std::optional<StorePath> {} : store.parseStorePath(s);
+    return s == "" ? std::optional<StorePath>{} : store.parseStorePath(s);
 }
 
-void CommonProto::Serialise<std::optional<StorePath>>::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const std::optional<StorePath> & storePathOpt)
+void CommonProto::Serialise<std::optional<StorePath>>::write(
+    const StoreDirConfig & store, CommonProto::WriteConn conn, const std::optional<StorePath> & storePathOpt)
 {
     conn.to << (storePathOpt ? store.printStorePath(*storePathOpt) : "");
 }
 
-
-std::optional<ContentAddress> CommonProto::Serialise<std::optional<ContentAddress>>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
+std::optional<ContentAddress>
+CommonProto::Serialise<std::optional<ContentAddress>>::read(const StoreDirConfig & store, CommonProto::ReadConn conn)
 {
     return ContentAddress::parseOpt(readString(conn.from));
 }
 
-void CommonProto::Serialise<std::optional<ContentAddress>>::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const std::optional<ContentAddress> & caOpt)
+void CommonProto::Serialise<std::optional<ContentAddress>>::write(
+    const StoreDirConfig & store, CommonProto::WriteConn conn, const std::optional<ContentAddress> & caOpt)
 {
     conn.to << (caOpt ? renderContentAddress(*caOpt) : "");
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/common-ssh-store-config.cc b/src/libstore/common-ssh-store-config.cc
index bcaa11a96..12f187b4c 100644
--- a/src/libstore/common-ssh-store-config.cc
+++ b/src/libstore/common-ssh-store-config.cc
@@ -5,33 +5,22 @@
 
 namespace nix {
 
-static std::string extractConnStr(std::string_view scheme, std::string_view _connStr)
+CommonSSHStoreConfig::CommonSSHStoreConfig(std::string_view scheme, std::string_view authority, const Params & params)
+    : CommonSSHStoreConfig(scheme, ParsedURL::Authority::parse(authority), params)
 {
-    if (_connStr.empty())
-        throw UsageError("`%s` store requires a valid SSH host as the authority part in Store URI", scheme);
-
-    std::string connStr{_connStr};
-
-    std::smatch result;
-    static std::regex v6AddrRegex("^((.*)@)?\\[(.*)\\]$");
-
-    if (std::regex_match(connStr, result, v6AddrRegex)) {
-        connStr = result[1].matched ? result.str(1) + result.str(3) : result.str(3);
-    }
-
-    return connStr;
 }
 
-CommonSSHStoreConfig::CommonSSHStoreConfig(std::string_view scheme, std::string_view host, const Params & params)
+CommonSSHStoreConfig::CommonSSHStoreConfig(
+    std::string_view scheme, const ParsedURL::Authority & authority, const Params & params)
     : StoreConfig(params)
-    , host(extractConnStr(scheme, host))
+    , authority(authority)
 {
 }
 
 SSHMaster CommonSSHStoreConfig::createSSHMaster(bool useMaster, Descriptor logFD) const
 {
     return {
-        host,
+        authority,
         sshKey.get(),
         sshPublicHostKey.get(),
         useMaster,
@@ -40,4 +29,4 @@ SSHMaster CommonSSHStoreConfig::createSSHMaster(bool useMaster, Descriptor logFD
     };
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/content-address.cc b/src/libstore/content-address.cc
index 5d27c4136..9a57e3aa6 100644
--- a/src/libstore/content-address.cc
+++ b/src/libstore/content-address.cc
@@ -62,8 +62,7 @@ ContentAddressMethod ContentAddressMethod::parse(std::string_view m)
     if (m == "text")
         return ContentAddressMethod::Raw::Text;
     else
-        return fileIngestionMethodToContentAddressMethod(
-            parseFileIngestionMethod(m));
+        return fileIngestionMethodToContentAddressMethod(parseFileIngestionMethod(m));
 }
 
 std::string_view ContentAddressMethod::renderPrefix() const
@@ -84,12 +83,10 @@ ContentAddressMethod ContentAddressMethod::parsePrefix(std::string_view & m)
 {
     if (splitPrefix(m, "r:")) {
         return ContentAddressMethod::Raw::NixArchive;
-    }
-    else if (splitPrefix(m, "git:")) {
+    } else if (splitPrefix(m, "git:")) {
         experimentalFeatureSettings.require(Xp::GitHashing);
         return ContentAddressMethod::Raw::Git;
-    }
-    else if (splitPrefix(m, "text:")) {
+    } else if (splitPrefix(m, "text:")) {
         return ContentAddressMethod::Raw::Text;
     }
     return ContentAddressMethod::Raw::Flat;
@@ -145,7 +142,7 @@ std::string ContentAddress::render() const
  */
 static std::pair<ContentAddressMethod, HashAlgorithm> parseContentAddressMethodPrefix(std::string_view & rest)
 {
-    std::string_view wholeInput { rest };
+    std::string_view wholeInput{rest};
 
     std::string_view prefix;
     {
@@ -155,7 +152,7 @@ static std::pair<ContentAddressMethod, HashAlgorithm> parseContentAddressMethodP
         prefix = *optPrefix;
     }
 
-    auto parseHashAlgorithm_ = [&](){
+    auto parseHashAlgorithm_ = [&]() {
         auto hashAlgoRaw = splitPrefixTo(rest, ':');
         if (!hashAlgoRaw)
             throw UsageError("content address hash must be in form '<algo>:<hash>', but found: %s", wholeInput);
@@ -186,7 +183,8 @@ static std::pair<ContentAddressMethod, HashAlgorithm> parseContentAddressMethodP
             std::move(hashAlgo),
         };
     } else
-        throw UsageError("content address prefix '%s' is unrecognized. Recogonized prefixes are 'text' or 'fixed'", prefix);
+        throw UsageError(
+            "content address prefix '%s' is unrecognized. Recogonized prefixes are 'text' or 'fixed'", prefix);
 }
 
 ContentAddress ContentAddress::parse(std::string_view rawCa)
@@ -195,7 +193,7 @@ ContentAddress ContentAddress::parse(std::string_view rawCa)
 
     auto [caMethod, hashAlgo] = parseContentAddressMethodPrefix(rest);
 
-    return ContentAddress {
+    return ContentAddress{
         .method = std::move(caMethod),
         .hash = Hash::parseNonSRIUnprefixed(rest, hashAlgo),
     };
@@ -211,9 +209,7 @@ std::pair<ContentAddressMethod, HashAlgorithm> ContentAddressMethod::parseWithAl
 
 std::optional<ContentAddress> ContentAddress::parseOpt(std::string_view rawCaOpt)
 {
-    return rawCaOpt == ""
-        ? std::nullopt
-        : std::optional { ContentAddress::parse(rawCaOpt) };
+    return rawCaOpt == "" ? std::nullopt : std::optional{ContentAddress::parse(rawCaOpt)};
 };
 
 std::string renderContentAddress(std::optional<ContentAddress> ca)
@@ -223,8 +219,7 @@ std::string renderContentAddress(std::optional<ContentAddress> ca)
 
 std::string ContentAddress::printMethodAlgo() const
 {
-    return std::string { method.renderPrefix() }
-        + printHashAlgo(hash.algo);
+    return std::string{method.renderPrefix()} + printHashAlgo(hash.algo);
 }
 
 bool StoreReferences::empty() const
@@ -241,14 +236,14 @@ ContentAddressWithReferences ContentAddressWithReferences::withoutRefs(const Con
 {
     switch (ca.method.raw) {
     case ContentAddressMethod::Raw::Text:
-        return TextInfo {
+        return TextInfo{
             .hash = ca.hash,
             .references = {},
         };
     case ContentAddressMethod::Raw::Flat:
     case ContentAddressMethod::Raw::NixArchive:
     case ContentAddressMethod::Raw::Git:
-        return FixedOutputInfo {
+        return FixedOutputInfo{
             .method = ca.method.getFileIngestionMethod(),
             .hash = ca.hash,
             .references = {},
@@ -258,21 +253,21 @@ ContentAddressWithReferences ContentAddressWithReferences::withoutRefs(const Con
     }
 }
 
-ContentAddressWithReferences ContentAddressWithReferences::fromParts(
-    ContentAddressMethod method, Hash hash, StoreReferences refs)
+ContentAddressWithReferences
+ContentAddressWithReferences::fromParts(ContentAddressMethod method, Hash hash, StoreReferences refs)
 {
     switch (method.raw) {
     case ContentAddressMethod::Raw::Text:
         if (refs.self)
             throw Error("self-reference not allowed with text hashing");
-        return TextInfo {
+        return TextInfo{
             .hash = std::move(hash),
             .references = std::move(refs.others),
         };
     case ContentAddressMethod::Raw::Flat:
     case ContentAddressMethod::Raw::NixArchive:
     case ContentAddressMethod::Raw::Git:
-        return FixedOutputInfo {
+        return FixedOutputInfo{
             .method = method.getFileIngestionMethod(),
             .hash = std::move(hash),
             .references = std::move(refs),
@@ -284,27 +279,24 @@ ContentAddressWithReferences ContentAddressWithReferences::fromParts(
 
 ContentAddressMethod ContentAddressWithReferences::getMethod() const
 {
-    return std::visit(overloaded {
-        [](const TextInfo & th) -> ContentAddressMethod {
-            return ContentAddressMethod::Raw::Text;
+    return std::visit(
+        overloaded{
+            [](const TextInfo & th) -> ContentAddressMethod { return ContentAddressMethod::Raw::Text; },
+            [](const FixedOutputInfo & fsh) -> ContentAddressMethod {
+                return fileIngestionMethodToContentAddressMethod(fsh.method);
+            },
         },
-        [](const FixedOutputInfo & fsh) -> ContentAddressMethod {
-            return fileIngestionMethodToContentAddressMethod(
-                fsh.method);
-        },
-    }, raw);
+        raw);
 }
 
 Hash ContentAddressWithReferences::getHash() const
 {
-    return std::visit(overloaded {
-        [](const TextInfo & th) {
-            return th.hash;
+    return std::visit(
+        overloaded{
+            [](const TextInfo & th) { return th.hash; },
+            [](const FixedOutputInfo & fsh) { return fsh.hash; },
         },
-        [](const FixedOutputInfo & fsh) {
-            return fsh.hash;
-        },
-    }, raw);
+        raw);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index bf4a9d959..2bd0698a0 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -16,16 +16,17 @@
 #include "nix/util/args.hh"
 #include "nix/util/git.hh"
 #include "nix/util/logging.hh"
+#include "nix/store/globals.hh"
 
 #ifndef _WIN32 // TODO need graceful async exit support on Windows?
-# include "nix/util/monitor-fd.hh"
+#  include "nix/util/monitor-fd.hh"
 #endif
 
 #include <sstream>
 
 namespace nix::daemon {
 
-Sink & operator << (Sink & sink, const Logger::Fields & fields)
+Sink & operator<<(Sink & sink, const Logger::Fields & fields)
 {
     sink << fields.size();
     for (auto & f : fields) {
@@ -34,7 +35,8 @@ Sink & operator << (Sink & sink, const Logger::Fields & fields)
             sink << f.i;
         else if (f.type == Logger::Field::tString)
             sink << f.s;
-        else unreachable();
+        else
+            unreachable();
     }
     return sink;
 }
@@ -57,7 +59,10 @@ struct TunnelLogger : public Logger
     WorkerProto::Version clientVersion;
 
     TunnelLogger(FdSink & to, WorkerProto::Version clientVersion)
-        : to(to), clientVersion(clientVersion) { }
+        : to(to)
+        , clientVersion(clientVersion)
+    {
+    }
 
     void enqueueMsg(const std::string & s)
     {
@@ -80,7 +85,8 @@ struct TunnelLogger : public Logger
 
     void log(Verbosity lvl, std::string_view s) override
     {
-        if (lvl > verbosity) return;
+        if (lvl > verbosity)
+            return;
 
         StringSink buf;
         buf << STDERR_NEXT << (s + "\n");
@@ -89,7 +95,8 @@ struct TunnelLogger : public Logger
 
     void logEI(const ErrorInfo & ei) override
     {
-        if (ei.level > verbosity) return;
+        if (ei.level > verbosity)
+            return;
 
         std::ostringstream oss;
         showErrorInfo(oss, ei, false);
@@ -133,8 +140,13 @@ struct TunnelLogger : public Logger
         }
     }
 
-    void startActivity(ActivityId act, Verbosity lvl, ActivityType type,
-        const std::string & s, const Fields & fields, ActivityId parent) override
+    void startActivity(
+        ActivityId act,
+        Verbosity lvl,
+        ActivityType type,
+        const std::string & s,
+        const Fields & fields,
+        ActivityId parent) override
     {
         if (GET_PROTOCOL_MINOR(clientVersion) < 20) {
             if (!s.empty())
@@ -149,7 +161,8 @@ struct TunnelLogger : public Logger
 
     void stopActivity(ActivityId act) override
     {
-        if (GET_PROTOCOL_MINOR(clientVersion) < 20) return;
+        if (GET_PROTOCOL_MINOR(clientVersion) < 20)
+            return;
         StringSink buf;
         buf << STDERR_STOP_ACTIVITY << act;
         enqueueMsg(buf.s);
@@ -157,7 +170,8 @@ struct TunnelLogger : public Logger
 
     void result(ActivityId act, ResultType type, const Fields & fields) override
     {
-        if (GET_PROTOCOL_MINOR(clientVersion) < 20) return;
+        if (GET_PROTOCOL_MINOR(clientVersion) < 20)
+            return;
         StringSink buf;
         buf << STDERR_RESULT << act << type << fields;
         enqueueMsg(buf.s);
@@ -167,8 +181,13 @@ struct TunnelLogger : public Logger
 struct TunnelSink : Sink
 {
     Sink & to;
-    TunnelSink(Sink & to) : to(to) { }
-    void operator () (std::string_view data) override
+
+    TunnelSink(Sink & to)
+        : to(to)
+    {
+    }
+
+    void operator()(std::string_view data) override
     {
         to << STDERR_WRITE;
         writeString(data, to);
@@ -179,13 +198,20 @@ struct TunnelSource : BufferedSource
 {
     Source & from;
     BufferedSink & to;
-    TunnelSource(Source & from, BufferedSink & to) : from(from), to(to) { }
+
+    TunnelSource(Source & from, BufferedSink & to)
+        : from(from)
+        , to(to)
+    {
+    }
+
     size_t readUnbuffered(char * data, size_t len) override
     {
         to << STDERR_READ << len;
         to.flush();
         size_t n = readString(data, len, from);
-        if (n == 0) throw EndOfFile("unexpected end-of-file");
+        if (n == 0)
+            throw EndOfFile("unexpected end-of-file");
         return n;
     }
 };
@@ -233,8 +259,10 @@ struct ClientSettings
                     else if (!hasSuffix(s, "/") && trusted.count(s + "/"))
                         subs.push_back(s + "/");
                     else
-                        warn("ignoring untrusted substituter '%s', you are not a trusted user.\n"
-                             "Run `man nix.conf` for more information on the `substituters` configuration option.", s);
+                        warn(
+                            "ignoring untrusted substituter '%s', you are not a trusted user.\n"
+                            "Run `man nix.conf` for more information on the `substituters` configuration option.",
+                            s);
                 res = subs;
                 return true;
             };
@@ -245,23 +273,24 @@ struct ClientSettings
                 else if (name == experimentalFeatureSettings.experimentalFeatures.name) {
                     // We don’t want to forward the experimental features to
                     // the daemon, as that could cause some pretty weird stuff
-                    if (parseFeatures(tokenizeString<StringSet>(value)) != experimentalFeatureSettings.experimentalFeatures.get())
+                    if (parseFeatures(tokenizeString<StringSet>(value))
+                        != experimentalFeatureSettings.experimentalFeatures.get())
                         debug("Ignoring the client-specified experimental features");
                 } else if (name == "plugin-files") {
-                    warn("Ignoring the client-specified plugin-files.\n"
-                         "The client specifying plugins to the daemon never made sense, and was removed in Nix >=2.14.");
-                }
-                else if (trusted
-                    || name == settings.buildTimeout.name
-                    || name == settings.maxSilentTime.name
-                    || name == settings.pollInterval.name
-                    || name == "connect-timeout"
+                    warn(
+                        "Ignoring the client-specified plugin-files.\n"
+                        "The client specifying plugins to the daemon never made sense, and was removed in Nix >=2.14.");
+                } else if (
+                    trusted || name == settings.buildTimeout.name || name == settings.maxSilentTime.name
+                    || name == settings.pollInterval.name || name == "connect-timeout"
                     || (name == "builders" && value == ""))
                     settings.set(name, value);
                 else if (setSubstituters(settings.substituters))
                     ;
                 else
-                    warn("ignoring the client-specified setting '%s', because it is a restricted setting and you are not a trusted user", name);
+                    warn(
+                        "ignoring the client-specified setting '%s', because it is a restricted setting and you are not a trusted user",
+                        name);
             } catch (UsageError & e) {
                 warn(e.what());
             }
@@ -269,8 +298,11 @@ struct ClientSettings
     }
 };
 
-static void performOp(TunnelLogger * logger, ref<Store> store,
-    TrustedFlag trusted, RecursiveFlag recursive,
+static void performOp(
+    TunnelLogger * logger,
+    ref<Store> store,
+    TrustedFlag trusted,
+    RecursiveFlag recursive,
     WorkerProto::BasicServerConnection & conn,
     WorkerProto::Op op)
 {
@@ -349,7 +381,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
             store->queryReferrers(path, paths);
         else if (op == WorkerProto::Op::QueryValidDerivers)
             paths = store->queryValidDerivers(path);
-        else paths = store->queryDerivationOutputs(path);
+        else
+            paths = store->queryDerivationOutputs(path);
         logger->stopWork();
         WorkerProto::write(*store, wconn, paths);
         break;
@@ -424,7 +457,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                     assert(false);
                 }
                 // TODO these two steps are essentially RemoteStore::addCAToStore. Move it up to Store.
-                auto path = store->addToStoreFromDump(source, name, dumpMethod, contentAddressMethod, hashAlgo, refs, repair);
+                auto path =
+                    store->addToStoreFromDump(source, name, dumpMethod, contentAddressMethod, hashAlgo, refs, repair);
                 return store->queryPathInfo(path);
             }();
             logger->stopWork();
@@ -440,10 +474,10 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                 std::string hashAlgoRaw;
                 conn.from >> baseName >> fixed /* obsolete */ >> recursive >> hashAlgoRaw;
                 if (recursive > true)
-                    throw Error("unsupported FileIngestionMethod with value of %i; you may need to upgrade nix-daemon", recursive);
-                method = recursive
-                    ? ContentAddressMethod::Raw::NixArchive
-                    : ContentAddressMethod::Raw::Flat;
+                    throw Error(
+                        "unsupported FileIngestionMethod with value of %i; you may need to upgrade nix-daemon",
+                        recursive);
+                method = recursive ? ContentAddressMethod::Raw::NixArchive : ContentAddressMethod::Raw::Flat;
                 /* Compatibility hack. */
                 if (!fixed) {
                     hashAlgoRaw = "sha256";
@@ -467,8 +501,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                 parseDump(sink, savedNARSource);
             });
             logger->startWork();
-            auto path = store->addToStoreFromDump(
-                *dumpSource, baseName, FileSerialisationMethod::NixArchive, method, hashAlgo);
+            auto path =
+                store->addToStoreFromDump(*dumpSource, baseName, FileSerialisationMethod::NixArchive, method, hashAlgo);
             logger->stopWork();
 
             conn.to << store->printStorePath(path);
@@ -485,9 +519,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         {
             FramedSource source(conn.from);
-            store->addMultipleToStore(source,
-                RepairFlag{repair},
-                dontCheckSigs ? NoCheckSigs : CheckSigs);
+            store->addMultipleToStore(source, RepairFlag{repair}, dontCheckSigs ? NoCheckSigs : CheckSigs);
         }
         logger->stopWork();
         break;
@@ -499,55 +531,37 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         auto refs = WorkerProto::Serialise<StorePathSet>::read(*store, rconn);
         logger->startWork();
         auto path = ({
-            StringSource source { s };
-            store->addToStoreFromDump(source, suffix, FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, refs, NoRepair);
+            StringSource source{s};
+            store->addToStoreFromDump(
+                source,
+                suffix,
+                FileSerialisationMethod::Flat,
+                ContentAddressMethod::Raw::Text,
+                HashAlgorithm::SHA256,
+                refs,
+                NoRepair);
         });
         logger->stopWork();
         conn.to << store->printStorePath(path);
         break;
     }
 
-    case WorkerProto::Op::ExportPath: {
-        auto path = store->parseStorePath(readString(conn.from));
-        readInt(conn.from); // obsolete
-        logger->startWork();
-        TunnelSink sink(conn.to);
-        store->exportPath(path, sink);
-        logger->stopWork();
-        conn.to << 1;
-        break;
-    }
-
-    case WorkerProto::Op::ImportPaths: {
-        logger->startWork();
-        TunnelSource source(conn.from, conn.to);
-        auto paths = store->importPaths(source,
-            trusted ? NoCheckSigs : CheckSigs);
-        logger->stopWork();
-        Strings paths2;
-        for (auto & i : paths) paths2.push_back(store->printStorePath(i));
-        conn.to << paths2;
-        break;
-    }
-
     case WorkerProto::Op::BuildPaths: {
         auto drvs = WorkerProto::Serialise<DerivedPaths>::read(*store, rconn);
         BuildMode mode = bmNormal;
-        if (GET_PROTOCOL_MINOR(conn.protoVersion) >= 15) {
-            mode = WorkerProto::Serialise<BuildMode>::read(*store, rconn);
+        mode = WorkerProto::Serialise<BuildMode>::read(*store, rconn);
 
-            /* Repairing is not atomic, so disallowed for "untrusted"
-               clients.
+        /* Repairing is not atomic, so disallowed for "untrusted"
+           clients.
 
-               FIXME: layer violation in this message: the daemon code (i.e.
-               this file) knows whether a client/connection is trusted, but it
-               does not how how the client was authenticated. The mechanism
-               need not be getting the UID of the other end of a Unix Domain
-               Socket.
-              */
-            if (mode == bmRepair && !trusted)
-                throw Error("repairing is not allowed because you are not in 'trusted-users'");
-        }
+           FIXME: layer violation in this message: the daemon code (i.e.
+           this file) knows whether a client/connection is trusted, but it
+           does not how how the client was authenticated. The mechanism
+           need not be getting the UID of the other end of a Unix Domain
+           Socket.
+          */
+        if (mode == bmRepair && !trusted)
+            throw Error("repairing is not allowed because you are not in 'trusted-users'");
         logger->startWork();
         store->buildPaths(drvs, mode);
         logger->stopWork();
@@ -644,7 +658,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
 
             Derivation drv2;
             static_cast<BasicDerivation &>(drv2) = drv;
-            drvPath = writeDerivation(*store, Derivation { drv2 });
+            drvPath = writeDerivation(*store, Derivation{drv2});
         }
 
         auto res = store->buildDerivation(drvPath, drv, buildMode);
@@ -766,13 +780,11 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         clientSettings.buildCores = readInt(conn.from);
         clientSettings.useSubstitutes = readInt(conn.from);
 
-        if (GET_PROTOCOL_MINOR(conn.protoVersion) >= 12) {
-            unsigned int n = readInt(conn.from);
-            for (unsigned int i = 0; i < n; i++) {
-                auto name = readString(conn.from);
-                auto value = readString(conn.from);
-                clientSettings.overrides.emplace(name, value);
-            }
+        unsigned int n = readInt(conn.from);
+        for (unsigned int i = 0; i < n; i++) {
+            auto name = readString(conn.from);
+            auto value = readString(conn.from);
+            clientSettings.overrides.emplace(name, value);
         }
 
         logger->startWork();
@@ -796,11 +808,9 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         if (i == infos.end())
             conn.to << 0;
         else {
-            conn.to << 1
-               << (i->second.deriver ? store->printStorePath(*i->second.deriver) : "");
+            conn.to << 1 << (i->second.deriver ? store->printStorePath(*i->second.deriver) : "");
             WorkerProto::write(*store, wconn, i->second.references);
-            conn.to << i->second.downloadSize
-                    << i->second.narSize;
+            conn.to << i->second.downloadSize << i->second.narSize;
         }
         break;
     }
@@ -839,18 +849,12 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         auto path = store->parseStorePath(readString(conn.from));
         std::shared_ptr<const ValidPathInfo> info;
         logger->startWork();
-        try {
-            info = store->queryPathInfo(path);
-        } catch (InvalidPath &) {
-            if (GET_PROTOCOL_MINOR(conn.protoVersion) < 17) throw;
-        }
+        info = store->queryPathInfo(path);
         logger->stopWork();
         if (info) {
-            if (GET_PROTOCOL_MINOR(conn.protoVersion) >= 17)
-                conn.to << 1;
+            conn.to << 1;
             WorkerProto::write(*store, wconn, static_cast<const UnkeyedValidPathInfo &>(*info));
         } else {
-            assert(GET_PROTOCOL_MINOR(conn.protoVersion) >= 17);
             conn.to << 0;
         }
         break;
@@ -898,7 +902,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         auto path = store->parseStorePath(readString(conn.from));
         auto deriver = readString(conn.from);
         auto narHash = Hash::parseAny(readString(conn.from), HashAlgorithm::SHA256);
-        ValidPathInfo info { path, narHash };
+        ValidPathInfo info{path, narHash};
         if (deriver != "")
             info.deriver = store->parseStorePath(deriver);
         info.references = WorkerProto::Serialise<StorePathSet>::read(*store, rconn);
@@ -915,8 +919,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
             logger->startWork();
             {
                 FramedSource source(conn.from);
-                store->addToStore(info, source, (RepairFlag) repair,
-                    dontCheckSigs ? NoCheckSigs : CheckSigs);
+                store->addToStore(info, source, (RepairFlag) repair, dontCheckSigs ? NoCheckSigs : CheckSigs);
             }
             logger->stopWork();
         }
@@ -927,7 +930,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
             if (GET_PROTOCOL_MINOR(conn.protoVersion) >= 21)
                 source = std::make_unique<TunnelSource>(conn.from, conn.to);
             else {
-                TeeSource tee { conn.from, saved };
+                TeeSource tee{conn.from, saved};
                 NullFileSystemObjectSink ether;
                 parseDump(ether, tee);
                 source = std::make_unique<StringSource>(saved.s);
@@ -936,8 +939,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
             logger->startWork();
 
             // FIXME: race if addToStore doesn't read source?
-            store->addToStore(info, *source, (RepairFlag) repair,
-                dontCheckSigs ? NoCheckSigs : CheckSigs);
+            store->addToStore(info, *source, (RepairFlag) repair, dontCheckSigs ? NoCheckSigs : CheckSigs);
 
             logger->stopWork();
         }
@@ -962,8 +964,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         if (GET_PROTOCOL_MINOR(conn.protoVersion) < 31) {
             auto outputId = DrvOutput::parse(readString(conn.from));
             auto outputPath = StorePath(readString(conn.from));
-            store->registerDrvOutput(Realisation{
-                .id = outputId, .outPath = outputPath});
+            store->registerDrvOutput(Realisation{.id = outputId, .outPath = outputPath});
         } else {
             auto realisation = WorkerProto::Serialise<Realisation>::read(*store, rconn);
             store->registerDrvOutput(realisation);
@@ -979,11 +980,13 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->stopWork();
         if (GET_PROTOCOL_MINOR(conn.protoVersion) < 31) {
             std::set<StorePath> outPaths;
-            if (info) outPaths.insert(info->outPath);
+            if (info)
+                outPaths.insert(info->outPath);
             WorkerProto::write(*store, wconn, outPaths);
         } else {
             std::set<Realisation> realisations;
-            if (info) realisations.insert(*info);
+            if (info)
+                realisations.insert(*info);
             WorkerProto::write(*store, wconn, realisations);
         }
         break;
@@ -1015,12 +1018,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
     }
 }
 
-void processConnection(
-    ref<Store> store,
-    FdSource && from,
-    FdSink && to,
-    TrustedFlag trusted,
-    RecursiveFlag recursive)
+void processConnection(ref<Store> store, FdSource && from, FdSink && to, TrustedFlag trusted, RecursiveFlag recursive)
 {
 #ifndef _WIN32 // TODO need graceful async exit support on Windows?
     auto monitor = !recursive ? std::make_unique<MonitorFdHup>(from.fd) : nullptr;
@@ -1029,10 +1027,9 @@ void processConnection(
 
     /* Exchange the greeting. */
     auto [protoVersion, features] =
-        WorkerProto::BasicServerConnection::handshake(
-            to, from, PROTOCOL_VERSION, WorkerProto::allFeatures);
+        WorkerProto::BasicServerConnection::handshake(to, from, PROTOCOL_VERSION, WorkerProto::allFeatures);
 
-    if (protoVersion < 0x10a)
+    if (protoVersion < 256 + 18)
         throw Error("the Nix client version is too old");
 
     WorkerProto::BasicServerConnection conn;
@@ -1059,14 +1056,14 @@ void processConnection(
         printMsgUsing(prevLogger, lvlDebug, "%d operations", opCount);
     });
 
-    conn.postHandshake(*store, {
-        .daemonNixVersion = nixVersion,
-        // We and the underlying store both need to trust the client for
-        // it to be trusted.
-        .remoteTrustsUs = trusted
-            ? store->isTrustedClient()
-            : std::optional { NotTrusted },
-    });
+    conn.postHandshake(
+        *store,
+        {
+            .daemonNixVersion = nixVersion,
+            // We and the underlying store both need to trust the client for
+            // it to be trusted.
+            .remoteTrustsUs = trusted ? store->isTrustedClient() : std::optional{NotTrusted},
+        });
 
     /* Send startup error messages to the client. */
     tunnelLogger->startWork();
@@ -1103,7 +1100,8 @@ void processConnection(
                    happens, just send the error message and exit. */
                 bool errorAllowed = tunnelLogger->state_.lock()->canSendStderr;
                 tunnelLogger->stopWork(&e);
-                if (!errorAllowed) throw;
+                if (!errorAllowed)
+                    throw;
             } catch (std::bad_alloc & e) {
                 auto ex = Error("Nix daemon out of memory");
                 tunnelLogger->stopWork(&ex);
@@ -1127,4 +1125,4 @@ void processConnection(
     }
 }
 
-}
+} // namespace nix::daemon
diff --git a/src/libstore/derivation-options.cc b/src/libstore/derivation-options.cc
index f6bac2868..630159629 100644
--- a/src/libstore/derivation-options.cc
+++ b/src/libstore/derivation-options.cc
@@ -5,6 +5,7 @@
 #include "nix/store/store-api.hh"
 #include "nix/util/types.hh"
 #include "nix/util/util.hh"
+#include "nix/store/globals.hh"
 
 #include <optional>
 #include <string>
@@ -92,6 +93,12 @@ using OutputChecks = DerivationOptions::OutputChecks;
 
 using OutputChecksVariant = std::variant<OutputChecks, std::map<std::string, OutputChecks>>;
 
+DerivationOptions DerivationOptions::fromStructuredAttrs(
+    const StringMap & env, const std::optional<StructuredAttrs> & parsed, bool shouldWarn)
+{
+    return fromStructuredAttrs(env, parsed ? &*parsed : nullptr);
+}
+
 DerivationOptions
 DerivationOptions::fromStructuredAttrs(const StringMap & env, const StructuredAttrs * parsed, bool shouldWarn)
 {
@@ -138,7 +145,7 @@ DerivationOptions::fromStructuredAttrs(const StringMap & env, const StructuredAt
                         if (auto maxClosureSize = get(output, "maxClosureSize"))
                             checks.maxClosureSize = maxClosureSize->get<uint64_t>();
 
-                        auto get_ = [&](const std::string & name) -> std::optional<StringSet> {
+                        auto get_ = [&output = output](const std::string & name) -> std::optional<StringSet> {
                             if (auto i = get(output, name)) {
                                 StringSet res;
                                 for (auto j = i->begin(); j != i->end(); ++j) {
@@ -249,6 +256,25 @@ DerivationOptions::fromStructuredAttrs(const StringMap & env, const StructuredAt
     };
 }
 
+std::map<std::string, StorePathSet>
+DerivationOptions::getParsedExportReferencesGraph(const StoreDirConfig & store) const
+{
+    std::map<std::string, StorePathSet> res;
+
+    for (auto & [fileName, ss] : exportReferencesGraph) {
+        StorePathSet storePaths;
+        for (auto & storePathS : ss) {
+            if (!store.isInStore(storePathS))
+                throw BuildError(
+                    BuildResult::InputRejected, "'exportReferencesGraph' contains a non-store path '%1%'", storePathS);
+            storePaths.insert(store.toStorePath(storePathS).first);
+        }
+        res.insert_or_assign(fileName, storePaths);
+    }
+
+    return res;
+}
+
 StringSet DerivationOptions::getRequiredSystemFeatures(const BasicDerivation & drv) const
 {
     // FIXME: cache this?
@@ -291,7 +317,7 @@ bool DerivationOptions::useUidRange(const BasicDerivation & drv) const
     return getRequiredSystemFeatures(drv).count("uid-range");
 }
 
-}
+} // namespace nix
 
 namespace nlohmann {
 
@@ -381,4 +407,4 @@ void adl_serializer<DerivationOptions::OutputChecks>::to_json(json & json, Deriv
     json["disallowedRequisites"] = c.disallowedRequisites;
 }
 
-}
+} // namespace nlohmann
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 0657a7499..84889ceac 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -11,132 +11,101 @@
 #include "nix/util/json-utils.hh"
 
 #include <boost/container/small_vector.hpp>
+#include <boost/unordered/concurrent_flat_map.hpp>
 #include <nlohmann/json.hpp>
 
 namespace nix {
 
-std::optional<StorePath> DerivationOutput::path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const
+using namespace std::literals::string_view_literals;
+
+std::optional<StorePath>
+DerivationOutput::path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const
 {
-    return std::visit(overloaded {
-        [](const DerivationOutput::InputAddressed & doi) -> std::optional<StorePath> {
-            return { doi.path };
+    return std::visit(
+        overloaded{
+            [](const DerivationOutput::InputAddressed & doi) -> std::optional<StorePath> { return {doi.path}; },
+            [&](const DerivationOutput::CAFixed & dof) -> std::optional<StorePath> {
+                return {dof.path(store, drvName, outputName)};
+            },
+            [](const DerivationOutput::CAFloating & dof) -> std::optional<StorePath> { return std::nullopt; },
+            [](const DerivationOutput::Deferred &) -> std::optional<StorePath> { return std::nullopt; },
+            [](const DerivationOutput::Impure &) -> std::optional<StorePath> { return std::nullopt; },
         },
-        [&](const DerivationOutput::CAFixed & dof) -> std::optional<StorePath> {
-            return {
-                dof.path(store, drvName, outputName)
-            };
-        },
-        [](const DerivationOutput::CAFloating & dof) -> std::optional<StorePath> {
-            return std::nullopt;
-        },
-        [](const DerivationOutput::Deferred &) -> std::optional<StorePath> {
-            return std::nullopt;
-        },
-        [](const DerivationOutput::Impure &) -> std::optional<StorePath> {
-            return std::nullopt;
-        },
-    }, raw);
+        raw);
 }
 
-
-StorePath DerivationOutput::CAFixed::path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const
+StorePath
+DerivationOutput::CAFixed::path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const
 {
     return store.makeFixedOutputPathFromCA(
-        outputPathName(drvName, outputName),
-        ContentAddressWithReferences::withoutRefs(ca));
+        outputPathName(drvName, outputName), ContentAddressWithReferences::withoutRefs(ca));
 }
 
-
 bool DerivationType::isCA() const
 {
     /* Normally we do the full `std::visit` to make sure we have
        exhaustively handled all variants, but so long as there is a
        variant called `ContentAddressed`, it must be the only one for
        which `isCA` is true for this to make sense!. */
-    return std::visit(overloaded {
-        [](const InputAddressed & ia) {
-            return false;
+    return std::visit(
+        overloaded{
+            [](const InputAddressed & ia) { return false; },
+            [](const ContentAddressed & ca) { return true; },
+            [](const Impure &) { return true; },
         },
-        [](const ContentAddressed & ca) {
-            return true;
-        },
-        [](const Impure &) {
-            return true;
-        },
-    }, raw);
+        raw);
 }
 
 bool DerivationType::isFixed() const
 {
-    return std::visit(overloaded {
-        [](const InputAddressed & ia) {
-            return false;
+    return std::visit(
+        overloaded{
+            [](const InputAddressed & ia) { return false; },
+            [](const ContentAddressed & ca) { return ca.fixed; },
+            [](const Impure &) { return false; },
         },
-        [](const ContentAddressed & ca) {
-            return ca.fixed;
-        },
-        [](const Impure &) {
-            return false;
-        },
-    }, raw);
+        raw);
 }
 
 bool DerivationType::hasKnownOutputPaths() const
 {
-    return std::visit(overloaded {
-        [](const InputAddressed & ia) {
-            return !ia.deferred;
+    return std::visit(
+        overloaded{
+            [](const InputAddressed & ia) { return !ia.deferred; },
+            [](const ContentAddressed & ca) { return ca.fixed; },
+            [](const Impure &) { return false; },
         },
-        [](const ContentAddressed & ca) {
-            return ca.fixed;
-        },
-        [](const Impure &) {
-            return false;
-        },
-    }, raw);
+        raw);
 }
 
-
 bool DerivationType::isSandboxed() const
 {
-    return std::visit(overloaded {
-        [](const InputAddressed & ia) {
-            return true;
+    return std::visit(
+        overloaded{
+            [](const InputAddressed & ia) { return true; },
+            [](const ContentAddressed & ca) { return ca.sandboxed; },
+            [](const Impure &) { return false; },
         },
-        [](const ContentAddressed & ca) {
-            return ca.sandboxed;
-        },
-        [](const Impure &) {
-            return false;
-        },
-    }, raw);
+        raw);
 }
 
-
 bool DerivationType::isImpure() const
 {
-    return std::visit(overloaded {
-        [](const InputAddressed & ia) {
-            return false;
+    return std::visit(
+        overloaded{
+            [](const InputAddressed & ia) { return false; },
+            [](const ContentAddressed & ca) { return false; },
+            [](const Impure &) { return true; },
         },
-        [](const ContentAddressed & ca) {
-            return false;
-        },
-        [](const Impure &) {
-            return true;
-        },
-    }, raw);
+        raw);
 }
 
-
 bool BasicDerivation::isBuiltin() const
 {
     return builder.substr(0, 8) == "builtin:";
 }
 
-
-StorePath writeDerivation(Store & store,
-    const Derivation & drv, RepairFlag repair, bool readOnly)
+StorePath writeDerivation(Store & store, const Derivation & drv, RepairFlag repair, bool readOnly)
 {
     auto references = drv.inputSrcs;
     for (auto & i : drv.inputDrvs.map)
@@ -146,50 +115,68 @@ StorePath writeDerivation(Store & store,
        held during a garbage collection). */
     auto suffix = std::string(drv.name) + drvExtension;
     auto contents = drv.unparse(store, false);
-    return readOnly || settings.readOnlyMode
-        ? store.makeFixedOutputPathFromCA(suffix, TextInfo {
-            .hash = hashString(HashAlgorithm::SHA256, contents),
-            .references = std::move(references),
-        })
-        : ({
-            StringSource s { contents };
-            store.addToStoreFromDump(s, suffix, FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, references, repair);
-        });
+    return readOnly || settings.readOnlyMode ? store.makeFixedOutputPathFromCA(
+                                                   suffix,
+                                                   TextInfo{
+                                                       .hash = hashString(HashAlgorithm::SHA256, contents),
+                                                       .references = std::move(references),
+                                                   })
+                                             : ({
+                                                   StringSource s{contents};
+                                                   store.addToStoreFromDump(
+                                                       s,
+                                                       suffix,
+                                                       FileSerialisationMethod::Flat,
+                                                       ContentAddressMethod::Raw::Text,
+                                                       HashAlgorithm::SHA256,
+                                                       references,
+                                                       repair);
+                                               });
 }
 
-
 namespace {
 /**
  * This mimics std::istream to some extent. We use this much smaller implementation
  * instead of plain istreams because the sentry object overhead is too high.
  */
-struct StringViewStream {
+struct StringViewStream
+{
     std::string_view remaining;
 
-    int peek() const {
+    int peek() const
+    {
         return remaining.empty() ? EOF : remaining[0];
     }
 
-    int get() {
-        if (remaining.empty()) return EOF;
+    int get()
+    {
+        if (remaining.empty())
+            return EOF;
         char c = remaining[0];
         remaining.remove_prefix(1);
         return c;
     }
 };
 
-constexpr struct Escapes {
+constexpr struct Escapes
+{
     char map[256];
-    constexpr Escapes() {
-        for (int i = 0; i < 256; i++) map[i] = (char) (unsigned char) i;
+
+    constexpr Escapes()
+    {
+        for (int i = 0; i < 256; i++)
+            map[i] = (char) (unsigned char) i;
         map[(int) (unsigned char) 'n'] = '\n';
         map[(int) (unsigned char) 'r'] = '\r';
         map[(int) (unsigned char) 't'] = '\t';
     }
-    char operator[](char c) const { return map[(unsigned char) c]; }
-} escapes;
-}
 
+    char operator[](char c) const
+    {
+        return map[(unsigned char) c];
+    }
+} escapes;
+} // namespace
 
 /* Read string `s' from stream `str'. */
 static void expect(StringViewStream & str, std::string_view s)
@@ -199,41 +186,65 @@ static void expect(StringViewStream & str, std::string_view s)
     str.remaining.remove_prefix(s.size());
 }
 
+static void expect(StringViewStream & str, char c)
+{
+    if (str.remaining.empty() || str.remaining[0] != c)
+        throw FormatError("expected string '%1%'", c);
+    str.remaining.remove_prefix(1);
+}
 
 /* Read a C-style string from stream `str'. */
 static BackedStringView parseString(StringViewStream & str)
 {
-    expect(str, "\"");
-    auto c = str.remaining.begin(), end = str.remaining.end();
-    bool escaped = false;
-    for (; c != end && *c != '"'; c++) {
-        if (*c == '\\') {
-            c++;
-            if (c == end)
-                throw FormatError("unterminated string in derivation");
-            escaped = true;
+    expect(str, '"');
+    size_t start = 0;
+    size_t end = str.remaining.size();
+    const auto data = str.remaining.data();
+    while (start < end) {
+        auto idx = str.remaining.find('"', start);
+        if (idx == std::string_view::npos) {
+            break;
         }
+        size_t pos = idx;
+        for (; pos > 0 && data[pos - 1] == '\\'; pos--)
+            ;
+        if ((idx - pos) % 2 == 0) { // even number of backslashes
+            end = idx;
+            break;
+        }
+        start = idx + 1;
     }
 
-    const auto contentLen = c - str.remaining.begin();
-    const auto content = str.remaining.substr(0, contentLen);
-    str.remaining.remove_prefix(contentLen + 1);
+    start = 0;
+    const auto content = str.remaining.substr(start, end);
+    str.remaining.remove_prefix(end + 1);
 
-    if (!escaped)
+    auto nextBackslash = content.find('\\', start);
+    if (nextBackslash == std::string_view::npos) {
         return content;
+    }
 
     std::string res;
-    res.reserve(content.size());
-    for (c = content.begin(), end = content.end(); c != end; c++)
-        if (*c == '\\') {
-            c++;
-            res += escapes[*c];
+    res.reserve(end);
+    do {
+        if (nextBackslash == end - 1) {
+            throw FormatError("unterminated string in derivation");
         }
-        else res += *c;
+        if (nextBackslash > start) {
+            res.append(&data[start], nextBackslash - start);
+        }
+        res.push_back(escapes[data[nextBackslash + 1]]);
+        start = nextBackslash + 2;
+        nextBackslash = content.find('\\', start);
+    } while (nextBackslash != std::string_view::npos);
+    if (end > start) {
+        res.append(&data[start], end - start);
+    }
     return res;
 }
 
-static void validatePath(std::string_view s) {
+static void validatePath(std::string_view s)
+{
     if (s.size() == 0 || s[0] != '/')
         throw FormatError("bad path '%1%' in derivation", s);
 }
@@ -245,7 +256,6 @@ static BackedStringView parsePath(StringViewStream & str)
     return s;
 }
 
-
 static bool endOfList(StringViewStream & str)
 {
     if (str.peek() == ',') {
@@ -259,72 +269,77 @@ static bool endOfList(StringViewStream & str)
     return false;
 }
 
-
 static StringSet parseStrings(StringViewStream & str, bool arePaths)
 {
     StringSet res;
-    expect(str, "[");
+    expect(str, '[');
     while (!endOfList(str))
         res.insert((arePaths ? parsePath(str) : parseString(str)).toOwned());
     return res;
 }
 
-
 static DerivationOutput parseDerivationOutput(
     const StoreDirConfig & store,
-    std::string_view pathS, std::string_view hashAlgoStr, std::string_view hashS,
+    std::string_view pathS,
+    std::string_view hashAlgoStr,
+    std::string_view hashS,
     const ExperimentalFeatureSettings & xpSettings)
 {
-    if (hashAlgoStr != "") {
+    if (!hashAlgoStr.empty()) {
         ContentAddressMethod method = ContentAddressMethod::parsePrefix(hashAlgoStr);
         if (method == ContentAddressMethod::Raw::Text)
             xpSettings.require(Xp::DynamicDerivations);
         const auto hashAlgo = parseHashAlgo(hashAlgoStr);
-        if (hashS == "impure") {
+        if (hashS == "impure"sv) {
             xpSettings.require(Xp::ImpureDerivations);
-            if (pathS != "")
+            if (!pathS.empty())
                 throw FormatError("impure derivation output should not specify output path");
-            return DerivationOutput::Impure {
+            return DerivationOutput::Impure{
                 .method = std::move(method),
                 .hashAlgo = std::move(hashAlgo),
             };
-        } else if (hashS != "") {
+        } else if (!hashS.empty()) {
             validatePath(pathS);
             auto hash = Hash::parseNonSRIUnprefixed(hashS, hashAlgo);
-            return DerivationOutput::CAFixed {
-                .ca = ContentAddress {
-                    .method = std::move(method),
-                    .hash = std::move(hash),
-                },
+            return DerivationOutput::CAFixed{
+                .ca =
+                    ContentAddress{
+                        .method = std::move(method),
+                        .hash = std::move(hash),
+                    },
             };
         } else {
             xpSettings.require(Xp::CaDerivations);
-            if (pathS != "")
+            if (!pathS.empty())
                 throw FormatError("content-addressing derivation output should not specify output path");
-            return DerivationOutput::CAFloating {
+            return DerivationOutput::CAFloating{
                 .method = std::move(method),
                 .hashAlgo = std::move(hashAlgo),
             };
         }
     } else {
-        if (pathS == "") {
-            return DerivationOutput::Deferred { };
+        if (pathS.empty()) {
+            return DerivationOutput::Deferred{};
         }
         validatePath(pathS);
-        return DerivationOutput::InputAddressed {
+        return DerivationOutput::InputAddressed{
             .path = store.parseStorePath(pathS),
         };
     }
 }
 
 static DerivationOutput parseDerivationOutput(
-    const StoreDirConfig & store, StringViewStream & str,
+    const StoreDirConfig & store,
+    StringViewStream & str,
     const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings)
 {
-    expect(str, ","); const auto pathS = parseString(str);
-    expect(str, ","); const auto hashAlgo = parseString(str);
-    expect(str, ","); const auto hash = parseString(str);
-    expect(str, ")");
+    expect(str, ',');
+    const auto pathS = parseString(str);
+    expect(str, ',');
+    const auto hashAlgo = parseString(str);
+    expect(str, ',');
+    const auto hash = parseString(str);
+    expect(str, ')');
 
     return parseDerivationOutput(store, *pathS, *hashAlgo, *hash, xpSettings);
 }
@@ -346,16 +361,12 @@ enum struct DerivationATermVersion {
     DynamicDerivations,
 };
 
-static DerivedPathMap<StringSet>::ChildNode parseDerivedPathMapNode(
-    const StoreDirConfig & store,
-    StringViewStream & str,
-    DerivationATermVersion version)
+static DerivedPathMap<StringSet>::ChildNode
+parseDerivedPathMapNode(const StoreDirConfig & store, StringViewStream & str, DerivationATermVersion version)
 {
     DerivedPathMap<StringSet>::ChildNode node;
 
-    auto parseNonDynamic = [&]() {
-        node.value = parseStrings(str, false);
-    };
+    auto parseNonDynamic = [&]() { node.value = parseStrings(str, false); };
 
     // Older derivation should never use new form, but newer
     // derivaiton can use old form.
@@ -369,17 +380,17 @@ static DerivedPathMap<StringSet>::ChildNode parseDerivedPathMapNode(
             parseNonDynamic();
             break;
         case '(':
-            expect(str, "(");
+            expect(str, '(');
             node.value = parseStrings(str, false);
-            expect(str, ",[");
+            expect(str, ",["sv);
             while (!endOfList(str)) {
-                expect(str, "(");
+                expect(str, '(');
                 auto outputName = parseString(str).toOwned();
-                expect(str, ",");
+                expect(str, ',');
                 node.childMap.insert_or_assign(outputName, parseDerivedPathMapNode(store, str, version));
-                expect(str, ")");
+                expect(str, ')');
             }
-            expect(str, ")");
+            expect(str, ')');
             break;
         default:
             throw FormatError("invalid inputDrvs entry in derivation");
@@ -392,33 +403,34 @@ static DerivedPathMap<StringSet>::ChildNode parseDerivedPathMapNode(
     return node;
 }
 
-
 Derivation parseDerivation(
-    const StoreDirConfig & store, std::string && s, std::string_view name,
+    const StoreDirConfig & store,
+    std::string && s,
+    std::string_view name,
     const ExperimentalFeatureSettings & xpSettings)
 {
     Derivation drv;
     drv.name = name;
 
     StringViewStream str{s};
-    expect(str, "D");
+    expect(str, 'D');
     DerivationATermVersion version;
     switch (str.peek()) {
     case 'e':
-        expect(str, "erive(");
+        expect(str, "erive("sv);
         version = DerivationATermVersion::Traditional;
         break;
     case 'r': {
-        expect(str, "rvWithVersion(");
+        expect(str, "rvWithVersion("sv);
         auto versionS = parseString(str);
-        if (*versionS == "xp-dyn-drv") {
+        if (*versionS == "xp-dyn-drv"sv) {
             // Only version we have so far
             version = DerivationATermVersion::DynamicDerivations;
             xpSettings.require(Xp::DynamicDerivations);
         } else {
             throw FormatError("Unknown derivation ATerm format version '%s'", *versionS);
         }
-        expect(str, ",");
+        expect(str, ',');
         break;
     }
     default:
@@ -426,46 +438,56 @@ Derivation parseDerivation(
     }
 
     /* Parse the list of outputs. */
-    expect(str, "[");
+    expect(str, '[');
     while (!endOfList(str)) {
-        expect(str, "("); std::string id = parseString(str).toOwned();
+        expect(str, '(');
+        std::string id = parseString(str).toOwned();
         auto output = parseDerivationOutput(store, str, xpSettings);
         drv.outputs.emplace(std::move(id), std::move(output));
     }
 
     /* Parse the list of input derivations. */
-    expect(str, ",[");
+    expect(str, ",["sv);
     while (!endOfList(str)) {
-        expect(str, "(");
+        expect(str, '(');
         auto drvPath = parsePath(str);
-        expect(str, ",");
-        drv.inputDrvs.map.insert_or_assign(store.parseStorePath(*drvPath), parseDerivedPathMapNode(store, str, version));
-        expect(str, ")");
+        expect(str, ',');
+        drv.inputDrvs.map.insert_or_assign(
+            store.parseStorePath(*drvPath), parseDerivedPathMapNode(store, str, version));
+        expect(str, ')');
     }
 
-    expect(str, ","); drv.inputSrcs = store.parseStorePathSet(parseStrings(str, true));
-    expect(str, ","); drv.platform = parseString(str).toOwned();
-    expect(str, ","); drv.builder = parseString(str).toOwned();
+    expect(str, ',');
+    drv.inputSrcs = store.parseStorePathSet(parseStrings(str, true));
+    expect(str, ',');
+    drv.platform = parseString(str).toOwned();
+    expect(str, ',');
+    drv.builder = parseString(str).toOwned();
 
     /* Parse the builder arguments. */
-    expect(str, ",[");
+    expect(str, ",["sv);
     while (!endOfList(str))
         drv.args.push_back(parseString(str).toOwned());
 
     /* Parse the environment variables. */
-    expect(str, ",[");
+    expect(str, ",["sv);
     while (!endOfList(str)) {
-        expect(str, "("); auto name = parseString(str).toOwned();
-        expect(str, ","); auto value = parseString(str).toOwned();
-        expect(str, ")");
-        drv.env.insert_or_assign(std::move(name), std::move(value));
+        expect(str, '(');
+        auto name = parseString(str).toOwned();
+        expect(str, ',');
+        auto value = parseString(str);
+        if (name == StructuredAttrs::envVarName) {
+            drv.structuredAttrs = StructuredAttrs::parse(*std::move(value));
+        } else {
+            drv.env.insert_or_assign(std::move(name), std::move(value).toOwned());
+        }
+        expect(str, ')');
     }
 
-    expect(str, ")");
+    expect(str, ')');
     return drv;
 }
 
-
 /**
  * Print a derivation string literal to an `std::string`.
  *
@@ -477,22 +499,35 @@ Derivation parseDerivation(
  */
 static void printString(std::string & res, std::string_view s)
 {
-    boost::container::small_vector<char, 64 * 1024> buffer;
-    buffer.reserve(s.size() * 2 + 2);
-    char * buf = buffer.data();
-    char * p = buf;
-    *p++ = '"';
-    for (auto c : s)
-        if (c == '\"' || c == '\\') { *p++ = '\\'; *p++ = c; }
-        else if (c == '\n') { *p++ = '\\'; *p++ = 'n'; }
-        else if (c == '\r') { *p++ = '\\'; *p++ = 'r'; }
-        else if (c == '\t') { *p++ = '\\'; *p++ = 't'; }
-        else *p++ = c;
-    *p++ = '"';
-    res.append(buf, p - buf);
+    res.reserve(res.size() + s.size() * 2 + 2);
+    res += '"';
+    static constexpr auto chunkSize = 1024;
+    std::array<char, 2 * chunkSize + 2> buffer;
+    while (!s.empty()) {
+        auto chunk = s.substr(0, /*n=*/chunkSize);
+        s.remove_prefix(chunk.size());
+        char * buf = buffer.data();
+        char * p = buf;
+        for (auto c : chunk)
+            if (c == '\"' || c == '\\') {
+                *p++ = '\\';
+                *p++ = c;
+            } else if (c == '\n') {
+                *p++ = '\\';
+                *p++ = 'n';
+            } else if (c == '\r') {
+                *p++ = '\\';
+                *p++ = 'r';
+            } else if (c == '\t') {
+                *p++ = '\\';
+                *p++ = 't';
+            } else
+                *p++ = c;
+        res.append(buf, p - buf);
+    }
+    res += '"';
 }
 
-
 static void printUnquotedString(std::string & res, std::string_view s)
 {
     res += '"';
@@ -500,54 +535,61 @@ static void printUnquotedString(std::string & res, std::string_view s)
     res += '"';
 }
 
-
 template<class ForwardIterator>
 static void printStrings(std::string & res, ForwardIterator i, ForwardIterator j)
 {
     res += '[';
     bool first = true;
-    for ( ; i != j; ++i) {
-        if (first) first = false; else res += ',';
+    for (; i != j; ++i) {
+        if (first)
+            first = false;
+        else
+            res += ',';
         printString(res, *i);
     }
     res += ']';
 }
 
-
 template<class ForwardIterator>
 static void printUnquotedStrings(std::string & res, ForwardIterator i, ForwardIterator j)
 {
     res += '[';
     bool first = true;
-    for ( ; i != j; ++i) {
-        if (first) first = false; else res += ',';
+    for (; i != j; ++i) {
+        if (first)
+            first = false;
+        else
+            res += ',';
         printUnquotedString(res, *i);
     }
     res += ']';
 }
 
-
-static void unparseDerivedPathMapNode(const StoreDirConfig & store, std::string & s, const DerivedPathMap<StringSet>::ChildNode & node)
+static void unparseDerivedPathMapNode(
+    const StoreDirConfig & store, std::string & s, const DerivedPathMap<StringSet>::ChildNode & node)
 {
     s += ',';
     if (node.childMap.empty()) {
         printUnquotedStrings(s, node.value.begin(), node.value.end());
     } else {
-        s += "(";
+        s += '(';
         printUnquotedStrings(s, node.value.begin(), node.value.end());
-        s += ",[";
+        s += ",["sv;
         bool first = true;
         for (auto & [outputName, childNode] : node.childMap) {
-            if (first) first = false; else s += ',';
-            s += '('; printUnquotedString(s, outputName);
+            if (first)
+                first = false;
+            else
+                s += ',';
+            s += '(';
+            printUnquotedString(s, outputName);
             unparseDerivedPathMapNode(store, s, childNode);
             s += ')';
         }
-        s += "])";
+        s += "])"sv;
     }
 }
 
-
 /**
  * Does the derivation have a dependency on the output of a dynamic
  * derivation?
@@ -559,17 +601,15 @@ static void unparseDerivedPathMapNode(const StoreDirConfig & store, std::string
  */
 static bool hasDynamicDrvDep(const Derivation & drv)
 {
-    return
-        std::find_if(
-            drv.inputDrvs.map.begin(),
-            drv.inputDrvs.map.end(),
-            [](auto & kv) { return !kv.second.childMap.empty(); })
-        != drv.inputDrvs.map.end();
+    return std::find_if(
+               drv.inputDrvs.map.begin(),
+               drv.inputDrvs.map.end(),
+               [](auto & kv) { return !kv.second.childMap.empty(); })
+           != drv.inputDrvs.map.end();
 }
 
-
-std::string Derivation::unparse(const StoreDirConfig & store, bool maskOutputs,
-    DerivedPathMap<StringSet>::ChildNode::Map * actualInputs) const
+std::string Derivation::unparse(
+    const StoreDirConfig & store, bool maskOutputs, DerivedPathMap<StringSet>::ChildNode::Map * actualInputs) const
 {
     std::string s;
     s.reserve(65536);
@@ -578,208 +618,224 @@ std::string Derivation::unparse(const StoreDirConfig & store, bool maskOutputs,
        newer form only if we need it, which we do for
        `Xp::DynamicDerivations`. */
     if (hasDynamicDrvDep(*this)) {
-        s += "DrvWithVersion(";
+        s += "DrvWithVersion("sv;
         // Only version we have so far
-        printUnquotedString(s, "xp-dyn-drv");
-        s += ",";
+        printUnquotedString(s, "xp-dyn-drv"sv);
+        s += ',';
     } else {
-        s += "Derive(";
+        s += "Derive("sv;
     }
 
     bool first = true;
-    s += "[";
+    s += '[';
     for (auto & i : outputs) {
-        if (first) first = false; else s += ',';
-        s += '('; printUnquotedString(s, i.first);
-        std::visit(overloaded {
-            [&](const DerivationOutput::InputAddressed & doi) {
-                s += ','; printUnquotedString(s, maskOutputs ? "" : store.printStorePath(doi.path));
-                s += ','; printUnquotedString(s, "");
-                s += ','; printUnquotedString(s, "");
-            },
-            [&](const DerivationOutput::CAFixed & dof) {
-                s += ','; printUnquotedString(s, maskOutputs ? "" : store.printStorePath(dof.path(store, name, i.first)));
-                s += ','; printUnquotedString(s, dof.ca.printMethodAlgo());
-                s += ','; printUnquotedString(s, dof.ca.hash.to_string(HashFormat::Base16, false));
-            },
-            [&](const DerivationOutput::CAFloating & dof) {
-                s += ','; printUnquotedString(s, "");
-                s += ','; printUnquotedString(s, std::string { dof.method.renderPrefix() } + printHashAlgo(dof.hashAlgo));
-                s += ','; printUnquotedString(s, "");
-            },
-            [&](const DerivationOutput::Deferred &) {
-                s += ','; printUnquotedString(s, "");
-                s += ','; printUnquotedString(s, "");
-                s += ','; printUnquotedString(s, "");
-            },
-            [&](const DerivationOutput::Impure & doi) {
-                // FIXME
-                s += ','; printUnquotedString(s, "");
-                s += ','; printUnquotedString(s, std::string { doi.method.renderPrefix() } + printHashAlgo(doi.hashAlgo));
-                s += ','; printUnquotedString(s, "impure");
-            }
-        }, i.second.raw);
+        if (first)
+            first = false;
+        else
+            s += ',';
+        s += '(';
+        printUnquotedString(s, i.first);
+        std::visit(
+            overloaded{
+                [&](const DerivationOutput::InputAddressed & doi) {
+                    s += ',';
+                    printUnquotedString(s, maskOutputs ? ""sv : store.printStorePath(doi.path));
+                    s += ',';
+                    printUnquotedString(s, {});
+                    s += ',';
+                    printUnquotedString(s, {});
+                },
+                [&](const DerivationOutput::CAFixed & dof) {
+                    s += ',';
+                    printUnquotedString(s, maskOutputs ? ""sv : store.printStorePath(dof.path(store, name, i.first)));
+                    s += ',';
+                    printUnquotedString(s, dof.ca.printMethodAlgo());
+                    s += ',';
+                    printUnquotedString(s, dof.ca.hash.to_string(HashFormat::Base16, false));
+                },
+                [&](const DerivationOutput::CAFloating & dof) {
+                    s += ',';
+                    printUnquotedString(s, {});
+                    s += ',';
+                    printUnquotedString(s, std::string{dof.method.renderPrefix()} + printHashAlgo(dof.hashAlgo));
+                    s += ',';
+                    printUnquotedString(s, {});
+                },
+                [&](const DerivationOutput::Deferred &) {
+                    s += ',';
+                    printUnquotedString(s, {});
+                    s += ',';
+                    printUnquotedString(s, {});
+                    s += ',';
+                    printUnquotedString(s, {});
+                },
+                [&](const DerivationOutput::Impure & doi) {
+                    // FIXME
+                    s += ',';
+                    printUnquotedString(s, {});
+                    s += ',';
+                    printUnquotedString(s, std::string{doi.method.renderPrefix()} + printHashAlgo(doi.hashAlgo));
+                    s += ',';
+                    printUnquotedString(s, "impure"sv);
+                }},
+            i.second.raw);
         s += ')';
     }
 
-    s += "],[";
+    s += "],["sv;
     first = true;
     if (actualInputs) {
         for (auto & [drvHashModulo, childMap] : *actualInputs) {
-            if (first) first = false; else s += ',';
-            s += '('; printUnquotedString(s, drvHashModulo);
+            if (first)
+                first = false;
+            else
+                s += ',';
+            s += '(';
+            printUnquotedString(s, drvHashModulo);
             unparseDerivedPathMapNode(store, s, childMap);
             s += ')';
         }
     } else {
         for (auto & [drvPath, childMap] : inputDrvs.map) {
-            if (first) first = false; else s += ',';
-            s += '('; printUnquotedString(s, store.printStorePath(drvPath));
+            if (first)
+                first = false;
+            else
+                s += ',';
+            s += '(';
+            printUnquotedString(s, store.printStorePath(drvPath));
             unparseDerivedPathMapNode(store, s, childMap);
             s += ')';
         }
     }
 
-    s += "],";
+    s += "],"sv;
     auto paths = store.printStorePathSet(inputSrcs); // FIXME: slow
     printUnquotedStrings(s, paths.begin(), paths.end());
 
-    s += ','; printUnquotedString(s, platform);
-    s += ','; printString(s, builder);
-    s += ','; printStrings(s, args.begin(), args.end());
+    s += ',';
+    printUnquotedString(s, platform);
+    s += ',';
+    printString(s, builder);
+    s += ',';
+    printStrings(s, args.begin(), args.end());
 
-    s += ",[";
+    s += ",["sv;
     first = true;
-    for (auto & i : env) {
-        if (first) first = false; else s += ',';
-        s += '('; printString(s, i.first);
-        s += ','; printString(s, maskOutputs && outputs.count(i.first) ? "" : i.second);
-        s += ')';
+
+    auto unparseEnv = [&](const StringPairs atermEnv) {
+        for (auto & i : atermEnv) {
+            if (first)
+                first = false;
+            else
+                s += ',';
+            s += '(';
+            printString(s, i.first);
+            s += ',';
+            printString(s, maskOutputs && outputs.count(i.first) ? ""sv : i.second);
+            s += ')';
+        }
+    };
+
+    StructuredAttrs::checkKeyNotInUse(env);
+    if (structuredAttrs) {
+        StringPairs scratch = env;
+        scratch.insert(structuredAttrs->unparse());
+        unparseEnv(scratch);
+    } else {
+        unparseEnv(env);
     }
 
-    s += "])";
+    s += "])"sv;
 
     return s;
 }
 
-
 // FIXME: remove
 bool isDerivation(std::string_view fileName)
 {
     return hasSuffix(fileName, drvExtension);
 }
 
-
-std::string outputPathName(std::string_view drvName, OutputNameView outputName) {
-    std::string res { drvName };
-    if (outputName != "out") {
-        res += "-";
+std::string outputPathName(std::string_view drvName, OutputNameView outputName)
+{
+    std::string res{drvName};
+    if (outputName != "out"sv) {
+        res += '-';
         res += outputName;
     }
     return res;
 }
 
-
 DerivationType BasicDerivation::type() const
 {
-    std::set<std::string_view>
-        inputAddressedOutputs,
-        fixedCAOutputs,
-        floatingCAOutputs,
-        deferredIAOutputs,
+    std::set<std::string_view> inputAddressedOutputs, fixedCAOutputs, floatingCAOutputs, deferredIAOutputs,
         impureOutputs;
     std::optional<HashAlgorithm> floatingHashAlgo;
 
     for (auto & i : outputs) {
-        std::visit(overloaded {
-            [&](const DerivationOutput::InputAddressed &) {
-               inputAddressedOutputs.insert(i.first);
+        std::visit(
+            overloaded{
+                [&](const DerivationOutput::InputAddressed &) { inputAddressedOutputs.insert(i.first); },
+                [&](const DerivationOutput::CAFixed &) { fixedCAOutputs.insert(i.first); },
+                [&](const DerivationOutput::CAFloating & dof) {
+                    floatingCAOutputs.insert(i.first);
+                    if (!floatingHashAlgo) {
+                        floatingHashAlgo = dof.hashAlgo;
+                    } else {
+                        if (*floatingHashAlgo != dof.hashAlgo)
+                            throw Error("all floating outputs must use the same hash algorithm");
+                    }
+                },
+                [&](const DerivationOutput::Deferred &) { deferredIAOutputs.insert(i.first); },
+                [&](const DerivationOutput::Impure &) { impureOutputs.insert(i.first); },
             },
-            [&](const DerivationOutput::CAFixed &) {
-                fixedCAOutputs.insert(i.first);
-            },
-            [&](const DerivationOutput::CAFloating & dof) {
-                floatingCAOutputs.insert(i.first);
-                if (!floatingHashAlgo) {
-                    floatingHashAlgo = dof.hashAlgo;
-                } else {
-                    if (*floatingHashAlgo != dof.hashAlgo)
-                        throw Error("all floating outputs must use the same hash algorithm");
-                }
-            },
-            [&](const DerivationOutput::Deferred &) {
-                deferredIAOutputs.insert(i.first);
-            },
-            [&](const DerivationOutput::Impure &) {
-                impureOutputs.insert(i.first);
-            },
-        }, i.second.raw);
+            i.second.raw);
     }
 
-    if (inputAddressedOutputs.empty()
-        && fixedCAOutputs.empty()
-        && floatingCAOutputs.empty()
-        && deferredIAOutputs.empty()
-        && impureOutputs.empty())
+    if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty() && impureOutputs.empty())
         throw Error("must have at least one output");
 
-    if (!inputAddressedOutputs.empty()
-        && fixedCAOutputs.empty()
-        && floatingCAOutputs.empty()
-        && deferredIAOutputs.empty()
-        && impureOutputs.empty())
-        return DerivationType::InputAddressed {
+    if (!inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty() && impureOutputs.empty())
+        return DerivationType::InputAddressed{
             .deferred = false,
         };
 
-    if (inputAddressedOutputs.empty()
-        && !fixedCAOutputs.empty()
-        && floatingCAOutputs.empty()
-        && deferredIAOutputs.empty()
-        && impureOutputs.empty())
-    {
+    if (inputAddressedOutputs.empty() && !fixedCAOutputs.empty() && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty() && impureOutputs.empty()) {
         if (fixedCAOutputs.size() > 1)
             // FIXME: Experimental feature?
             throw Error("only one fixed output is allowed for now");
-        if (*fixedCAOutputs.begin() != "out")
+        if (*fixedCAOutputs.begin() != "out"sv)
             throw Error("single fixed output must be named \"out\"");
-        return DerivationType::ContentAddressed {
+        return DerivationType::ContentAddressed{
             .sandboxed = false,
             .fixed = true,
         };
     }
 
-    if (inputAddressedOutputs.empty()
-        && fixedCAOutputs.empty()
-        && !floatingCAOutputs.empty()
-        && deferredIAOutputs.empty()
-        && impureOutputs.empty())
-        return DerivationType::ContentAddressed {
+    if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && !floatingCAOutputs.empty()
+        && deferredIAOutputs.empty() && impureOutputs.empty())
+        return DerivationType::ContentAddressed{
             .sandboxed = true,
             .fixed = false,
         };
 
-    if (inputAddressedOutputs.empty()
-        && fixedCAOutputs.empty()
-        && floatingCAOutputs.empty()
-        && !deferredIAOutputs.empty()
-        && impureOutputs.empty())
-        return DerivationType::InputAddressed {
+    if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty()
+        && !deferredIAOutputs.empty() && impureOutputs.empty())
+        return DerivationType::InputAddressed{
             .deferred = true,
         };
 
-    if (inputAddressedOutputs.empty()
-        && fixedCAOutputs.empty()
-        && floatingCAOutputs.empty()
-        && deferredIAOutputs.empty()
-        && !impureOutputs.empty())
-        return DerivationType::Impure { };
+    if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty() && !impureOutputs.empty())
+        return DerivationType::Impure{};
 
     throw Error("can't mix derivation output types");
 }
 
-
-Sync<DrvHashes> drvHashes;
+DrvHashes drvHashes;
 
 /* pathDerivationModulo and hashDerivationModulo are mutually recursive
  */
@@ -789,19 +845,13 @@ Sync<DrvHashes> drvHashes;
  */
 static const DrvHash pathDerivationModulo(Store & store, const StorePath & drvPath)
 {
-    {
-        auto hashes = drvHashes.lock();
-        auto h = hashes->find(drvPath);
-        if (h != hashes->end()) {
-            return h->second;
-        }
+    std::optional<DrvHash> hash;
+    if (drvHashes.cvisit(drvPath, [&hash](const auto & kv) { hash.emplace(kv.second); })) {
+        return *hash;
     }
-    auto h = hashDerivationModulo(
-        store,
-        store.readInvalidDerivation(drvPath),
-        false);
+    auto h = hashDerivationModulo(store, store.readInvalidDerivation(drvPath), false);
     // Cache it
-    drvHashes.lock()->insert_or_assign(drvPath, h);
+    drvHashes.insert_or_assign(drvPath, h);
     return h;
 }
 
@@ -831,33 +881,30 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
         std::map<std::string, Hash> outputHashes;
         for (const auto & i : drv.outputs) {
             auto & dof = std::get<DerivationOutput::CAFixed>(i.second.raw);
-            auto hash = hashString(HashAlgorithm::SHA256, "fixed:out:"
-                + dof.ca.printMethodAlgo() + ":"
-                + dof.ca.hash.to_string(HashFormat::Base16, false) + ":"
-                + store.printStorePath(dof.path(store, drv.name, i.first)));
+            auto hash = hashString(
+                HashAlgorithm::SHA256,
+                "fixed:out:" + dof.ca.printMethodAlgo() + ":" + dof.ca.hash.to_string(HashFormat::Base16, false) + ":"
+                    + store.printStorePath(dof.path(store, drv.name, i.first)));
             outputHashes.insert_or_assign(i.first, std::move(hash));
         }
-        return DrvHash {
+        return DrvHash{
             .hashes = outputHashes,
             .kind = DrvHash::Kind::Regular,
         };
     }
 
-    auto kind = std::visit(overloaded {
-        [](const DerivationType::InputAddressed & ia) {
-            /* This might be a "pesimistically" deferred output, so we don't
-               "taint" the kind yet. */
-            return DrvHash::Kind::Regular;
-        },
-        [](const DerivationType::ContentAddressed & ca) {
-            return ca.fixed
-                ? DrvHash::Kind::Regular
-                : DrvHash::Kind::Deferred;
-        },
-        [](const DerivationType::Impure &) -> DrvHash::Kind {
-            return DrvHash::Kind::Deferred;
-        }
-    }, drv.type().raw);
+    auto kind = std::visit(
+        overloaded{
+            [](const DerivationType::InputAddressed & ia) {
+                /* This might be a "pesimistically" deferred output, so we don't
+                   "taint" the kind yet. */
+                return DrvHash::Kind::Regular;
+            },
+            [](const DerivationType::ContentAddressed & ca) {
+                return ca.fixed ? DrvHash::Kind::Regular : DrvHash::Kind::Deferred;
+            },
+            [](const DerivationType::Impure &) -> DrvHash::Kind { return DrvHash::Kind::Deferred; }},
+        drv.type().raw);
 
     DerivedPathMap<StringSet>::ChildNode::Map inputs2;
     for (auto & [drvPath, node] : drv.inputDrvs.map) {
@@ -879,19 +926,17 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
         outputHashes.insert_or_assign(outputName, hash);
     }
 
-    return DrvHash {
+    return DrvHash{
         .hashes = outputHashes,
         .kind = kind,
     };
 }
 
-
 std::map<std::string, Hash> staticOutputHashes(Store & store, const Derivation & drv)
 {
     return hashDerivationModulo(store, drv, true).hashes;
 }
 
-
 static DerivationOutput readDerivationOutput(Source & in, const StoreDirConfig & store)
 {
     const auto pathS = readString(in);
@@ -913,11 +958,8 @@ DerivationOutputsAndOptPaths BasicDerivation::outputsAndOptPaths(const StoreDirC
 {
     DerivationOutputsAndOptPaths outsAndOptPaths;
     for (auto & [outputName, output] : outputs)
-        outsAndOptPaths.insert(std::make_pair(
-            outputName,
-            std::make_pair(output, output.path(store, name, outputName))
-            )
-        );
+        outsAndOptPaths.insert(
+            std::make_pair(outputName, std::make_pair(output, output.path(store, name, outputName))));
     return outsAndOptPaths;
 }
 
@@ -929,7 +971,6 @@ std::string_view BasicDerivation::nameFromPath(const StorePath & drvPath)
     return nameWithSuffix;
 }
 
-
 Source & readDerivation(Source & in, const StoreDirConfig & store, BasicDerivation & drv, std::string_view name)
 {
     drv.name = name;
@@ -942,8 +983,7 @@ Source & readDerivation(Source & in, const StoreDirConfig & store, BasicDerivati
         drv.outputs.emplace(std::move(name), std::move(output));
     }
 
-    drv.inputSrcs = CommonProto::Serialise<StorePathSet>::read(store,
-        CommonProto::ReadConn { .from = in });
+    drv.inputSrcs = CommonProto::Serialise<StorePathSet>::read(store, CommonProto::ReadConn{.from = in});
     in >> drv.platform >> drv.builder;
     drv.args = readStrings<Strings>(in);
 
@@ -953,63 +993,71 @@ Source & readDerivation(Source & in, const StoreDirConfig & store, BasicDerivati
         auto value = readString(in);
         drv.env[key] = value;
     }
+    drv.structuredAttrs = StructuredAttrs::tryExtract(drv.env);
 
     return in;
 }
 
-
 void writeDerivation(Sink & out, const StoreDirConfig & store, const BasicDerivation & drv)
 {
     out << drv.outputs.size();
     for (auto & i : drv.outputs) {
         out << i.first;
-        std::visit(overloaded {
-            [&](const DerivationOutput::InputAddressed & doi) {
-                out << store.printStorePath(doi.path)
-                    << ""
-                    << "";
+        std::visit(
+            overloaded{
+                [&](const DerivationOutput::InputAddressed & doi) {
+                    out << store.printStorePath(doi.path) << ""
+                        << "";
+                },
+                [&](const DerivationOutput::CAFixed & dof) {
+                    out << store.printStorePath(dof.path(store, drv.name, i.first)) << dof.ca.printMethodAlgo()
+                        << dof.ca.hash.to_string(HashFormat::Base16, false);
+                },
+                [&](const DerivationOutput::CAFloating & dof) {
+                    out << "" << (std::string{dof.method.renderPrefix()} + printHashAlgo(dof.hashAlgo)) << "";
+                },
+                [&](const DerivationOutput::Deferred &) {
+                    out << ""
+                        << ""
+                        << "";
+                },
+                [&](const DerivationOutput::Impure & doi) {
+                    out << "" << (std::string{doi.method.renderPrefix()} + printHashAlgo(doi.hashAlgo)) << "impure";
+                },
             },
-            [&](const DerivationOutput::CAFixed & dof) {
-                out << store.printStorePath(dof.path(store, drv.name, i.first))
-                    << dof.ca.printMethodAlgo()
-                    << dof.ca.hash.to_string(HashFormat::Base16, false);
-            },
-            [&](const DerivationOutput::CAFloating & dof) {
-                out << ""
-                    << (std::string { dof.method.renderPrefix() } + printHashAlgo(dof.hashAlgo))
-                    << "";
-            },
-            [&](const DerivationOutput::Deferred &) {
-                out << ""
-                    << ""
-                    << "";
-            },
-            [&](const DerivationOutput::Impure & doi) {
-                out << ""
-                    << (std::string { doi.method.renderPrefix() } + printHashAlgo(doi.hashAlgo))
-                    << "impure";
-            },
-        }, i.second.raw);
+            i.second.raw);
     }
-    CommonProto::write(store,
-        CommonProto::WriteConn { .to = out },
-        drv.inputSrcs);
+    CommonProto::write(store, CommonProto::WriteConn{.to = out}, drv.inputSrcs);
     out << drv.platform << drv.builder << drv.args;
-    out << drv.env.size();
-    for (auto & i : drv.env)
-        out << i.first << i.second;
-}
 
+    auto writeEnv = [&](const StringPairs atermEnv) {
+        out << atermEnv.size();
+        for (auto & [k, v] : atermEnv)
+            out << k << v;
+    };
+
+    StructuredAttrs::checkKeyNotInUse(drv.env);
+    if (drv.structuredAttrs) {
+        StringPairs scratch = drv.env;
+        scratch.insert(drv.structuredAttrs->unparse());
+        writeEnv(scratch);
+    } else {
+        writeEnv(drv.env);
+    }
+}
 
 std::string hashPlaceholder(const OutputNameView outputName)
 {
     // FIXME: memoize?
-    return "/" + hashString(HashAlgorithm::SHA256, concatStrings("nix-output:", outputName)).to_string(HashFormat::Nix32, false);
+    return "/"
+           + hashString(HashAlgorithm::SHA256, concatStrings("nix-output:", outputName))
+                 .to_string(HashFormat::Nix32, false);
 }
 
 void BasicDerivation::applyRewrites(const StringMap & rewrites)
 {
-    if (rewrites.empty()) return;
+    if (rewrites.empty())
+        return;
 
     debug("rewriting the derivation");
 
@@ -1027,6 +1075,13 @@ void BasicDerivation::applyRewrites(const StringMap & rewrites)
         newEnv.emplace(envName, envValue);
     }
     env = std::move(newEnv);
+
+    if (structuredAttrs) {
+        // TODO rewrite the JSON AST properly, rather than dump parse round trip.
+        auto [_, jsonS] = structuredAttrs->unparse();
+        jsonS = rewriteStrings(std::move(jsonS), rewrites);
+        structuredAttrs = StructuredAttrs::parse(jsonS);
+    }
 }
 
 static void rewriteDerivation(Store & store, BasicDerivation & drv, const StringMap & rewrites)
@@ -1038,23 +1093,21 @@ static void rewriteDerivation(Store & store, BasicDerivation & drv, const String
         if (std::holds_alternative<DerivationOutput::Deferred>(output.raw)) {
             auto h = get(hashModulo.hashes, outputName);
             if (!h)
-                throw Error("derivation '%s' output '%s' has no hash (derivations.cc/rewriteDerivation)",
-                    drv.name, outputName);
+                throw Error(
+                    "derivation '%s' output '%s' has no hash (derivations.cc/rewriteDerivation)", drv.name, outputName);
             auto outPath = store.makeOutputPath(outputName, *h, drv.name);
             drv.env[outputName] = store.printStorePath(outPath);
-            output = DerivationOutput::InputAddressed {
+            output = DerivationOutput::InputAddressed{
                 .path = std::move(outPath),
             };
         }
     }
-
 }
 
 std::optional<BasicDerivation> Derivation::tryResolve(Store & store, Store * evalStore) const
 {
     return tryResolve(
-        store,
-        [&](ref<const SingleDerivedPath> drvPath, const std::string & outputName) -> std::optional<StorePath> {
+        store, [&](ref<const SingleDerivedPath> drvPath, const std::string & outputName) -> std::optional<StorePath> {
             try {
                 return resolveDerivedPath(store, SingleDerivedPath::Built{drvPath, outputName}, evalStore);
             } catch (Error &) {
@@ -1064,41 +1117,45 @@ std::optional<BasicDerivation> Derivation::tryResolve(Store & store, Store * eva
 }
 
 static bool tryResolveInput(
-    Store & store, StorePathSet & inputSrcs, StringMap & inputRewrites,
+    Store & store,
+    StorePathSet & inputSrcs,
+    StringMap & inputRewrites,
     const DownstreamPlaceholder * placeholderOpt,
-    ref<const SingleDerivedPath> drvPath, const DerivedPathMap<StringSet>::ChildNode & inputNode,
-    std::function<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)> queryResolutionChain)
+    ref<const SingleDerivedPath> drvPath,
+    const DerivedPathMap<StringSet>::ChildNode & inputNode,
+    std::function<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
+        queryResolutionChain)
 {
     auto getPlaceholder = [&](const std::string & outputName) {
-        return placeholderOpt
-            ? DownstreamPlaceholder::unknownDerivation(*placeholderOpt, outputName)
-            : [&]{
-                auto * p = std::get_if<SingleDerivedPath::Opaque>(&drvPath->raw());
-                // otherwise we should have had a placeholder to build-upon already
-                assert(p);
-                return DownstreamPlaceholder::unknownCaOutput(p->path, outputName);
-            }();
+        return placeholderOpt ? DownstreamPlaceholder::unknownDerivation(*placeholderOpt, outputName) : [&] {
+            auto * p = std::get_if<SingleDerivedPath::Opaque>(&drvPath->raw());
+            // otherwise we should have had a placeholder to build-upon already
+            assert(p);
+            return DownstreamPlaceholder::unknownCaOutput(p->path, outputName);
+        }();
     };
 
     for (auto & outputName : inputNode.value) {
         auto actualPathOpt = queryResolutionChain(drvPath, outputName);
-        if (!actualPathOpt) return false;
+        if (!actualPathOpt)
+            return false;
         auto actualPath = *actualPathOpt;
         if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
-            inputRewrites.emplace(
-                getPlaceholder(outputName).render(),
-                store.printStorePath(actualPath));
+            inputRewrites.emplace(getPlaceholder(outputName).render(), store.printStorePath(actualPath));
         }
         inputSrcs.insert(std::move(actualPath));
     }
 
     for (auto & [outputName, childNode] : inputNode.childMap) {
         auto nextPlaceholder = getPlaceholder(outputName);
-        if (!tryResolveInput(store, inputSrcs, inputRewrites,
-            &nextPlaceholder,
-            make_ref<const SingleDerivedPath>(SingleDerivedPath::Built{drvPath, outputName}),
-            childNode,
-            queryResolutionChain))
+        if (!tryResolveInput(
+                store,
+                inputSrcs,
+                inputRewrites,
+                &nextPlaceholder,
+                make_ref<const SingleDerivedPath>(SingleDerivedPath::Built{drvPath, outputName}),
+                childNode,
+                queryResolutionChain))
             return false;
     }
     return true;
@@ -1106,16 +1163,23 @@ static bool tryResolveInput(
 
 std::optional<BasicDerivation> Derivation::tryResolve(
     Store & store,
-    std::function<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)> queryResolutionChain) const
+    std::function<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
+        queryResolutionChain) const
 {
-    BasicDerivation resolved { *this };
+    BasicDerivation resolved{*this};
 
     // Input paths that we'll want to rewrite in the derivation
     StringMap inputRewrites;
 
     for (auto & [inputDrv, inputNode] : inputDrvs.map)
-        if (!tryResolveInput(store, resolved.inputSrcs, inputRewrites,
-            nullptr, make_ref<const SingleDerivedPath>(SingleDerivedPath::Opaque{inputDrv}), inputNode, queryResolutionChain))
+        if (!tryResolveInput(
+                store,
+                resolved.inputSrcs,
+                inputRewrites,
+                nullptr,
+                make_ref<const SingleDerivedPath>(SingleDerivedPath::Opaque{inputDrv}),
+                inputNode,
+                queryResolutionChain))
             return std::nullopt;
 
     rewriteDerivation(store, resolved, inputRewrites);
@@ -1123,7 +1187,6 @@ std::optional<BasicDerivation> Derivation::tryResolve(
     return resolved;
 }
 
-
 void Derivation::checkInvariants(Store & store, const StorePath & drvPath) const
 {
     assert(drvPath.isDerivation());
@@ -1134,15 +1197,16 @@ void Derivation::checkInvariants(Store & store, const StorePath & drvPath) const
         throw Error("Derivation '%s' has name '%s' which does not match its path", store.printStorePath(drvPath), name);
     }
 
-    auto envHasRightPath = [&](const StorePath & actual, const std::string & varName)
-    {
+    auto envHasRightPath = [&](const StorePath & actual, const std::string & varName) {
         auto j = env.find(varName);
         if (j == env.end() || store.parseStorePath(j->second) != actual)
-            throw Error("derivation '%s' has incorrect environment variable '%s', should be '%s'",
-                store.printStorePath(drvPath), varName, store.printStorePath(actual));
+            throw Error(
+                "derivation '%s' has incorrect environment variable '%s', should be '%s'",
+                store.printStorePath(drvPath),
+                varName,
+                store.printStorePath(actual));
     };
 
-
     // Don't need the answer, but do this anyways to assert is proper
     // combination. The code below is more general and naturally allows
     // combinations that are currently prohibited.
@@ -1150,74 +1214,82 @@ void Derivation::checkInvariants(Store & store, const StorePath & drvPath) const
 
     std::optional<DrvHash> hashesModulo;
     for (auto & i : outputs) {
-        std::visit(overloaded {
-            [&](const DerivationOutput::InputAddressed & doia) {
-                if (!hashesModulo) {
-                    // somewhat expensive so we do lazily
-                    hashesModulo = hashDerivationModulo(store, *this, true);
-                }
-                auto currentOutputHash = get(hashesModulo->hashes, i.first);
-                if (!currentOutputHash)
-                    throw Error("derivation '%s' has unexpected output '%s' (local-store / hashesModulo) named '%s'",
-                        store.printStorePath(drvPath), store.printStorePath(doia.path), i.first);
-                StorePath recomputed = store.makeOutputPath(i.first, *currentOutputHash, drvName);
-                if (doia.path != recomputed)
-                    throw Error("derivation '%s' has incorrect output '%s', should be '%s'",
-                        store.printStorePath(drvPath), store.printStorePath(doia.path), store.printStorePath(recomputed));
-                envHasRightPath(doia.path, i.first);
+        std::visit(
+            overloaded{
+                [&](const DerivationOutput::InputAddressed & doia) {
+                    if (!hashesModulo) {
+                        // somewhat expensive so we do lazily
+                        hashesModulo = hashDerivationModulo(store, *this, true);
+                    }
+                    auto currentOutputHash = get(hashesModulo->hashes, i.first);
+                    if (!currentOutputHash)
+                        throw Error(
+                            "derivation '%s' has unexpected output '%s' (local-store / hashesModulo) named '%s'",
+                            store.printStorePath(drvPath),
+                            store.printStorePath(doia.path),
+                            i.first);
+                    StorePath recomputed = store.makeOutputPath(i.first, *currentOutputHash, drvName);
+                    if (doia.path != recomputed)
+                        throw Error(
+                            "derivation '%s' has incorrect output '%s', should be '%s'",
+                            store.printStorePath(drvPath),
+                            store.printStorePath(doia.path),
+                            store.printStorePath(recomputed));
+                    envHasRightPath(doia.path, i.first);
+                },
+                [&](const DerivationOutput::CAFixed & dof) {
+                    auto path = dof.path(store, drvName, i.first);
+                    envHasRightPath(path, i.first);
+                },
+                [&](const DerivationOutput::CAFloating &) {
+                    /* Nothing to check */
+                },
+                [&](const DerivationOutput::Deferred &) {
+                    /* Nothing to check */
+                },
+                [&](const DerivationOutput::Impure &) {
+                    /* Nothing to check */
+                },
             },
-            [&](const DerivationOutput::CAFixed & dof) {
-                auto path = dof.path(store, drvName, i.first);
-                envHasRightPath(path, i.first);
-            },
-            [&](const DerivationOutput::CAFloating &) {
-                /* Nothing to check */
-            },
-            [&](const DerivationOutput::Deferred &) {
-                /* Nothing to check */
-            },
-            [&](const DerivationOutput::Impure &) {
-                /* Nothing to check */
-            },
-        }, i.second.raw);
+            i.second.raw);
     }
 }
 
-
 const Hash impureOutputHash = hashString(HashAlgorithm::SHA256, "impure");
 
-nlohmann::json DerivationOutput::toJSON(
-    const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const
+nlohmann::json
+DerivationOutput::toJSON(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const
 {
     nlohmann::json res = nlohmann::json::object();
-    std::visit(overloaded {
-        [&](const DerivationOutput::InputAddressed & doi) {
-            res["path"] = store.printStorePath(doi.path);
+    std::visit(
+        overloaded{
+            [&](const DerivationOutput::InputAddressed & doi) { res["path"] = store.printStorePath(doi.path); },
+            [&](const DerivationOutput::CAFixed & dof) {
+                res["path"] = store.printStorePath(dof.path(store, drvName, outputName));
+                res["method"] = std::string{dof.ca.method.render()};
+                res["hashAlgo"] = printHashAlgo(dof.ca.hash.algo);
+                res["hash"] = dof.ca.hash.to_string(HashFormat::Base16, false);
+                // FIXME print refs?
+            },
+            [&](const DerivationOutput::CAFloating & dof) {
+                res["method"] = std::string{dof.method.render()};
+                res["hashAlgo"] = printHashAlgo(dof.hashAlgo);
+            },
+            [&](const DerivationOutput::Deferred &) {},
+            [&](const DerivationOutput::Impure & doi) {
+                res["method"] = std::string{doi.method.render()};
+                res["hashAlgo"] = printHashAlgo(doi.hashAlgo);
+                res["impure"] = true;
+            },
         },
-        [&](const DerivationOutput::CAFixed & dof) {
-            res["path"] = store.printStorePath(dof.path(store, drvName, outputName));
-            res["method"] = std::string { dof.ca.method.render() };
-            res["hashAlgo"] = printHashAlgo(dof.ca.hash.algo);
-            res["hash"] = dof.ca.hash.to_string(HashFormat::Base16, false);
-            // FIXME print refs?
-        },
-        [&](const DerivationOutput::CAFloating & dof) {
-            res["method"] = std::string { dof.method.render() };
-            res["hashAlgo"] = printHashAlgo(dof.hashAlgo);
-        },
-        [&](const DerivationOutput::Deferred &) {},
-        [&](const DerivationOutput::Impure & doi) {
-            res["method"] = std::string { doi.method.render() };
-            res["hashAlgo"] = printHashAlgo(doi.hashAlgo);
-            res["impure"] = true;
-        },
-    }, raw);
+        raw);
     return res;
 }
 
-
 DerivationOutput DerivationOutput::fromJSON(
-    const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName,
+    const StoreDirConfig & store,
+    std::string_view drvName,
+    OutputNameView outputName,
     const nlohmann::json & _json,
     const ExperimentalFeatureSettings & xpSettings)
 {
@@ -1228,52 +1300,51 @@ DerivationOutput DerivationOutput::fromJSON(
         keys.insert(key);
 
     auto methodAlgo = [&]() -> std::pair<ContentAddressMethod, HashAlgorithm> {
-        ContentAddressMethod method = ContentAddressMethod::parse(
-            getString(valueAt(json, "method")));
+        ContentAddressMethod method = ContentAddressMethod::parse(getString(valueAt(json, "method")));
         if (method == ContentAddressMethod::Raw::Text)
             xpSettings.require(Xp::DynamicDerivations);
 
-        auto hashAlgo = parseHashAlgo(
-            getString(valueAt(json, "hashAlgo")));
-        return { std::move(method), std::move(hashAlgo) };
+        auto hashAlgo = parseHashAlgo(getString(valueAt(json, "hashAlgo")));
+        return {std::move(method), std::move(hashAlgo)};
     };
 
-    if (keys == (std::set<std::string_view> { "path" })) {
-        return DerivationOutput::InputAddressed {
+    if (keys == (std::set<std::string_view>{"path"})) {
+        return DerivationOutput::InputAddressed{
             .path = store.parseStorePath(getString(valueAt(json, "path"))),
         };
     }
 
-    else if (keys == (std::set<std::string_view> { "path", "method", "hashAlgo", "hash" })) {
+    else if (keys == (std::set<std::string_view>{"path", "method", "hashAlgo", "hash"})) {
         auto [method, hashAlgo] = methodAlgo();
-        auto dof = DerivationOutput::CAFixed {
-            .ca = ContentAddress {
-                .method = std::move(method),
-                .hash = Hash::parseNonSRIUnprefixed(getString(valueAt(json, "hash")), hashAlgo),
-            },
+        auto dof = DerivationOutput::CAFixed{
+            .ca =
+                ContentAddress{
+                    .method = std::move(method),
+                    .hash = Hash::parseNonSRIUnprefixed(getString(valueAt(json, "hash")), hashAlgo),
+                },
         };
         if (dof.path(store, drvName, outputName) != store.parseStorePath(getString(valueAt(json, "path"))))
             throw Error("Path doesn't match derivation output");
         return dof;
     }
 
-    else if (keys == (std::set<std::string_view> { "method", "hashAlgo" })) {
+    else if (keys == (std::set<std::string_view>{"method", "hashAlgo"})) {
         xpSettings.require(Xp::CaDerivations);
         auto [method, hashAlgo] = methodAlgo();
-        return DerivationOutput::CAFloating {
+        return DerivationOutput::CAFloating{
             .method = std::move(method),
             .hashAlgo = std::move(hashAlgo),
         };
     }
 
-    else if (keys == (std::set<std::string_view> { })) {
-        return DerivationOutput::Deferred {};
+    else if (keys == (std::set<std::string_view>{})) {
+        return DerivationOutput::Deferred{};
     }
 
-    else if (keys == (std::set<std::string_view> { "method", "hashAlgo", "impure" })) {
+    else if (keys == (std::set<std::string_view>{"method", "hashAlgo", "impure"})) {
         xpSettings.require(Xp::ImpureDerivations);
         auto [method, hashAlgo] = methodAlgo();
-        return DerivationOutput::Impure {
+        return DerivationOutput::Impure{
             .method = std::move(method),
             .hashAlgo = hashAlgo,
         };
@@ -1284,7 +1355,6 @@ DerivationOutput DerivationOutput::fromJSON(
     }
 }
 
-
 nlohmann::json Derivation::toJSON(const StoreDirConfig & store) const
 {
     nlohmann::json res = nlohmann::json::object();
@@ -1300,7 +1370,7 @@ nlohmann::json Derivation::toJSON(const StoreDirConfig & store) const
     }
 
     {
-        auto& inputsList = res["inputSrcs"];
+        auto & inputsList = res["inputSrcs"];
         inputsList = nlohmann::json ::array();
         for (auto & input : inputSrcs)
             inputsList.emplace_back(store.printStorePath(input));
@@ -1320,7 +1390,7 @@ nlohmann::json Derivation::toJSON(const StoreDirConfig & store) const
             return value;
         };
         {
-            auto& inputDrvsObj = res["inputDrvs"];
+            auto & inputDrvsObj = res["inputDrvs"];
             inputDrvsObj = nlohmann::json::object();
             for (auto & [inputDrv, inputNode] : inputDrvs.map) {
                 inputDrvsObj[store.printStorePath(inputDrv)] = doInput(inputNode);
@@ -1333,19 +1403,14 @@ nlohmann::json Derivation::toJSON(const StoreDirConfig & store) const
     res["args"] = args;
     res["env"] = env;
 
-    if (auto it = env.find("__json"); it != env.end()) {
-        res["env"].erase("__json");
-        res["structuredAttrs"] = nlohmann::json::parse(it->second);
-    }
+    if (structuredAttrs)
+        res["structuredAttrs"] = structuredAttrs->structuredAttrs;
 
     return res;
 }
 
-
 Derivation Derivation::fromJSON(
-    const StoreDirConfig & store,
-    const nlohmann::json & _json,
-    const ExperimentalFeatureSettings & xpSettings)
+    const StoreDirConfig & store, const nlohmann::json & _json, const ExperimentalFeatureSettings & xpSettings)
 {
     using nlohmann::detail::value_t;
 
@@ -1359,8 +1424,7 @@ Derivation Derivation::fromJSON(
         auto outputs = getObject(valueAt(json, "outputs"));
         for (auto & [outputName, output] : outputs) {
             res.outputs.insert_or_assign(
-                outputName,
-                DerivationOutput::fromJSON(store, res.name, outputName, output, xpSettings));
+                outputName, DerivationOutput::fromJSON(store, res.name, outputName, output, xpSettings));
         }
     } catch (Error & e) {
         e.addTrace({}, "while reading key 'outputs'");
@@ -1391,8 +1455,7 @@ Derivation Derivation::fromJSON(
         };
         auto drvs = getObject(valueAt(json, "inputDrvs"));
         for (auto & [inputDrvPath, inputOutputs] : drvs)
-            res.inputDrvs.map[store.parseStorePath(inputDrvPath)] =
-                doInput(inputOutputs);
+            res.inputDrvs.map[store.parseStorePath(inputDrvPath)] = doInput(inputOutputs);
     } catch (Error & e) {
         e.addTrace({}, "while reading key 'inputDrvs'");
         throw;
@@ -1411,9 +1474,9 @@ Derivation Derivation::fromJSON(
     }
 
     if (auto structuredAttrs = get(json, "structuredAttrs"))
-        res.env.insert_or_assign("__json", structuredAttrs->dump());
+        res.structuredAttrs = StructuredAttrs{*structuredAttrs};
 
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/derived-path-map.cc b/src/libstore/derived-path-map.cc
index e34deb744..bcbdc85bd 100644
--- a/src/libstore/derived-path-map.cc
+++ b/src/libstore/derived-path-map.cc
@@ -6,18 +6,20 @@ namespace nix {
 template<typename V>
 typename DerivedPathMap<V>::ChildNode & DerivedPathMap<V>::ensureSlot(const SingleDerivedPath & k)
 {
-    std::function<ChildNode &(const SingleDerivedPath & )> initIter;
+    std::function<ChildNode &(const SingleDerivedPath &)> initIter;
     initIter = [&](const auto & k) -> auto & {
-        return std::visit(overloaded {
-            [&](const SingleDerivedPath::Opaque & bo) -> auto & {
-                // will not overwrite if already there
-                return map[bo.path];
+        return std::visit(
+            overloaded{
+                [&](const SingleDerivedPath::Opaque & bo) -> auto & {
+                    // will not overwrite if already there
+                    return map[bo.path];
+                },
+                [&](const SingleDerivedPath::Built & bfd) -> auto & {
+                    auto & n = initIter(*bfd.drvPath);
+                    return n.childMap[bfd.output];
+                },
             },
-            [&](const SingleDerivedPath::Built & bfd) -> auto & {
-                auto & n = initIter(*bfd.drvPath);
-                return n.childMap[bfd.output];
-            },
-        }, k.raw());
+            k.raw());
     };
     return initIter(k);
 }
@@ -25,39 +27,39 @@ typename DerivedPathMap<V>::ChildNode & DerivedPathMap<V>::ensureSlot(const Sing
 template<typename V>
 typename DerivedPathMap<V>::ChildNode * DerivedPathMap<V>::findSlot(const SingleDerivedPath & k)
 {
-    std::function<ChildNode *(const SingleDerivedPath & )> initIter;
+    std::function<ChildNode *(const SingleDerivedPath &)> initIter;
     initIter = [&](const auto & k) {
-        return std::visit(overloaded {
-            [&](const SingleDerivedPath::Opaque & bo) {
-                auto it = map.find(bo.path);
-                return it != map.end()
-                    ? &it->second
-                    : nullptr;
-            },
-            [&](const SingleDerivedPath::Built & bfd) {
-                auto * n = initIter(*bfd.drvPath);
-                if (!n) return (ChildNode *)nullptr;
+        return std::visit(
+            overloaded{
+                [&](const SingleDerivedPath::Opaque & bo) {
+                    auto it = map.find(bo.path);
+                    return it != map.end() ? &it->second : nullptr;
+                },
+                [&](const SingleDerivedPath::Built & bfd) {
+                    auto * n = initIter(*bfd.drvPath);
+                    if (!n)
+                        return (ChildNode *) nullptr;
 
-                auto it = n->childMap.find(bfd.output);
-                return it != n->childMap.end()
-                    ? &it->second
-                    : nullptr;
+                    auto it = n->childMap.find(bfd.output);
+                    return it != n->childMap.end() ? &it->second : nullptr;
+                },
             },
-        }, k.raw());
+            k.raw());
     };
     return initIter(k);
 }
 
-}
+} // namespace nix
 
 // instantiations
 
 #include "nix/store/build/derivation-trampoline-goal.hh"
+
 namespace nix {
 
 template<>
-bool DerivedPathMap<StringSet>::ChildNode::operator == (
-    const DerivedPathMap<StringSet>::ChildNode &) const noexcept = default;
+bool DerivedPathMap<StringSet>::ChildNode::operator==(const DerivedPathMap<StringSet>::ChildNode &) const noexcept =
+    default;
 
 // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
 #if 0
@@ -71,5 +73,4 @@ template struct DerivedPathMap<StringSet>;
 
 template struct DerivedPathMap<std::map<OutputsSpec, std::weak_ptr<DerivationTrampolineGoal>>>;
 
-
-};
+}; // namespace nix
diff --git a/src/libstore/derived-path.cc b/src/libstore/derived-path.cc
index 6186f0582..1fee1ae75 100644
--- a/src/libstore/derived-path.cc
+++ b/src/libstore/derived-path.cc
@@ -10,38 +10,22 @@
 namespace nix {
 
 // Custom implementation to avoid `ref` ptr equality
-GENERATE_CMP_EXT(
-    ,
-    std::strong_ordering,
-    SingleDerivedPathBuilt,
-    *me->drvPath,
-    me->output);
+GENERATE_CMP_EXT(, std::strong_ordering, SingleDerivedPathBuilt, *me->drvPath, me->output);
 
 // Custom implementation to avoid `ref` ptr equality
 
 // TODO no `GENERATE_CMP_EXT` because no `std::set::operator<=>` on
 // Darwin, per header.
-GENERATE_EQUAL(
-    ,
-    DerivedPathBuilt ::,
-    DerivedPathBuilt,
-    *me->drvPath,
-    me->outputs);
-GENERATE_ONE_CMP(
-    ,
-    bool,
-    DerivedPathBuilt ::,
-    <,
-    DerivedPathBuilt,
-    *me->drvPath,
-    me->outputs);
+GENERATE_EQUAL(, DerivedPathBuilt ::, DerivedPathBuilt, *me->drvPath, me->outputs);
+GENERATE_ONE_CMP(, bool, DerivedPathBuilt ::, <, DerivedPathBuilt, *me->drvPath, me->outputs);
 
 nlohmann::json DerivedPath::Opaque::toJSON(const StoreDirConfig & store) const
 {
     return store.printStorePath(path);
 }
 
-nlohmann::json SingleDerivedPath::Built::toJSON(Store & store) const {
+nlohmann::json SingleDerivedPath::Built::toJSON(Store & store) const
+{
     nlohmann::json res;
     res["drvPath"] = drvPath->toJSON(store);
     // Fallback for the input-addressed derivation case: We expect to always be
@@ -59,7 +43,8 @@ nlohmann::json SingleDerivedPath::Built::toJSON(Store & store) const {
     return res;
 }
 
-nlohmann::json DerivedPath::Built::toJSON(Store & store) const {
+nlohmann::json DerivedPath::Built::toJSON(Store & store) const
+{
     nlohmann::json res;
     res["drvPath"] = drvPath->toJSON(store);
     // Fallback for the input-addressed derivation case: We expect to always be
@@ -67,7 +52,8 @@ nlohmann::json DerivedPath::Built::toJSON(Store & store) const {
     // FIXME try-resolve on drvPath
     const auto outputMap = store.queryPartialDerivationOutputMap(resolveDerivedPath(store, *drvPath));
     for (const auto & [output, outputPathOpt] : outputMap) {
-        if (!outputs.contains(output)) continue;
+        if (!outputs.contains(output))
+            continue;
         if (outputPathOpt)
             res["outputs"][output] = store.printStorePath(*outputPathOpt);
         else
@@ -78,16 +64,12 @@ nlohmann::json DerivedPath::Built::toJSON(Store & store) const {
 
 nlohmann::json SingleDerivedPath::toJSON(Store & store) const
 {
-    return std::visit([&](const auto & buildable) {
-        return buildable.toJSON(store);
-    }, raw());
+    return std::visit([&](const auto & buildable) { return buildable.toJSON(store); }, raw());
 }
 
 nlohmann::json DerivedPath::toJSON(Store & store) const
 {
-    return std::visit([&](const auto & buildable) {
-        return buildable.toJSON(store);
-    }, raw());
+    return std::visit([&](const auto & buildable) { return buildable.toJSON(store); }, raw());
 }
 
 std::string DerivedPath::Opaque::to_string(const StoreDirConfig & store) const
@@ -107,82 +89,77 @@ std::string SingleDerivedPath::Built::to_string_legacy(const StoreDirConfig & st
 
 std::string DerivedPath::Built::to_string(const StoreDirConfig & store) const
 {
-    return drvPath->to_string(store)
-        + '^'
-        + outputs.to_string();
+    return drvPath->to_string(store) + '^' + outputs.to_string();
 }
 
 std::string DerivedPath::Built::to_string_legacy(const StoreDirConfig & store) const
 {
-    return drvPath->to_string_legacy(store)
-        + "!"
-        + outputs.to_string();
+    return drvPath->to_string_legacy(store) + "!" + outputs.to_string();
 }
 
 std::string SingleDerivedPath::to_string(const StoreDirConfig & store) const
 {
-    return std::visit(
-        [&](const auto & req) { return req.to_string(store); },
-        raw());
+    return std::visit([&](const auto & req) { return req.to_string(store); }, raw());
 }
 
 std::string DerivedPath::to_string(const StoreDirConfig & store) const
 {
-    return std::visit(
-        [&](const auto & req) { return req.to_string(store); },
-        raw());
+    return std::visit([&](const auto & req) { return req.to_string(store); }, raw());
 }
 
 std::string SingleDerivedPath::to_string_legacy(const StoreDirConfig & store) const
 {
-    return std::visit(overloaded {
-        [&](const SingleDerivedPath::Built & req) { return req.to_string_legacy(store); },
-        [&](const SingleDerivedPath::Opaque & req) { return req.to_string(store); },
-    }, this->raw());
+    return std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Built & req) { return req.to_string_legacy(store); },
+            [&](const SingleDerivedPath::Opaque & req) { return req.to_string(store); },
+        },
+        this->raw());
 }
 
 std::string DerivedPath::to_string_legacy(const StoreDirConfig & store) const
 {
-    return std::visit(overloaded {
-        [&](const DerivedPath::Built & req) { return req.to_string_legacy(store); },
-        [&](const DerivedPath::Opaque & req) { return req.to_string(store); },
-    }, this->raw());
+    return std::visit(
+        overloaded{
+            [&](const DerivedPath::Built & req) { return req.to_string_legacy(store); },
+            [&](const DerivedPath::Opaque & req) { return req.to_string(store); },
+        },
+        this->raw());
 }
 
-
 DerivedPath::Opaque DerivedPath::Opaque::parse(const StoreDirConfig & store, std::string_view s)
 {
     return {store.parseStorePath(s)};
 }
 
-void drvRequireExperiment(
-    const SingleDerivedPath & drv,
-    const ExperimentalFeatureSettings & xpSettings)
+void drvRequireExperiment(const SingleDerivedPath & drv, const ExperimentalFeatureSettings & xpSettings)
 {
-    std::visit(overloaded {
-        [&](const SingleDerivedPath::Opaque &) {
-            // plain drv path; no experimental features required.
+    std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Opaque &) {
+                // plain drv path; no experimental features required.
+            },
+            [&](const SingleDerivedPath::Built &) { xpSettings.require(Xp::DynamicDerivations); },
         },
-        [&](const SingleDerivedPath::Built &) {
-            xpSettings.require(Xp::DynamicDerivations);
-        },
-    }, drv.raw());
+        drv.raw());
 }
 
 SingleDerivedPath::Built SingleDerivedPath::Built::parse(
-    const StoreDirConfig & store, ref<const SingleDerivedPath> drv,
+    const StoreDirConfig & store,
+    ref<const SingleDerivedPath> drv,
     OutputNameView output,
     const ExperimentalFeatureSettings & xpSettings)
 {
     drvRequireExperiment(*drv, xpSettings);
     return {
         .drvPath = drv,
-        .output = std::string { output },
+        .output = std::string{output},
     };
 }
 
 DerivedPath::Built DerivedPath::Built::parse(
-    const StoreDirConfig & store, ref<const SingleDerivedPath> drv,
+    const StoreDirConfig & store,
+    ref<const SingleDerivedPath> drv,
     OutputNameView outputsS,
     const ExperimentalFeatureSettings & xpSettings)
 {
@@ -194,117 +171,105 @@ DerivedPath::Built DerivedPath::Built::parse(
 }
 
 static SingleDerivedPath parseWithSingle(
-    const StoreDirConfig & store, std::string_view s, std::string_view separator,
+    const StoreDirConfig & store,
+    std::string_view s,
+    std::string_view separator,
     const ExperimentalFeatureSettings & xpSettings)
 {
     size_t n = s.rfind(separator);
     return n == s.npos
-        ? (SingleDerivedPath) SingleDerivedPath::Opaque::parse(store, s)
-        : (SingleDerivedPath) SingleDerivedPath::Built::parse(store,
-            make_ref<const SingleDerivedPath>(parseWithSingle(
-                store,
-                s.substr(0, n),
-                separator,
-                xpSettings)),
-            s.substr(n + 1),
-            xpSettings);
+               ? (SingleDerivedPath) SingleDerivedPath::Opaque::parse(store, s)
+               : (SingleDerivedPath) SingleDerivedPath::Built::parse(
+                     store,
+                     make_ref<const SingleDerivedPath>(parseWithSingle(store, s.substr(0, n), separator, xpSettings)),
+                     s.substr(n + 1),
+                     xpSettings);
 }
 
 SingleDerivedPath SingleDerivedPath::parse(
-    const StoreDirConfig & store,
-    std::string_view s,
-    const ExperimentalFeatureSettings & xpSettings)
+    const StoreDirConfig & store, std::string_view s, const ExperimentalFeatureSettings & xpSettings)
 {
     return parseWithSingle(store, s, "^", xpSettings);
 }
 
 SingleDerivedPath SingleDerivedPath::parseLegacy(
-    const StoreDirConfig & store,
-    std::string_view s,
-    const ExperimentalFeatureSettings & xpSettings)
+    const StoreDirConfig & store, std::string_view s, const ExperimentalFeatureSettings & xpSettings)
 {
     return parseWithSingle(store, s, "!", xpSettings);
 }
 
 static DerivedPath parseWith(
-    const StoreDirConfig & store, std::string_view s, std::string_view separator,
+    const StoreDirConfig & store,
+    std::string_view s,
+    std::string_view separator,
     const ExperimentalFeatureSettings & xpSettings)
 {
     size_t n = s.rfind(separator);
     return n == s.npos
-        ? (DerivedPath) DerivedPath::Opaque::parse(store, s)
-        : (DerivedPath) DerivedPath::Built::parse(store,
-            make_ref<const SingleDerivedPath>(parseWithSingle(
-                store,
-                s.substr(0, n),
-                separator,
-                xpSettings)),
-            s.substr(n + 1),
-            xpSettings);
+               ? (DerivedPath) DerivedPath::Opaque::parse(store, s)
+               : (DerivedPath) DerivedPath::Built::parse(
+                     store,
+                     make_ref<const SingleDerivedPath>(parseWithSingle(store, s.substr(0, n), separator, xpSettings)),
+                     s.substr(n + 1),
+                     xpSettings);
 }
 
-DerivedPath DerivedPath::parse(
-    const StoreDirConfig & store,
-    std::string_view s,
-    const ExperimentalFeatureSettings & xpSettings)
+DerivedPath
+DerivedPath::parse(const StoreDirConfig & store, std::string_view s, const ExperimentalFeatureSettings & xpSettings)
 {
     return parseWith(store, s, "^", xpSettings);
 }
 
 DerivedPath DerivedPath::parseLegacy(
-    const StoreDirConfig & store,
-    std::string_view s,
-    const ExperimentalFeatureSettings & xpSettings)
+    const StoreDirConfig & store, std::string_view s, const ExperimentalFeatureSettings & xpSettings)
 {
     return parseWith(store, s, "!", xpSettings);
 }
 
 DerivedPath DerivedPath::fromSingle(const SingleDerivedPath & req)
 {
-    return std::visit(overloaded {
-        [&](const SingleDerivedPath::Opaque & o) -> DerivedPath {
-            return o;
+    return std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Opaque & o) -> DerivedPath { return o; },
+            [&](const SingleDerivedPath::Built & b) -> DerivedPath {
+                return DerivedPath::Built{
+                    .drvPath = b.drvPath,
+                    .outputs = OutputsSpec::Names{b.output},
+                };
+            },
         },
-        [&](const SingleDerivedPath::Built & b) -> DerivedPath {
-            return DerivedPath::Built {
-                .drvPath = b.drvPath,
-                .outputs = OutputsSpec::Names { b.output },
-            };
-        },
-    }, req.raw());
+        req.raw());
 }
 
 const StorePath & SingleDerivedPath::Built::getBaseStorePath() const
 {
-	return drvPath->getBaseStorePath();
+    return drvPath->getBaseStorePath();
 }
 
 const StorePath & DerivedPath::Built::getBaseStorePath() const
 {
-	return drvPath->getBaseStorePath();
+    return drvPath->getBaseStorePath();
 }
 
 template<typename DP>
 static inline const StorePath & getBaseStorePath_(const DP & derivedPath)
 {
-    return std::visit(overloaded {
-        [&](const typename DP::Built & bfd) -> auto & {
-            return bfd.drvPath->getBaseStorePath();
+    return std::visit(
+        overloaded{
+            [&](const typename DP::Built & bfd) -> auto & { return bfd.drvPath->getBaseStorePath(); },
+            [&](const typename DP::Opaque & bo) -> auto & { return bo.path; },
         },
-        [&](const typename DP::Opaque & bo) -> auto & {
-            return bo.path;
-        },
-    }, derivedPath.raw());
+        derivedPath.raw());
 }
 
 const StorePath & SingleDerivedPath::getBaseStorePath() const
 {
-	return getBaseStorePath_(*this);
+    return getBaseStorePath_(*this);
 }
 
 const StorePath & DerivedPath::getBaseStorePath() const
 {
-	return getBaseStorePath_(*this);
+    return getBaseStorePath_(*this);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/downstream-placeholder.cc b/src/libstore/downstream-placeholder.cc
index 24ce2ad99..b3ac1c8c4 100644
--- a/src/libstore/downstream-placeholder.cc
+++ b/src/libstore/downstream-placeholder.cc
@@ -8,19 +8,15 @@ std::string DownstreamPlaceholder::render() const
     return "/" + hash.to_string(HashFormat::Nix32, false);
 }
 
-
 DownstreamPlaceholder DownstreamPlaceholder::unknownCaOutput(
-    const StorePath & drvPath,
-    OutputNameView outputName,
-    const ExperimentalFeatureSettings & xpSettings)
+    const StorePath & drvPath, OutputNameView outputName, const ExperimentalFeatureSettings & xpSettings)
 {
     xpSettings.require(Xp::CaDerivations);
     auto drvNameWithExtension = drvPath.name();
     auto drvName = drvNameWithExtension.substr(0, drvNameWithExtension.size() - 4);
-    auto clearText = "nix-upstream-output:" + std::string { drvPath.hashPart() } + ":" + outputPathName(drvName, outputName);
-    return DownstreamPlaceholder {
-        hashString(HashAlgorithm::SHA256, clearText)
-    };
+    auto clearText =
+        "nix-upstream-output:" + std::string{drvPath.hashPart()} + ":" + outputPathName(drvName, outputName);
+    return DownstreamPlaceholder{hashString(HashAlgorithm::SHA256, clearText)};
 }
 
 DownstreamPlaceholder DownstreamPlaceholder::unknownDerivation(
@@ -30,29 +26,25 @@ DownstreamPlaceholder DownstreamPlaceholder::unknownDerivation(
 {
     xpSettings.require(Xp::DynamicDerivations);
     auto compressed = compressHash(placeholder.hash, 20);
-    auto clearText = "nix-computed-output:"
-        + compressed.to_string(HashFormat::Nix32, false)
-        + ":" + std::string { outputName };
-    return DownstreamPlaceholder {
-        hashString(HashAlgorithm::SHA256, clearText)
-    };
+    auto clearText =
+        "nix-computed-output:" + compressed.to_string(HashFormat::Nix32, false) + ":" + std::string{outputName};
+    return DownstreamPlaceholder{hashString(HashAlgorithm::SHA256, clearText)};
 }
 
 DownstreamPlaceholder DownstreamPlaceholder::fromSingleDerivedPathBuilt(
-    const SingleDerivedPath::Built & b,
-    const ExperimentalFeatureSettings & xpSettings)
+    const SingleDerivedPath::Built & b, const ExperimentalFeatureSettings & xpSettings)
 {
-    return std::visit(overloaded {
-        [&](const SingleDerivedPath::Opaque & o) {
-            return DownstreamPlaceholder::unknownCaOutput(o.path, b.output, xpSettings);
+    return std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Opaque & o) {
+                return DownstreamPlaceholder::unknownCaOutput(o.path, b.output, xpSettings);
+            },
+            [&](const SingleDerivedPath::Built & b2) {
+                return DownstreamPlaceholder::unknownDerivation(
+                    DownstreamPlaceholder::fromSingleDerivedPathBuilt(b2, xpSettings), b.output, xpSettings);
+            },
         },
-        [&](const SingleDerivedPath::Built & b2) {
-            return DownstreamPlaceholder::unknownDerivation(
-                DownstreamPlaceholder::fromSingleDerivedPathBuilt(b2, xpSettings),
-                b.output,
-                xpSettings);
-        },
-    }, b.drvPath->raw());
+        b.drvPath->raw());
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/dummy-store.cc b/src/libstore/dummy-store.cc
index 819c47bab..d0e298968 100644
--- a/src/libstore/dummy-store.cc
+++ b/src/libstore/dummy-store.cc
@@ -3,7 +3,8 @@
 
 namespace nix {
 
-struct DummyStoreConfig : public std::enable_shared_from_this<DummyStoreConfig>, virtual StoreConfig {
+struct DummyStoreConfig : public std::enable_shared_from_this<DummyStoreConfig>, virtual StoreConfig
+{
     using StoreConfig::StoreConfig;
 
     DummyStoreConfig(std::string_view scheme, std::string_view authority, const Params & params)
@@ -13,20 +14,34 @@ struct DummyStoreConfig : public std::enable_shared_from_this<DummyStoreConfig>,
             throw UsageError("`%s` store URIs must not contain an authority part %s", scheme, authority);
     }
 
-    static const std::string name() { return "Dummy Store"; }
+    static const std::string name()
+    {
+        return "Dummy Store";
+    }
 
     static std::string doc()
     {
         return
-          #include "dummy-store.md"
-          ;
+#include "dummy-store.md"
+            ;
     }
 
-    static StringSet uriSchemes() {
+    static StringSet uriSchemes()
+    {
         return {"dummy"};
     }
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override
+    {
+        return {
+            .variant =
+                StoreReference::Specified{
+                    .scheme = *uriSchemes().begin(),
+                },
+        };
+    }
 };
 
 struct DummyStore : virtual Store
@@ -38,15 +53,11 @@ struct DummyStore : virtual Store
     DummyStore(ref<const Config> config)
         : Store{*config}
         , config(config)
-    { }
-
-    std::string getUri() override
     {
-        return *Config::uriSchemes().begin();
     }
 
-    void queryPathInfoUncached(const StorePath & path,
-        Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override
+    void queryPathInfoUncached(
+        const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override
     {
         callback(nullptr);
     }
@@ -60,11 +71,14 @@ struct DummyStore : virtual Store
     }
 
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override
-    { unsupported("queryPathFromHashPart"); }
+    {
+        unsupported("queryPathFromHashPart");
+    }
 
-    void addToStore(const ValidPathInfo & info, Source & source,
-        RepairFlag repair, CheckSigsFlag checkSigs) override
-    { unsupported("addToStore"); }
+    void addToStore(const ValidPathInfo & info, Source & source, RepairFlag repair, CheckSigsFlag checkSigs) override
+    {
+        unsupported("addToStore");
+    }
 
     virtual StorePath addToStoreFromDump(
         Source & dump,
@@ -74,14 +88,20 @@ struct DummyStore : virtual Store
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) override
-    { unsupported("addToStore"); }
+    {
+        unsupported("addToStore");
+    }
 
     void narFromPath(const StorePath & path, Sink & sink) override
-    { unsupported("narFromPath"); }
+    {
+        unsupported("narFromPath");
+    }
 
-    void queryRealisationUncached(const DrvOutput &,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept override
-    { callback(nullptr); }
+    void
+    queryRealisationUncached(const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept override
+    {
+        callback(nullptr);
+    }
 
     virtual ref<SourceAccessor> getFSAccessor(bool requireValidPath) override
     {
@@ -96,4 +116,4 @@ ref<Store> DummyStore::Config::openStore() const
 
 static RegisterStoreImplementation<DummyStore::Config> regDummyStore;
 
-}
+} // namespace nix
diff --git a/src/libstore/export-import.cc b/src/libstore/export-import.cc
index 5bbdd1e5c..a343b5837 100644
--- a/src/libstore/export-import.cc
+++ b/src/libstore/export-import.cc
@@ -1,3 +1,4 @@
+#include "nix/store/export-import.hh"
 #include "nix/util/serialise.hh"
 #include "nix/store/store-api.hh"
 #include "nix/util/archive.hh"
@@ -8,58 +9,57 @@
 
 namespace nix {
 
-void Store::exportPaths(const StorePathSet & paths, Sink & sink)
+static void exportPath(Store & store, const StorePath & path, Sink & sink)
 {
-    auto sorted = topoSortPaths(paths);
+    auto info = store.queryPathInfo(path);
+
+    HashSink hashSink(HashAlgorithm::SHA256);
+    TeeSink teeSink(sink, hashSink);
+
+    store.narFromPath(path, teeSink);
+
+    /* Refuse to export paths that have changed.  This prevents
+       filesystem corruption from spreading to other machines.
+       Don't complain if the stored hash is zero (unknown). */
+    Hash hash = hashSink.currentHash().hash;
+    if (hash != info->narHash && info->narHash != Hash(info->narHash.algo))
+        throw Error(
+            "hash of path '%s' has changed from '%s' to '%s'!",
+            store.printStorePath(path),
+            info->narHash.to_string(HashFormat::Nix32, true),
+            hash.to_string(HashFormat::Nix32, true));
+
+    teeSink << exportMagic << store.printStorePath(path);
+    CommonProto::write(store, CommonProto::WriteConn{.to = teeSink}, info->references);
+    teeSink << (info->deriver ? store.printStorePath(*info->deriver) : "") << 0;
+}
+
+void exportPaths(Store & store, const StorePathSet & paths, Sink & sink)
+{
+    auto sorted = store.topoSortPaths(paths);
     std::reverse(sorted.begin(), sorted.end());
 
     for (auto & path : sorted) {
         sink << 1;
-        exportPath(path, sink);
+        exportPath(store, path, sink);
     }
 
     sink << 0;
 }
 
-void Store::exportPath(const StorePath & path, Sink & sink)
-{
-    auto info = queryPathInfo(path);
-
-    HashSink hashSink(HashAlgorithm::SHA256);
-    TeeSink teeSink(sink, hashSink);
-
-    narFromPath(path, teeSink);
-
-    /* Refuse to export paths that have changed.  This prevents
-       filesystem corruption from spreading to other machines.
-       Don't complain if the stored hash is zero (unknown). */
-    Hash hash = hashSink.currentHash().first;
-    if (hash != info->narHash && info->narHash != Hash(info->narHash.algo))
-        throw Error("hash of path '%s' has changed from '%s' to '%s'!",
-                    printStorePath(path), info->narHash.to_string(HashFormat::Nix32, true), hash.to_string(HashFormat::Nix32, true));
-
-    teeSink
-        << exportMagic
-        << printStorePath(path);
-    CommonProto::write(*this,
-        CommonProto::WriteConn { .to = teeSink },
-        info->references);
-    teeSink
-        << (info->deriver ? printStorePath(*info->deriver) : "")
-        << 0;
-}
-
-StorePaths Store::importPaths(Source & source, CheckSigsFlag checkSigs)
+StorePaths importPaths(Store & store, Source & source, CheckSigsFlag checkSigs)
 {
     StorePaths res;
     while (true) {
         auto n = readNum<uint64_t>(source);
-        if (n == 0) break;
-        if (n != 1) throw Error("input doesn't look like something created by 'nix-store --export'");
+        if (n == 0)
+            break;
+        if (n != 1)
+            throw Error("input doesn't look like something created by 'nix-store --export'");
 
         /* Extract the NAR from the source. */
         StringSink saved;
-        TeeSource tee { source, saved };
+        TeeSource tee{source, saved};
         NullFileSystemObjectSink ether;
         parseDump(ether, tee);
 
@@ -67,18 +67,17 @@ StorePaths Store::importPaths(Source & source, CheckSigsFlag checkSigs)
         if (magic != exportMagic)
             throw Error("Nix archive cannot be imported; wrong format");
 
-        auto path = parseStorePath(readString(source));
+        auto path = store.parseStorePath(readString(source));
 
-        //Activity act(*logger, lvlInfo, "importing path '%s'", info.path);
+        // Activity act(*logger, lvlInfo, "importing path '%s'", info.path);
 
-        auto references = CommonProto::Serialise<StorePathSet>::read(*this,
-            CommonProto::ReadConn { .from = source });
+        auto references = CommonProto::Serialise<StorePathSet>::read(store, CommonProto::ReadConn{.from = source});
         auto deriver = readString(source);
         auto narHash = hashString(HashAlgorithm::SHA256, saved.s);
 
-        ValidPathInfo info { path, narHash };
+        ValidPathInfo info{path, narHash};
         if (deriver != "")
-            info.deriver = parseStorePath(deriver);
+            info.deriver = store.parseStorePath(deriver);
         info.references = references;
         info.narSize = saved.s.size();
 
@@ -88,7 +87,7 @@ StorePaths Store::importPaths(Source & source, CheckSigsFlag checkSigs)
 
         // Can't use underlying source, which would have been exhausted
         auto source = StringSource(saved.s);
-        addToStore(info, source, NoRepair, checkSigs);
+        store.addToStore(info, source, NoRepair, checkSigs);
 
         res.push_back(info.path);
     }
@@ -96,4 +95,4 @@ StorePaths Store::importPaths(Source & source, CheckSigsFlag checkSigs)
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 7e29d00e6..a162df1ad 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -10,11 +10,11 @@
 
 #include "store-config-private.hh"
 #if NIX_WITH_S3_SUPPORT
-#include <aws/core/client/ClientConfiguration.h>
+#  include <aws/core/client/ClientConfiguration.h>
 #endif
 
 #ifdef __linux__
-# include "nix/util/linux-namespaces.hh"
+#  include "nix/util/linux-namespaces.hh"
 #endif
 
 #include <unistd.h>
@@ -77,7 +77,7 @@ struct curlFileTransfer : public FileTransfer
 
         std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now();
 
-        inline static const std::set<long> successfulStatuses {200, 201, 204, 206, 304, 0 /* other protocol */};
+        inline static const std::set<long> successfulStatuses{200, 201, 204, 206, 304, 0 /* other protocol */};
 
         /* Get the HTTP status code, or 0 for other protocols. */
         long getHTTPStatus()
@@ -90,14 +90,18 @@ struct curlFileTransfer : public FileTransfer
             return httpStatus;
         }
 
-        TransferItem(curlFileTransfer & fileTransfer,
+        TransferItem(
+            curlFileTransfer & fileTransfer,
             const FileTransferRequest & request,
             Callback<FileTransferResult> && callback)
             : fileTransfer(fileTransfer)
             , request(request)
-            , act(*logger, lvlTalkative, actFileTransfer,
-                fmt("%sing '%s'", request.verb(), request.uri),
-                {request.uri}, request.parentAct)
+            , act(*logger,
+                  lvlTalkative,
+                  actFileTransfer,
+                  fmt("%sing '%s'", request.verb(), request.uri),
+                  {request.uri.to_string()},
+                  request.parentAct)
             , callback(std::move(callback))
             , finalSink([this](std::string_view data) {
                 if (errorSink) {
@@ -115,16 +119,16 @@ struct curlFileTransfer : public FileTransfer
                     }
                 } else
                     this->result.data.append(data);
-              })
+            })
         {
-            result.urls.push_back(request.uri);
+            result.urls.push_back(request.uri.to_string());
 
             requestHeaders = curl_slist_append(requestHeaders, "Accept-Encoding: zstd, br, gzip, deflate, bzip2, xz");
             if (!request.expectedETag.empty())
                 requestHeaders = curl_slist_append(requestHeaders, ("If-None-Match: " + request.expectedETag).c_str());
             if (!request.mimeType.empty())
                 requestHeaders = curl_slist_append(requestHeaders, ("Content-Type: " + request.mimeType).c_str());
-            for (auto it = request.headers.begin(); it != request.headers.end(); ++it){
+            for (auto it = request.headers.begin(); it != request.headers.end(); ++it) {
                 requestHeaders = curl_slist_append(requestHeaders, fmt("%s: %s", it->first, it->second).c_str());
             }
         }
@@ -136,7 +140,8 @@ struct curlFileTransfer : public FileTransfer
                     curl_multi_remove_handle(fileTransfer.curlm, req);
                 curl_easy_cleanup(req);
             }
-            if (requestHeaders) curl_slist_free_all(requestHeaders);
+            if (requestHeaders)
+                curl_slist_free_all(requestHeaders);
             try {
                 if (!done)
                     fail(FileTransferError(Interrupted, {}, "download of '%s' was interrupted", request.uri));
@@ -172,12 +177,12 @@ struct curlFileTransfer : public FileTransfer
 
                 if (!decompressionSink) {
                     decompressionSink = makeDecompressionSink(encoding, finalSink);
-                    if (! successfulStatuses.count(getHTTPStatus())) {
+                    if (!successfulStatuses.count(getHTTPStatus())) {
                         // In this case we want to construct a TeeSink, to keep
                         // the response around (which we figure won't be big
                         // like an actual download should be) to improve error
                         // messages.
-                        errorSink = StringSink { };
+                        errorSink = StringSink{};
                     }
                 }
 
@@ -247,7 +252,8 @@ struct curlFileTransfer : public FileTransfer
 
                     else if (name == "link" || name == "x-amz-meta-link") {
                         auto value = trim(line.substr(i + 1));
-                        static std::regex linkRegex("<([^>]*)>; rel=\"immutable\"", std::regex::extended | std::regex::icase);
+                        static std::regex linkRegex(
+                            "<([^>]*)>; rel=\"immutable\"", std::regex::extended | std::regex::icase);
                         if (std::smatch match; std::regex_match(value, match, linkRegex))
                             result.immutableUrl = match.str(1);
                         else
@@ -273,7 +279,8 @@ struct curlFileTransfer : public FileTransfer
             return getInterrupted();
         }
 
-        static int progressCallbackWrapper(void * userp, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow)
+        static int progressCallbackWrapper(
+            void * userp, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow)
         {
             auto & item = *static_cast<TransferItem *>(userp);
             auto isUpload = bool(item.request.data);
@@ -288,7 +295,8 @@ struct curlFileTransfer : public FileTransfer
         }
 
         size_t readOffset = 0;
-        size_t readCallback(char *buffer, size_t size, size_t nitems)
+
+        size_t readCallback(char * buffer, size_t size, size_t nitems)
         {
             if (readOffset == request.data->length())
                 return 0;
@@ -299,18 +307,19 @@ struct curlFileTransfer : public FileTransfer
             return count;
         }
 
-        static size_t readCallbackWrapper(char *buffer, size_t size, size_t nitems, void * userp)
+        static size_t readCallbackWrapper(char * buffer, size_t size, size_t nitems, void * userp)
         {
             return ((TransferItem *) userp)->readCallback(buffer, size, nitems);
         }
 
-        #if !defined(_WIN32) && LIBCURL_VERSION_NUM >= 0x071000
-        static int cloexec_callback(void *, curl_socket_t curlfd, curlsocktype purpose) {
+#if !defined(_WIN32) && LIBCURL_VERSION_NUM >= 0x071000
+        static int cloexec_callback(void *, curl_socket_t curlfd, curlsocktype purpose)
+        {
             unix::closeOnExec(curlfd);
             vomit("cloexec set for fd %i", curlfd);
             return CURL_SOCKOPT_OK;
         }
-        #endif
+#endif
 
         size_t seekCallback(curl_off_t offset, int origin)
         {
@@ -324,14 +333,15 @@ struct curlFileTransfer : public FileTransfer
             return CURL_SEEKFUNC_OK;
         }
 
-        static size_t seekCallbackWrapper(void *clientp, curl_off_t offset, int origin)
+        static size_t seekCallbackWrapper(void * clientp, curl_off_t offset, int origin)
         {
             return ((TransferItem *) clientp)->seekCallback(offset, origin);
         }
 
         void init()
         {
-            if (!req) req = curl_easy_init();
+            if (!req)
+                req = curl_easy_init();
 
             curl_easy_reset(req);
 
@@ -340,22 +350,25 @@ struct curlFileTransfer : public FileTransfer
                 curl_easy_setopt(req, CURLOPT_DEBUGFUNCTION, TransferItem::debugCallback);
             }
 
-            curl_easy_setopt(req, CURLOPT_URL, request.uri.c_str());
+            curl_easy_setopt(req, CURLOPT_URL, request.uri.to_string().c_str());
             curl_easy_setopt(req, CURLOPT_FOLLOWLOCATION, 1L);
             curl_easy_setopt(req, CURLOPT_MAXREDIRS, 10);
             curl_easy_setopt(req, CURLOPT_NOSIGNAL, 1);
-            curl_easy_setopt(req, CURLOPT_USERAGENT,
-                ("curl/" LIBCURL_VERSION " Nix/" + nixVersion +
-                    (fileTransferSettings.userAgentSuffix != "" ? " " + fileTransferSettings.userAgentSuffix.get() : "")).c_str());
-            #if LIBCURL_VERSION_NUM >= 0x072b00
+            curl_easy_setopt(
+                req,
+                CURLOPT_USERAGENT,
+                ("curl/" LIBCURL_VERSION " Nix/" + nixVersion
+                 + (fileTransferSettings.userAgentSuffix != "" ? " " + fileTransferSettings.userAgentSuffix.get() : ""))
+                    .c_str());
+#if LIBCURL_VERSION_NUM >= 0x072b00
             curl_easy_setopt(req, CURLOPT_PIPEWAIT, 1);
-            #endif
-            #if LIBCURL_VERSION_NUM >= 0x072f00
+#endif
+#if LIBCURL_VERSION_NUM >= 0x072f00
             if (fileTransferSettings.enableHttp2)
                 curl_easy_setopt(req, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
             else
                 curl_easy_setopt(req, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
-            #endif
+#endif
             curl_easy_setopt(req, CURLOPT_WRITEFUNCTION, TransferItem::writeCallbackWrapper);
             curl_easy_setopt(req, CURLOPT_WRITEDATA, this);
             curl_easy_setopt(req, CURLOPT_HEADERFUNCTION, TransferItem::headerCallbackWrapper);
@@ -393,9 +406,9 @@ struct curlFileTransfer : public FileTransfer
                 curl_easy_setopt(req, CURLOPT_SSL_VERIFYHOST, 0);
             }
 
-            #if !defined(_WIN32) && LIBCURL_VERSION_NUM >= 0x071000
+#if !defined(_WIN32) && LIBCURL_VERSION_NUM >= 0x071000
             curl_easy_setopt(req, CURLOPT_SOCKOPTFUNCTION, cloexec_callback);
-            #endif
+#endif
 
             curl_easy_setopt(req, CURLOPT_CONNECTTIMEOUT, fileTransferSettings.connectTimeout.get());
 
@@ -425,10 +438,14 @@ struct curlFileTransfer : public FileTransfer
 
             auto httpStatus = getHTTPStatus();
 
-            debug("finished %s of '%s'; curl status = %d, HTTP status = %d, body = %d bytes, duration = %.2f s",
-                request.verb(), request.uri, code, httpStatus, result.bodySize,
-                std::chrono::duration_cast<std::chrono::milliseconds>(finishTime - startTime).count() / 1000.0f
-                );
+            debug(
+                "finished %s of '%s'; curl status = %d, HTTP status = %d, body = %d bytes, duration = %.2f s",
+                request.verb(),
+                request.uri,
+                code,
+                httpStatus,
+                result.bodySize,
+                std::chrono::duration_cast<std::chrono::milliseconds>(finishTime - startTime).count() / 1000.0f);
 
             appendCurrentUrl();
 
@@ -448,8 +465,7 @@ struct curlFileTransfer : public FileTransfer
             if (writeException)
                 failEx(writeException);
 
-            else if (code == CURLE_OK && successfulStatuses.count(httpStatus))
-            {
+            else if (code == CURLE_OK && successfulStatuses.count(httpStatus)) {
                 result.cached = httpStatus == 304;
 
                 // In 2021, GitHub responds to If-None-Match with 304,
@@ -487,32 +503,32 @@ struct curlFileTransfer : public FileTransfer
                     //   * 511 we're behind a captive portal
                     err = Misc;
                 } else {
-                    // Don't bother retrying on certain cURL errors either
+// Don't bother retrying on certain cURL errors either
 
-                    // Allow selecting a subset of enum values
-                    #pragma GCC diagnostic push
-                    #pragma GCC diagnostic ignored "-Wswitch-enum"
+// Allow selecting a subset of enum values
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch-enum"
                     switch (code) {
-                        case CURLE_FAILED_INIT:
-                        case CURLE_URL_MALFORMAT:
-                        case CURLE_NOT_BUILT_IN:
-                        case CURLE_REMOTE_ACCESS_DENIED:
-                        case CURLE_FILE_COULDNT_READ_FILE:
-                        case CURLE_FUNCTION_NOT_FOUND:
-                        case CURLE_ABORTED_BY_CALLBACK:
-                        case CURLE_BAD_FUNCTION_ARGUMENT:
-                        case CURLE_INTERFACE_FAILED:
-                        case CURLE_UNKNOWN_OPTION:
-                        case CURLE_SSL_CACERT_BADFILE:
-                        case CURLE_TOO_MANY_REDIRECTS:
-                        case CURLE_WRITE_ERROR:
-                        case CURLE_UNSUPPORTED_PROTOCOL:
-                            err = Misc;
-                            break;
-                        default: // Shut up warnings
-                            break;
+                    case CURLE_FAILED_INIT:
+                    case CURLE_URL_MALFORMAT:
+                    case CURLE_NOT_BUILT_IN:
+                    case CURLE_REMOTE_ACCESS_DENIED:
+                    case CURLE_FILE_COULDNT_READ_FILE:
+                    case CURLE_FUNCTION_NOT_FOUND:
+                    case CURLE_ABORTED_BY_CALLBACK:
+                    case CURLE_BAD_FUNCTION_ARGUMENT:
+                    case CURLE_INTERFACE_FAILED:
+                    case CURLE_UNKNOWN_OPTION:
+                    case CURLE_SSL_CACERT_BADFILE:
+                    case CURLE_TOO_MANY_REDIRECTS:
+                    case CURLE_WRITE_ERROR:
+                    case CURLE_UNSUPPORTED_PROTOCOL:
+                        err = Misc;
+                        break;
+                    default: // Shut up warnings
+                        break;
                     }
-                    #pragma GCC diagnostic pop
+#pragma GCC diagnostic pop
                 }
 
                 attempt++;
@@ -520,31 +536,40 @@ struct curlFileTransfer : public FileTransfer
                 std::optional<std::string> response;
                 if (errorSink)
                     response = std::move(errorSink->s);
-                auto exc =
-                    code == CURLE_ABORTED_BY_CALLBACK && getInterrupted()
-                    ? FileTransferError(Interrupted, std::move(response), "%s of '%s' was interrupted", request.verb(), request.uri)
-                    : httpStatus != 0
-                    ? FileTransferError(err,
-                        std::move(response),
-                        "unable to %s '%s': HTTP error %d%s",
-                        request.verb(), request.uri, httpStatus,
-                        code == CURLE_OK ? "" : fmt(" (curl error: %s)", curl_easy_strerror(code)))
-                    : FileTransferError(err,
-                        std::move(response),
-                        "unable to %s '%s': %s (%d) %s",
-                        request.verb(), request.uri, curl_easy_strerror(code), code, errbuf);
+                auto exc = code == CURLE_ABORTED_BY_CALLBACK && getInterrupted() ? FileTransferError(
+                                                                                       Interrupted,
+                                                                                       std::move(response),
+                                                                                       "%s of '%s' was interrupted",
+                                                                                       request.verb(),
+                                                                                       request.uri)
+                           : httpStatus != 0
+                               ? FileTransferError(
+                                     err,
+                                     std::move(response),
+                                     "unable to %s '%s': HTTP error %d%s",
+                                     request.verb(),
+                                     request.uri,
+                                     httpStatus,
+                                     code == CURLE_OK ? "" : fmt(" (curl error: %s)", curl_easy_strerror(code)))
+                               : FileTransferError(
+                                     err,
+                                     std::move(response),
+                                     "unable to %s '%s': %s (%d) %s",
+                                     request.verb(),
+                                     request.uri,
+                                     curl_easy_strerror(code),
+                                     code,
+                                     errbuf);
 
                 /* If this is a transient error, then maybe retry the
                    download after a while. If we're writing to a
                    sink, we can only retry if the server supports
                    ranged requests. */
-                if (err == Transient
-                    && attempt < request.tries
-                    && (!this->request.dataCallback
-                        || writtenToSink == 0
-                        || (acceptRanges && encoding.empty())))
-                {
-                    int ms = retryTimeMs * std::pow(2.0f, attempt - 1 + std::uniform_real_distribution<>(0.0, 0.5)(fileTransfer.mt19937));
+                if (err == Transient && attempt < request.tries
+                    && (!this->request.dataCallback || writtenToSink == 0 || (acceptRanges && encoding.empty()))) {
+                    int ms = retryTimeMs
+                             * std::pow(
+                                 2.0f, attempt - 1 + std::uniform_real_distribution<>(0.0, 0.5)(fileTransfer.mt19937));
                     if (writtenToSink)
                         warn("%s; retrying from offset %d in %d ms", exc.what(), writtenToSink, ms);
                     else
@@ -553,8 +578,7 @@ struct curlFileTransfer : public FileTransfer
                     errorSink.reset();
                     embargo = std::chrono::steady_clock::now() + std::chrono::milliseconds(ms);
                     fileTransfer.enqueueItem(shared_from_this());
-                }
-                else
+                } else
                     fail(std::move(exc));
             }
         }
@@ -562,23 +586,28 @@ struct curlFileTransfer : public FileTransfer
 
     struct State
     {
-        struct EmbargoComparator {
-            bool operator() (const std::shared_ptr<TransferItem> & i1, const std::shared_ptr<TransferItem> & i2) {
+        struct EmbargoComparator
+        {
+            bool operator()(const std::shared_ptr<TransferItem> & i1, const std::shared_ptr<TransferItem> & i2)
+            {
                 return i1->embargo > i2->embargo;
             }
         };
+
         bool quit = false;
-        std::priority_queue<std::shared_ptr<TransferItem>, std::vector<std::shared_ptr<TransferItem>>, EmbargoComparator> incoming;
+        std::
+            priority_queue<std::shared_ptr<TransferItem>, std::vector<std::shared_ptr<TransferItem>>, EmbargoComparator>
+                incoming;
     };
 
     Sync<State> state_;
 
-    #ifndef _WIN32 // TODO need graceful async exit support on Windows?
+#ifndef _WIN32 // TODO need graceful async exit support on Windows?
     /* We can't use a std::condition_variable to wake up the curl
        thread, because it only monitors file descriptors. So use a
        pipe instead. */
     Pipe wakeupPipe;
-    #endif
+#endif
 
     std::thread workerThread;
 
@@ -590,18 +619,17 @@ struct curlFileTransfer : public FileTransfer
 
         curlm = curl_multi_init();
 
-        #if LIBCURL_VERSION_NUM >= 0x072b00 // Multiplex requires >= 7.43.0
+#if LIBCURL_VERSION_NUM >= 0x072b00 // Multiplex requires >= 7.43.0
         curl_multi_setopt(curlm, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
-        #endif
-        #if LIBCURL_VERSION_NUM >= 0x071e00 // Max connections requires >= 7.30.0
-        curl_multi_setopt(curlm, CURLMOPT_MAX_TOTAL_CONNECTIONS,
-            fileTransferSettings.httpConnections.get());
-        #endif
+#endif
+#if LIBCURL_VERSION_NUM >= 0x071e00 // Max connections requires >= 7.30.0
+        curl_multi_setopt(curlm, CURLMOPT_MAX_TOTAL_CONNECTIONS, fileTransferSettings.httpConnections.get());
+#endif
 
-        #ifndef _WIN32 // TODO need graceful async exit support on Windows?
+#ifndef _WIN32 // TODO need graceful async exit support on Windows?
         wakeupPipe.create();
         fcntl(wakeupPipe.readSide.get(), F_SETFL, O_NONBLOCK);
-        #endif
+#endif
 
         workerThread = std::thread([&]() { workerThreadEntry(); });
     }
@@ -612,7 +640,8 @@ struct curlFileTransfer : public FileTransfer
 
         workerThread.join();
 
-        if (curlm) curl_multi_cleanup(curlm);
+        if (curlm)
+            curl_multi_cleanup(curlm);
     }
 
     void stopWorkerThread()
@@ -622,28 +651,26 @@ struct curlFileTransfer : public FileTransfer
             auto state(state_.lock());
             state->quit = true;
         }
-        #ifndef _WIN32 // TODO need graceful async exit support on Windows?
+#ifndef _WIN32 // TODO need graceful async exit support on Windows?
         writeFull(wakeupPipe.writeSide.get(), " ", false);
-        #endif
+#endif
     }
 
     void workerThreadMain()
     {
-        /* Cause this thread to be notified on SIGINT. */
-        #ifndef _WIN32 // TODO need graceful async exit support on Windows?
-        auto callback = createInterruptCallback([&]() {
-            stopWorkerThread();
-        });
-        #endif
+/* Cause this thread to be notified on SIGINT. */
+#ifndef _WIN32 // TODO need graceful async exit support on Windows?
+        auto callback = createInterruptCallback([&]() { stopWorkerThread(); });
+#endif
 
-        #ifdef __linux__
+#ifdef __linux__
         try {
             tryUnshareFilesystem();
         } catch (nix::Error & e) {
             e.addTrace({}, "in download thread");
             throw;
         }
-        #endif
+#endif
 
         std::map<CURL *, std::shared_ptr<TransferItem>> items;
 
@@ -677,16 +704,19 @@ struct curlFileTransfer : public FileTransfer
             /* Wait for activity, including wakeup events. */
             int numfds = 0;
             struct curl_waitfd extraFDs[1];
-            #ifndef _WIN32 // TODO need graceful async exit support on Windows?
+#ifndef _WIN32 // TODO need graceful async exit support on Windows?
             extraFDs[0].fd = wakeupPipe.readSide.get();
             extraFDs[0].events = CURL_WAIT_POLLIN;
             extraFDs[0].revents = 0;
-            #endif
+#endif
             long maxSleepTimeMs = items.empty() ? 10000 : 100;
-            auto sleepTimeMs =
-                nextWakeup != std::chrono::steady_clock::time_point()
-                ? std::max(0, (int) std::chrono::duration_cast<std::chrono::milliseconds>(nextWakeup - std::chrono::steady_clock::now()).count())
-                : maxSleepTimeMs;
+            auto sleepTimeMs = nextWakeup != std::chrono::steady_clock::time_point()
+                                   ? std::max(
+                                         0,
+                                         (int) std::chrono::duration_cast<std::chrono::milliseconds>(
+                                             nextWakeup - std::chrono::steady_clock::now())
+                                             .count())
+                                   : maxSleepTimeMs;
             vomit("download thread waiting for %d ms", sleepTimeMs);
             mc = curl_multi_wait(curlm, extraFDs, 1, sleepTimeMs, &numfds);
             if (mc != CURLM_OK)
@@ -715,8 +745,7 @@ struct curlFileTransfer : public FileTransfer
                         incoming.push_back(item);
                         state->incoming.pop();
                     } else {
-                        if (nextWakeup == std::chrono::steady_clock::time_point()
-                            || item->embargo < nextWakeup)
+                        if (nextWakeup == std::chrono::steady_clock::time_point() || item->embargo < nextWakeup)
                             nextWakeup = item->embargo;
                         break;
                     }
@@ -747,17 +776,16 @@ struct curlFileTransfer : public FileTransfer
 
         {
             auto state(state_.lock());
-            while (!state->incoming.empty()) state->incoming.pop();
+            while (!state->incoming.empty())
+                state->incoming.pop();
             state->quit = true;
         }
     }
 
     void enqueueItem(std::shared_ptr<TransferItem> item)
     {
-        if (item->request.data
-            && !hasPrefix(item->request.uri, "http://")
-            && !hasPrefix(item->request.uri, "https://"))
-            throw nix::Error("uploading to '%s' is not supported", item->request.uri);
+        if (item->request.data && item->request.uri.scheme() != "http" && item->request.uri.scheme() != "https")
+            throw nix::Error("uploading to '%s' is not supported", item->request.uri.to_string());
 
         {
             auto state(state_.lock());
@@ -765,56 +793,42 @@ struct curlFileTransfer : public FileTransfer
                 throw nix::Error("cannot enqueue download request because the download thread is shutting down");
             state->incoming.push(item);
         }
-        #ifndef _WIN32 // TODO need graceful async exit support on Windows?
+#ifndef _WIN32 // TODO need graceful async exit support on Windows?
         writeFull(wakeupPipe.writeSide.get(), " ");
-        #endif
-    }
-
-#if NIX_WITH_S3_SUPPORT
-    std::tuple<std::string, std::string, Store::Config::Params> parseS3Uri(std::string uri)
-    {
-        auto [path, params] = splitUriAndParams(uri);
-
-        auto slash = path.find('/', 5); // 5 is the length of "s3://" prefix
-            if (slash == std::string::npos)
-                throw nix::Error("bad S3 URI '%s'", path);
-
-        std::string bucketName(path, 5, slash - 5);
-        std::string key(path, slash + 1);
-
-        return {bucketName, key, params};
-    }
 #endif
+    }
 
-    void enqueueFileTransfer(const FileTransferRequest & request,
-        Callback<FileTransferResult> callback) override
+    void enqueueFileTransfer(const FileTransferRequest & request, Callback<FileTransferResult> callback) override
     {
         /* Ugly hack to support s3:// URIs. */
-        if (hasPrefix(request.uri, "s3://")) {
+        if (request.uri.scheme() == "s3") {
             // FIXME: do this on a worker thread
             try {
 #if NIX_WITH_S3_SUPPORT
-                auto [bucketName, key, params] = parseS3Uri(request.uri);
+                auto parsed = ParsedS3URL::parse(request.uri.parsed());
 
-                std::string profile = getOr(params, "profile", "");
-                std::string region = getOr(params, "region", Aws::Region::US_EAST_1);
-                std::string scheme = getOr(params, "scheme", "");
-                std::string endpoint = getOr(params, "endpoint", "");
+                std::string profile = parsed.profile.value_or("");
+                std::string region = parsed.region.value_or(Aws::Region::US_EAST_1);
+                std::string scheme = parsed.scheme.value_or("");
+                std::string endpoint = parsed.getEncodedEndpoint().value_or("");
 
                 S3Helper s3Helper(profile, region, scheme, endpoint);
 
                 // FIXME: implement ETag
-                auto s3Res = s3Helper.getObject(bucketName, key);
+                auto s3Res = s3Helper.getObject(parsed.bucket, encodeUrlPath(parsed.key));
                 FileTransferResult res;
                 if (!s3Res.data)
                     throw FileTransferError(NotFound, {}, "S3 object '%s' does not exist", request.uri);
                 res.data = std::move(*s3Res.data);
-                res.urls.push_back(request.uri);
+                res.urls.push_back(request.uri.to_string());
                 callback(std::move(res));
 #else
-                throw nix::Error("cannot download '%s' because Nix is not built with S3 support", request.uri);
+                throw nix::Error(
+                    "cannot download '%s' because Nix is not built with S3 support", request.uri.to_string());
 #endif
-            } catch (...) { callback.rethrow(); }
+            } catch (...) {
+                callback.rethrow();
+            }
             return;
         }
 
@@ -845,14 +859,13 @@ ref<FileTransfer> makeFileTransfer()
 std::future<FileTransferResult> FileTransfer::enqueueFileTransfer(const FileTransferRequest & request)
 {
     auto promise = std::make_shared<std::promise<FileTransferResult>>();
-    enqueueFileTransfer(request,
-        {[promise](std::future<FileTransferResult> fut) {
-            try {
-                promise->set_value(fut.get());
-            } catch (...) {
-                promise->set_exception(std::current_exception());
-            }
-        }});
+    enqueueFileTransfer(request, {[promise](std::future<FileTransferResult> fut) {
+                            try {
+                                promise->set_value(fut.get());
+                            } catch (...) {
+                                promise->set_exception(std::current_exception());
+                            }
+                        }});
     return promise->get_future();
 }
 
@@ -868,9 +881,7 @@ FileTransferResult FileTransfer::upload(const FileTransferRequest & request)
 }
 
 void FileTransfer::download(
-    FileTransferRequest && request,
-    Sink & sink,
-    std::function<void(FileTransferResult)> resultCallback)
+    FileTransferRequest && request, Sink & sink, std::function<void(FileTransferResult)> resultCallback)
 {
     /* Note: we can't call 'sink' via request.dataCallback, because
        that would cause the sink to execute on the fileTransfer
@@ -880,7 +891,8 @@ void FileTransfer::download(
        Therefore we use a buffer to communicate data between the
        download thread and the calling thread. */
 
-    struct State {
+    struct State
+    {
         bool quit = false;
         std::exception_ptr exc;
         std::string data;
@@ -898,10 +910,10 @@ void FileTransfer::download(
     });
 
     request.dataCallback = [_state](std::string_view data) {
-
         auto state(_state->lock());
 
-        if (state->quit) return;
+        if (state->quit)
+            return;
 
         /* If the buffer is full, then go to sleep until the calling
            thread wakes us up (i.e. when it has removed data from the
@@ -921,8 +933,8 @@ void FileTransfer::download(
         state->avail.notify_one();
     };
 
-    enqueueFileTransfer(request,
-        {[_state, resultCallback{std::move(resultCallback)}](std::future<FileTransferResult> fut) {
+    enqueueFileTransfer(
+        request, {[_state, resultCallback{std::move(resultCallback)}](std::future<FileTransferResult> fut) {
             auto state(_state->lock());
             state->quit = true;
             try {
@@ -949,13 +961,15 @@ void FileTransfer::download(
             if (state->data.empty()) {
 
                 if (state->quit) {
-                    if (state->exc) std::rethrow_exception(state->exc);
+                    if (state->exc)
+                        std::rethrow_exception(state->exc);
                     return;
                 }
 
                 state.wait(state->avail);
 
-                if (state->data.empty()) continue;
+                if (state->data.empty())
+                    continue;
             }
 
             chunk = std::move(state->data);
@@ -974,8 +988,11 @@ void FileTransfer::download(
 }
 
 template<typename... Args>
-FileTransferError::FileTransferError(FileTransfer::Error error, std::optional<std::string> response, const Args & ... args)
-    : Error(args...), error(error), response(response)
+FileTransferError::FileTransferError(
+    FileTransfer::Error error, std::optional<std::string> response, const Args &... args)
+    : Error(args...)
+    , error(error)
+    , response(response)
 {
     const auto hf = HintFmt(args...);
     // FIXME: Due to https://github.com/NixOS/nix/issues/3841 we don't know how
@@ -987,4 +1004,4 @@ FileTransferError::FileTransferError(FileTransfer::Error error, std::optional<st
         err.msg = hf;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 48467381d..fdbc670df 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -1,6 +1,7 @@
 #include "nix/store/derivations.hh"
 #include "nix/store/globals.hh"
 #include "nix/store/local-store.hh"
+#include "nix/store/path.hh"
 #include "nix/util/finally.hh"
 #include "nix/util/unix-domain-socket.hh"
 #include "nix/util/signals.hh"
@@ -13,14 +14,10 @@
 #  include "nix/util/processes.hh"
 #endif
 
+#include <boost/unordered/unordered_flat_map.hpp>
+#include <boost/unordered/unordered_flat_set.hpp>
 #include <boost/regex.hpp>
-
-#include <functional>
 #include <queue>
-#include <algorithm>
-#include <random>
-
-#include <climits>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
@@ -40,7 +37,6 @@ namespace nix {
 static std::string gcSocketPath = "/gc-socket/socket";
 static std::string gcRootsDir = "gcroots";
 
-
 void LocalStore::addIndirectRoot(const Path & path)
 {
     std::string hash = hashString(HashAlgorithm::SHA1, path).to_string(HashFormat::Nix32, false);
@@ -48,13 +44,13 @@ void LocalStore::addIndirectRoot(const Path & path)
     makeSymlink(realRoot, path);
 }
 
-
 void LocalStore::createTempRootsFile()
 {
     auto fdTempRoots(_fdTempRoots.lock());
 
     /* Create the temporary roots file for this process. */
-    if (*fdTempRoots) return;
+    if (*fdTempRoots)
+        return;
 
     while (1) {
         if (pathExists(fnTempRoots))
@@ -72,7 +68,8 @@ void LocalStore::createTempRootsFile()
         struct stat st;
         if (fstat(fromDescriptorReadOnly(fdTempRoots->get()), &st) == -1)
             throw SysError("statting '%1%'", fnTempRoots);
-        if (st.st_size == 0) break;
+        if (st.st_size == 0)
+            break;
 
         /* The garbage collector deleted this file before we could get
            a lock.  (It won't delete the file after we get a lock.)
@@ -80,12 +77,12 @@ void LocalStore::createTempRootsFile()
     }
 }
 
-
 void LocalStore::addTempRoot(const StorePath & path)
 {
     if (config->readOnly) {
-      debug("Read-only store doesn't support creating lock files for temp roots, but nothing can be deleted anyways.");
-      return;
+        debug(
+            "Read-only store doesn't support creating lock files for temp roots, but nothing can be deleted anyways.");
+        return;
     }
 
     createTempRootsFile();
@@ -97,7 +94,7 @@ void LocalStore::addTempRoot(const StorePath & path)
             *fdGCLock = openGCLock();
     }
 
- restart:
+restart:
     /* Try to acquire a shared global GC lock (non-blocking). This
        only succeeds if the garbage collector is not currently
        running. */
@@ -157,10 +154,8 @@ void LocalStore::addTempRoot(const StorePath & path)
     writeFull(_fdTempRoots.lock()->get(), s);
 }
 
-
 static std::string censored = "{censored}";
 
-
 void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
 {
     /* Read the `temproots' directory for per-process temporary root
@@ -178,14 +173,17 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
         pid_t pid = std::stoi(name);
 
         debug("reading temporary root file '%1%'", path);
-        AutoCloseFD fd(toDescriptor(open(path.c_str(),
+        AutoCloseFD fd(toDescriptor(open(
+            path.c_str(),
 #ifndef _WIN32
             O_CLOEXEC |
 #endif
-            O_RDWR, 0666)));
+                O_RDWR,
+            0666)));
         if (!fd) {
             /* It's okay if the file has disappeared. */
-            if (errno == ENOENT) continue;
+            if (errno == ENOENT)
+                continue;
             throw SysError("opening temporary roots file '%1%'", path);
         }
 
@@ -214,7 +212,6 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
     }
 }
 
-
 void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, Roots & roots)
 {
     auto foundRoot = [&](const Path & path, const Path & target) {
@@ -224,7 +221,8 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
                 roots[std::move(storePath)].emplace(path);
             else
                 printInfo("skipping invalid root from '%1%' to '%2%'", path, target);
-        } catch (BadStorePath &) { }
+        } catch (BadStorePath &) {
+        }
     };
 
     try {
@@ -253,9 +251,11 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
                         unlink(path.c_str());
                     }
                 } else {
-                    if (!std::filesystem::is_symlink(target)) return;
+                    if (!std::filesystem::is_symlink(target))
+                        return;
                     Path target2 = readLink(target);
-                    if (isInStore(target2)) foundRoot(target, target2);
+                    if (isInStore(target2))
+                        foundRoot(target, target2);
                 }
             }
         }
@@ -270,7 +270,8 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
 
     catch (std::filesystem::filesystem_error & e) {
         /* We only ignore permanent failures. */
-        if (e.code() == std::errc::permission_denied || e.code() == std::errc::no_such_file_or_directory || e.code() == std::errc::not_a_directory)
+        if (e.code() == std::errc::permission_denied || e.code() == std::errc::no_such_file_or_directory
+            || e.code() == std::errc::not_a_directory)
             printInfo("cannot read potential root '%1%'", path);
         else
             throw;
@@ -285,7 +286,6 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
     }
 }
 
-
 void LocalStore::findRootsNoTemp(Roots & roots, bool censor)
 {
     /* Process direct roots in {gcroots,profiles}. */
@@ -298,7 +298,6 @@ void LocalStore::findRootsNoTemp(Roots & roots, bool censor)
     findRuntimeRoots(roots, censor);
 }
 
-
 Roots LocalStore::findRoots(bool censor)
 {
     Roots roots;
@@ -312,7 +311,12 @@ Roots LocalStore::findRoots(bool censor)
 /**
  * Key is a mere string because cannot has path with macOS's libc++
  */
-typedef std::unordered_map<std::string, std::unordered_set<std::string>> UncheckedRoots;
+typedef boost::unordered_flat_map<
+    std::string,
+    boost::unordered_flat_set<std::string, StringViewHash, std::equal_to<>>,
+    StringViewHash,
+    std::equal_to<>>
+    UncheckedRoots;
 
 static void readProcLink(const std::filesystem::path & file, UncheckedRoots & roots)
 {
@@ -320,14 +324,13 @@ static void readProcLink(const std::filesystem::path & file, UncheckedRoots & ro
     try {
         buf = std::filesystem::read_symlink(file);
     } catch (std::filesystem::filesystem_error & e) {
-        if (e.code() == std::errc::no_such_file_or_directory
-                || e.code() == std::errc::permission_denied
-                || e.code() == std::errc::no_such_process)
+        if (e.code() == std::errc::no_such_file_or_directory || e.code() == std::errc::permission_denied
+            || e.code() == std::errc::no_such_process)
             return;
         throw;
     }
     if (buf.is_absolute())
-        roots[buf.string()].emplace(file.string());
+        roots[buf].emplace(file.string());
 }
 
 static std::string quoteRegexChars(const std::string & raw)
@@ -362,7 +365,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
             checkInterrupt();
             if (boost::regex_match(ent->d_name, digitsRegex)) {
                 try {
-                    readProcLink(fmt("/proc/%s/exe" ,ent->d_name), unchecked);
+                    readProcLink(fmt("/proc/%s/exe", ent->d_name), unchecked);
                     readProcLink(fmt("/proc/%s/cwd", ent->d_name), unchecked);
 
                     auto fdStr = fmt("/proc/%s/fd", ent->d_name);
@@ -395,7 +398,9 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
                     auto envFile = fmt("/proc/%s/environ", ent->d_name);
                     auto envString = readFile(envFile);
                     auto env_end = boost::sregex_iterator{};
-                    for (auto i = boost::sregex_iterator{envString.begin(), envString.end(), storePathRegex}; i != env_end; ++i)
+                    for (auto i = boost::sregex_iterator{envString.begin(), envString.end(), storePathRegex};
+                         i != env_end;
+                         ++i)
                         unchecked[i->str()].emplace(envFile);
                 } catch (SystemError & e) {
                     if (errno == ENOENT || errno == EACCES || errno == ESRCH)
@@ -416,7 +421,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
         try {
             boost::regex lsofRegex(R"(^n(/.*)$)");
             auto lsofLines =
-                tokenizeString<std::vector<std::string>>(runProgram(LSOF, true, { "-n", "-w", "-F", "n" }), "\n");
+                tokenizeString<std::vector<std::string>>(runProgram(LSOF, true, {"-n", "-w", "-F", "n"}), "\n");
             for (const auto & line : lsofLines) {
                 boost::smatch match;
                 if (boost::regex_match(line, match, lsofRegex))
@@ -435,22 +440,24 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
 #endif
 
     for (auto & [target, links] : unchecked) {
-        if (!isInStore(target)) continue;
+        if (!isInStore(target))
+            continue;
         try {
             auto path = toStorePath(target).first;
-            if (!isValidPath(path)) continue;
+            if (!isValidPath(path))
+                continue;
             debug("got additional root '%1%'", printStorePath(path));
             if (censor)
                 roots[path].insert(censored);
             else
                 roots[path].insert(links.begin(), links.end());
-        } catch (BadStorePath &) { }
+        } catch (BadStorePath &) {
+        }
     }
 }
 
-
-struct GCLimitReached { };
-
+struct GCLimitReached
+{};
 
 void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 {
@@ -458,13 +465,13 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
     bool gcKeepOutputs = settings.gcKeepOutputs;
     bool gcKeepDerivations = settings.gcKeepDerivations;
 
-    std::unordered_set<StorePath> roots, dead, alive;
+    boost::unordered_flat_set<StorePath, std::hash<StorePath>> roots, dead, alive;
 
     struct Shared
     {
         // The temp roots only store the hash part to make it easier to
         // ignore suffixes like '.lock', '.chroot' and '.check'.
-        std::unordered_set<std::string> tempRoots;
+        boost::unordered_flat_set<std::string, StringViewHash, std::equal_to<>> tempRoots;
 
         // Hash part of the store path currently being deleted, if
         // any.
@@ -521,7 +528,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
             fdServer.close();
             while (true) {
                 auto item = remove_begin(*connections.lock());
-                if (!item) break;
+                if (!item)
+                    break;
                 auto & [fd, thread] = *item;
                 shutdown(fd, SHUT_RDWR);
                 thread.join();
@@ -543,7 +551,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                 /* Accept a new connection. */
                 assert(fds[1].revents & POLLIN);
                 AutoCloseFD fdClient = accept(fdServer.get(), nullptr, nullptr);
-                if (!fdClient) continue;
+                if (!fdClient)
+                    continue;
 
                 debug("GC roots server accepted new client");
 
@@ -571,9 +580,9 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                             auto storePath = maybeParseStorePath(path);
                             if (storePath) {
                                 debug("got new GC root '%s'", path);
-                                auto hashPart = std::string(storePath->hashPart());
+                                auto hashPart = storePath->hashPart();
                                 auto shared(_shared.lock());
-                                shared->tempRoots.insert(hashPart);
+                                shared->tempRoots.emplace(hashPart);
                                 /* If this path is currently being
                                    deleted, then we have to wait until
                                    deletion is finished to ensure that
@@ -604,7 +613,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
     Finally stopServer([&]() {
         writeFull(shutdownPipe.writeSide.get(), "x", false);
         wakeup.notify_all();
-        if (serverThread.joinable()) serverThread.join();
+        if (serverThread.joinable())
+            serverThread.join();
     });
 
 #endif
@@ -616,14 +626,15 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
     if (!options.ignoreLiveness)
         findRootsNoTemp(rootMap, true);
 
-    for (auto & i : rootMap) roots.insert(i.first);
+    for (auto & i : rootMap)
+        roots.insert(i.first);
 
     /* Read the temporary roots created before we acquired the global
        GC root. Any new roots will be sent to our socket. */
     Roots tempRoots;
     findTempRoots(tempRoots, true);
     for (auto & root : tempRoots) {
-        _shared.lock()->tempRoots.insert(std::string(root.first.hashPart()));
+        _shared.lock()->tempRoots.emplace(root.first.hashPart());
         roots.insert(root.first);
     }
 
@@ -633,8 +644,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 
     /* Helper function that deletes a path from the store and throws
        GCLimitReached if we've deleted enough garbage. */
-    auto deleteFromStore = [&](std::string_view baseName)
-    {
+    auto deleteFromStore = [&](std::string_view baseName) {
         Path path = storeDir + "/" + std::string(baseName);
         Path realPath = config->realStoreDir + "/" + std::string(baseName);
 
@@ -664,7 +674,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         }
     };
 
-    std::unordered_map<StorePath, StorePathSet> referrersCache;
+    boost::unordered_flat_map<StorePath, StorePathSet, std::hash<StorePath>> referrersCache;
 
     /* Helper function that visits all paths reachable from `start`
        via the referrers edges and optionally derivers and derivation
@@ -701,19 +711,24 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 
             /* If we've previously deleted this path, we don't have to
                handle it again. */
-            if (dead.count(*path)) continue;
+            if (dead.count(*path))
+                continue;
 
-            auto markAlive = [&]()
-            {
+            auto markAlive = [&]() {
                 alive.insert(*path);
                 alive.insert(start);
                 try {
                     StorePathSet closure;
-                    computeFSClosure(*path, closure,
-                        /* flipDirection */ false, gcKeepOutputs, gcKeepDerivations);
+                    computeFSClosure(
+                        *path,
+                        closure,
+                        /* flipDirection */ false,
+                        gcKeepOutputs,
+                        gcKeepDerivations);
                     for (auto & p : closure)
                         alive.insert(p);
-                } catch (InvalidPath &) { }
+                } catch (InvalidPath &) {
+                }
             };
 
             /* If this is a root, bail out. */
@@ -722,12 +737,11 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                 return markAlive();
             }
 
-            if (options.action == GCOptions::gcDeleteSpecific
-                && !options.pathsToDelete.count(*path))
+            if (options.action == GCOptions::gcDeleteSpecific && !options.pathsToDelete.count(*path))
                 return;
 
             {
-                auto hashPart = std::string(path->hashPart());
+                auto hashPart = path->hashPart();
                 auto shared(_shared.lock());
                 if (shared->tempRoots.count(hashPart)) {
                     debug("cannot delete '%s' because it's a temporary root", printStorePath(*path));
@@ -753,9 +767,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                    derivation, then visit the derivation outputs. */
                 if (gcKeepDerivations && path->isDerivation()) {
                     for (auto & [name, maybeOutPath] : queryPartialDerivationOutputMap(*path))
-                        if (maybeOutPath &&
-                            isValidPath(*maybeOutPath) &&
-                            queryPathInfo(*maybeOutPath)->deriver == *path)
+                        if (maybeOutPath && isValidPath(*maybeOutPath)
+                            && queryPathInfo(*maybeOutPath)->deriver == *path)
                             enqueue(*maybeOutPath);
                 }
 
@@ -768,13 +781,14 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
             }
         }
         for (auto & path : topoSortPaths(visited)) {
-            if (!dead.insert(path).second) continue;
+            if (!dead.insert(path).second)
+                continue;
             if (shouldDelete) {
                 try {
                     invalidatePathChecked(path);
                     deleteFromStore(path.to_string());
                     referrersCache.erase(path);
-                } catch (PathInUse &e) {
+                } catch (PathInUse & e) {
                     // If we end up here, it's likely a new occurrence
                     // of https://github.com/NixOS/nix/issues/11923
                     printError("BUG: %s", e.what());
@@ -806,24 +820,24 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 
         try {
             AutoCloseDir dir(opendir(config->realStoreDir.get().c_str()));
-            if (!dir) throw SysError("opening directory '%1%'", config->realStoreDir);
+            if (!dir)
+                throw SysError("opening directory '%1%'", config->realStoreDir);
 
             /* Read the store and delete all paths that are invalid or
                unreachable. We don't use readDirectory() here so that
                GCing can start faster. */
             auto linksName = baseNameOf(linksDir);
-            Paths entries;
             struct dirent * dirent;
             while (errno = 0, dirent = readdir(dir.get())) {
                 checkInterrupt();
                 std::string name = dirent->d_name;
-                if (name == "." || name == ".." || name == linksName) continue;
+                if (name == "." || name == ".." || name == linksName)
+                    continue;
 
                 if (auto storePath = maybeParseStorePath(storeDir + "/" + name))
                     deleteReferrersClosure(*storePath);
                 else
                     deleteFromStore(name);
-
             }
         } catch (GCLimitReached & e) {
         }
@@ -850,7 +864,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         printInfo("deleting unused links...");
 
         AutoCloseDir dir(opendir(linksDir.c_str()));
-        if (!dir) throw SysError("opening directory '%1%'", linksDir);
+        if (!dir)
+            throw SysError("opening directory '%1%'", linksDir);
 
         int64_t actualSize = 0, unsharedSize = 0;
 
@@ -858,7 +873,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         while (errno = 0, dirent = readdir(dir.get())) {
             checkInterrupt();
             std::string name = dirent->d_name;
-            if (name == "." || name == "..") continue;
+            if (name == "." || name == "..")
+                continue;
             Path path = linksDir + "/" + name;
 
             auto st = lstat(path);
@@ -889,15 +905,15 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 #endif
             ;
 
-        printInfo("note: currently hard linking saves %.2f MiB",
+        printInfo(
+            "note: currently hard linking saves %.2f MiB",
             ((unsharedSize - actualSize - overhead) / (1024.0 * 1024.0)));
     }
 
     /* While we're at it, vacuum the database. */
-    //if (options.action == GCOptions::gcDeleteDead) vacuumDB();
+    // if (options.action == GCOptions::gcDeleteDead) vacuumDB();
 }
 
-
 void LocalStore::autoGC(bool sync)
 {
 #if HAVE_STATVFS
@@ -917,7 +933,7 @@ void LocalStore::autoGC(bool sync)
     std::shared_future<void> future;
 
     {
-        auto state(_state.lock());
+        auto state(_state->lock());
 
         if (state->gcRunning) {
             future = state->gcFuture;
@@ -927,15 +943,18 @@ void LocalStore::autoGC(bool sync)
 
         auto now = std::chrono::steady_clock::now();
 
-        if (now < state->lastGCCheck + std::chrono::seconds(settings.minFreeCheckInterval)) return;
+        if (now < state->lastGCCheck + std::chrono::seconds(settings.minFreeCheckInterval))
+            return;
 
         auto avail = getAvail();
 
         state->lastGCCheck = now;
 
-        if (avail >= settings.minFree || avail >= settings.maxFree) return;
+        if (avail >= settings.minFree || avail >= settings.maxFree)
+            return;
 
-        if (avail > state->availAfterGC * 0.97) return;
+        if (avail > state->availAfterGC * 0.97)
+            return;
 
         state->gcRunning = true;
 
@@ -943,12 +962,11 @@ void LocalStore::autoGC(bool sync)
         future = state->gcFuture = promise.get_future().share();
 
         std::thread([promise{std::move(promise)}, this, avail, getAvail]() mutable {
-
             try {
 
                 /* Wake up any threads waiting for the auto-GC to finish. */
                 Finally wakeup([&]() {
-                    auto state(_state.lock());
+                    auto state(_state->lock());
                     state->gcRunning = false;
                     state->lastGCCheck = std::chrono::steady_clock::now();
                     promise.set_value();
@@ -963,22 +981,21 @@ void LocalStore::autoGC(bool sync)
 
                 collectGarbage(options, results);
 
-                _state.lock()->availAfterGC = getAvail();
+                _state->lock()->availAfterGC = getAvail();
 
             } catch (...) {
                 // FIXME: we could propagate the exception to the
                 // future, but we don't really care. (what??)
                 ignoreExceptionInDestructor();
             }
-
         }).detach();
     }
 
- sync:
+sync:
     // Wait for the future outside of the state lock.
-    if (sync) future.get();
+    if (sync)
+        future.get();
 #endif
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index de5128347..612e79ab0 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -16,30 +16,29 @@
 #include <nlohmann/json.hpp>
 
 #ifndef _WIN32
-# include <sys/utsname.h>
+#  include <sys/utsname.h>
 #endif
 
 #ifdef __GLIBC__
-# include <gnu/lib-names.h>
-# include <nss.h>
-# include <dlfcn.h>
+#  include <gnu/lib-names.h>
+#  include <nss.h>
+#  include <dlfcn.h>
 #endif
 
 #ifdef __APPLE__
-# include "nix/util/processes.hh"
+#  include "nix/util/processes.hh"
 #endif
 
 #include "nix/util/config-impl.hh"
 
 #ifdef __APPLE__
-#include <sys/sysctl.h>
+#  include <sys/sysctl.h>
 #endif
 
 #include "store-config-private.hh"
 
 namespace nix {
 
-
 /* The default location of the daemon socket, relative to nixStateDir.
    The socket is in a directory to allow you to control access to the
    Nix daemon by setting the mode/ownership of the directory
@@ -55,17 +54,18 @@ Settings::Settings()
     : nixPrefix(NIX_PREFIX)
     , nixStore(
 #ifndef _WIN32
-        // On Windows `/nix/store` is not a canonical path, but we dont'
-        // want to deal with that yet.
-        canonPath
+          // On Windows `/nix/store` is not a canonical path, but we dont'
+          // want to deal with that yet.
+          canonPath
 #endif
-        (getEnvNonEmpty("NIX_STORE_DIR").value_or(getEnvNonEmpty("NIX_STORE").value_or(NIX_STORE_DIR))))
+          (getEnvNonEmpty("NIX_STORE_DIR").value_or(getEnvNonEmpty("NIX_STORE").value_or(NIX_STORE_DIR))))
     , nixDataDir(canonPath(getEnvNonEmpty("NIX_DATA_DIR").value_or(NIX_DATA_DIR)))
     , nixLogDir(canonPath(getEnvNonEmpty("NIX_LOG_DIR").value_or(NIX_LOG_DIR)))
     , nixStateDir(canonPath(getEnvNonEmpty("NIX_STATE_DIR").value_or(NIX_STATE_DIR)))
     , nixConfDir(canonPath(getEnvNonEmpty("NIX_CONF_DIR").value_or(NIX_CONF_DIR)))
     , nixUserConfFiles(getUserConfigFiles())
-    , nixDaemonSocketFile(canonPath(getEnvNonEmpty("NIX_DAEMON_SOCKET_PATH").value_or(nixStateDir + DEFAULT_SOCKET_PATH)))
+    , nixDaemonSocketFile(
+          canonPath(getEnvNonEmpty("NIX_DAEMON_SOCKET_PATH").value_or(nixStateDir + DEFAULT_SOCKET_PATH)))
 {
 #ifndef _WIN32
     buildUsersGroup = isRootUser() ? "nixbld" : "";
@@ -86,12 +86,22 @@ Settings::Settings()
     }
 
 #if (defined(__linux__) || defined(__FreeBSD__)) && defined(SANDBOX_SHELL)
-    sandboxPaths = tokenizeString<StringSet>("/bin/sh=" SANDBOX_SHELL);
+    sandboxPaths = {{"/bin/sh", {.source = SANDBOX_SHELL}}};
 #endif
 
     /* chroot-like behavior from Apple's sandbox */
 #ifdef __APPLE__
-    sandboxPaths = tokenizeString<StringSet>("/System/Library/Frameworks /System/Library/PrivateFrameworks /bin/sh /bin/bash /private/tmp /private/var/tmp /usr/lib");
+    for (PathView p : {
+             "/System/Library/Frameworks",
+             "/System/Library/PrivateFrameworks",
+             "/bin/sh",
+             "/bin/bash",
+             "/private/tmp",
+             "/private/var/tmp",
+             "/usr/lib",
+         }) {
+        sandboxPaths.get().insert_or_assign(std::string{p}, ChrootPath{.source = std::string{p}});
+    }
     allowedImpureHostPrefixes = tokenizeString<StringSet>("/System/Library /usr/lib /dev /bin/sh");
 #endif
 }
@@ -102,7 +112,8 @@ void loadConfFile(AbstractConfig & config)
         try {
             std::string contents = readFile(path);
             config.applyConfig(contents, path);
-        } catch (SystemError &) { }
+        } catch (SystemError &) {
+        }
     };
 
     applyConfigFile(settings.nixConfDir + "/nix.conf");
@@ -120,7 +131,6 @@ void loadConfFile(AbstractConfig & config)
     if (nixConfEnv.has_value()) {
         config.applyConfig(nixConfEnv.value(), "NIX_CONFIG");
     }
-
 }
 
 std::vector<Path> getUserConfigFiles()
@@ -140,19 +150,20 @@ std::vector<Path> getUserConfigFiles()
     return files;
 }
 
-unsigned int Settings::getDefaultCores()
+unsigned int Settings::getDefaultCores() const
 {
     const unsigned int concurrency = std::max(1U, std::thread::hardware_concurrency());
     const unsigned int maxCPU = getMaxCPU();
 
     if (maxCPU > 0)
-      return maxCPU;
+        return maxCPU;
     else
-      return concurrency;
+        return concurrency;
 }
 
 #ifdef __APPLE__
-static bool hasVirt() {
+static bool hasVirt()
+{
 
     int hasVMM;
     int hvSupport;
@@ -181,19 +192,19 @@ StringSet Settings::getDefaultSystemFeatures()
        actually require anything special on the machines. */
     StringSet features{"nixos-test", "benchmark", "big-parallel"};
 
-    #ifdef __linux__
+#ifdef __linux__
     features.insert("uid-range");
-    #endif
+#endif
 
-    #ifdef __linux__
+#ifdef __linux__
     if (access("/dev/kvm", R_OK | W_OK) == 0)
         features.insert("kvm");
-    #endif
+#endif
 
-    #ifdef __APPLE__
+#ifdef __APPLE__
     if (hasVirt())
         features.insert("apple-virt");
-    #endif
+#endif
 
     return features;
 }
@@ -214,8 +225,11 @@ StringSet Settings::getDefaultExtraPlatforms()
     // machines. Note that we can’t force processes from executing
     // x86_64 in aarch64 environments or vice versa since they can
     // always exec with their own binary preferences.
-    if (std::string{NIX_LOCAL_SYSTEM} == "aarch64-darwin" &&
-        runProgram(RunOptions {.program = "arch", .args = {"-arch", "x86_64", "/usr/bin/true"}, .mergeStderrToStdout = true}).first == 0)
+    if (std::string{NIX_LOCAL_SYSTEM} == "aarch64-darwin"
+        && runProgram(
+               RunOptions{.program = "arch", .args = {"-arch", "x86_64", "/usr/bin/true"}, .mergeStderrToStdout = true})
+                   .first
+               == 0)
         extraPlatforms.insert("x86_64-darwin");
 #endif
 
@@ -237,41 +251,57 @@ bool Settings::isWSL1()
 
 Path Settings::getDefaultSSLCertFile()
 {
-    for (auto & fn : {"/etc/ssl/certs/ca-certificates.crt", "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"})
-        if (pathAccessible(fn)) return fn;
+    for (auto & fn :
+         {"/etc/ssl/certs/ca-certificates.crt", "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"})
+        if (pathAccessible(fn))
+            return fn;
     return "";
 }
 
 std::string nixVersion = PACKAGE_VERSION;
 
-NLOHMANN_JSON_SERIALIZE_ENUM(SandboxMode, {
-    {SandboxMode::smEnabled, true},
-    {SandboxMode::smRelaxed, "relaxed"},
-    {SandboxMode::smDisabled, false},
-});
+NLOHMANN_JSON_SERIALIZE_ENUM(
+    SandboxMode,
+    {
+        {SandboxMode::smEnabled, true},
+        {SandboxMode::smRelaxed, "relaxed"},
+        {SandboxMode::smDisabled, false},
+    });
 
-template<> SandboxMode BaseSetting<SandboxMode>::parse(const std::string & str) const
+template<>
+SandboxMode BaseSetting<SandboxMode>::parse(const std::string & str) const
 {
-    if (str == "true") return smEnabled;
-    else if (str == "relaxed") return smRelaxed;
-    else if (str == "false") return smDisabled;
-    else throw UsageError("option '%s' has invalid value '%s'", name, str);
+    if (str == "true")
+        return smEnabled;
+    else if (str == "relaxed")
+        return smRelaxed;
+    else if (str == "false")
+        return smDisabled;
+    else
+        throw UsageError("option '%s' has invalid value '%s'", name, str);
 }
 
-template<> struct BaseSetting<SandboxMode>::trait
+template<>
+struct BaseSetting<SandboxMode>::trait
 {
     static constexpr bool appendable = false;
 };
 
-template<> std::string BaseSetting<SandboxMode>::to_string() const
+template<>
+std::string BaseSetting<SandboxMode>::to_string() const
 {
-    if (value == smEnabled) return "true";
-    else if (value == smRelaxed) return "relaxed";
-    else if (value == smDisabled) return "false";
-    else unreachable();
+    if (value == smEnabled)
+        return "true";
+    else if (value == smRelaxed)
+        return "relaxed";
+    else if (value == smDisabled)
+        return "false";
+    else
+        unreachable();
 }
 
-template<> void BaseSetting<SandboxMode>::convertToArg(Args & args, const std::string & category)
+template<>
+void BaseSetting<SandboxMode>::convertToArg(Args & args, const std::string & category)
 {
     args.addFlag({
         .longName = name,
@@ -296,9 +326,46 @@ template<> void BaseSetting<SandboxMode>::convertToArg(Args & args, const std::s
     });
 }
 
+NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(ChrootPath, source, optional)
+
+template<>
+PathsInChroot BaseSetting<PathsInChroot>::parse(const std::string & str) const
+{
+    PathsInChroot pathsInChroot;
+    for (auto i : tokenizeString<StringSet>(str)) {
+        if (i.empty())
+            continue;
+        bool optional = false;
+        if (i[i.size() - 1] == '?') {
+            optional = true;
+            i.pop_back();
+        }
+        size_t p = i.find('=');
+        if (p == std::string::npos)
+            pathsInChroot[i] = {.source = i, .optional = optional};
+        else
+            pathsInChroot[i.substr(0, p)] = {.source = i.substr(p + 1), .optional = optional};
+    }
+    return pathsInChroot;
+}
+
+template<>
+std::string BaseSetting<PathsInChroot>::to_string() const
+{
+    std::vector<std::string> accum;
+    for (auto & [name, cp] : value) {
+        std::string s = name == cp.source ? name : name + "=" + cp.source;
+        if (cp.optional)
+            s += "?";
+        accum.push_back(std::move(s));
+    }
+    return concatStringsSep(" ", accum);
+}
+
 unsigned int MaxBuildJobsSetting::parse(const std::string & str) const
 {
-    if (str == "auto") return std::max(1U, std::thread::hardware_concurrency());
+    if (str == "auto")
+        return std::max(1U, std::thread::hardware_concurrency());
     else {
         if (auto n = string2Int<decltype(value)>(str))
             return *n;
@@ -307,6 +374,13 @@ unsigned int MaxBuildJobsSetting::parse(const std::string & str) const
     }
 }
 
+template<>
+void BaseSetting<PathsInChroot>::appendOrSet(PathsInChroot newValue, bool append)
+{
+    if (!append)
+        value.clear();
+    value.insert(std::make_move_iterator(newValue.begin()), std::make_move_iterator(newValue.end()));
+}
 
 static void preloadNSS()
 {
@@ -346,15 +420,18 @@ static void preloadNSS()
 
 static bool initLibStoreDone = false;
 
-void assertLibStoreInitialized() {
+void assertLibStoreInitialized()
+{
     if (!initLibStoreDone) {
         printError("The program must call nix::initNix() before calling any libstore library functions.");
         abort();
     };
 }
 
-void initLibStore(bool loadConfig) {
-    if (initLibStoreDone) return;
+void initLibStore(bool loadConfig)
+{
+    if (initLibStoreDone)
+        return;
 
     initLibUtil();
 
@@ -371,7 +448,8 @@ void initLibStore(bool loadConfig) {
        by calling curl_global_init here, which should mean curl will already
        have been initialized by the time we try to do so in a forked process.
 
-       [1] https://github.com/apple-oss-distributions/objc4/blob/01edf1705fbc3ff78a423cd21e03dfc21eb4d780/runtime/objc-initialize.mm#L614-L636
+       [1]
+       https://github.com/apple-oss-distributions/objc4/blob/01edf1705fbc3ff78a423cd21e03dfc21eb4d780/runtime/objc-initialize.mm#L614-L636
     */
     curl_global_init(CURL_GLOBAL_ALL);
 #ifdef __APPLE__
@@ -385,5 +463,4 @@ void initLibStore(bool loadConfig) {
     initLibStoreDone = true;
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/http-binary-cache-store.cc b/src/libstore/http-binary-cache-store.cc
index e44d146b9..7737389a3 100644
--- a/src/libstore/http-binary-cache-store.cc
+++ b/src/libstore/http-binary-cache-store.cc
@@ -9,7 +9,6 @@ namespace nix {
 
 MakeError(UploadToHTTP, Error);
 
-
 StringSet HttpBinaryCacheStoreConfig::uriSchemes()
 {
     static bool forceHttp = getEnv("_NIX_FORCE_HTTP") == "1";
@@ -20,33 +19,38 @@ StringSet HttpBinaryCacheStoreConfig::uriSchemes()
 }
 
 HttpBinaryCacheStoreConfig::HttpBinaryCacheStoreConfig(
-    std::string_view scheme,
-    std::string_view _cacheUri,
-    const Params & params)
+    std::string_view scheme, std::string_view _cacheUri, const Params & params)
     : StoreConfig(params)
     , BinaryCacheStoreConfig(params)
-    , cacheUri(
-        std::string { scheme }
-        + "://"
-        + (!_cacheUri.empty()
-            ? _cacheUri
-            : throw UsageError("`%s` Store requires a non-empty authority in Store URL", scheme)))
+    , cacheUri(parseURL(
+          std::string{scheme} + "://"
+          + (!_cacheUri.empty() ? _cacheUri
+                                : throw UsageError("`%s` Store requires a non-empty authority in Store URL", scheme))))
 {
-    while (!cacheUri.empty() && cacheUri.back() == '/')
-        cacheUri.pop_back();
+    while (!cacheUri.path.empty() && cacheUri.path.back() == "")
+        cacheUri.path.pop_back();
 }
 
+StoreReference HttpBinaryCacheStoreConfig::getReference() const
+{
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = cacheUri.scheme,
+                .authority = cacheUri.renderAuthorityAndPath(),
+            },
+        .params = cacheUri.query,
+    };
+}
 
 std::string HttpBinaryCacheStoreConfig::doc()
 {
     return
-      #include "http-binary-cache-store.md"
-      ;
+#include "http-binary-cache-store.md"
+        ;
 }
 
-
-class HttpBinaryCacheStore :
-    public virtual BinaryCacheStore
+class HttpBinaryCacheStore : public virtual BinaryCacheStore
 {
     struct State
     {
@@ -63,32 +67,27 @@ public:
     ref<Config> config;
 
     HttpBinaryCacheStore(ref<Config> config)
-        : Store{*config}
-        // TODO it will actually mutate the configuration
+        : Store{*config} // TODO it will actually mutate the configuration
         , BinaryCacheStore{*config}
         , config{config}
     {
         diskCache = getNarInfoDiskCache();
     }
 
-    std::string getUri() override
-    {
-        return config->cacheUri;
-    }
-
     void init() override
     {
         // FIXME: do this lazily?
-        if (auto cacheInfo = diskCache->upToDateCacheExists(config->cacheUri)) {
+        if (auto cacheInfo = diskCache->upToDateCacheExists(config->cacheUri.to_string())) {
             config->wantMassQuery.setDefault(cacheInfo->wantMassQuery);
             config->priority.setDefault(cacheInfo->priority);
         } else {
             try {
                 BinaryCacheStore::init();
             } catch (UploadToHTTP &) {
-                throw Error("'%s' does not appear to be a binary cache", config->cacheUri);
+                throw Error("'%s' does not appear to be a binary cache", config->cacheUri.to_string());
             }
-            diskCache->createCache(config->cacheUri, config->storeDir, config->wantMassQuery, config->priority);
+            diskCache->createCache(
+                config->cacheUri.to_string(), config->storeDir, config->wantMassQuery, config->priority);
         }
     }
 
@@ -99,7 +98,7 @@ protected:
         auto state(_state.lock());
         if (state->enabled && settings.tryFallback) {
             int t = 60;
-            printError("disabling binary cache '%s' for %s seconds", getUri(), t);
+            printError("disabling binary cache '%s' for %s seconds", config->getHumanReadableURI(), t);
             state->enabled = false;
             state->disabledUntil = std::chrono::steady_clock::now() + std::chrono::seconds(t);
         }
@@ -108,13 +107,14 @@ protected:
     void checkEnabled()
     {
         auto state(_state.lock());
-        if (state->enabled) return;
+        if (state->enabled)
+            return;
         if (std::chrono::steady_clock::now() > state->disabledUntil) {
             state->enabled = true;
-            debug("re-enabling binary cache '%s'", getUri());
+            debug("re-enabling binary cache '%s'", config->getHumanReadableURI());
             return;
         }
-        throw SubstituterDisabled("substituter '%s' is disabled", getUri());
+        throw SubstituterDisabled("substituter '%s' is disabled", config->getHumanReadableURI());
     }
 
     bool fileExists(const std::string & path) override
@@ -136,7 +136,8 @@ protected:
         }
     }
 
-    void upsertFile(const std::string & path,
+    void upsertFile(
+        const std::string & path,
         std::shared_ptr<std::basic_iostream<char>> istream,
         const std::string & mimeType) override
     {
@@ -146,17 +147,24 @@ protected:
         try {
             getFileTransfer()->upload(req);
         } catch (FileTransferError & e) {
-            throw UploadToHTTP("while uploading to HTTP binary cache at '%s': %s", config->cacheUri, e.msg());
+            throw UploadToHTTP(
+                "while uploading to HTTP binary cache at '%s': %s", config->cacheUri.to_string(), e.msg());
         }
     }
 
     FileTransferRequest makeRequest(const std::string & path)
     {
-        return FileTransferRequest(
-            hasPrefix(path, "https://") || hasPrefix(path, "http://") || hasPrefix(path, "file://")
-            ? path
-            : config->cacheUri + "/" + path);
+        /* Otherwise the last path fragment will get discarded. */
+        auto cacheUriWithTrailingSlash = config->cacheUri;
+        if (!cacheUriWithTrailingSlash.path.empty())
+            cacheUriWithTrailingSlash.path.push_back("");
 
+        /* path is not a path, but a full relative or absolute
+           URL, e.g. we've seen in the wild NARINFO files have a URL
+           field which is
+           `nar/15f99rdaf26k39knmzry4xd0d97wp6yfpnfk1z9avakis7ipb9yg.nar?hash=zphkqn2wg8mnvbkixnl2aadkbn0rcnfj`
+           (note the query param) and that gets passed here. */
+        return FileTransferRequest(parseURLRelative(path, cacheUriWithTrailingSlash));
     }
 
     void getFile(const std::string & path, Sink & sink) override
@@ -167,14 +175,14 @@ protected:
             getFileTransfer()->download(std::move(request), sink);
         } catch (FileTransferError & e) {
             if (e.error == FileTransfer::NotFound || e.error == FileTransfer::Forbidden)
-                throw NoSuchBinaryCacheFile("file '%s' does not exist in binary cache '%s'", path, getUri());
+                throw NoSuchBinaryCacheFile(
+                    "file '%s' does not exist in binary cache '%s'", path, config->getHumanReadableURI());
             maybeDisable();
             throw;
         }
     }
 
-    void getFile(const std::string & path,
-        Callback<std::optional<std::string>> callback) noexcept override
+    void getFile(const std::string & path, Callback<std::optional<std::string>> callback) noexcept override
     {
         auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback));
 
@@ -183,8 +191,8 @@ protected:
 
             auto request(makeRequest(path));
 
-            getFileTransfer()->enqueueFileTransfer(request,
-                {[callbackPtr, this](std::future<FileTransferResult> result) {
+            getFileTransfer()->enqueueFileTransfer(
+                request, {[callbackPtr, this](std::future<FileTransferResult> result) {
                     try {
                         (*callbackPtr)(std::move(result.get().data));
                     } catch (FileTransferError & e) {
@@ -195,7 +203,7 @@ protected:
                     } catch (...) {
                         callbackPtr->rethrow();
                     }
-            }});
+                }});
 
         } catch (...) {
             callbackPtr->rethrow();
@@ -232,12 +240,11 @@ protected:
 
 ref<Store> HttpBinaryCacheStore::Config::openStore() const
 {
-    return make_ref<HttpBinaryCacheStore>(ref{
-        // FIXME we shouldn't actually need a mutable config
-        std::const_pointer_cast<HttpBinaryCacheStore::Config>(shared_from_this())
-    });
+    return make_ref<HttpBinaryCacheStore>(
+        ref{// FIXME we shouldn't actually need a mutable config
+            std::const_pointer_cast<HttpBinaryCacheStore::Config>(shared_from_this())});
 }
 
 static RegisterStoreImplementation<HttpBinaryCacheStore::Config> regHttpBinaryCacheStore;
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/binary-cache-store.hh b/src/libstore/include/nix/store/binary-cache-store.hh
index 43f2cf690..908500b42 100644
--- a/src/libstore/include/nix/store/binary-cache-store.hh
+++ b/src/libstore/include/nix/store/binary-cache-store.hh
@@ -17,31 +17,42 @@ struct BinaryCacheStoreConfig : virtual StoreConfig
 {
     using StoreConfig::StoreConfig;
 
-    const Setting<std::string> compression{this, "xz", "compression",
-        "NAR compression method (`xz`, `bzip2`, `gzip`, `zstd`, or `none`)."};
+    const Setting<std::string> compression{
+        this, "xz", "compression", "NAR compression method (`xz`, `bzip2`, `gzip`, `zstd`, or `none`)."};
 
-    const Setting<bool> writeNARListing{this, false, "write-nar-listing",
-        "Whether to write a JSON file that lists the files in each NAR."};
+    const Setting<bool> writeNARListing{
+        this, false, "write-nar-listing", "Whether to write a JSON file that lists the files in each NAR."};
 
-    const Setting<bool> writeDebugInfo{this, false, "index-debug-info",
+    const Setting<bool> writeDebugInfo{
+        this,
+        false,
+        "index-debug-info",
         R"(
           Whether to index DWARF debug info files by build ID. This allows [`dwarffs`](https://github.com/edolstra/dwarffs) to
           fetch debug info on demand
         )"};
 
-    const Setting<Path> secretKeyFile{this, "", "secret-key",
-        "Path to the secret key used to sign the binary cache."};
+    const Setting<Path> secretKeyFile{this, "", "secret-key", "Path to the secret key used to sign the binary cache."};
 
-    const Setting<std::string> secretKeyFiles{this, "", "secret-keys",
-        "List of comma-separated paths to the secret keys used to sign the binary cache."};
+    const Setting<std::string> secretKeyFiles{
+        this, "", "secret-keys", "List of comma-separated paths to the secret keys used to sign the binary cache."};
 
-    const Setting<Path> localNarCache{this, "", "local-nar-cache",
+    const Setting<Path> localNarCache{
+        this,
+        "",
+        "local-nar-cache",
         "Path to a local cache of NARs fetched from this binary cache, used by commands such as `nix store cat`."};
 
-    const Setting<bool> parallelCompression{this, false, "parallel-compression",
+    const Setting<bool> parallelCompression{
+        this,
+        false,
+        "parallel-compression",
         "Enable multi-threaded compression of NARs. This is currently only available for `xz` and `zstd`."};
 
-    const Setting<int> compressionLevel{this, -1, "compression-level",
+    const Setting<int> compressionLevel{
+        this,
+        -1,
+        "compression-level",
         R"(
           The *preset level* to be used when compressing NARs.
           The meaning and accepted values depend on the compression method selected.
@@ -49,14 +60,11 @@ struct BinaryCacheStoreConfig : virtual StoreConfig
         )"};
 };
 
-
 /**
  * @note subclasses must implement at least one of the two
  * virtual getFile() methods.
  */
-struct BinaryCacheStore :
-    virtual Store,
-    virtual LogStore
+struct BinaryCacheStore : virtual Store, virtual LogStore
 {
     using Config = BinaryCacheStoreConfig;
 
@@ -82,11 +90,11 @@ public:
 
     virtual bool fileExists(const std::string & path) = 0;
 
-    virtual void upsertFile(const std::string & path,
-        std::shared_ptr<std::basic_iostream<char>> istream,
-        const std::string & mimeType) = 0;
+    virtual void upsertFile(
+        const std::string & path, std::shared_ptr<std::basic_iostream<char>> istream, const std::string & mimeType) = 0;
 
-    void upsertFile(const std::string & path,
+    void upsertFile(
+        const std::string & path,
         // FIXME: use std::string_view
         std::string && data,
         const std::string & mimeType);
@@ -106,9 +114,7 @@ public:
      * Fetch the specified file and call the specified callback with
      * the result. A subclass may implement this asynchronously.
      */
-    virtual void getFile(
-        const std::string & path,
-        Callback<std::optional<std::string>> callback) noexcept;
+    virtual void getFile(const std::string & path, Callback<std::optional<std::string>> callback) noexcept;
 
     std::optional<std::string> getFile(const std::string & path);
 
@@ -125,20 +131,22 @@ private:
     void writeNarInfo(ref<NarInfo> narInfo);
 
     ref<const ValidPathInfo> addToStoreCommon(
-        Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs,
+        Source & narSource,
+        RepairFlag repair,
+        CheckSigsFlag checkSigs,
         std::function<ValidPathInfo(HashResult)> mkInfo);
 
 public:
 
     bool isValidPathUncached(const StorePath & path) override;
 
-    void queryPathInfoUncached(const StorePath & path,
-        Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
+    void queryPathInfoUncached(
+        const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
 
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override;
 
-    void addToStore(const ValidPathInfo & info, Source & narSource,
-        RepairFlag repair, CheckSigsFlag checkSigs) override;
+    void
+    addToStore(const ValidPathInfo & info, Source & narSource, RepairFlag repair, CheckSigsFlag checkSigs) override;
 
     StorePath addToStoreFromDump(
         Source & dump,
@@ -160,8 +168,8 @@ public:
 
     void registerDrvOutput(const Realisation & info) override;
 
-    void queryRealisationUncached(const DrvOutput &,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
+    void queryRealisationUncached(
+        const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
 
     void narFromPath(const StorePath & path, Sink & sink) override;
 
@@ -172,9 +180,8 @@ public:
     std::optional<std::string> getBuildLogExact(const StorePath & path) override;
 
     void addBuildLog(const StorePath & drvPath, std::string_view log) override;
-
 };
 
 MakeError(NoSuchBinaryCacheFile, Error);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build-result.hh b/src/libstore/include/nix/store/build-result.hh
index 088b057b6..d7249d420 100644
--- a/src/libstore/include/nix/store/build-result.hh
+++ b/src/libstore/include/nix/store/build-result.hh
@@ -1,13 +1,13 @@
 #pragma once
 ///@file
 
-#include "nix/store/realisation.hh"
-#include "nix/store/derived-path.hh"
-
 #include <string>
 #include <chrono>
 #include <optional>
 
+#include "nix/store/derived-path.hh"
+#include "nix/store/realisation.hh"
+
 namespace nix {
 
 struct BuildResult
@@ -36,6 +36,10 @@ struct BuildResult
         NotDeterministic,
         ResolvesToAlreadyValid,
         NoSubstituters,
+        /// A certain type of `OutputRejected`. The protocols do not yet
+        /// know about this one, so change it back to `OutputRejected`
+        /// before serialization.
+        HashMismatch,
     } status = MiscFailure;
 
     /**
@@ -46,30 +50,6 @@ struct BuildResult
      */
     std::string errorMsg;
 
-    std::string toString() const {
-        auto strStatus = [&]() {
-            switch (status) {
-                case Built: return "Built";
-                case Substituted: return "Substituted";
-                case AlreadyValid: return "AlreadyValid";
-                case PermanentFailure: return "PermanentFailure";
-                case InputRejected: return "InputRejected";
-                case OutputRejected: return "OutputRejected";
-                case TransientFailure: return "TransientFailure";
-                case CachedFailure: return "CachedFailure";
-                case TimedOut: return "TimedOut";
-                case MiscFailure: return "MiscFailure";
-                case DependencyFailed: return "DependencyFailed";
-                case LogLimitExceeded: return "LogLimitExceeded";
-                case NotDeterministic: return "NotDeterministic";
-                case ResolvesToAlreadyValid: return "ResolvesToAlreadyValid";
-                case NoSubstituters: return "NoSubstituters";
-                default: return "Unknown";
-            };
-        }();
-        return strStatus + ((errorMsg == "") ? "" : " : " + errorMsg);
-    }
-
     /**
      * How many times this build was performed.
      */
@@ -100,8 +80,8 @@ struct BuildResult
      */
     std::optional<std::chrono::microseconds> cpuUser, cpuSystem;
 
-    bool operator ==(const BuildResult &) const noexcept;
-    std::strong_ordering operator <=>(const BuildResult &) const noexcept;
+    bool operator==(const BuildResult &) const noexcept;
+    std::strong_ordering operator<=>(const BuildResult &) const noexcept;
 
     bool success()
     {
@@ -114,6 +94,26 @@ struct BuildResult
     }
 };
 
+/**
+ * denotes a permanent build failure
+ */
+struct BuildError : public Error
+{
+    BuildResult::Status status;
+
+    BuildError(BuildResult::Status status, BuildError && error)
+        : Error{std::move(error)}
+        , status{status}
+    {
+    }
+
+    BuildError(BuildResult::Status status, auto &&... args)
+        : Error{args...}
+        , status{status}
+    {
+    }
+};
+
 /**
  * A `BuildResult` together with its "primary key".
  */
@@ -126,8 +126,10 @@ struct KeyedBuildResult : BuildResult
 
     // Hack to work around a gcc "may be used uninitialized" warning.
     KeyedBuildResult(BuildResult res, DerivedPath path)
-        : BuildResult(std::move(res)), path(std::move(path))
-    { }
+        : BuildResult(std::move(res))
+        , path(std::move(path))
+    {
+    }
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/include/nix/store/build/derivation-builder.hh b/src/libstore/include/nix/store/build/derivation-builder.hh
similarity index 55%
rename from src/libstore/unix/include/nix/store/build/derivation-builder.hh
rename to src/libstore/include/nix/store/build/derivation-builder.hh
index 5ce38e034..7fad2837a 100644
--- a/src/libstore/unix/include/nix/store/build/derivation-builder.hh
+++ b/src/libstore/include/nix/store/build/derivation-builder.hh
@@ -8,10 +8,44 @@
 #include "nix/store/parsed-derivations.hh"
 #include "nix/util/processes.hh"
 #include "nix/store/restricted-store.hh"
-#include "nix/store/user-lock.hh"
+#include "nix/store/build/derivation-env-desugar.hh"
 
 namespace nix {
 
+/**
+ * Denotes a build failure that stemmed from the builder exiting with a
+ * failing exist status.
+ */
+struct BuilderFailureError : BuildError
+{
+    int builderStatus;
+
+    std::string extraMsgAfter;
+
+    BuilderFailureError(BuildResult::Status status, int builderStatus, std::string extraMsgAfter)
+        : BuildError{
+            status,
+              /* No message for now, because the caller will make for
+                 us, with extra context */
+              "",
+          }
+        , builderStatus{std::move(builderStatus)}
+        , extraMsgAfter{std::move(extraMsgAfter)}
+    {
+    }
+};
+
+/**
+ * Stuff we need to pass to initChild().
+ */
+struct ChrootPath
+{
+    Path source;
+    bool optional = false;
+};
+
+typedef std::map<Path, ChrootPath> PathsInChroot; // maps target path to source path
+
 /**
  * Parameters by (mostly) `const` reference for `DerivationBuilder`.
  */
@@ -27,15 +61,6 @@ struct DerivationBuilderParams
      */
     const Derivation & drv;
 
-    /**
-     * The "structured attrs" of `drv`, if it has them.
-     *
-     * @todo this should be part of `Derivation`.
-     *
-     * @todo this should be renamed from `parsedDrv`.
-     */
-    const StructuredAttrs * parsedDrv;
-
     /**
      * The derivation options of `drv`.
      *
@@ -51,33 +76,25 @@ struct DerivationBuilderParams
      */
     const StorePathSet & inputPaths;
 
-    /**
-     * @note we do in fact mutate this
-     */
-    std::map<std::string, InitialOutput> & initialOutputs;
+    const std::map<std::string, InitialOutput> & initialOutputs;
 
     const BuildMode & buildMode;
 
-    DerivationBuilderParams(
-        const StorePath & drvPath,
-        const BuildMode & buildMode,
-        BuildResult & buildResult,
-        const Derivation & drv,
-        const StructuredAttrs * parsedDrv,
-        const DerivationOptions & drvOptions,
-        const StorePathSet & inputPaths,
-        std::map<std::string, InitialOutput> & initialOutputs)
-        : drvPath{drvPath}
-        , buildResult{buildResult}
-        , drv{drv}
-        , parsedDrv{parsedDrv}
-        , drvOptions{drvOptions}
-        , inputPaths{inputPaths}
-        , initialOutputs{initialOutputs}
-        , buildMode{buildMode}
-    { }
+    /**
+     * Extra paths we want to be in the chroot, regardless of the
+     * derivation we are building.
+     */
+    PathsInChroot defaultPathsInChroot;
 
-    DerivationBuilderParams(DerivationBuilderParams &&) = default;
+    /**
+     * May be used to control various platform-specific functionality.
+     *
+     * For example, on Linux, the `kvm` system feature controls whether
+     * `/dev/kvm` should be exposed to the builder within the sandbox.
+     */
+    StringSet systemFeatures;
+
+    DesugaredEnv desugaredEnv;
 };
 
 /**
@@ -97,24 +114,10 @@ struct DerivationBuilderCallbacks
      */
     virtual void closeLogFile() = 0;
 
-    virtual void appendLogTailErrorMsg(std::string & msg) = 0;
-
-    /**
-     * Hook up `builderOut` to some mechanism to ingest the log
-     *
-     * @todo this should be reworked
-     */
-    virtual void childStarted(Descriptor builderOut) = 0;
-
     /**
      * @todo this should be reworked
      */
     virtual void childTerminated() = 0;
-
-    virtual void noteHashMismatch(void) = 0;
-    virtual void noteCheckMismatch(void) = 0;
-
-    virtual void markContentsGood(const StorePath & path) = 0;
 };
 
 /**
@@ -130,11 +133,6 @@ struct DerivationBuilderCallbacks
  */
 struct DerivationBuilder : RestrictionContext
 {
-    /**
-     * The process ID of the builder.
-     */
-    Pid pid;
-
     DerivationBuilder() = default;
     virtual ~DerivationBuilder() = default;
 
@@ -149,15 +147,15 @@ struct DerivationBuilder : RestrictionContext
      * locks as needed). After this is run, the builder should be
      * started.
      *
-     * @returns true if successful, false if we could not acquire a build
-     * user. In that case, the caller must wait and then try again.
+     * @returns logging pipe if successful, `std::nullopt` if we could
+     * not acquire a build user. In that case, the caller must wait and
+     * then try again.
+     *
+     * @note "success" just means that we were able to set up the environment
+     * and start the build. The builder could have immediately exited with
+     * failure, and that would still be considered a successful start.
      */
-    virtual bool prepareBuild() = 0;
-
-    /**
-     * Start building a derivation.
-     */
-    virtual void startBuilder() = 0;
+    virtual std::optional<Descriptor> startBuild() = 0;
 
     /**
      * Tear down build environment after the builder exits (either on
@@ -167,30 +165,23 @@ struct DerivationBuilder : RestrictionContext
      * processing. A status code and exception are returned, providing
      * more information. The second case indicates success, and
      * realisations for each output of the derivation are returned.
+     *
+     * @throws BuildError
      */
-    virtual std::variant<std::pair<BuildResult::Status, Error>, SingleDrvOutputs> unprepareBuild() = 0;
+    virtual SingleDrvOutputs unprepareBuild() = 0;
 
     /**
-     * Stop the in-process nix daemon thread.
-     * @see startDaemon
+     * Forcibly kill the child process, if any.
+     *
+     * @returns whether the child was still alive and needed to be
+     * killed.
      */
-    virtual void stopDaemon() = 0;
-
-    /**
-     * Delete the temporary directory, if we have one.
-     */
-    virtual void deleteTmpDir(bool force) = 0;
-
-    /**
-     * Kill any processes running under the build user UID or in the
-     * cgroup of the build.
-     */
-    virtual void killSandbox(bool getStats) = 0;
+    virtual bool killChild() = 0;
 };
 
+#ifndef _WIN32 // TODO enable `DerivationBuilder` on Windows
 std::unique_ptr<DerivationBuilder> makeDerivationBuilder(
-    Store & store,
-    std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
-    DerivationBuilderParams params);
+    LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params);
+#endif
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/derivation-building-goal.hh b/src/libstore/include/nix/store/build/derivation-building-goal.hh
index 569d1ddbb..d394eb3c9 100644
--- a/src/libstore/include/nix/store/build/derivation-building-goal.hh
+++ b/src/libstore/include/nix/store/build/derivation-building-goal.hh
@@ -1,8 +1,8 @@
 #pragma once
 ///@file
 
-#include "nix/store/parsed-derivations.hh"
 #include "nix/store/derivations.hh"
+#include "nix/store/parsed-derivations.hh"
 #include "nix/store/derivation-options.hh"
 #include "nix/store/build/derivation-building-misc.hh"
 #include "nix/store/outputs-spec.hh"
@@ -14,19 +14,13 @@ namespace nix {
 
 using std::map;
 
+struct BuilderFailureError;
 #ifndef _WIN32 // TODO enable build hook on Windows
 struct HookInstance;
 struct DerivationBuilder;
 #endif
 
-typedef enum {rpAccept, rpDecline, rpPostpone} HookReply;
-
-/** Used internally */
-void runPostBuildHook(
-    Store & store,
-    Logger & logger,
-    const StorePath & drvPath,
-    const StorePathSet & outputPaths);
+typedef enum { rpAccept, rpDecline, rpPostpone } HookReply;
 
 /**
  * A goal for building a derivation. Substitution, (or any other method of
@@ -35,6 +29,12 @@ void runPostBuildHook(
  */
 struct DerivationBuildingGoal : public Goal
 {
+    DerivationBuildingGoal(
+        const StorePath & drvPath, const Derivation & drv, Worker & worker, BuildMode buildMode = bmNormal);
+    ~DerivationBuildingGoal();
+
+private:
+
     /** The path of the derivation. */
     StorePath drvPath;
 
@@ -43,26 +43,18 @@ struct DerivationBuildingGoal : public Goal
      */
     std::unique_ptr<Derivation> drv;
 
-    std::unique_ptr<StructuredAttrs> parsedDrv;
     std::unique_ptr<DerivationOptions> drvOptions;
 
     /**
      * The remainder is state held during the build.
      */
 
-    /**
-     * Locks on (fixed) output paths.
-     */
-    PathLocks outputLocks;
-
     /**
      * All input paths (that is, the union of FS closures of the
      * immediate input paths).
      */
     StorePathSet inputPaths;
 
-    std::map<std::string, InitialOutput> initialOutputs;
-
     /**
      * File descriptor for the log file.
      */
@@ -99,23 +91,8 @@ struct DerivationBuildingGoal : public Goal
 
     std::unique_ptr<Activity> act;
 
-    /**
-     * Activity that denotes waiting for a lock.
-     */
-    std::unique_ptr<Activity> actLock;
-
     std::map<ActivityId, Activity> builderActivities;
 
-    /**
-     * The remote machine on which we're building.
-     */
-    std::string machineName;
-
-    DerivationBuildingGoal(const StorePath & drvPath, const Derivation & drv,
-        Worker & worker,
-        BuildMode buildMode = bmNormal);
-    ~DerivationBuildingGoal();
-
     void timedOut(Error && ex) override;
 
     std::string key() override;
@@ -125,12 +102,11 @@ struct DerivationBuildingGoal : public Goal
      */
     Co gaveUpOnSubstitution();
     Co tryToBuild();
-    Co hookDone();
 
     /**
      * Is the build hook willing to perform the build?
      */
-    HookReply tryBuildHook();
+    HookReply tryBuildHook(const std::map<std::string, InitialOutput> & initialOutputs);
 
     /**
      * Open a log file and a pipe to it.
@@ -164,33 +140,23 @@ struct DerivationBuildingGoal : public Goal
      * whether all outputs are valid and non-corrupt, and a
      * 'SingleDrvOutputs' structure containing the valid outputs.
      */
-    std::pair<bool, SingleDrvOutputs> checkPathValidity();
-
-    /**
-     * Aborts if any output is not valid or corrupt, and otherwise
-     * returns a 'SingleDrvOutputs' structure containing all outputs.
-     */
-    SingleDrvOutputs assertPathValidity();
+    std::pair<bool, SingleDrvOutputs> checkPathValidity(std::map<std::string, InitialOutput> & initialOutputs);
 
     /**
      * Forcibly kill the child process, if any.
      */
     void killChild();
 
-    void started();
+    Done doneSuccess(BuildResult::Status status, SingleDrvOutputs builtOutputs);
 
-    Done done(
-        BuildResult::Status status,
-        SingleDrvOutputs builtOutputs = {},
-        std::optional<Error> ex = {});
+    Done doneFailure(BuildError ex);
 
-    void appendLogTailErrorMsg(std::string & msg);
+    BuildError fixupBuilderFailureErrorMessage(BuilderFailureError msg);
 
-    StorePathSet exportReferences(const StorePathSet & storePaths);
-
-    JobCategory jobCategory() const override {
+    JobCategory jobCategory() const override
+    {
         return JobCategory::Build;
     };
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/derivation-building-misc.hh b/src/libstore/include/nix/store/build/derivation-building-misc.hh
index 3259c5e36..2b68fa178 100644
--- a/src/libstore/include/nix/store/build/derivation-building-misc.hh
+++ b/src/libstore/include/nix/store/build/derivation-building-misc.hh
@@ -25,6 +25,7 @@ struct InitialOutputStatus
 {
     StorePath path;
     PathStatus status;
+
     /**
      * Valid in the store, and additionally non-corrupt if we are repairing
      */
@@ -32,6 +33,7 @@ struct InitialOutputStatus
     {
         return status == PathStatus::Valid;
     }
+
     /**
      * Merely present, allowed to be corrupt
      */
@@ -43,16 +45,13 @@ struct InitialOutputStatus
 
 struct InitialOutput
 {
-    bool wanted;
     Hash outputHash;
     std::optional<InitialOutputStatus> known;
 };
 
-void runPostBuildHook(Store & store, Logger & logger, const StorePath & drvPath, const StorePathSet & outputPaths);
-
 /**
  * Format the known outputs of a derivation for use in error messages.
  */
-std::string showKnownOutputs(Store & store, const Derivation & drv);
+std::string showKnownOutputs(const StoreDirConfig & store, const Derivation & drv);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/derivation-env-desugar.hh b/src/libstore/include/nix/store/build/derivation-env-desugar.hh
new file mode 100644
index 000000000..6e2efa6bb
--- /dev/null
+++ b/src/libstore/include/nix/store/build/derivation-env-desugar.hh
@@ -0,0 +1,83 @@
+#pragma once
+///@file
+
+#include "nix/util/types.hh"
+#include "nix/store/path.hh"
+
+namespace nix {
+
+class Store;
+struct Derivation;
+struct DerivationOptions;
+
+/**
+ * Derivations claim to "just" specify their environment variables, but
+ * actually do a number of different features, such as "structured
+ * attrs", "pass as file", and "export references graph", things are
+ * more complicated then they appear.
+ *
+ * The good news is that we can simplify all that to the following view,
+ * where environment variables and extra files are specified exactly,
+ * with no special cases.
+ *
+ * Because we have `DesugaredEnv`, `DerivationBuilder` doesn't need to
+ * know about any of those above features, and their special case.
+ */
+struct DesugaredEnv
+{
+    struct EnvEntry
+    {
+        /**
+         * Whether to prepend the (inside via) path to the sandbox build
+         * directory to `value`. This is useful for when the env var
+         * should point to a file visible to the builder.
+         */
+        bool prependBuildDirectory = false;
+
+        /**
+         * String value of env var, or contents of the file.
+         */
+        std::string value;
+    };
+
+    /**
+     * The final environment variables to set.
+     */
+    std::map<std::string, EnvEntry, std::less<>> variables;
+
+    /**
+     * Extra file to be placed in the build directory.
+     *
+     * @note `EnvEntry::prependBuildDirectory` can be used to refer to
+     * those files without knowing what the build directory is.
+     */
+    StringMap extraFiles;
+
+    /**
+     * A common case is to define an environment variable that points to
+     * a file, which contains some contents.
+     *
+     * In base:
+     * ```
+     * export VAR=FILE_NAME
+     * echo CONTENTS >FILE_NAME
+     * ```
+     *
+     * This function assists in doing both parts, so the file name is
+     * kept in sync.
+     */
+    std::string & atFileEnvPair(std::string_view name, std::string fileName);
+
+    /**
+     * Given a (resolved) derivation, its options, and the closure of
+     * its inputs (which we can get since the derivation is resolved),
+     * desugar the environment to create a `DesguaredEnv`.
+     *
+     * @todo drvOptions will go away as a separate argument when it is
+     * just part of `Derivation`.
+     */
+    static DesugaredEnv create(
+        Store & store, const Derivation & drv, const DerivationOptions & drvOptions, const StorePathSet & inputPaths);
+};
+
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/derivation-goal.hh b/src/libstore/include/nix/store/build/derivation-goal.hh
index ac9ec5346..85b471e28 100644
--- a/src/libstore/include/nix/store/build/derivation-goal.hh
+++ b/src/libstore/include/nix/store/build/derivation-goal.hh
@@ -14,13 +14,6 @@ namespace nix {
 
 using std::map;
 
-/** Used internally */
-void runPostBuildHook(
-    Store & store,
-    Logger & logger,
-    const StorePath & drvPath,
-    const StorePathSet & outputPaths);
-
 /**
  * A goal for realising a single output of a derivation. Various sorts of
  * fetching (which will be done by other goal types) is tried, and if none of
@@ -47,67 +40,68 @@ struct DerivationGoal : public Goal
      */
     OutputName wantedOutput;
 
+    DerivationGoal(
+        const StorePath & drvPath,
+        const Derivation & drv,
+        const OutputName & wantedOutput,
+        Worker & worker,
+        BuildMode buildMode = bmNormal);
+    ~DerivationGoal() = default;
+
+    void timedOut(Error && ex) override
+    {
+        unreachable();
+    };
+
+    std::string key() override;
+
+    JobCategory jobCategory() const override
+    {
+        return JobCategory::Administration;
+    };
+
+private:
+
     /**
      * The derivation stored at drvPath.
      */
     std::unique_ptr<Derivation> drv;
 
+    const Hash outputHash;
+
+    const BuildMode buildMode;
+
     /**
      * The remainder is state held during the build.
      */
 
-    std::map<std::string, InitialOutput> initialOutputs;
-
-    BuildMode buildMode;
-
     std::unique_ptr<MaintainCount<uint64_t>> mcExpectedBuilds;
 
-    DerivationGoal(const StorePath & drvPath, const Derivation & drv,
-        const OutputName & wantedOutput, Worker & worker,
-        BuildMode buildMode = bmNormal);
-    ~DerivationGoal() = default;
-
-    void timedOut(Error && ex) override { unreachable(); };
-
-    std::string key() override;
-
     /**
      * The states.
      */
     Co haveDerivation();
 
     /**
-     * Wrappers around the corresponding Store methods that first consult the
-     * derivation.  This is currently needed because when there is no drv file
-     * there also is no DB entry.
+     * Return `std::nullopt` if the output is unknown, e.g. un unbuilt
+     * floating content-addressing derivation. Otherwise, returns a pair
+     * of a `Realisation`, containing among other things the store path
+     * of the wanted output, and a `PathStatus` with the
+     * current status of that output.
      */
-    std::map<std::string, std::optional<StorePath>> queryPartialDerivationOutputMap();
-    OutputPathMap queryDerivationOutputMap();
-
-    /**
-     * Update 'initialOutputs' to determine the current status of the
-     * outputs of the derivation. Also returns a Boolean denoting
-     * whether all outputs are valid and non-corrupt, and a
-     * 'SingleDrvOutputs' structure containing the valid outputs.
-     */
-    std::pair<bool, SingleDrvOutputs> checkPathValidity();
+    std::optional<std::pair<Realisation, PathStatus>> checkPathValidity();
 
     /**
      * Aborts if any output is not valid or corrupt, and otherwise
-     * returns a 'SingleDrvOutputs' structure containing all outputs.
+     * returns a 'Realisation' for the wanted output.
      */
-    SingleDrvOutputs assertPathValidity();
+    Realisation assertPathValidity();
 
     Co repairClosure();
 
-    Done done(
-        BuildResult::Status status,
-        SingleDrvOutputs builtOutputs = {},
-        std::optional<Error> ex = {});
+    Done doneSuccess(BuildResult::Status status, Realisation builtOutput);
 
-    JobCategory jobCategory() const override {
-        return JobCategory::Administration;
-    };
+    Done doneFailure(BuildError ex);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/derivation-trampoline-goal.hh b/src/libstore/include/nix/store/build/derivation-trampoline-goal.hh
index 648337695..79b74f4c1 100644
--- a/src/libstore/include/nix/store/build/derivation-trampoline-goal.hh
+++ b/src/libstore/include/nix/store/build/derivation-trampoline-goal.hh
@@ -131,4 +131,4 @@ private:
     void commonInit();
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/drv-output-substitution-goal.hh b/src/libstore/include/nix/store/build/drv-output-substitution-goal.hh
index 0176f001a..b42336427 100644
--- a/src/libstore/include/nix/store/build/drv-output-substitution-goal.hh
+++ b/src/libstore/include/nix/store/build/drv-output-substitution-goal.hh
@@ -20,7 +20,8 @@ class Worker;
  * 2. Substitute the corresponding output path
  * 3. Register the output info
  */
-class DrvOutputSubstitutionGoal : public Goal {
+class DrvOutputSubstitutionGoal : public Goal
+{
 
     /**
      * The drv output we're trying to substitute
@@ -28,7 +29,11 @@ class DrvOutputSubstitutionGoal : public Goal {
     DrvOutput id;
 
 public:
-    DrvOutputSubstitutionGoal(const DrvOutput& id, Worker & worker, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);
+    DrvOutputSubstitutionGoal(
+        const DrvOutput & id,
+        Worker & worker,
+        RepairFlag repair = NoRepair,
+        std::optional<ContentAddress> ca = std::nullopt);
 
     typedef void (DrvOutputSubstitutionGoal::*GoalState)();
     GoalState state;
@@ -36,15 +41,19 @@ public:
     Co init();
     Co realisationFetched(Goals waitees, std::shared_ptr<const Realisation> outputInfo, nix::ref<nix::Store> sub);
 
-    void timedOut(Error && ex) override { unreachable(); };
+    void timedOut(Error && ex) override
+    {
+        unreachable();
+    };
 
     std::string key() override;
 
     void handleEOF(Descriptor fd) override;
 
-    JobCategory jobCategory() const override {
+    JobCategory jobCategory() const override
+    {
         return JobCategory::Substitution;
     };
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/goal.hh b/src/libstore/include/nix/store/build/goal.hh
index ee69c9cc7..52700d12e 100644
--- a/src/libstore/include/nix/store/build/goal.hh
+++ b/src/libstore/include/nix/store/build/goal.hh
@@ -20,8 +20,9 @@ class Worker;
 typedef std::shared_ptr<Goal> GoalPtr;
 typedef std::weak_ptr<Goal> WeakGoalPtr;
 
-struct CompareGoalPtrs {
-    bool operator() (const GoalPtr & a, const GoalPtr & b) const;
+struct CompareGoalPtrs
+{
+    bool operator()(const GoalPtr & a, const GoalPtr & b) const;
 };
 
 /**
@@ -71,7 +72,7 @@ private:
     Goals waitees;
 
 public:
-    typedef enum {ecBusy, ecSuccess, ecFailed, ecNoSubstituters} ExitCode;
+    typedef enum { ecBusy, ecSuccess, ecFailed, ecNoSubstituters } ExitCode;
 
     /**
      * Backlink to the worker.
@@ -114,22 +115,25 @@ public:
      * Suspend our goal and wait until we get `work`-ed again.
      * `co_await`-able by @ref Co.
      */
-    struct Suspend {};
+    struct Suspend
+    {};
 
     /**
      * Return from the current coroutine and suspend our goal
      * if we're not busy anymore, or jump to the next coroutine
      * set to be executed/resumed.
      */
-    struct Return {};
+    struct Return
+    {};
 
     /**
      * `co_return`-ing this will end the goal.
      * If you're not inside a coroutine, you can safely discard this.
      */
-    struct [[nodiscard]] Done {
-        private:
-        Done(){}
+    struct [[nodiscard]] Done
+    {
+    private:
+        Done() {}
 
         friend Goal;
     };
@@ -183,18 +187,24 @@ public:
      *
      * @todo Support returning data natively
      */
-    struct [[nodiscard]] Co {
+    struct [[nodiscard]] Co
+    {
         /**
          * The underlying handle.
          */
         handle_type handle;
 
-        explicit Co(handle_type handle) : handle(handle) {};
-        void operator=(Co&&);
-        Co(Co&& rhs);
+        explicit Co(handle_type handle)
+            : handle(handle) {};
+        void operator=(Co &&);
+        Co(Co && rhs);
         ~Co();
 
-        bool await_ready() { return false; };
+        bool await_ready()
+        {
+            return false;
+        };
+
         /**
          * When we `co_await` another `Co`-returning coroutine,
          * we tell the caller of `caller_coroutine.resume()` to switch to our coroutine (@ref handle).
@@ -215,21 +225,29 @@ public:
      * Used on initial suspend, does the same as `std::suspend_always`,
      * but asserts that everything has been set correctly.
      */
-    struct InitialSuspend {
+    struct InitialSuspend
+    {
         /**
          * Handle of coroutine that does the
          * initial suspend
          */
         handle_type handle;
 
-        bool await_ready() { return false; };
-        void await_suspend(handle_type handle_) {
+        bool await_ready()
+        {
+            return false;
+        };
+
+        void await_suspend(handle_type handle_)
+        {
             handle = handle_;
         }
-        void await_resume() {
+
+        void await_resume()
+        {
             assert(handle);
-            assert(handle.promise().goal); // goal must be set
-            assert(handle.promise().goal->top_co); // top_co of goal must be set
+            assert(handle.promise().goal);                           // goal must be set
+            assert(handle.promise().goal->top_co);                   // top_co of goal must be set
             assert(handle.promise().goal->top_co->handle == handle); // top_co of goal must be us
         }
     };
@@ -238,7 +256,8 @@ public:
      * Promise type for coroutines defined using @ref Co.
      * Attached to coroutine handle.
      */
-    struct promise_type {
+    struct promise_type
+    {
         /**
          * Either this is who called us, or it is who we will tail-call.
          * It is what we "jump" to once we are done.
@@ -249,7 +268,7 @@ public:
          * The goal that we're a part of.
          * Set either in @ref Co::await_suspend or in constructor of @ref Goal.
          */
-        Goal* goal = nullptr;
+        Goal * goal = nullptr;
 
         /**
          * Is set to false when destructed to ensure we don't use a
@@ -260,8 +279,13 @@ public:
         /**
          * The awaiter used by @ref final_suspend.
          */
-        struct final_awaiter {
-            bool await_ready() noexcept { return false; };
+        struct final_awaiter
+        {
+            bool await_ready() noexcept
+            {
+                return false;
+            };
+
             /**
              * Here we execute our continuation, by passing it back to the caller.
              * C++ compiler will create code that takes that and executes it promptly.
@@ -269,7 +293,11 @@ public:
              * thus it must be destroyed.
              */
             std::coroutine_handle<> await_suspend(handle_type h) noexcept;
-            void await_resume() noexcept { assert(false); };
+
+            void await_resume() noexcept
+            {
+                assert(false);
+            };
         };
 
         /**
@@ -283,13 +311,19 @@ public:
          * We use this opportunity to set the @ref goal field
          * and `top_co` field of @ref Goal.
          */
-        InitialSuspend initial_suspend() { return {}; };
+        InitialSuspend initial_suspend()
+        {
+            return {};
+        };
 
         /**
          * Called on `co_return`. Creates @ref final_awaiter which
          * either jumps to continuation or suspends goal.
          */
-        final_awaiter final_suspend() noexcept { return {}; };
+        final_awaiter final_suspend() noexcept
+        {
+            return {};
+        };
 
         /**
          * Does nothing, but provides an opportunity for
@@ -316,24 +350,33 @@ public:
          * the continuation of the new continuation. Thus, the continuation
          * passed to @ref return_value must not have a continuation set.
          */
-        void return_value(Co&&);
+        void return_value(Co &&);
 
         /**
          * If an exception is thrown inside a coroutine,
          * we re-throw it in the context of the "resumer" of the continuation.
          */
-        void unhandled_exception() { throw; };
+        void unhandled_exception()
+        {
+            throw;
+        };
 
         /**
          * Allows awaiting a @ref Co.
          */
-        Co&& await_transform(Co&& co) { return static_cast<Co&&>(co); }
+        Co && await_transform(Co && co)
+        {
+            return static_cast<Co &&>(co);
+        }
 
         /**
          * Allows awaiting a @ref Suspend.
          * Always suspends.
          */
-        std::suspend_always await_transform(Suspend) { return {}; };
+        std::suspend_always await_transform(Suspend)
+        {
+            return {};
+        };
     };
 
 protected:
@@ -354,7 +397,7 @@ protected:
     Done amDone(ExitCode result, std::optional<Error> ex = {});
 
 public:
-    virtual void cleanup() { }
+    virtual void cleanup() {}
 
     /**
      * Hack to say that this goal should not log `ex`, but instead keep
@@ -373,7 +416,8 @@ public:
     std::optional<Error> ex;
 
     Goal(Worker & worker, Co init)
-        : worker(worker), top_co(std::move(init))
+        : worker(worker)
+        , top_co(std::move(init))
     {
         // top_co shouldn't have a goal already, should be nullptr.
         assert(!top_co->handle.promise().goal);
@@ -430,9 +474,10 @@ protected:
 
 void addToWeakGoals(WeakGoals & goals, GoalPtr p);
 
-}
+} // namespace nix
 
 template<typename... ArgTypes>
-struct std::coroutine_traits<nix::Goal::Co, ArgTypes...> {
+struct std::coroutine_traits<nix::Goal::Co, ArgTypes...>
+{
     using promise_type = nix::Goal::promise_type;
 };
diff --git a/src/libstore/include/nix/store/build/substitution-goal.hh b/src/libstore/include/nix/store/build/substitution-goal.hh
index b61706840..9fc6450b1 100644
--- a/src/libstore/include/nix/store/build/substitution-goal.hh
+++ b/src/libstore/include/nix/store/build/substitution-goal.hh
@@ -33,24 +33,28 @@ struct PathSubstitutionGoal : public Goal
      */
     std::thread thr;
 
-    std::unique_ptr<MaintainCount<uint64_t>> maintainExpectedSubstitutions,
-        maintainRunningSubstitutions, maintainExpectedNar, maintainExpectedDownload;
+    std::unique_ptr<MaintainCount<uint64_t>> maintainExpectedSubstitutions, maintainRunningSubstitutions,
+        maintainExpectedNar, maintainExpectedDownload;
 
     /**
      * Content address for recomputing store path
      */
     std::optional<ContentAddress> ca;
 
-    Done done(
-        ExitCode result,
-        BuildResult::Status status,
-        std::optional<std::string> errorMsg = {});
+    Done done(ExitCode result, BuildResult::Status status, std::optional<std::string> errorMsg = {});
 
 public:
-    PathSubstitutionGoal(const StorePath & storePath, Worker & worker, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);
+    PathSubstitutionGoal(
+        const StorePath & storePath,
+        Worker & worker,
+        RepairFlag repair = NoRepair,
+        std::optional<ContentAddress> ca = std::nullopt);
     ~PathSubstitutionGoal();
 
-    void timedOut(Error && ex) override { unreachable(); };
+    void timedOut(Error && ex) override
+    {
+        unreachable();
+    };
 
     /**
      * We prepend "a$" to the key name to ensure substitution goals
@@ -66,7 +70,8 @@ public:
      */
     Co init();
     Co gotInfo();
-    Co tryToRun(StorePath subPath, nix::ref<Store> sub, std::shared_ptr<const ValidPathInfo> info, bool & substituterFailed);
+    Co tryToRun(
+        StorePath subPath, nix::ref<Store> sub, std::shared_ptr<const ValidPathInfo> info, bool & substituterFailed);
     Co finished();
 
     /**
@@ -78,9 +83,10 @@ public:
     /* Called by destructor, can't be overridden */
     void cleanup() override final;
 
-    JobCategory jobCategory() const override {
+    JobCategory jobCategory() const override
+    {
         return JobCategory::Substitution;
     };
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/build/worker.hh b/src/libstore/include/nix/store/build/worker.hh
index 491b8f494..a6de780c1 100644
--- a/src/libstore/include/nix/store/build/worker.hh
+++ b/src/libstore/include/nix/store/build/worker.hh
@@ -205,11 +205,10 @@ public:
      */
 private:
     template<class G, typename... Args>
-    std::shared_ptr<G> initGoalIfNeeded(std::weak_ptr<G> & goal_weak, Args && ...args);
+    std::shared_ptr<G> initGoalIfNeeded(std::weak_ptr<G> & goal_weak, Args &&... args);
 
     std::shared_ptr<DerivationTrampolineGoal> makeDerivationTrampolineGoal(
-        ref<const SingleDerivedPath> drvReq,
-        const OutputsSpec & wantedOutputs, BuildMode buildMode = bmNormal);
+        ref<const SingleDerivedPath> drvReq, const OutputsSpec & wantedOutputs, BuildMode buildMode = bmNormal);
 
 public:
     std::shared_ptr<DerivationTrampolineGoal> makeDerivationTrampolineGoal(
@@ -219,21 +218,24 @@ public:
         BuildMode buildMode = bmNormal);
 
     std::shared_ptr<DerivationGoal> makeDerivationGoal(
-        const StorePath & drvPath, const Derivation & drv,
-        const OutputName & wantedOutput, BuildMode buildMode = bmNormal);
+        const StorePath & drvPath,
+        const Derivation & drv,
+        const OutputName & wantedOutput,
+        BuildMode buildMode = bmNormal);
 
     /**
      * @ref DerivationBuildingGoal "derivation goal"
      */
-    std::shared_ptr<DerivationBuildingGoal> makeDerivationBuildingGoal(
-        const StorePath & drvPath, const Derivation & drv,
-        BuildMode buildMode = bmNormal);
+    std::shared_ptr<DerivationBuildingGoal>
+    makeDerivationBuildingGoal(const StorePath & drvPath, const Derivation & drv, BuildMode buildMode = bmNormal);
 
     /**
      * @ref PathSubstitutionGoal "substitution goal"
      */
-    std::shared_ptr<PathSubstitutionGoal> makePathSubstitutionGoal(const StorePath & storePath, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);
-    std::shared_ptr<DrvOutputSubstitutionGoal> makeDrvOutputSubstitutionGoal(const DrvOutput & id, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);
+    std::shared_ptr<PathSubstitutionGoal> makePathSubstitutionGoal(
+        const StorePath & storePath, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);
+    std::shared_ptr<DrvOutputSubstitutionGoal> makeDrvOutputSubstitutionGoal(
+        const DrvOutput & id, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);
 
     /**
      * Make a goal corresponding to the `DerivedPath`.
@@ -268,8 +270,11 @@ public:
      * Registers a running child process.  `inBuildSlot` means that
      * the process counts towards the jobs limit.
      */
-    void childStarted(GoalPtr goal, const std::set<MuxablePipePollState::CommChannel> & channels,
-        bool inBuildSlot, bool respectTimeouts);
+    void childStarted(
+        GoalPtr goal,
+        const std::set<MuxablePipePollState::CommChannel> & channels,
+        bool inBuildSlot,
+        bool respectTimeouts);
 
     /**
      * Unregisters a running child process.  `wakeSleepers` should be
@@ -343,10 +348,11 @@ public:
     void updateProgress()
     {
         actDerivations.progress(doneBuilds, expectedBuilds + doneBuilds, runningBuilds, failedBuilds);
-        actSubstitutions.progress(doneSubstitutions, expectedSubstitutions + doneSubstitutions, runningSubstitutions, failedSubstitutions);
+        actSubstitutions.progress(
+            doneSubstitutions, expectedSubstitutions + doneSubstitutions, runningSubstitutions, failedSubstitutions);
         act.setExpected(actFileTransfer, expectedDownloadSize + doneDownloadSize);
         act.setExpected(actCopyPath, expectedNarSize + doneNarSize);
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/builtins.hh b/src/libstore/include/nix/store/builtins.hh
index 096c8af7b..cc164fe82 100644
--- a/src/libstore/include/nix/store/builtins.hh
+++ b/src/libstore/include/nix/store/builtins.hh
@@ -20,7 +20,8 @@ struct RegisterBuiltinBuilder
 {
     typedef std::map<std::string, BuiltinBuilder> BuiltinBuilders;
 
-    static BuiltinBuilders & builtinBuilders() {
+    static BuiltinBuilders & builtinBuilders()
+    {
         static BuiltinBuilders builders;
         return builders;
     }
@@ -31,4 +32,4 @@ struct RegisterBuiltinBuilder
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/builtins/buildenv.hh b/src/libstore/include/nix/store/builtins/buildenv.hh
index 163666c0b..c152ab00a 100644
--- a/src/libstore/include/nix/store/builtins/buildenv.hh
+++ b/src/libstore/include/nix/store/builtins/buildenv.hh
@@ -8,11 +8,18 @@ namespace nix {
 /**
  * Think of this as a "store level package attrset", but stripped down to no more than the needs of buildenv.
  */
-struct Package {
+struct Package
+{
     Path path;
     bool active;
     int priority;
-    Package(const Path & path, bool active, int priority) : path{path}, active{active}, priority{priority} {}
+
+    Package(const Path & path, bool active, int priority)
+        : path{path}
+        , active{active}
+        , priority{priority}
+    {
+    }
 };
 
 class BuildEnvFileConflictError : public Error
@@ -22,27 +29,23 @@ public:
     const Path fileB;
     int priority;
 
-    BuildEnvFileConflictError(
-        const Path fileA,
-        const Path fileB,
-        int priority
-    )
+    BuildEnvFileConflictError(const Path fileA, const Path fileB, int priority)
         : Error(
-            "Unable to build profile. There is a conflict for the following files:\n"
-            "\n"
-            "  %1%\n"
-            "  %2%",
-            fileA,
-            fileB
-        )
+              "Unable to build profile. There is a conflict for the following files:\n"
+              "\n"
+              "  %1%\n"
+              "  %2%",
+              fileA,
+              fileB)
         , fileA(fileA)
         , fileB(fileB)
         , priority(priority)
-    {}
+    {
+    }
 };
 
 typedef std::vector<Package> Packages;
 
 void buildProfile(const Path & out, Packages && pkgs);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/common-protocol-impl.hh b/src/libstore/include/nix/store/common-protocol-impl.hh
index e9c726a99..cb1020a3c 100644
--- a/src/libstore/include/nix/store/common-protocol-impl.hh
+++ b/src/libstore/include/nix/store/common-protocol-impl.hh
@@ -15,14 +15,15 @@ namespace nix {
 
 /* protocol-agnostic templates */
 
-#define COMMON_USE_LENGTH_PREFIX_SERIALISER(TEMPLATE, T) \
-    TEMPLATE T CommonProto::Serialise< T >::read(const StoreDirConfig & store, CommonProto::ReadConn conn) \
-    { \
-        return LengthPrefixedProtoHelper<CommonProto, T >::read(store, conn); \
-    } \
-    TEMPLATE void CommonProto::Serialise< T >::write(const StoreDirConfig & store, CommonProto::WriteConn conn, const T & t) \
-    { \
-        LengthPrefixedProtoHelper<CommonProto, T >::write(store, conn, t); \
+#define COMMON_USE_LENGTH_PREFIX_SERIALISER(TEMPLATE, T)                                                 \
+    TEMPLATE T CommonProto::Serialise<T>::read(const StoreDirConfig & store, CommonProto::ReadConn conn) \
+    {                                                                                                    \
+        return LengthPrefixedProtoHelper<CommonProto, T>::read(store, conn);                             \
+    }                                                                                                    \
+    TEMPLATE void CommonProto::Serialise<T>::write(                                                      \
+        const StoreDirConfig & store, CommonProto::WriteConn conn, const T & t)                          \
+    {                                                                                                    \
+        LengthPrefixedProtoHelper<CommonProto, T>::write(store, conn, t);                                \
     }
 
 #define COMMA_ ,
@@ -30,12 +31,9 @@ COMMON_USE_LENGTH_PREFIX_SERIALISER(template<typename T>, std::vector<T>)
 COMMON_USE_LENGTH_PREFIX_SERIALISER(template<typename T COMMA_ typename Compare>, std::set<T COMMA_ Compare>)
 COMMON_USE_LENGTH_PREFIX_SERIALISER(template<typename... Ts>, std::tuple<Ts...>)
 
-COMMON_USE_LENGTH_PREFIX_SERIALISER(
-    template<typename K COMMA_ typename V>,
-    std::map<K COMMA_ V>)
+COMMON_USE_LENGTH_PREFIX_SERIALISER(template<typename K COMMA_ typename V>, std::map<K COMMA_ V>)
 #undef COMMA_
 
-
 /* protocol-specific templates */
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/common-protocol.hh b/src/libstore/include/nix/store/common-protocol.hh
index 1dc4aa7c5..c1d22fa6c 100644
--- a/src/libstore/include/nix/store/common-protocol.hh
+++ b/src/libstore/include/nix/store/common-protocol.hh
@@ -14,7 +14,6 @@ struct ContentAddress;
 struct DrvOutput;
 struct Realisation;
 
-
 /**
  * Shared serializers between the worker protocol, serve protocol, and a
  * few others.
@@ -28,7 +27,8 @@ struct CommonProto
      * A unidirectional read connection, to be used by the read half of the
      * canonical serializers below.
      */
-    struct ReadConn {
+    struct ReadConn
+    {
         Source & from;
     };
 
@@ -36,7 +36,8 @@ struct CommonProto
      * A unidirectional write connection, to be used by the write half of the
      * canonical serializers below.
      */
-    struct WriteConn {
+    struct WriteConn
+    {
         Sink & to;
     };
 
@@ -54,10 +55,10 @@ struct CommonProto
     }
 };
 
-#define DECLARE_COMMON_SERIALISER(T) \
-    struct CommonProto::Serialise< T > \
-    { \
-        static T read(const StoreDirConfig & store, CommonProto::ReadConn conn); \
+#define DECLARE_COMMON_SERIALISER(T)                                                                 \
+    struct CommonProto::Serialise<T>                                                                 \
+    {                                                                                                \
+        static T read(const StoreDirConfig & store, CommonProto::ReadConn conn);                     \
         static void write(const StoreDirConfig & store, CommonProto::WriteConn conn, const T & str); \
     }
 
@@ -103,4 +104,4 @@ DECLARE_COMMON_SERIALISER(std::optional<StorePath>);
 template<>
 DECLARE_COMMON_SERIALISER(std::optional<ContentAddress>);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/common-ssh-store-config.hh b/src/libstore/include/nix/store/common-ssh-store-config.hh
index 82a78f075..bbd81835d 100644
--- a/src/libstore/include/nix/store/common-ssh-store-config.hh
+++ b/src/libstore/include/nix/store/common-ssh-store-config.hh
@@ -2,6 +2,7 @@
 ///@file
 
 #include "nix/store/store-api.hh"
+#include "nix/util/url.hh"
 
 namespace nix {
 
@@ -11,18 +12,21 @@ struct CommonSSHStoreConfig : virtual StoreConfig
 {
     using StoreConfig::StoreConfig;
 
-    CommonSSHStoreConfig(std::string_view scheme, std::string_view host, const Params & params);
+    CommonSSHStoreConfig(std::string_view scheme, const ParsedURL::Authority & authority, const Params & params);
+    CommonSSHStoreConfig(std::string_view scheme, std::string_view authority, const Params & params);
 
-    const Setting<Path> sshKey{this, "", "ssh-key",
-        "Path to the SSH private key used to authenticate to the remote machine."};
+    const Setting<Path> sshKey{
+        this, "", "ssh-key", "Path to the SSH private key used to authenticate to the remote machine."};
 
-    const Setting<std::string> sshPublicHostKey{this, "", "base64-ssh-public-host-key",
-        "The public host key of the remote machine."};
+    const Setting<std::string> sshPublicHostKey{
+        this, "", "base64-ssh-public-host-key", "The public host key of the remote machine."};
 
-    const Setting<bool> compress{this, false, "compress",
-        "Whether to enable SSH compression."};
+    const Setting<bool> compress{this, false, "compress", "Whether to enable SSH compression."};
 
-    const Setting<std::string> remoteStore{this, "", "remote-store",
+    const Setting<std::string> remoteStore{
+        this,
+        "",
+        "remote-store",
         R"(
           [Store URL](@docroot@/store/types/index.md#store-url-format)
           to be used on the remote machine. The default is `auto`
@@ -30,23 +34,9 @@ struct CommonSSHStoreConfig : virtual StoreConfig
         )"};
 
     /**
-     * The `parseURL` function supports both IPv6 URIs as defined in
-     * RFC2732, but also pure addresses. The latter one is needed here to
-     * connect to a remote store via SSH (it's possible to do e.g. `ssh root@::1`).
-     *
-     * When initialized, the following adjustments are made:
-     *
-     * - If the URL looks like `root@[::1]` (which is allowed by the URL parser and probably
-     *   needed to pass further flags), it
-     *   will be transformed into `root@::1` for SSH (same for `[::1]` -> `::1`).
-     *
-     * - If the URL looks like `root@::1` it will be left as-is.
-     *
-     * - In any other case, the string will be left as-is.
-     *
-     * Will throw an error if `connStr` is empty too.
+     * Authority representing the SSH host to connect to.
      */
-    std::string host;
+    ParsedURL::Authority authority;
 
     /**
      * Small wrapper around `SSHMaster::SSHMaster` that gets most
@@ -54,9 +44,7 @@ struct CommonSSHStoreConfig : virtual StoreConfig
      *
      * See that constructor for details on the remaining two arguments.
      */
-    SSHMaster createSSHMaster(
-        bool useMaster,
-        Descriptor logFD = INVALID_DESCRIPTOR) const;
+    SSHMaster createSSHMaster(bool useMaster, Descriptor logFD = INVALID_DESCRIPTOR) const;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/content-address.hh b/src/libstore/include/nix/store/content-address.hh
index 8442fabb2..0a3dc79bd 100644
--- a/src/libstore/include/nix/store/content-address.hh
+++ b/src/libstore/include/nix/store/content-address.hh
@@ -73,8 +73,8 @@ struct ContentAddressMethod
 
     Raw raw;
 
-    bool operator ==(const ContentAddressMethod &) const = default;
-    auto operator <=>(const ContentAddressMethod &) const = default;
+    bool operator==(const ContentAddressMethod &) const = default;
+    auto operator<=>(const ContentAddressMethod &) const = default;
 
     MAKE_WRAPPER_CONSTRUCTOR(ContentAddressMethod);
 
@@ -132,7 +132,6 @@ struct ContentAddressMethod
     FileIngestionMethod getFileIngestionMethod() const;
 };
 
-
 /*
  * Mini content address
  */
@@ -161,8 +160,8 @@ struct ContentAddress
      */
     Hash hash;
 
-    bool operator ==(const ContentAddress &) const = default;
-    auto operator <=>(const ContentAddress &) const = default;
+    bool operator==(const ContentAddress &) const = default;
+    auto operator<=>(const ContentAddress &) const = default;
 
     /**
      * Compute the content-addressability assertion
@@ -184,7 +183,6 @@ struct ContentAddress
  */
 std::string renderContentAddress(std::optional<ContentAddress> ca);
 
-
 /*
  * Full content address
  *
@@ -221,9 +219,9 @@ struct StoreReferences
      */
     size_t size() const;
 
-    bool operator ==(const StoreReferences &) const = default;
+    bool operator==(const StoreReferences &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=>(const StoreReferences &) const = default;
+    // auto operator <=>(const StoreReferences &) const = default;
 };
 
 // This matches the additional info that we need for makeTextPath
@@ -240,9 +238,9 @@ struct TextInfo
      */
     StorePathSet references;
 
-    bool operator ==(const TextInfo &) const = default;
+    bool operator==(const TextInfo &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=>(const TextInfo &) const = default;
+    // auto operator <=>(const TextInfo &) const = default;
 };
 
 struct FixedOutputInfo
@@ -262,9 +260,9 @@ struct FixedOutputInfo
      */
     StoreReferences references;
 
-    bool operator ==(const FixedOutputInfo &) const = default;
+    bool operator==(const FixedOutputInfo &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=>(const FixedOutputInfo &) const = default;
+    // auto operator <=>(const FixedOutputInfo &) const = default;
 };
 
 /**
@@ -274,16 +272,13 @@ struct FixedOutputInfo
  */
 struct ContentAddressWithReferences
 {
-    typedef std::variant<
-        TextInfo,
-        FixedOutputInfo
-    > Raw;
+    typedef std::variant<TextInfo, FixedOutputInfo> Raw;
 
     Raw raw;
 
-    bool operator ==(const ContentAddressWithReferences &) const = default;
+    bool operator==(const ContentAddressWithReferences &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=>(const ContentAddressWithReferences &) const = default;
+    // auto operator <=>(const ContentAddressWithReferences &) const = default;
 
     MAKE_WRAPPER_CONSTRUCTOR(ContentAddressWithReferences);
 
@@ -306,12 +301,11 @@ struct ContentAddressWithReferences
      * *partial function* and exceptions will be thrown for invalid
      * combinations.
      */
-    static ContentAddressWithReferences fromParts(
-        ContentAddressMethod method, Hash hash, StoreReferences refs);
+    static ContentAddressWithReferences fromParts(ContentAddressMethod method, Hash hash, StoreReferences refs);
 
     ContentAddressMethod getMethod() const;
 
     Hash getHash() const;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/daemon.hh b/src/libstore/include/nix/store/daemon.hh
index d14541df7..4d550696e 100644
--- a/src/libstore/include/nix/store/daemon.hh
+++ b/src/libstore/include/nix/store/daemon.hh
@@ -8,11 +8,6 @@ namespace nix::daemon {
 
 enum RecursiveFlag : bool { NotRecursive = false, Recursive = true };
 
-void processConnection(
-    ref<Store> store,
-    FdSource && from,
-    FdSink && to,
-    TrustedFlag trusted,
-    RecursiveFlag recursive);
+void processConnection(ref<Store> store, FdSource && from, FdSink && to, TrustedFlag trusted, RecursiveFlag recursive);
 
-}
+} // namespace nix::daemon
diff --git a/src/libstore/include/nix/store/derivation-options.hh b/src/libstore/include/nix/store/derivation-options.hh
index f61a43e60..88694f730 100644
--- a/src/libstore/include/nix/store/derivation-options.hh
+++ b/src/libstore/include/nix/store/derivation-options.hh
@@ -8,10 +8,12 @@
 
 #include "nix/util/types.hh"
 #include "nix/util/json-impls.hh"
+#include "nix/store/path.hh"
 
 namespace nix {
 
 class Store;
+struct StoreDirConfig;
 struct BasicDerivation;
 struct StructuredAttrs;
 
@@ -116,6 +118,22 @@ struct DerivationOptions
      */
     std::map<std::string, StringSet> exportReferencesGraph;
 
+    /**
+     * Once a derivations is resolved, the strings in in
+     * `exportReferencesGraph` should all be store paths (with possible
+     * suffix paths, but those are discarded).
+     *
+     * @return The parsed path set for for each key in the map.
+     *
+     * @todo Ideally, `exportReferencesGraph` would just store
+     * `StorePath`s for this, but we can't just do that, because for CA
+     * derivations they is actually in general `DerivedPath`s (via
+     * placeholder strings) until the derivation is resolved and exact
+     * inputs store paths are known. We can use better types for that
+     * too, but that is a longer project.
+     */
+    std::map<std::string, StorePathSet> getParsedExportReferencesGraph(const StoreDirConfig & store) const;
+
     /**
      * env: __sandboxProfile
      *
@@ -176,6 +194,9 @@ struct DerivationOptions
     static DerivationOptions
     fromStructuredAttrs(const StringMap & env, const StructuredAttrs * parsed, bool shouldWarn = true);
 
+    static DerivationOptions
+    fromStructuredAttrs(const StringMap & env, const std::optional<StructuredAttrs> & parsed, bool shouldWarn = true);
+
     /**
      * @param drv Must be the same derivation we parsed this from. In
      * the future we'll flip things around so a `BasicDerivation` has
@@ -201,7 +222,7 @@ struct DerivationOptions
     bool useUidRange(const BasicDerivation & drv) const;
 };
 
-};
+}; // namespace nix
 
 JSON_IMPL(DerivationOptions);
 JSON_IMPL(DerivationOptions::OutputChecks)
diff --git a/src/libstore/include/nix/store/derivations.hh b/src/libstore/include/nix/store/derivations.hh
index a813137bc..08bb7183f 100644
--- a/src/libstore/include/nix/store/derivations.hh
+++ b/src/libstore/include/nix/store/derivations.hh
@@ -7,10 +7,11 @@
 #include "nix/store/content-address.hh"
 #include "nix/util/repair-flag.hh"
 #include "nix/store/derived-path-map.hh"
+#include "nix/store/parsed-derivations.hh"
 #include "nix/util/sync.hh"
 #include "nix/util/variant-wrapper.hh"
 
-#include <map>
+#include <boost/unordered/concurrent_flat_map_fwd.hpp>
 #include <variant>
 
 namespace nix {
@@ -31,8 +32,8 @@ struct DerivationOutput
     {
         StorePath path;
 
-        bool operator == (const InputAddressed &) const = default;
-        auto operator <=> (const InputAddressed &) const = default;
+        bool operator==(const InputAddressed &) const = default;
+        auto operator<=>(const InputAddressed &) const = default;
     };
 
     /**
@@ -56,8 +57,8 @@ struct DerivationOutput
          */
         StorePath path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const;
 
-        bool operator == (const CAFixed &) const = default;
-        auto operator <=> (const CAFixed &) const = default;
+        bool operator==(const CAFixed &) const = default;
+        auto operator<=>(const CAFixed &) const = default;
     };
 
     /**
@@ -77,17 +78,18 @@ struct DerivationOutput
          */
         HashAlgorithm hashAlgo;
 
-        bool operator == (const CAFloating &) const = default;
-        auto operator <=> (const CAFloating &) const = default;
+        bool operator==(const CAFloating &) const = default;
+        auto operator<=>(const CAFloating &) const = default;
     };
 
     /**
      * Input-addressed output which depends on a (CA) derivation whose hash
      * isn't known yet.
      */
-    struct Deferred {
-        bool operator == (const Deferred &) const = default;
-        auto operator <=> (const Deferred &) const = default;
+    struct Deferred
+    {
+        bool operator==(const Deferred &) const = default;
+        auto operator<=>(const Deferred &) const = default;
     };
 
     /**
@@ -106,22 +108,16 @@ struct DerivationOutput
          */
         HashAlgorithm hashAlgo;
 
-        bool operator == (const Impure &) const = default;
-        auto operator <=> (const Impure &) const = default;
+        bool operator==(const Impure &) const = default;
+        auto operator<=>(const Impure &) const = default;
     };
 
-    typedef std::variant<
-        InputAddressed,
-        CAFixed,
-        CAFloating,
-        Deferred,
-        Impure
-    > Raw;
+    typedef std::variant<InputAddressed, CAFixed, CAFloating, Deferred, Impure> Raw;
 
     Raw raw;
 
-    bool operator == (const DerivationOutput &) const = default;
-    auto operator <=> (const DerivationOutput &) const = default;
+    bool operator==(const DerivationOutput &) const = default;
+    auto operator<=>(const DerivationOutput &) const = default;
 
     MAKE_WRAPPER_CONSTRUCTOR(DerivationOutput);
 
@@ -136,12 +132,10 @@ struct DerivationOutput
      * the safer interface provided by
      * BasicDerivation::outputsAndOptPaths
      */
-    std::optional<StorePath> path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const;
+    std::optional<StorePath>
+    path(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const;
 
-    nlohmann::json toJSON(
-        const StoreDirConfig & store,
-        std::string_view drvName,
-        OutputNameView outputName) const;
+    nlohmann::json toJSON(const StoreDirConfig & store, std::string_view drvName, OutputNameView outputName) const;
     /**
      * @param xpSettings Stop-gap to avoid globals during unit tests.
      */
@@ -161,8 +155,7 @@ typedef std::map<std::string, DerivationOutput> DerivationOutputs;
  * path in which it would be written. To calculate values of these
  * types, see the corresponding functions in BasicDerivation.
  */
-typedef std::map<std::string, std::pair<DerivationOutput, std::optional<StorePath>>>
-  DerivationOutputsAndOptPaths;
+typedef std::map<std::string, std::pair<DerivationOutput, std::optional<StorePath>>> DerivationOutputsAndOptPaths;
 
 /**
  * For inputs that are sub-derivations, we specify exactly which
@@ -170,26 +163,29 @@ typedef std::map<std::string, std::pair<DerivationOutput, std::optional<StorePat
  */
 typedef std::map<StorePath, StringSet> DerivationInputs;
 
-struct DerivationType {
+struct DerivationType
+{
     /**
      * Input-addressed derivation types
      */
-    struct InputAddressed {
+    struct InputAddressed
+    {
         /**
          * True iff the derivation type can't be determined statically,
          * for instance because it (transitively) depends on a content-addressed
          * derivation.
-        */
+         */
         bool deferred;
 
-        bool operator == (const InputAddressed &) const = default;
-        auto operator <=> (const InputAddressed &) const = default;
+        bool operator==(const InputAddressed &) const = default;
+        auto operator<=>(const InputAddressed &) const = default;
     };
 
     /**
      * Content-addressing derivation types
      */
-    struct ContentAddressed {
+    struct ContentAddressed
+    {
         /**
          * Whether the derivation should be built safely inside a sandbox.
          */
@@ -207,8 +203,8 @@ struct DerivationType {
          */
         bool fixed;
 
-        bool operator == (const ContentAddressed &) const = default;
-        auto operator <=> (const ContentAddressed &) const = default;
+        bool operator==(const ContentAddressed &) const = default;
+        auto operator<=>(const ContentAddressed &) const = default;
     };
 
     /**
@@ -217,21 +213,18 @@ struct DerivationType {
      * This is similar at build-time to the content addressed, not standboxed, not fixed
      * type, but has some restrictions on its usage.
      */
-    struct Impure {
-        bool operator == (const Impure &) const = default;
-        auto operator <=> (const Impure &) const = default;
+    struct Impure
+    {
+        bool operator==(const Impure &) const = default;
+        auto operator<=>(const Impure &) const = default;
     };
 
-    typedef std::variant<
-        InputAddressed,
-        ContentAddressed,
-        Impure
-    > Raw;
+    typedef std::variant<InputAddressed, ContentAddressed, Impure> Raw;
 
     Raw raw;
 
-    bool operator == (const DerivationType &) const = default;
-    auto operator <=> (const DerivationType &) const = default;
+    bool operator==(const DerivationType &) const = default;
+    auto operator<=>(const DerivationType &) const = default;
 
     MAKE_WRAPPER_CONSTRUCTOR(DerivationType);
 
@@ -294,15 +287,20 @@ struct BasicDerivation
     std::string platform;
     Path builder;
     Strings args;
+    /**
+     * Must not contain the key `__json`, at least in order to serialize to A-Term.
+     */
     StringPairs env;
+    std::optional<StructuredAttrs> structuredAttrs;
+
     std::string name;
 
     BasicDerivation() = default;
     BasicDerivation(BasicDerivation &&) = default;
     BasicDerivation(const BasicDerivation &) = default;
-    BasicDerivation& operator=(BasicDerivation &&) = default;
-    BasicDerivation& operator=(const BasicDerivation &) = default;
-    virtual ~BasicDerivation() { };
+    BasicDerivation & operator=(BasicDerivation &&) = default;
+    BasicDerivation & operator=(const BasicDerivation &) = default;
+    virtual ~BasicDerivation() {};
 
     bool isBuiltin() const;
 
@@ -331,9 +329,9 @@ struct BasicDerivation
      */
     void applyRewrites(const StringMap & rewrites);
 
-    bool operator == (const BasicDerivation &) const = default;
+    bool operator==(const BasicDerivation &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=> (const BasicDerivation &) const = default;
+    // auto operator <=> (const BasicDerivation &) const = default;
 };
 
 class Store;
@@ -348,7 +346,9 @@ struct Derivation : BasicDerivation
     /**
      * Print a derivation.
      */
-    std::string unparse(const StoreDirConfig & store, bool maskOutputs,
+    std::string unparse(
+        const StoreDirConfig & store,
+        bool maskOutputs,
         DerivedPathMap<StringSet>::ChildNode::Map * actualInputs = nullptr) const;
 
     /**
@@ -369,7 +369,8 @@ struct Derivation : BasicDerivation
      */
     std::optional<BasicDerivation> tryResolve(
         Store & store,
-        std::function<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)> queryResolutionChain) const;
+        std::function<std::optional<StorePath>(ref<const SingleDerivedPath> drvPath, const std::string & outputName)>
+            queryResolutionChain) const;
 
     /**
      * Check that the derivation is valid and does not present any
@@ -382,8 +383,16 @@ struct Derivation : BasicDerivation
     void checkInvariants(Store & store, const StorePath & drvPath) const;
 
     Derivation() = default;
-    Derivation(const BasicDerivation & bd) : BasicDerivation(bd) { }
-    Derivation(BasicDerivation && bd) : BasicDerivation(std::move(bd)) { }
+
+    Derivation(const BasicDerivation & bd)
+        : BasicDerivation(bd)
+    {
+    }
+
+    Derivation(BasicDerivation && bd)
+        : BasicDerivation(std::move(bd))
+    {
+    }
 
     nlohmann::json toJSON(const StoreDirConfig & store) const;
     static Derivation fromJSON(
@@ -391,21 +400,17 @@ struct Derivation : BasicDerivation
         const nlohmann::json & json,
         const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
-    bool operator == (const Derivation &) const = default;
+    bool operator==(const Derivation &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=> (const Derivation &) const = default;
+    // auto operator <=> (const Derivation &) const = default;
 };
 
-
 class Store;
 
 /**
  * Write a derivation to the Nix store, and return its path.
  */
-StorePath writeDerivation(Store & store,
-    const Derivation & drv,
-    RepairFlag repair = NoRepair,
-    bool readOnly = false);
+StorePath writeDerivation(Store & store, const Derivation & drv, RepairFlag repair = NoRepair, bool readOnly = false);
 
 /**
  * Read a derivation from a file.
@@ -432,7 +437,6 @@ bool isDerivation(std::string_view fileName);
  */
 std::string outputPathName(std::string_view drvName, OutputNameView outputName);
 
-
 /**
  * The hashes modulo of a derivation.
  *
@@ -440,7 +444,8 @@ std::string outputPathName(std::string_view drvName, OutputNameView outputName);
  * derivations (fixed-output or not) will have a different hash for each
  * output.
  */
-struct DrvHash {
+struct DrvHash
+{
     /**
      * Map from output names to hashes
      */
@@ -466,7 +471,7 @@ struct DrvHash {
     Kind kind;
 };
 
-void operator |= (DrvHash::Kind & self, const DrvHash::Kind & other) noexcept;
+void operator|=(DrvHash::Kind & self, const DrvHash::Kind & other) noexcept;
 
 /**
  * Returns hashes with the details of fixed-output subderivations
@@ -502,13 +507,23 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
  */
 std::map<std::string, Hash> staticOutputHashes(Store & store, const Derivation & drv);
 
+struct DrvHashFct
+{
+    using is_avalanching = std::true_type;
+
+    std::size_t operator()(const StorePath & path) const noexcept
+    {
+        return std::hash<std::string_view>{}(path.to_string());
+    }
+};
+
 /**
  * Memoisation of hashDerivationModulo().
  */
-typedef std::map<StorePath, DrvHash> DrvHashes;
+typedef boost::concurrent_flat_map<StorePath, DrvHash, DrvHashFct> DrvHashes;
 
 // FIXME: global, though at least thread-safe.
-extern Sync<DrvHashes> drvHashes;
+extern DrvHashes drvHashes;
 
 struct Source;
 struct Sink;
@@ -526,4 +541,4 @@ void writeDerivation(Sink & out, const StoreDirConfig & store, const BasicDeriva
  */
 std::string hashPlaceholder(const OutputNameView outputName);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/derived-path-map.hh b/src/libstore/include/nix/store/derived-path-map.hh
index 6dae73fab..c10af84ca 100644
--- a/src/libstore/include/nix/store/derived-path-map.hh
+++ b/src/libstore/include/nix/store/derived-path-map.hh
@@ -28,11 +28,13 @@ namespace nix {
  * "optional" types.
  */
 template<typename V>
-struct DerivedPathMap {
+struct DerivedPathMap
+{
     /**
      * A child node (non-root node).
      */
-    struct ChildNode {
+    struct ChildNode
+    {
         /**
          * Value of this child node.
          *
@@ -50,7 +52,7 @@ struct DerivedPathMap {
          */
         Map childMap;
 
-        bool operator == (const ChildNode &) const noexcept;
+        bool operator==(const ChildNode &) const noexcept;
 
         // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
         // decltype(std::declval<V>() <=> std::declval<V>())
@@ -67,7 +69,7 @@ struct DerivedPathMap {
      */
     Map map;
 
-    bool operator == (const DerivedPathMap &) const = default;
+    bool operator==(const DerivedPathMap &) const = default;
 
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
     // auto operator <=> (const DerivedPathMap &) const noexcept;
@@ -94,8 +96,7 @@ struct DerivedPathMap {
 };
 
 template<>
-bool DerivedPathMap<StringSet>::ChildNode::operator == (
-    const DerivedPathMap<StringSet>::ChildNode &) const noexcept;
+bool DerivedPathMap<StringSet>::ChildNode::operator==(const DerivedPathMap<StringSet>::ChildNode &) const noexcept;
 
 // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
 #if 0
@@ -110,4 +111,4 @@ inline auto DerivedPathMap<StringSet>::operator <=> (const DerivedPathMap<String
 extern template struct DerivedPathMap<StringSet>::ChildNode;
 extern template struct DerivedPathMap<StringSet>;
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/derived-path.hh b/src/libstore/include/nix/store/derived-path.hh
index 64189bd41..bc89b012e 100644
--- a/src/libstore/include/nix/store/derived-path.hh
+++ b/src/libstore/include/nix/store/derived-path.hh
@@ -24,15 +24,16 @@ class Store;
  * cannot be simplified further. Since they are opaque, they cannot be
  * built, but they can fetched.
  */
-struct DerivedPathOpaque {
+struct DerivedPathOpaque
+{
     StorePath path;
 
     std::string to_string(const StoreDirConfig & store) const;
     static DerivedPathOpaque parse(const StoreDirConfig & store, std::string_view);
     nlohmann::json toJSON(const StoreDirConfig & store) const;
 
-    bool operator == (const DerivedPathOpaque &) const = default;
-    auto operator <=> (const DerivedPathOpaque &) const = default;
+    bool operator==(const DerivedPathOpaque &) const = default;
+    auto operator<=>(const DerivedPathOpaque &) const = default;
 };
 
 struct SingleDerivedPath;
@@ -44,7 +45,8 @@ struct SingleDerivedPath;
  * evaluated by building the derivation, and then taking the resulting output
  * path of the given output name.
  */
-struct SingleDerivedPathBuilt {
+struct SingleDerivedPathBuilt
+{
     ref<const SingleDerivedPath> drvPath;
     OutputName output;
 
@@ -74,19 +76,17 @@ struct SingleDerivedPathBuilt {
      * @param xpSettings Stop-gap to avoid globals during unit tests.
      */
     static SingleDerivedPathBuilt parse(
-        const StoreDirConfig & store, ref<const SingleDerivedPath> drvPath,
+        const StoreDirConfig & store,
+        ref<const SingleDerivedPath> drvPath,
         OutputNameView outputs,
         const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
     nlohmann::json toJSON(Store & store) const;
 
-    bool operator == (const SingleDerivedPathBuilt &) const noexcept;
-    std::strong_ordering operator <=> (const SingleDerivedPathBuilt &) const noexcept;
+    bool operator==(const SingleDerivedPathBuilt &) const noexcept;
+    std::strong_ordering operator<=>(const SingleDerivedPathBuilt &) const noexcept;
 };
 
-using _SingleDerivedPathRaw = std::variant<
-    DerivedPathOpaque,
-    SingleDerivedPathBuilt
->;
+using _SingleDerivedPathRaw = std::variant<DerivedPathOpaque, SingleDerivedPathBuilt>;
 
 /**
  * A "derived path" is a very simple sort of expression (not a Nix
@@ -99,19 +99,21 @@ using _SingleDerivedPathRaw = std::variant<
  * - built, in which case it is a pair of a derivation path and an
  *   output name.
  */
-struct SingleDerivedPath : _SingleDerivedPathRaw {
+struct SingleDerivedPath : _SingleDerivedPathRaw
+{
     using Raw = _SingleDerivedPathRaw;
     using Raw::Raw;
 
     using Opaque = DerivedPathOpaque;
     using Built = SingleDerivedPathBuilt;
 
-    inline const Raw & raw() const {
+    inline const Raw & raw() const
+    {
         return static_cast<const Raw &>(*this);
     }
 
-    bool operator == (const SingleDerivedPath &) const = default;
-    auto operator <=> (const SingleDerivedPath &) const = default;
+    bool operator==(const SingleDerivedPath &) const = default;
+    auto operator<=>(const SingleDerivedPath &) const = default;
 
     /**
      * Get the store path this is ultimately derived from (by realising
@@ -156,7 +158,7 @@ struct SingleDerivedPath : _SingleDerivedPathRaw {
 
 static inline ref<SingleDerivedPath> makeConstantStorePathRef(StorePath drvPath)
 {
-    return make_ref<SingleDerivedPath>(SingleDerivedPath::Opaque { drvPath });
+    return make_ref<SingleDerivedPath>(SingleDerivedPath::Opaque{drvPath});
 }
 
 /**
@@ -171,7 +173,8 @@ static inline ref<SingleDerivedPath> makeConstantStorePathRef(StorePath drvPath)
  * evaluate to single values. Perhaps this should have just a single
  * output name.
  */
-struct DerivedPathBuilt {
+struct DerivedPathBuilt
+{
     ref<const SingleDerivedPath> drvPath;
     OutputsSpec outputs;
 
@@ -201,20 +204,18 @@ struct DerivedPathBuilt {
      * @param xpSettings Stop-gap to avoid globals during unit tests.
      */
     static DerivedPathBuilt parse(
-        const StoreDirConfig & store, ref<const SingleDerivedPath>,
+        const StoreDirConfig & store,
+        ref<const SingleDerivedPath>,
         std::string_view,
         const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
     nlohmann::json toJSON(Store & store) const;
 
-    bool operator == (const DerivedPathBuilt &) const noexcept;
+    bool operator==(const DerivedPathBuilt &) const noexcept;
     // TODO libc++ 16 (used by darwin) missing `std::set::operator <=>`, can't do yet.
-    bool operator < (const DerivedPathBuilt &) const noexcept;
+    bool operator<(const DerivedPathBuilt &) const noexcept;
 };
 
-using _DerivedPathRaw = std::variant<
-    DerivedPathOpaque,
-    DerivedPathBuilt
->;
+using _DerivedPathRaw = std::variant<DerivedPathOpaque, DerivedPathBuilt>;
 
 /**
  * A "derived path" is a very simple sort of expression that evaluates
@@ -226,20 +227,22 @@ using _DerivedPathRaw = std::variant<
  * - built, in which case it is a pair of a derivation path and some
  *   output names.
  */
-struct DerivedPath : _DerivedPathRaw {
+struct DerivedPath : _DerivedPathRaw
+{
     using Raw = _DerivedPathRaw;
     using Raw::Raw;
 
     using Opaque = DerivedPathOpaque;
     using Built = DerivedPathBuilt;
 
-    inline const Raw & raw() const {
+    inline const Raw & raw() const
+    {
         return static_cast<const Raw &>(*this);
     }
 
-    bool operator == (const DerivedPath &) const = default;
+    bool operator==(const DerivedPath &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::set::operator <=>`, can't do yet.
-    //auto operator <=> (const DerivedPath &) const = default;
+    // auto operator <=> (const DerivedPath &) const = default;
 
     /**
      * Get the store path this is ultimately derived from (by realising
@@ -300,6 +303,5 @@ typedef std::vector<DerivedPath> DerivedPaths;
  * @param xpSettings Stop-gap to avoid globals during unit tests.
  */
 void drvRequireExperiment(
-    const SingleDerivedPath & drv,
-    const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
-}
+    const SingleDerivedPath & drv, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+} // namespace nix
diff --git a/src/libstore/include/nix/store/downstream-placeholder.hh b/src/libstore/include/nix/store/downstream-placeholder.hh
index da03cd9a6..ee4d9e3c2 100644
--- a/src/libstore/include/nix/store/downstream-placeholder.hh
+++ b/src/libstore/include/nix/store/downstream-placeholder.hh
@@ -38,7 +38,10 @@ class DownstreamPlaceholder
     /**
      * Newtype constructor
      */
-    DownstreamPlaceholder(Hash hash) : hash(hash) { }
+    DownstreamPlaceholder(Hash hash)
+        : hash(hash)
+    {
+    }
 
 public:
     /**
@@ -88,4 +91,4 @@ public:
         const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/export-import.hh b/src/libstore/include/nix/store/export-import.hh
new file mode 100644
index 000000000..15092202f
--- /dev/null
+++ b/src/libstore/include/nix/store/export-import.hh
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "nix/store/store-api.hh"
+
+namespace nix {
+
+/**
+ * Magic header of exportPath() output (obsolete).
+ */
+const uint32_t exportMagic = 0x4558494e;
+
+/**
+ * Export multiple paths in the format expected by `nix-store
+ * --import`. The paths will be sorted topologically.
+ */
+void exportPaths(Store & store, const StorePathSet & paths, Sink & sink);
+
+/**
+ * Import a sequence of NAR dumps created by `exportPaths()` into the
+ * Nix store.
+ */
+StorePaths importPaths(Store & store, Source & source, CheckSigsFlag checkSigs = CheckSigs);
+
+} // namespace nix
diff --git a/src/libstore/include/nix/store/filetransfer.hh b/src/libstore/include/nix/store/filetransfer.hh
index 745aeb29e..2f2d59036 100644
--- a/src/libstore/include/nix/store/filetransfer.hh
+++ b/src/libstore/include/nix/store/filetransfer.hh
@@ -9,19 +9,21 @@
 #include "nix/util/ref.hh"
 #include "nix/util/configuration.hh"
 #include "nix/util/serialise.hh"
+#include "nix/util/url.hh"
 
 namespace nix {
 
 struct FileTransferSettings : Config
 {
-    Setting<bool> enableHttp2{this, true, "http2",
-        "Whether to enable HTTP/2 support."};
+    Setting<bool> enableHttp2{this, true, "http2", "Whether to enable HTTP/2 support."};
 
-    Setting<std::string> userAgentSuffix{this, "", "user-agent-suffix",
-        "String appended to the user agent in HTTP requests."};
+    Setting<std::string> userAgentSuffix{
+        this, "", "user-agent-suffix", "String appended to the user agent in HTTP requests."};
 
     Setting<size_t> httpConnections{
-        this, 25, "http-connections",
+        this,
+        25,
+        "http-connections",
         R"(
           The maximum number of parallel TCP connections used to fetch
           files from binary caches and by other downloads. It defaults
@@ -29,8 +31,18 @@ struct FileTransferSettings : Config
         )",
         {"binary-caches-parallel-connections"}};
 
+    /* Do not set this too low. On glibc, getaddrinfo() contains fallback code
+       paths that deal with ill-behaved DNS servers. Setting this too low
+       prevents some fallbacks from occurring.
+
+       See description of options timeout, single-request, single-request-reopen
+       in resolv.conf(5). Also see https://github.com/NixOS/nix/pull/13985 for
+       details on the interaction between getaddrinfo(3) behavior and libcurl
+       CURLOPT_CONNECTTIMEOUT. */
     Setting<unsigned long> connectTimeout{
-        this, 5, "connect-timeout",
+        this,
+        15,
+        "connect-timeout",
         R"(
           The timeout (in seconds) for establishing connections in the
           binary cache substituter. It corresponds to `curl`’s
@@ -38,17 +50,22 @@ struct FileTransferSettings : Config
         )"};
 
     Setting<unsigned long> stalledDownloadTimeout{
-        this, 300, "stalled-download-timeout",
+        this,
+        300,
+        "stalled-download-timeout",
         R"(
           The timeout (in seconds) for receiving data from servers
           during download. Nix cancels idle downloads after this
           timeout's duration.
         )"};
 
-    Setting<unsigned int> tries{this, 5, "download-attempts",
-        "The number of times Nix attempts to download a file before giving up."};
+    Setting<unsigned int> tries{
+        this, 5, "download-attempts", "The number of times Nix attempts to download a file before giving up."};
 
-    Setting<size_t> downloadBufferSize{this, 64 * 1024 * 1024, "download-buffer-size",
+    Setting<size_t> downloadBufferSize{
+        this,
+        64 * 1024 * 1024,
+        "download-buffer-size",
         R"(
           The size of Nix's internal download buffer in bytes during `curl` transfers. If data is
           not processed quickly enough to exceed the size of this buffer, downloads may stall.
@@ -62,7 +79,7 @@ extern const unsigned int RETRY_TIME_MS_DEFAULT;
 
 struct FileTransferRequest
 {
-    std::string uri;
+    ValidURL uri;
     Headers headers;
     std::string expectedETag;
     bool verifyTLS = true;
@@ -76,8 +93,11 @@ struct FileTransferRequest
     std::string mimeType;
     std::function<void(std::string_view data)> dataCallback;
 
-    FileTransferRequest(std::string_view uri)
-        : uri(uri), parentAct(getCurActivity()) { }
+    FileTransferRequest(ValidURL uri)
+        : uri(std::move(uri))
+        , parentAct(getCurActivity())
+    {
+    }
 
     std::string verb() const
     {
@@ -100,6 +120,9 @@ struct FileTransferResult
 
     /**
      * All URLs visited in the redirect chain.
+     *
+     * @note Intentionally strings and not `ParsedURL`s so we faithfully
+     * return what cURL gave us.
      */
     std::vector<std::string> urls;
 
@@ -122,15 +145,14 @@ class Store;
 
 struct FileTransfer
 {
-    virtual ~FileTransfer() { }
+    virtual ~FileTransfer() {}
 
     /**
      * Enqueue a data transfer request, returning a future to the result of
      * the download. The future may throw a FileTransferError
      * exception.
      */
-    virtual void enqueueFileTransfer(const FileTransferRequest & request,
-        Callback<FileTransferResult> callback) = 0;
+    virtual void enqueueFileTransfer(const FileTransferRequest & request, Callback<FileTransferResult> callback) = 0;
 
     std::future<FileTransferResult> enqueueFileTransfer(const FileTransferRequest & request);
 
@@ -148,10 +170,8 @@ struct FileTransfer
      * Download a file, writing its data to a sink. The sink will be
      * invoked on the thread of the caller.
      */
-    void download(
-        FileTransferRequest && request,
-        Sink & sink,
-        std::function<void(FileTransferResult)> resultCallback = {});
+    void
+    download(FileTransferRequest && request, Sink & sink, std::function<void(FileTransferResult)> resultCallback = {});
 
     enum Error { NotFound, Forbidden, Misc, Transient, Interrupted };
 };
@@ -179,7 +199,7 @@ public:
     std::optional<std::string> response;
 
     template<typename... Args>
-    FileTransferError(FileTransfer::Error error, std::optional<std::string> response, const Args & ... args);
+    FileTransferError(FileTransfer::Error error, std::optional<std::string> response, const Args &... args);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/gc-store.hh b/src/libstore/include/nix/store/gc-store.hh
index 8b25ec8d4..5a4a6db14 100644
--- a/src/libstore/include/nix/store/gc-store.hh
+++ b/src/libstore/include/nix/store/gc-store.hh
@@ -1,15 +1,17 @@
 #pragma once
 ///@file
 
-#include <unordered_set>
-
 #include "nix/store/store-api.hh"
+#include <boost/unordered/unordered_flat_map.hpp>
+#include <boost/unordered/unordered_flat_set.hpp>
 
 namespace nix {
 
-
-typedef std::unordered_map<StorePath, std::unordered_set<std::string>> Roots;
-
+typedef boost::unordered_flat_map<
+    StorePath,
+    boost::unordered_flat_set<std::string, StringViewHash, std::equal_to<>>,
+    std::hash<StorePath>>
+    Roots;
 
 struct GCOptions
 {
@@ -55,7 +57,6 @@ struct GCOptions
     uint64_t maxFreed{std::numeric_limits<uint64_t>::max()};
 };
 
-
 struct GCResults
 {
     /**
@@ -71,7 +72,6 @@ struct GCResults
     uint64_t bytesFreed = 0;
 };
 
-
 /**
  * Mix-in class for \ref Store "stores" which expose a notion of garbage
  * collection.
@@ -117,4 +117,4 @@ struct GcStore : public virtual Store
     virtual void collectGarbage(const GCOptions & options, GCResults & results) = 0;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/globals.hh b/src/libstore/include/nix/store/globals.hh
index 0ac689b55..2cd92467c 100644
--- a/src/libstore/include/nix/store/globals.hh
+++ b/src/libstore/include/nix/store/globals.hh
@@ -11,6 +11,7 @@
 #include "nix/util/environment-variables.hh"
 #include "nix/util/experimental-features.hh"
 #include "nix/util/users.hh"
+#include "nix/store/build/derivation-builder.hh"
 
 #include "nix/store/config.hh"
 
@@ -18,9 +19,29 @@ namespace nix {
 
 typedef enum { smEnabled, smRelaxed, smDisabled } SandboxMode;
 
+template<>
+SandboxMode BaseSetting<SandboxMode>::parse(const std::string & str) const;
+template<>
+std::string BaseSetting<SandboxMode>::to_string() const;
+
+template<>
+PathsInChroot BaseSetting<PathsInChroot>::parse(const std::string & str) const;
+template<>
+std::string BaseSetting<PathsInChroot>::to_string() const;
+
+template<>
+struct BaseSetting<PathsInChroot>::trait
+{
+    static constexpr bool appendable = true;
+};
+
+template<>
+void BaseSetting<PathsInChroot>::appendOrSet(PathsInChroot newValue, bool append);
+
 struct MaxBuildJobsSetting : public BaseSetting<unsigned int>
 {
-    MaxBuildJobsSetting(Config * options,
+    MaxBuildJobsSetting(
+        Config * options,
         unsigned int def,
         const std::string & name,
         const std::string & description,
@@ -34,16 +55,15 @@ struct MaxBuildJobsSetting : public BaseSetting<unsigned int>
 };
 
 const uint32_t maxIdsPerBuild =
-    #ifdef __linux__
+#ifdef __linux__
     1 << 16
-    #else
+#else
     1
-    #endif
+#endif
     ;
 
-class Settings : public Config {
-
-    unsigned int getDefaultCores();
+class Settings : public Config
+{
 
     StringSet getDefaultSystemFeatures();
 
@@ -57,6 +77,8 @@ public:
 
     Settings();
 
+    unsigned int getDefaultCores() const;
+
     Path nixPrefix;
 
     /**
@@ -91,7 +113,10 @@ public:
      */
     Path nixDaemonSocketFile;
 
-    Setting<std::string> storeUri{this, getEnv("NIX_REMOTE").value_or("auto"), "store",
+    Setting<std::string> storeUri{
+        this,
+        getEnv("NIX_REMOTE").value_or("auto"),
+        "store",
         R"(
           The [URL of the Nix store](@docroot@/store/types/index.md#store-url-format)
           to use for most operations.
@@ -100,14 +125,15 @@ public:
           section of the manual for supported store types and settings.
         )"};
 
-    Setting<bool> keepFailed{this, false, "keep-failed",
-        "Whether to keep temporary directories of failed builds."};
+    Setting<bool> keepFailed{this, false, "keep-failed", "Whether to keep temporary directories of failed builds."};
 
-    Setting<bool> keepGoing{this, false, "keep-going",
-        "Whether to keep building derivations when another build fails."};
+    Setting<bool> keepGoing{
+        this, false, "keep-going", "Whether to keep building derivations when another build fails."};
 
     Setting<bool> tryFallback{
-        this, false, "fallback",
+        this,
+        false,
+        "fallback",
         R"(
           If set to `true`, Nix falls back to building from source if a
           binary substitute fails. This is equivalent to the `--fallback`
@@ -120,12 +146,17 @@ public:
      */
     bool verboseBuild = true;
 
-    Setting<size_t> logLines{this, 25, "log-lines",
+    Setting<size_t> logLines{
+        this,
+        25,
+        "log-lines",
         "The number of lines of the tail of "
         "the log to show if a build fails."};
 
     MaxBuildJobsSetting maxBuildJobs{
-        this, 1, "max-jobs",
+        this,
+        1,
+        "max-jobs",
         R"(
           Maximum number of jobs that Nix tries to build locally in parallel.
 
@@ -143,7 +174,9 @@ public:
         {"build-max-jobs"}};
 
     Setting<unsigned int> maxSubstitutionJobs{
-        this, 16, "max-substitution-jobs",
+        this,
+        16,
+        "max-substitution-jobs",
         R"(
           This option defines the maximum number of substitution jobs that Nix
           tries to run in parallel. The default is `16`. The minimum value
@@ -153,7 +186,7 @@ public:
 
     Setting<unsigned int> buildCores{
         this,
-        getDefaultCores(),
+        0,
         "cores",
         R"(
           Sets the value of the `NIX_BUILD_CORES` environment variable in the [invocation of the `builder` executable](@docroot@/language/derivations.md#builder-execution) of a derivation.
@@ -166,15 +199,13 @@ public:
           -->
           For instance, in Nixpkgs, if the attribute `enableParallelBuilding` for the `mkDerivation` build helper is set to `true`, it passes the `-j${NIX_BUILD_CORES}` flag to GNU Make.
 
-          The value `0` means that the `builder` should use all available CPU cores in the system.
+          If set to `0`, nix will detect the number of CPU cores and pass this number via NIX_BUILD_CORES.
 
           > **Note**
           >
           > The number of parallel local Nix build jobs is independently controlled with the [`max-jobs`](#conf-max-jobs) setting.
         )",
-        {"build-cores"},
-        // Don't document the machine-specific default value
-        false};
+        {"build-cores"}};
 
     /**
      * Read-only mode.  Don't copy stuff to the store, don't change
@@ -183,7 +214,9 @@ public:
     bool readOnlyMode = false;
 
     Setting<std::string> thisSystem{
-        this, NIX_LOCAL_SYSTEM, "system",
+        this,
+        NIX_LOCAL_SYSTEM,
+        "system",
         R"(
           The system type of the current Nix installation.
           Nix only builds a given [store derivation](@docroot@/glossary.md#gloss-store-derivation) locally when its `system` attribute equals any of the values specified here or in [`extra-platforms`](#conf-extra-platforms).
@@ -210,7 +243,9 @@ public:
         )"};
 
     Setting<time_t> maxSilentTime{
-        this, 0, "max-silent-time",
+        this,
+        0,
+        "max-silent-time",
         R"(
           This option defines the maximum number of seconds that a builder can
           go without producing any data on standard output or standard error.
@@ -225,7 +260,9 @@ public:
         {"build-max-silent-time"}};
 
     Setting<time_t> buildTimeout{
-        this, 0, "timeout",
+        this,
+        0,
+        "timeout",
         R"(
           This option defines the maximum number of seconds that a builder can
           run. This is useful (for instance in an automated build system) to
@@ -238,7 +275,10 @@ public:
         )",
         {"build-timeout"}};
 
-    Setting<Strings> buildHook{this, {"nix", "__build-remote"}, "build-hook",
+    Setting<Strings> buildHook{
+        this,
+        {"nix", "__build-remote"},
+        "build-hook",
         R"(
           The path to the helper program that executes remote builds.
 
@@ -251,7 +291,9 @@ public:
         )"};
 
     Setting<std::string> builders{
-        this, "@" + nixConfDir + "/machines", "builders",
+        this,
+        "@" + nixConfDir + "/machines",
+        "builders",
         R"(
           A semicolon- or newline-separated list of build machines.
 
@@ -269,7 +311,7 @@ public:
           Only the first element is required.
           To leave a field at its default, set it to `-`.
 
-          1. The URI of the remote store in the format `ssh://[username@]hostname`.
+          1. The URI of the remote store in the format `ssh://[username@]hostname[:port]`.
 
              > **Example**
              >
@@ -367,16 +409,21 @@ public:
 
           If you want the remote machines to use substituters, set [`builders-use-substitutes`](#conf-builders-use-substitutes) to `true`.
         )",
-        {}, false};
+        {},
+        false};
 
     Setting<bool> alwaysAllowSubstitutes{
-        this, false, "always-allow-substitutes",
+        this,
+        false,
+        "always-allow-substitutes",
         R"(
           If set to `true`, Nix ignores the [`allowSubstitutes`](@docroot@/language/advanced-attributes.md) attribute in derivations and always attempt to use [available substituters](#conf-substituters).
         )"};
 
     Setting<bool> buildersUseSubstitutes{
-        this, false, "builders-use-substitutes",
+        this,
+        false,
+        "builders-use-substitutes",
         R"(
           If set to `true`, Nix instructs [remote build machines](#conf-builders) to use their own [`substituters`](#conf-substituters) if available.
 
@@ -384,11 +431,13 @@ public:
           This can drastically reduce build times if the network connection between the local machine and the remote build host is slow.
         )"};
 
-    Setting<off_t> reservedSize{this, 8 * 1024 * 1024, "gc-reserved-space",
-        "Amount of reserved disk space for the garbage collector."};
+    Setting<off_t> reservedSize{
+        this, 8 * 1024 * 1024, "gc-reserved-space", "Amount of reserved disk space for the garbage collector."};
 
     Setting<bool> fsyncMetadata{
-        this, true, "fsync-metadata",
+        this,
+        true,
+        "fsync-metadata",
         R"(
           If set to `true`, changes to the Nix store metadata (in
           `/nix/var/nix/db`) are synchronously flushed to disk. This improves
@@ -396,24 +445,28 @@ public:
           default is `true`.
         )"};
 
-    Setting<bool> fsyncStorePaths{this, false, "fsync-store-paths",
+    Setting<bool> fsyncStorePaths{
+        this,
+        false,
+        "fsync-store-paths",
         R"(
           Whether to call `fsync()` on store paths before registering them, to
           flush them to disk. This improves robustness in case of system crashes,
           but reduces performance. The default is `false`.
         )"};
 
-    Setting<bool> useSQLiteWAL{this, !isWSL1(), "use-sqlite-wal",
-        "Whether SQLite should use WAL mode."};
+    Setting<bool> useSQLiteWAL{this, !isWSL1(), "use-sqlite-wal", "Whether SQLite should use WAL mode."};
 
 #ifndef _WIN32
     // FIXME: remove this option, `fsync-store-paths` is faster.
-    Setting<bool> syncBeforeRegistering{this, false, "sync-before-registering",
-        "Whether to call `sync()` before registering a path as valid."};
+    Setting<bool> syncBeforeRegistering{
+        this, false, "sync-before-registering", "Whether to call `sync()` before registering a path as valid."};
 #endif
 
     Setting<bool> useSubstitutes{
-        this, true, "substitute",
+        this,
+        true,
+        "substitute",
         R"(
           If set to `true` (default), Nix uses binary substitutes if
           available. This option can be disabled to force building from
@@ -422,7 +475,9 @@ public:
         {"build-use-substitutes"}};
 
     Setting<std::string> buildUsersGroup{
-        this, "", "build-users-group",
+        this,
+        "",
+        "build-users-group",
         R"(
           This options specifies the Unix group containing the Nix build user
           accounts. In multi-user Nix installations, builds should not be
@@ -456,37 +511,48 @@ public:
 
           Defaults to `nixbld` when running as root, *empty* otherwise.
         )",
-        {}, false};
+        {},
+        false};
 
-    Setting<bool> autoAllocateUids{this, false, "auto-allocate-uids",
+    Setting<bool> autoAllocateUids{
+        this,
+        false,
+        "auto-allocate-uids",
         R"(
           Whether to select UIDs for builds automatically, instead of using the
           users in `build-users-group`.
 
           UIDs are allocated starting at 872415232 (0x34000000) on Linux and 56930 on macOS.
-        )", {}, true, Xp::AutoAllocateUids};
+        )",
+        {},
+        true,
+        Xp::AutoAllocateUids};
 
-    Setting<uint32_t> startId{this,
-        #ifdef __linux__
+    Setting<uint32_t> startId{
+        this,
+#ifdef __linux__
         0x34000000,
-        #else
+#else
         56930,
-        #endif
+#endif
         "start-id",
         "The first UID and GID to use for dynamic ID allocation."};
 
-    Setting<uint32_t> uidCount{this,
-        #ifdef __linux__
+    Setting<uint32_t> uidCount{
+        this,
+#ifdef __linux__
         maxIdsPerBuild * 128,
-        #else
+#else
         128,
-        #endif
+#endif
         "id-count",
         "The number of UIDs/GIDs to use for dynamic ID allocation."};
 
-    #ifdef __linux__
+#ifdef __linux__
     Setting<bool> useCgroups{
-        this, false, "use-cgroups",
+        this,
+        false,
+        "use-cgroups",
         R"(
           Whether to execute builds inside cgroups.
           This is only supported on Linux.
@@ -494,14 +560,19 @@ public:
           Cgroups are required and enabled automatically for derivations
           that require the `uid-range` system feature.
         )"};
-    #endif
+#endif
 
-    Setting<bool> impersonateLinux26{this, false, "impersonate-linux-26",
+    Setting<bool> impersonateLinux26{
+        this,
+        false,
+        "impersonate-linux-26",
         "Whether to impersonate a Linux 2.6 machine on newer kernels.",
         {"build-impersonate-linux-26"}};
 
     Setting<bool> keepLog{
-        this, true, "keep-build-log",
+        this,
+        true,
+        "keep-build-log",
         R"(
           If set to `true` (the default), Nix writes the build log of a
           derivation (i.e. the standard output and error of its builder) to
@@ -511,7 +582,9 @@ public:
         {"build-keep-log"}};
 
     Setting<bool> compressLog{
-        this, true, "compress-build-log",
+        this,
+        true,
+        "compress-build-log",
         R"(
           If set to `true` (the default), build logs written to
           `/nix/var/log/nix/drvs` are compressed on the fly using bzip2.
@@ -520,7 +593,9 @@ public:
         {"build-compress-log"}};
 
     Setting<unsigned long> maxLogSize{
-        this, 0, "max-build-log-size",
+        this,
+        0,
+        "max-build-log-size",
         R"(
           This option defines the maximum number of bytes that a builder can
           write to its stdout/stderr. If the builder exceeds this limit, it’s
@@ -528,11 +603,12 @@ public:
         )",
         {"build-max-log-size"}};
 
-    Setting<unsigned int> pollInterval{this, 5, "build-poll-interval",
-        "How often (in seconds) to poll for locks."};
+    Setting<unsigned int> pollInterval{this, 5, "build-poll-interval", "How often (in seconds) to poll for locks."};
 
     Setting<bool> gcKeepOutputs{
-        this, false, "keep-outputs",
+        this,
+        false,
+        "keep-outputs",
         R"(
           If `true`, the garbage collector keeps the outputs of
           non-garbage derivations. If `false` (default), outputs are
@@ -548,7 +624,9 @@ public:
         {"gc-keep-outputs"}};
 
     Setting<bool> gcKeepDerivations{
-        this, true, "keep-derivations",
+        this,
+        true,
+        "keep-derivations",
         R"(
           If `true` (default), the garbage collector keeps the derivations
           from which non-garbage store paths were built. If `false`, they are
@@ -564,7 +642,9 @@ public:
         {"gc-keep-derivations"}};
 
     Setting<bool> autoOptimiseStore{
-        this, false, "auto-optimise-store",
+        this,
+        false,
+        "auto-optimise-store",
         R"(
           If set to `true`, Nix automatically detects files in the store
           that have identical contents, and replaces them with hard links to
@@ -574,7 +654,9 @@ public:
         )"};
 
     Setting<bool> envKeepDerivations{
-        this, false, "keep-env-derivations",
+        this,
+        false,
+        "keep-env-derivations",
         R"(
           If `false` (default), derivations are not stored in Nix user
           environments. That is, the derivations of any build-time-only
@@ -596,12 +678,13 @@ public:
 
     Setting<SandboxMode> sandboxMode{
         this,
-        #ifdef __linux__
-          smEnabled
-        #else
-          smDisabled
-        #endif
-        , "sandbox",
+#ifdef __linux__
+        smEnabled
+#else
+        smDisabled
+#endif
+        ,
+        "sandbox",
         R"(
           If set to `true`, builds are performed in a *sandboxed
           environment*, i.e., they’re isolated from the normal file system
@@ -629,8 +712,10 @@ public:
         )",
         {"build-use-chroot", "build-use-sandbox"}};
 
-    Setting<PathSet> sandboxPaths{
-        this, {}, "sandbox-paths",
+    Setting<PathsInChroot> sandboxPaths{
+        this,
+        {},
+        "sandbox-paths",
         R"(
           A list of paths bind-mounted into Nix sandbox environments. You can
           use the syntax `target=source` to mount a path in a different
@@ -648,11 +733,14 @@ public:
         )",
         {"build-chroot-dirs", "build-sandbox-paths"}};
 
-    Setting<bool> sandboxFallback{this, true, "sandbox-fallback",
-        "Whether to disable sandboxing when the kernel doesn't allow it."};
+    Setting<bool> sandboxFallback{
+        this, true, "sandbox-fallback", "Whether to disable sandboxing when the kernel doesn't allow it."};
 
 #ifndef _WIN32
-    Setting<bool> requireDropSupplementaryGroups{this, isRootUser(), "require-drop-supplementary-groups",
+    Setting<bool> requireDropSupplementaryGroups{
+        this,
+        isRootUser(),
+        "require-drop-supplementary-groups",
         R"(
           Following the principle of least privilege,
           Nix attempts to drop supplementary groups when building with sandboxing.
@@ -673,7 +761,9 @@ public:
 
 #ifdef __linux__
     Setting<std::string> sandboxShmSize{
-        this, "50%", "sandbox-dev-shm-size",
+        this,
+        "50%",
+        "sandbox-dev-shm-size",
         R"(
             *Linux only*
 
@@ -685,7 +775,10 @@ public:
 #endif
 
 #if defined(__linux__) || defined(__FreeBSD__)
-    Setting<Path> sandboxBuildDir{this, "/build", "sandbox-build-dir",
+    Setting<Path> sandboxBuildDir{
+        this,
+        "/build",
+        "sandbox-build-dir",
         R"(
             *Linux only*
 
@@ -695,21 +788,32 @@ public:
         )"};
 #endif
 
-    Setting<std::optional<Path>> buildDir{this, std::nullopt, "build-dir",
+    Setting<std::optional<Path>> buildDir{
+        this,
+        std::nullopt,
+        "build-dir",
         R"(
             Override the `build-dir` store setting for all stores that have this setting.
         )"};
 
-    Setting<PathSet> allowedImpureHostPrefixes{this, {}, "allowed-impure-host-deps",
+    Setting<PathSet> allowedImpureHostPrefixes{
+        this,
+        {},
+        "allowed-impure-host-deps",
         "Which prefixes to allow derivations to ask for access to (primarily for Darwin)."};
 
 #ifdef __APPLE__
-    Setting<bool> darwinLogSandboxViolations{this, false, "darwin-log-sandbox-violations",
+    Setting<bool> darwinLogSandboxViolations{
+        this,
+        false,
+        "darwin-log-sandbox-violations",
         "Whether to log Darwin sandbox access violations to the system log."};
 #endif
 
     Setting<bool> runDiffHook{
-        this, false, "run-diff-hook",
+        this,
+        false,
+        "run-diff-hook",
         R"(
           If true, enable the execution of the `diff-hook` program.
 
@@ -719,7 +823,9 @@ public:
         )"};
 
     OptionalPathSetting diffHook{
-        this, std::nullopt, "diff-hook",
+        this,
+        std::nullopt,
+        "diff-hook",
         R"(
           Absolute path to an executable capable of diffing build
           results. The hook is executed if `run-diff-hook` is true, and the
@@ -767,7 +873,9 @@ public:
         {"binary-cache-public-keys"}};
 
     Setting<Strings> secretKeyFiles{
-        this, {}, "secret-key-files",
+        this,
+        {},
+        "secret-key-files",
         R"(
           A whitespace-separated list of files containing secret (private)
           keys. These are used to sign locally-built paths. They can be
@@ -777,7 +885,9 @@ public:
         )"};
 
     Setting<unsigned int> tarballTtl{
-        this, 60 * 60, "tarball-ttl",
+        this,
+        60 * 60,
+        "tarball-ttl",
         R"(
           The number of seconds a downloaded tarball is considered fresh. If
           the cached tarball is stale, Nix checks whether it is still up
@@ -794,7 +904,9 @@ public:
         )"};
 
     Setting<bool> requireSigs{
-        this, true, "require-sigs",
+        this,
+        true,
+        "require-sigs",
         R"(
           If set to `true` (the default), any non-content-addressed path added
           or copied to the Nix store (e.g. when substituting from a binary
@@ -873,7 +985,7 @@ public:
             On Linux, Nix can run builds in a user namespace where they run as root (UID 0) and have 65,536 UIDs available.
             This is primarily useful for running containers such as `systemd-nspawn` inside a Nix build. For an example, see [`tests/systemd-nspawn/nix`][nspawn].
 
-            [nspawn]: https://github.com/NixOS/nix/blob/67bcb99700a0da1395fa063d7c6586740b304598/tests/systemd-nspawn.nix.
+            [nspawn]: https://github.com/NixOS/nix/blob/67bcb99700a0da1395fa063d7c6586740b304598/tests/systemd-nspawn.nix
 
             Included by default on Linux if the [`auto-allocate-uids`](#conf-auto-allocate-uids) setting is enabled.
         )",
@@ -903,7 +1015,9 @@ public:
         {"binary-caches"}};
 
     Setting<StringSet> trustedSubstituters{
-        this, {}, "trusted-substituters",
+        this,
+        {},
+        "trusted-substituters",
         R"(
           A list of [Nix store URLs](@docroot@/store/types/index.md#store-url-format), separated by whitespace.
           These are not used by default, but users of the Nix daemon can enable them by specifying [`substituters`](#conf-substituters).
@@ -913,7 +1027,9 @@ public:
         {"trusted-binary-caches"}};
 
     Setting<unsigned int> ttlNegativeNarInfoCache{
-        this, 3600, "narinfo-cache-negative-ttl",
+        this,
+        3600,
+        "narinfo-cache-negative-ttl",
         R"(
           The TTL in seconds for negative lookups.
           If a store path is queried from a [substituter](#conf-substituters) but was not found, a negative lookup is cached in the local disk cache database for the specified duration.
@@ -929,7 +1045,9 @@ public:
         )"};
 
     Setting<unsigned int> ttlPositiveNarInfoCache{
-        this, 30 * 24 * 3600, "narinfo-cache-positive-ttl",
+        this,
+        30 * 24 * 3600,
+        "narinfo-cache-positive-ttl",
         R"(
           The TTL in seconds for positive lookups. If a store path is queried
           from a substituter, the result of the query is cached in the
@@ -941,11 +1059,13 @@ public:
           mismatch if the build isn't reproducible.
         )"};
 
-    Setting<bool> printMissing{this, true, "print-missing",
-        "Whether to print what paths need to be built or downloaded."};
+    Setting<bool> printMissing{
+        this, true, "print-missing", "Whether to print what paths need to be built or downloaded."};
 
     Setting<std::string> preBuildHook{
-        this, "", "pre-build-hook",
+        this,
+        "",
+        "pre-build-hook",
         R"(
           If set, the path to a program that can set extra derivation-specific
           settings for this system. This is used for settings that can't be
@@ -964,7 +1084,9 @@ public:
         )"};
 
     Setting<std::string> postBuildHook{
-        this, "", "post-build-hook",
+        this,
+        "",
+        "post-build-hook",
         R"(
           Optional. The path to a program to execute after each build.
 
@@ -1008,15 +1130,19 @@ public:
               /nix/store/xfghy8ixrhz3kyy6p724iv3cxji088dx-bash-4.4-p23`.
         )"};
 
-    Setting<unsigned int> downloadSpeed {
-        this, 0, "download-speed",
+    Setting<unsigned int> downloadSpeed{
+        this,
+        0,
+        "download-speed",
         R"(
           Specify the maximum transfer rate in kilobytes per second you want
           Nix to use for downloads.
         )"};
 
     Setting<std::string> netrcFile{
-        this, fmt("%s/%s", nixConfDir, "netrc"), "netrc-file",
+        this,
+        fmt("%s/%s", nixConfDir, "netrc"),
+        "netrc-file",
         R"(
           If set to an absolute path to a `netrc` file, Nix uses the HTTP
           authentication credentials in this file when trying to download from
@@ -1041,7 +1167,9 @@ public:
         )"};
 
     Setting<Path> caFile{
-        this, getDefaultSSLCertFile(), "ssl-cert-file",
+        this,
+        getDefaultSSLCertFile(),
+        "ssl-cert-file",
         R"(
           The path of a file containing CA certificates used to
           authenticate `https://` downloads. Nix by default uses
@@ -1062,7 +1190,9 @@ public:
 
 #ifdef __linux__
     Setting<bool> filterSyscalls{
-        this, true, "filter-syscalls",
+        this,
+        true,
+        "filter-syscalls",
         R"(
           Whether to prevent certain dangerous system calls, such as
           creation of setuid/setgid files or adding ACLs or extended
@@ -1071,7 +1201,9 @@ public:
         )"};
 
     Setting<bool> allowNewPrivileges{
-        this, false, "allow-new-privileges",
+        this,
+        false,
+        "allow-new-privileges",
         R"(
           (Linux-specific.) By default, builders on Linux cannot acquire new
           privileges by calling setuid/setgid programs or programs that have
@@ -1087,7 +1219,9 @@ public:
 
 #if NIX_SUPPORT_ACL
     Setting<StringSet> ignoredAcls{
-        this, {"security.selinux", "system.nfs4_acl", "security.csm"}, "ignored-acls",
+        this,
+        {"security.selinux", "system.nfs4_acl", "security.csm"},
+        "ignored-acls",
         R"(
           A list of ACLs that should be ignored, normally Nix attempts to
           remove all ACLs from files and directories in the Nix store, but
@@ -1097,7 +1231,9 @@ public:
 #endif
 
     Setting<Strings> hashedMirrors{
-        this, {}, "hashed-mirrors",
+        this,
+        {},
+        "hashed-mirrors",
         R"(
           A list of web servers used by `builtins.fetchurl` to obtain files by
           hash. Given a hash algorithm *ha* and a base-16 hash *h*, Nix tries to
@@ -1119,7 +1255,9 @@ public:
         )"};
 
     Setting<uint64_t> minFree{
-        this, 0, "min-free",
+        this,
+        0,
+        "min-free",
         R"(
           When free disk space in `/nix/store` drops below `min-free` during a
           build, Nix performs a garbage-collection until `max-free` bytes are
@@ -1127,25 +1265,28 @@ public:
           disables this feature.
         )"};
 
-    Setting<uint64_t> maxFree{
-        // n.b. this is deliberately int64 max rather than uint64 max because
-        // this goes through the Nix language JSON parser and thus needs to be
-        // representable in Nix language integers.
-        this, std::numeric_limits<int64_t>::max(), "max-free",
-        R"(
+    Setting<uint64_t> maxFree{// n.b. this is deliberately int64 max rather than uint64 max because
+                              // this goes through the Nix language JSON parser and thus needs to be
+                              // representable in Nix language integers.
+                              this,
+                              std::numeric_limits<int64_t>::max(),
+                              "max-free",
+                              R"(
           When a garbage collection is triggered by the `min-free` option, it
           stops as soon as `max-free` bytes are available. The default is
           infinity (i.e. delete all garbage).
         )"};
 
-    Setting<uint64_t> minFreeCheckInterval{this, 5, "min-free-check-interval",
-        "Number of seconds between checking free disk space."};
+    Setting<uint64_t> minFreeCheckInterval{
+        this, 5, "min-free-check-interval", "Number of seconds between checking free disk space."};
 
-    Setting<size_t> narBufferSize{this, 32 * 1024 * 1024, "nar-buffer-size",
-        "Maximum size of NARs before spilling them to disk."};
+    Setting<size_t> narBufferSize{
+        this, 32 * 1024 * 1024, "nar-buffer-size", "Maximum size of NARs before spilling them to disk."};
 
     Setting<bool> allowSymlinkedStore{
-        this, false, "allow-symlinked-store",
+        this,
+        false,
+        "allow-symlinked-store",
         R"(
           If set to `true`, Nix stops complaining if the store directory
           (typically `/nix/store`) contains symlink components.
@@ -1158,7 +1299,9 @@ public:
         )"};
 
     Setting<bool> useXDGBaseDirectories{
-        this, false, "use-xdg-base-directories",
+        this,
+        false,
+        "use-xdg-base-directories",
         R"(
           If set to `true`, Nix conforms to the [XDG Base Directory Specification] for files in `$HOME`.
           The environment variables used to implement this are documented in the [Environment Variables section](@docroot@/command-ref/env-common.md).
@@ -1187,10 +1330,12 @@ public:
           mv $HOME/.nix-defexpr $nix_state_home/defexpr
           mv $HOME/.nix-channels $nix_state_home/channels
           ```
-        )"
-    };
+        )"};
 
-    Setting<StringMap> impureEnv {this, {}, "impure-env",
+    Setting<StringMap> impureEnv{
+        this,
+        {},
+        "impure-env",
         R"(
           A list of items, each in the format of:
 
@@ -1204,10 +1349,9 @@ public:
           fixed-output derivations and in a multi-user Nix installation, or
           setting private access tokens when fetching a private repository.
         )",
-        {}, // aliases
+        {},   // aliases
         true, // document default
-        Xp::ConfigurableImpureEnv
-    };
+        Xp::ConfigurableImpureEnv};
 
     Setting<std::string> upgradeNixStorePathUrl{
         this,
@@ -1216,8 +1360,7 @@ public:
         R"(
           Used by `nix upgrade-nix`, the URL of the file that contains the
           store paths of the latest Nix release.
-        )"
-    };
+        )"};
 
     Setting<uint64_t> warnLargePathThreshold{
         this,
@@ -1228,11 +1371,9 @@ public:
           (as determined by its NAR serialisation).
           Default is 0, which disables the warning.
           Set it to 1 to warn on all paths.
-        )"
-    };
+        )"};
 };
 
-
 // FIXME: don't use a global variable.
 extern Settings settings;
 
@@ -1270,4 +1411,4 @@ void initLibStore(bool loadConfig = true);
  */
 void assertLibStoreInitialized();
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/http-binary-cache-store.hh b/src/libstore/include/nix/store/http-binary-cache-store.hh
index 66ec5f8d2..4102c858f 100644
--- a/src/libstore/include/nix/store/http-binary-cache-store.hh
+++ b/src/libstore/include/nix/store/http-binary-cache-store.hh
@@ -1,3 +1,7 @@
+#pragma once
+///@file
+
+#include "nix/util/url.hh"
 #include "nix/store/binary-cache-store.hh"
 
 namespace nix {
@@ -11,7 +15,7 @@ struct HttpBinaryCacheStoreConfig : std::enable_shared_from_this<HttpBinaryCache
     HttpBinaryCacheStoreConfig(
         std::string_view scheme, std::string_view cacheUri, const Store::Config::Params & params);
 
-    Path cacheUri;
+    ParsedURL cacheUri;
 
     static const std::string name()
     {
@@ -23,6 +27,8 @@ struct HttpBinaryCacheStoreConfig : std::enable_shared_from_this<HttpBinaryCache
     static std::string doc();
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/indirect-root-store.hh b/src/libstore/include/nix/store/indirect-root-store.hh
index bbdad83f3..c39e8ea69 100644
--- a/src/libstore/include/nix/store/indirect-root-store.hh
+++ b/src/libstore/include/nix/store/indirect-root-store.hh
@@ -72,4 +72,4 @@ protected:
     void makeSymlink(const Path & link, const Path & target);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/legacy-ssh-store.hh b/src/libstore/include/nix/store/legacy-ssh-store.hh
index 65f29d649..ac31506d0 100644
--- a/src/libstore/include/nix/store/legacy-ssh-store.hh
+++ b/src/libstore/include/nix/store/legacy-ssh-store.hh
@@ -14,10 +14,7 @@ struct LegacySSHStoreConfig : std::enable_shared_from_this<LegacySSHStoreConfig>
 {
     using CommonSSHStoreConfig::CommonSSHStoreConfig;
 
-    LegacySSHStoreConfig(
-        std::string_view scheme,
-        std::string_view authority,
-        const Params & params);
+    LegacySSHStoreConfig(std::string_view scheme, std::string_view authority, const Params & params);
 
 #ifndef _WIN32
     // Hack for getting remote build log output.
@@ -28,11 +25,10 @@ struct LegacySSHStoreConfig : std::enable_shared_from_this<LegacySSHStoreConfig>
     Descriptor logFD = INVALID_DESCRIPTOR;
 #endif
 
-    const Setting<Strings> remoteProgram{this, {"nix-store"}, "remote-program",
-        "Path to the `nix-store` executable on the remote machine."};
+    const Setting<Strings> remoteProgram{
+        this, {"nix-store"}, "remote-program", "Path to the `nix-store` executable on the remote machine."};
 
-    const Setting<int> maxConnections{this, 1, "max-connections",
-        "Maximum number of concurrent SSH connections."};
+    const Setting<int> maxConnections{this, 1, "max-connections", "Maximum number of concurrent SSH connections."};
 
     /**
      * Hack for hydra
@@ -44,13 +40,21 @@ struct LegacySSHStoreConfig : std::enable_shared_from_this<LegacySSHStoreConfig>
      */
     std::optional<size_t> connPipeSize;
 
-    static const std::string name() { return "SSH Store"; }
+    static const std::string name()
+    {
+        return "SSH Store";
+    }
 
-    static StringSet uriSchemes() { return {"ssh"}; }
+    static StringSet uriSchemes()
+    {
+        return {"ssh"};
+    }
 
     static std::string doc();
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override;
 };
 
 struct LegacySSHStore : public virtual Store
@@ -69,16 +73,12 @@ struct LegacySSHStore : public virtual Store
 
     ref<Connection> openConnection();
 
-    std::string getUri() override;
+    void queryPathInfoUncached(
+        const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
 
-    void queryPathInfoUncached(const StorePath & path,
-        Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
+    std::map<StorePath, UnkeyedValidPathInfo> queryPathInfosUncached(const StorePathSet & paths);
 
-    std::map<StorePath, UnkeyedValidPathInfo> queryPathInfosUncached(
-        const StorePathSet & paths);
-
-    void addToStore(const ValidPathInfo & info, Source & source,
-        RepairFlag repair, CheckSigsFlag checkSigs) override;
+    void addToStore(const ValidPathInfo & info, Source & source, RepairFlag repair, CheckSigsFlag checkSigs) override;
 
     void narFromPath(const StorePath & path, Sink & sink) override;
 
@@ -93,7 +93,9 @@ struct LegacySSHStore : public virtual Store
     void narFromPath(const StorePath & path, std::function<void(Source &)> fun);
 
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override
-    { unsupported("queryPathFromHashPart"); }
+    {
+        unsupported("queryPathFromHashPart");
+    }
 
     StorePath addToStore(
         std::string_view name,
@@ -103,7 +105,9 @@ struct LegacySSHStore : public virtual Store
         const StorePathSet & references,
         PathFilter & filter,
         RepairFlag repair) override
-    { unsupported("addToStore"); }
+    {
+        unsupported("addToStore");
+    }
 
     virtual StorePath addToStoreFromDump(
         Source & dump,
@@ -113,12 +117,13 @@ struct LegacySSHStore : public virtual Store
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) override
-    { unsupported("addToStore"); }
+    {
+        unsupported("addToStore");
+    }
 
 public:
 
-    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
-        BuildMode buildMode) override;
+    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
 
     /**
      * Note, the returned function must only be called once, or we'll
@@ -127,16 +132,20 @@ public:
      * @todo Use C++23 `std::move_only_function`.
      */
     std::function<BuildResult()> buildDerivationAsync(
-        const StorePath & drvPath, const BasicDerivation & drv,
-        const ServeProto::BuildOptions & options);
+        const StorePath & drvPath, const BasicDerivation & drv, const ServeProto::BuildOptions & options);
 
-    void buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
+    void buildPaths(
+        const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
 
     void ensurePath(const StorePath & path) override
-    { unsupported("ensurePath"); }
+    {
+        unsupported("ensurePath");
+    }
 
     virtual ref<SourceAccessor> getFSAccessor(bool requireValidPath) override
-    { unsupported("getFSAccessor"); }
+    {
+        unsupported("getFSAccessor");
+    }
 
     /**
      * The default instance would schedule the work on the client side, but
@@ -147,14 +156,18 @@ public:
      * without it being a breaking change.
      */
     void repairPath(const StorePath & path) override
-    { unsupported("repairPath"); }
+    {
+        unsupported("repairPath");
+    }
 
-    void computeFSClosure(const StorePathSet & paths,
-        StorePathSet & out, bool flipDirection = false,
-        bool includeOutputs = false, bool includeDerivers = false) override;
+    void computeFSClosure(
+        const StorePathSet & paths,
+        StorePathSet & out,
+        bool flipDirection = false,
+        bool includeOutputs = false,
+        bool includeDerivers = false) override;
 
-    StorePathSet queryValidPaths(const StorePathSet & paths,
-        SubstituteFlag maybeSubstitute = NoSubstitute) override;
+    StorePathSet queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute = NoSubstitute) override;
 
     /**
      * Custom variation that atomically creates temp locks on the remote
@@ -164,21 +177,14 @@ public:
      * garbage-collects paths that are already there. Optionally, ask
      * the remote host to substitute missing paths.
      */
-    StorePathSet queryValidPaths(const StorePathSet & paths,
-        bool lock,
-        SubstituteFlag maybeSubstitute = NoSubstitute);
-
-    /**
-     * Just exists because this is exactly what Hydra was doing, and we
-     * don't yet want an algorithmic change.
-     */
-    void addMultipleToStoreLegacy(Store & srcStore, const StorePathSet & paths);
+    StorePathSet queryValidPaths(const StorePathSet & paths, bool lock, SubstituteFlag maybeSubstitute = NoSubstitute);
 
     void connect() override;
 
     unsigned int getProtocol() override;
 
-    struct ConnectionStats {
+    struct ConnectionStats
+    {
         size_t bytesReceived, bytesSent;
     };
 
@@ -192,10 +198,12 @@ public:
      */
     std::optional<TrustedFlag> isTrustedClient() override;
 
-    void queryRealisationUncached(const DrvOutput &,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept override
+    void
+    queryRealisationUncached(const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept override
     // TODO: Implement
-    { unsupported("queryRealisation"); }
+    {
+        unsupported("queryRealisation");
+    }
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/length-prefixed-protocol-helper.hh b/src/libstore/include/nix/store/length-prefixed-protocol-helper.hh
index a83635aa4..035019340 100644
--- a/src/libstore/include/nix/store/length-prefixed-protocol-helper.hh
+++ b/src/libstore/include/nix/store/length-prefixed-protocol-helper.hh
@@ -30,23 +30,24 @@ struct StoreDirConfig;
 template<class Inner, typename T>
 struct LengthPrefixedProtoHelper;
 
-#define LENGTH_PREFIXED_PROTO_HELPER(Inner, T) \
-    struct LengthPrefixedProtoHelper< Inner, T > \
-    { \
-        static T read(const StoreDirConfig & store, typename Inner::ReadConn conn); \
+#define LENGTH_PREFIXED_PROTO_HELPER(Inner, T)                                                          \
+    struct LengthPrefixedProtoHelper<Inner, T>                                                          \
+    {                                                                                                   \
+        static T read(const StoreDirConfig & store, typename Inner::ReadConn conn);                     \
         static void write(const StoreDirConfig & store, typename Inner::WriteConn conn, const T & str); \
-    private: \
-        /*! \
-         * Read this as simply `using S = Inner::Serialise;`. \
-         * \
-         * It would be nice to use that directly, but C++ doesn't seem to allow \
-         * it. The `typename` keyword needed to refer to `Inner` seems to greedy \
-         * (low precedence), and then C++ complains that `Serialise` is not a \
-         * type parameter but a real type. \
-         * \
-         * Making this `S` alias seems to be the only way to avoid these issues. \
-         */ \
-        template<typename U> using S = typename Inner::template Serialise<U>; \
+    private:                                                                                            \
+        /*!                                                                                             \
+         * Read this as simply `using S = Inner::Serialise;`.                                           \
+         *                                                                                              \
+         * It would be nice to use that directly, but C++ doesn't seem to allow                         \
+         * it. The `typename` keyword needed to refer to `Inner` seems to greedy                        \
+         * (low precedence), and then C++ complains that `Serialise` is not a                           \
+         * type parameter but a real type.                                                              \
+         *                                                                                              \
+         * Making this `S` alias seems to be the only way to avoid these issues.                        \
+         */                                                                                             \
+        template<typename U>                                                                            \
+        using S = typename Inner::template Serialise<U>;                                                \
     }
 
 template<class Inner, typename T>
@@ -66,8 +67,7 @@ LENGTH_PREFIXED_PROTO_HELPER(Inner, LENGTH_PREFIXED_PROTO_HELPER_X);
 
 template<class Inner, typename T>
 std::vector<T>
-LengthPrefixedProtoHelper<Inner, std::vector<T>>::read(
-    const StoreDirConfig & store, typename Inner::ReadConn conn)
+LengthPrefixedProtoHelper<Inner, std::vector<T>>::read(const StoreDirConfig & store, typename Inner::ReadConn conn)
 {
     std::vector<T> resSet;
     auto size = readNum<size_t>(conn.from);
@@ -78,8 +78,7 @@ LengthPrefixedProtoHelper<Inner, std::vector<T>>::read(
 }
 
 template<class Inner, typename T>
-void
-LengthPrefixedProtoHelper<Inner, std::vector<T>>::write(
+void LengthPrefixedProtoHelper<Inner, std::vector<T>>::write(
     const StoreDirConfig & store, typename Inner::WriteConn conn, const std::vector<T> & resSet)
 {
     conn.to << resSet.size();
@@ -112,8 +111,7 @@ void LengthPrefixedProtoHelper<Inner, std::set<T, Compare>>::write(
 
 template<class Inner, typename K, typename V>
 std::map<K, V>
-LengthPrefixedProtoHelper<Inner, std::map<K, V>>::read(
-    const StoreDirConfig & store, typename Inner::ReadConn conn)
+LengthPrefixedProtoHelper<Inner, std::map<K, V>>::read(const StoreDirConfig & store, typename Inner::ReadConn conn)
 {
     std::map<K, V> resMap;
     auto size = readNum<size_t>(conn.from);
@@ -126,8 +124,7 @@ LengthPrefixedProtoHelper<Inner, std::map<K, V>>::read(
 }
 
 template<class Inner, typename K, typename V>
-void
-LengthPrefixedProtoHelper<Inner, std::map<K, V>>::write(
+void LengthPrefixedProtoHelper<Inner, std::map<K, V>>::write(
     const StoreDirConfig & store, typename Inner::WriteConn conn, const std::map<K, V> & resMap)
 {
     conn.to << resMap.size();
@@ -139,22 +136,18 @@ LengthPrefixedProtoHelper<Inner, std::map<K, V>>::write(
 
 template<class Inner, typename... Ts>
 std::tuple<Ts...>
-LengthPrefixedProtoHelper<Inner, std::tuple<Ts...>>::read(
-    const StoreDirConfig & store, typename Inner::ReadConn conn)
+LengthPrefixedProtoHelper<Inner, std::tuple<Ts...>>::read(const StoreDirConfig & store, typename Inner::ReadConn conn)
 {
-    return std::tuple<Ts...> {
+    return std::tuple<Ts...>{
         S<Ts>::read(store, conn)...,
     };
 }
 
 template<class Inner, typename... Ts>
-void
-LengthPrefixedProtoHelper<Inner, std::tuple<Ts...>>::write(
+void LengthPrefixedProtoHelper<Inner, std::tuple<Ts...>>::write(
     const StoreDirConfig & store, typename Inner::WriteConn conn, const std::tuple<Ts...> & res)
 {
-    std::apply([&]<typename... Us>(const Us &... args) {
-        (S<Us>::write(store, conn, args), ...);
-    }, res);
+    std::apply([&]<typename... Us>(const Us &... args) { (S<Us>::write(store, conn, args), ...); }, res);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/local-binary-cache-store.hh b/src/libstore/include/nix/store/local-binary-cache-store.hh
index 780eaf480..2846a9225 100644
--- a/src/libstore/include/nix/store/local-binary-cache-store.hh
+++ b/src/libstore/include/nix/store/local-binary-cache-store.hh
@@ -26,6 +26,8 @@ struct LocalBinaryCacheStoreConfig : std::enable_shared_from_this<LocalBinaryCac
     static std::string doc();
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/local-fs-store.hh b/src/libstore/include/nix/store/local-fs-store.hh
index d5fafb0c6..84777f3d7 100644
--- a/src/libstore/include/nix/store/local-fs-store.hh
+++ b/src/libstore/include/nix/store/local-fs-store.hh
@@ -20,29 +20,41 @@ struct LocalFSStoreConfig : virtual StoreConfig
      */
     LocalFSStoreConfig(PathView path, const Params & params);
 
-    OptionalPathSetting rootDir{this, std::nullopt,
-        "root",
-        "Directory prefixed to all other paths."};
+    OptionalPathSetting rootDir{this, std::nullopt, "root", "Directory prefixed to all other paths."};
 
-    PathSetting stateDir{this,
-        rootDir.get() ? *rootDir.get() + "/nix/var/nix" : settings.nixStateDir,
+private:
+
+    /**
+     * An indirection so that we don't need to refer to global settings
+     * in headers.
+     */
+    static Path getDefaultStateDir();
+
+    /**
+     * An indirection so that we don't need to refer to global settings
+     * in headers.
+     */
+    static Path getDefaultLogDir();
+
+public:
+
+    PathSetting stateDir{
+        this,
+        rootDir.get() ? *rootDir.get() + "/nix/var/nix" : getDefaultStateDir(),
         "state",
         "Directory where Nix stores state."};
 
-    PathSetting logDir{this,
-        rootDir.get() ? *rootDir.get() + "/nix/var/log/nix" : settings.nixLogDir,
+    PathSetting logDir{
+        this,
+        rootDir.get() ? *rootDir.get() + "/nix/var/log/nix" : getDefaultLogDir(),
         "log",
         "directory where Nix stores log files."};
 
-    PathSetting realStoreDir{this,
-        rootDir.get() ? *rootDir.get() + "/nix/store" : storeDir, "real",
-        "Physical path of the Nix store."};
+    PathSetting realStoreDir{
+        this, rootDir.get() ? *rootDir.get() + "/nix/store" : storeDir, "real", "Physical path of the Nix store."};
 };
 
-struct LocalFSStore :
-    virtual Store,
-    virtual GcStore,
-    virtual LogStore
+struct LocalFSStore : virtual Store, virtual GcStore, virtual LogStore
 {
     using Config = LocalFSStoreConfig;
 
@@ -73,7 +85,10 @@ struct LocalFSStore :
      */
     virtual Path addPermRoot(const StorePath & storePath, const Path & gcRoot) = 0;
 
-    virtual Path getRealStoreDir() { return config.realStoreDir; }
+    virtual Path getRealStoreDir()
+    {
+        return config.realStoreDir;
+    }
 
     Path toRealPath(const Path & storePath) override
     {
@@ -82,7 +97,6 @@ struct LocalFSStore :
     }
 
     std::optional<std::string> getBuildLogExact(const StorePath & path) override;
-
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/local-overlay-store.hh b/src/libstore/include/nix/store/local-overlay-store.hh
index 6077d9e53..b89d0a1a0 100644
--- a/src/libstore/include/nix/store/local-overlay-store.hh
+++ b/src/libstore/include/nix/store/local-overlay-store.hh
@@ -9,7 +9,8 @@ struct LocalOverlayStoreConfig : virtual LocalStoreConfig
 {
     LocalOverlayStoreConfig(const StringMap & params)
         : LocalOverlayStoreConfig("local-overlay", "", params)
-    { }
+    {
+    }
 
     LocalOverlayStoreConfig(std::string_view scheme, PathView path, const Params & params)
         : StoreConfig(params)
@@ -18,7 +19,10 @@ struct LocalOverlayStoreConfig : virtual LocalStoreConfig
     {
     }
 
-    const Setting<std::string> lowerStoreUri{(StoreConfig*) this, "", "lower-store",
+    const Setting<std::string> lowerStoreUri{
+        (StoreConfig *) this,
+        "",
+        "lower-store",
         R"(
           [Store URL](@docroot@/command-ref/new-cli/nix3-help-stores.md#store-url-format)
           for the lower store. The default is `auto` (i.e. use the Nix daemon or `/nix/store` directly).
@@ -27,12 +31,18 @@ struct LocalOverlayStoreConfig : virtual LocalStoreConfig
           Must be used as OverlayFS lower layer for this store's store dir.
         )"};
 
-    const PathSetting upperLayer{(StoreConfig*) this, "", "upper-layer",
+    const PathSetting upperLayer{
+        (StoreConfig *) this,
+        "",
+        "upper-layer",
         R"(
           Directory containing the OverlayFS upper layer for this store's store dir.
         )"};
 
-    Setting<bool> checkMount{(StoreConfig*) this, true, "check-mount",
+    Setting<bool> checkMount{
+        (StoreConfig *) this,
+        true,
+        "check-mount",
         R"(
           Check that the overlay filesystem is correctly mounted.
 
@@ -43,7 +53,10 @@ struct LocalOverlayStoreConfig : virtual LocalStoreConfig
           default, but can be disabled if needed.
         )"};
 
-    const PathSetting remountHook{(StoreConfig*) this, "", "remount-hook",
+    const PathSetting remountHook{
+        (StoreConfig *) this,
+        "",
+        "remount-hook",
         R"(
           Script or other executable to run when overlay filesystem needs remounting.
 
@@ -56,7 +69,10 @@ struct LocalOverlayStoreConfig : virtual LocalStoreConfig
           The store directory is passed as an argument to the invoked executable.
         )"};
 
-    static const std::string name() { return "Experimental Local Overlay Store"; }
+    static const std::string name()
+    {
+        return "Experimental Local Overlay Store";
+    }
 
     static std::optional<ExperimentalFeature> experimentalFeature()
     {
@@ -65,13 +81,15 @@ struct LocalOverlayStoreConfig : virtual LocalStoreConfig
 
     static StringSet uriSchemes()
     {
-        return { "local-overlay" };
+        return {"local-overlay"};
     }
 
     static std::string doc();
 
     ref<Store> openStore() const override;
 
+    StoreReference getReference() const override;
+
 protected:
     /**
      * @return The host OS path corresponding to the store path for the
@@ -100,11 +118,6 @@ struct LocalOverlayStore : virtual LocalStore
 
     LocalOverlayStore(ref<const Config>);
 
-    std::string getUri() override
-    {
-        return "local-overlay://";
-    }
-
 private:
     /**
      * The store beneath us.
@@ -124,8 +137,8 @@ private:
     /**
      * Check lower store if upper DB does not have.
      */
-    void queryPathInfoUncached(const StorePath & path,
-        Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
+    void queryPathInfoUncached(
+        const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
 
     /**
      * Check lower store if upper DB does not have.
@@ -159,8 +172,8 @@ private:
     /**
      * Check lower store if upper DB does not have.
      */
-    void queryRealisationUncached(const DrvOutput&,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
+    void queryRealisationUncached(
+        const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
 
     /**
      * Call `remountIfNecessary` after collecting garbage normally.
@@ -217,4 +230,4 @@ private:
     std::atomic_bool _remountRequired = false;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/local-store.hh b/src/libstore/include/nix/store/local-store.hh
index abaf1b981..b871aaee2 100644
--- a/src/libstore/include/nix/store/local-store.hh
+++ b/src/libstore/include/nix/store/local-store.hh
@@ -11,12 +11,10 @@
 #include <chrono>
 #include <future>
 #include <string>
-#include <unordered_set>
-
+#include <boost/unordered/unordered_flat_set.hpp>
 
 namespace nix {
 
-
 /**
  * Nix store and database schema version.
  *
@@ -27,7 +25,6 @@ namespace nix {
  */
 const int nixSchemaVersion = 10;
 
-
 struct OptimiseStats
 {
     unsigned long filesLinked = 0;
@@ -41,7 +38,10 @@ private:
     /**
       Input for computing the build directory. See `getBuildDir()`.
      */
-     Setting<std::optional<Path>> buildDir{this, std::nullopt, "build-dir",
+    Setting<std::optional<Path>> buildDir{
+        this,
+        std::nullopt,
+        "build-dir",
         R"(
             The directory on the host, in which derivations' temporary build directories are created.
 
@@ -66,21 +66,32 @@ public:
     Path getBuildDir() const;
 };
 
-struct LocalStoreConfig : std::enable_shared_from_this<LocalStoreConfig>, virtual LocalFSStoreConfig, virtual LocalBuildStoreConfig
+struct LocalStoreConfig : std::enable_shared_from_this<LocalStoreConfig>,
+                          virtual LocalFSStoreConfig,
+                          virtual LocalBuildStoreConfig
 {
     using LocalFSStoreConfig::LocalFSStoreConfig;
 
-    LocalStoreConfig(
-        std::string_view scheme,
-        std::string_view authority,
-        const Params & params);
+    LocalStoreConfig(std::string_view scheme, std::string_view authority, const Params & params);
 
-    Setting<bool> requireSigs{this,
-        settings.requireSigs,
+private:
+
+    /**
+     * An indirection so that we don't need to refer to global settings
+     * in headers.
+     */
+    bool getDefaultRequireSigs();
+
+public:
+
+    Setting<bool> requireSigs{
+        this,
+        getDefaultRequireSigs(),
         "require-sigs",
         "Whether store paths copied into this store should have a trusted signature."};
 
-    Setting<bool> readOnly{this,
+    Setting<bool> readOnly{
+        this,
         false,
         "read-only",
         R"(
@@ -97,19 +108,24 @@ struct LocalStoreConfig : std::enable_shared_from_this<LocalStoreConfig>, virtua
           > While the filesystem the database resides on might appear to be read-only, consider whether another user or system might have write access to it.
         )"};
 
-    static const std::string name() { return "Local Store"; }
+    static const std::string name()
+    {
+        return "Local Store";
+    }
 
     static StringSet uriSchemes()
-    { return {"local"}; }
+    {
+        return {"local"};
+    }
 
     static std::string doc();
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override;
 };
 
-class LocalStore :
-    public virtual IndirectRootStore,
-    public virtual GcStore
+class LocalStore : public virtual IndirectRootStore, public virtual GcStore
 {
 public:
 
@@ -158,7 +174,11 @@ private:
         std::unique_ptr<PublicKeys> publicKeys;
     };
 
-    Sync<State> _state;
+    /**
+     * Mutable state. It's behind a `ref` to reduce false sharing
+     * between immutable and mutable fields.
+     */
+    ref<Sync<State>> _state;
 
 public:
 
@@ -192,33 +212,30 @@ public:
      * Implementations of abstract store API methods.
      */
 
-    std::string getUri() override;
-
     bool isValidPathUncached(const StorePath & path) override;
 
-    StorePathSet queryValidPaths(const StorePathSet & paths,
-        SubstituteFlag maybeSubstitute = NoSubstitute) override;
+    StorePathSet queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute = NoSubstitute) override;
 
     StorePathSet queryAllValidPaths() override;
 
-    void queryPathInfoUncached(const StorePath & path,
-        Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
+    void queryPathInfoUncached(
+        const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
 
     void queryReferrers(const StorePath & path, StorePathSet & referrers) override;
 
     StorePathSet queryValidDerivers(const StorePath & path) override;
 
-    std::map<std::string, std::optional<StorePath>> queryStaticPartialDerivationOutputMap(const StorePath & path) override;
+    std::map<std::string, std::optional<StorePath>>
+    queryStaticPartialDerivationOutputMap(const StorePath & path) override;
 
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override;
 
     StorePathSet querySubstitutablePaths(const StorePathSet & paths) override;
 
     bool pathInfoIsUntrusted(const ValidPathInfo &) override;
-    bool realisationIsUntrusted(const Realisation & ) override;
+    bool realisationIsUntrusted(const Realisation &) override;
 
-    void addToStore(const ValidPathInfo & info, Source & source,
-        RepairFlag repair, CheckSigsFlag checkSigs) override;
+    void addToStore(const ValidPathInfo & info, Source & source, RepairFlag repair, CheckSigsFlag checkSigs) override;
 
     StorePath addToStoreFromDump(
         Source & dump,
@@ -312,7 +329,8 @@ protected:
     /**
      * Result of `verifyAllValidPaths`
      */
-    struct VerificationResult {
+    struct VerificationResult
+    {
         /**
          * Whether any errors were encountered
          */
@@ -365,22 +383,24 @@ public:
     void registerDrvOutput(const Realisation & info) override;
     void registerDrvOutput(const Realisation & info, CheckSigsFlag checkSigs) override;
     void cacheDrvOutputMapping(
-        State & state,
-        const uint64_t deriver,
-        const std::string & outputName,
-        const StorePath & output);
+        State & state, const uint64_t deriver, const std::string & outputName, const StorePath & output);
 
     std::optional<const Realisation> queryRealisation_(State & state, const DrvOutput & id);
     std::optional<std::pair<int64_t, Realisation>> queryRealisationCore_(State & state, const DrvOutput & id);
-    void queryRealisationUncached(const DrvOutput&,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
+    void queryRealisationUncached(
+        const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
 
     std::optional<std::string> getVersion() override;
 
 protected:
 
-    void verifyPath(const StorePath & path, std::function<bool(const StorePath &)> existsInStoreDir,
-        StorePathSet & done, StorePathSet & validPaths, RepairFlag repair, bool & errors);
+    void verifyPath(
+        const StorePath & path,
+        std::function<bool(const StorePath &)> existsInStoreDir,
+        StorePathSet & done,
+        StorePathSet & validPaths,
+        RepairFlag repair,
+        bool & errors);
 
 private:
 
@@ -422,11 +442,12 @@ private:
 
     std::pair<std::filesystem::path, AutoCloseFD> createTempDirInStore();
 
-    typedef std::unordered_set<ino_t> InodeHash;
+    typedef boost::unordered_flat_set<ino_t> InodeHash;
 
     InodeHash loadInodeHash();
     Strings readDirectoryIgnoringInodes(const Path & path, const InodeHash & inodeHash);
-    void optimisePath_(Activity * act, OptimiseStats & stats, const Path & path, InodeHash & inodeHash, RepairFlag repair);
+    void
+    optimisePath_(Activity * act, OptimiseStats & stats, const Path & path, InodeHash & inodeHash, RepairFlag repair);
 
     // Internal versions that are not wrapped in retry_sqlite.
     bool isValidPath_(State & state, const StorePath & path);
@@ -438,4 +459,4 @@ private:
     friend struct DerivationGoal;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/log-store.hh b/src/libstore/include/nix/store/log-store.hh
index fc12b0c47..2d81d02b1 100644
--- a/src/libstore/include/nix/store/log-store.hh
+++ b/src/libstore/include/nix/store/log-store.hh
@@ -3,7 +3,6 @@
 
 #include "nix/store/store-api.hh"
 
-
 namespace nix {
 
 struct LogStore : public virtual Store
@@ -23,4 +22,4 @@ struct LogStore : public virtual Store
     static LogStore & require(Store & store);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/machines.hh b/src/libstore/include/nix/store/machines.hh
index 2bf7408f6..1f7bb669a 100644
--- a/src/libstore/include/nix/store/machines.hh
+++ b/src/libstore/include/nix/store/machines.hh
@@ -12,7 +12,8 @@ struct Machine;
 
 typedef std::vector<Machine> Machines;
 
-struct Machine {
+struct Machine
+{
 
     const StoreReference storeUri;
     const StringSet systemTypes;
@@ -85,4 +86,4 @@ struct Machine {
  */
 Machines getMachines();
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/make-content-addressed.hh b/src/libstore/include/nix/store/make-content-addressed.hh
index 3881b6d40..09e7dd98a 100644
--- a/src/libstore/include/nix/store/make-content-addressed.hh
+++ b/src/libstore/include/nix/store/make-content-addressed.hh
@@ -7,18 +7,12 @@ namespace nix {
 
 /** Rewrite a closure of store paths to be completely content addressed.
  */
-std::map<StorePath, StorePath> makeContentAddressed(
-    Store & srcStore,
-    Store & dstStore,
-    const StorePathSet & rootPaths);
+std::map<StorePath, StorePath> makeContentAddressed(Store & srcStore, Store & dstStore, const StorePathSet & rootPaths);
 
 /** Rewrite a closure of a store path to be completely content addressed.
  *
  * This is a convenience function for the case where you only have one root path.
  */
-StorePath makeContentAddressed(
-    Store & srcStore,
-    Store & dstStore,
-    const StorePath & rootPath);
+StorePath makeContentAddressed(Store & srcStore, Store & dstStore, const StorePath & rootPath);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/meson.build b/src/libstore/include/nix/store/meson.build
index 44d9815de..60af5ff53 100644
--- a/src/libstore/include/nix/store/meson.build
+++ b/src/libstore/include/nix/store/meson.build
@@ -9,12 +9,14 @@ config_pub_h = configure_file(
   output : 'config.hh',
 )
 
-headers = [config_pub_h] + files(
+headers = [ config_pub_h ] + files(
   'binary-cache-store.hh',
   'build-result.hh',
-  'build/derivation-goal.hh',
+  'build/derivation-builder.hh',
   'build/derivation-building-goal.hh',
   'build/derivation-building-misc.hh',
+  'build/derivation-env-desugar.hh',
+  'build/derivation-goal.hh',
   'build/derivation-trampoline-goal.hh',
   'build/drv-output-substitution-goal.hh',
   'build/goal.hh',
@@ -27,11 +29,12 @@ headers = [config_pub_h] + files(
   'common-ssh-store-config.hh',
   'content-address.hh',
   'daemon.hh',
-  'derivations.hh',
   'derivation-options.hh',
+  'derivations.hh',
   'derived-path-map.hh',
   'derived-path.hh',
   'downstream-placeholder.hh',
+  'export-import.hh',
   'filetransfer.hh',
   'gc-store.hh',
   'globals.hh',
@@ -62,6 +65,7 @@ headers = [config_pub_h] + files(
   'posix-fs-canonicalise.hh',
   'profiles.hh',
   'realisation.hh',
+  'references.hh',
   'remote-fs-accessor.hh',
   'remote-store-connection.hh',
   'remote-store.hh',
diff --git a/src/libstore/include/nix/store/names.hh b/src/libstore/include/nix/store/names.hh
index ab315de63..23d935270 100644
--- a/src/libstore/include/nix/store/names.hh
+++ b/src/libstore/include/nix/store/names.hh
@@ -28,9 +28,8 @@ private:
 
 typedef std::list<DrvName> DrvNames;
 
-std::string_view nextComponent(std::string_view::const_iterator & p,
-    const std::string_view::const_iterator end);
+std::string_view nextComponent(std::string_view::const_iterator & p, const std::string_view::const_iterator end);
 std::strong_ordering compareVersions(const std::string_view v1, const std::string_view v2);
 DrvNames drvNamesFromArgs(const Strings & opArgs);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/nar-accessor.hh b/src/libstore/include/nix/store/nar-accessor.hh
index 199d525cb..0e69d436e 100644
--- a/src/libstore/include/nix/store/nar-accessor.hh
+++ b/src/libstore/include/nix/store/nar-accessor.hh
@@ -27,9 +27,7 @@ ref<SourceAccessor> makeNarAccessor(Source & source);
  */
 using GetNarBytes = std::function<std::string(uint64_t, uint64_t)>;
 
-ref<SourceAccessor> makeLazyNarAccessor(
-    const std::string & listing,
-    GetNarBytes getNarBytes);
+ref<SourceAccessor> makeLazyNarAccessor(const std::string & listing, GetNarBytes getNarBytes);
 
 /**
  * Write a JSON representation of the contents of a NAR (except file
@@ -37,4 +35,4 @@ ref<SourceAccessor> makeLazyNarAccessor(
  */
 nlohmann::json listNar(ref<SourceAccessor> accessor, const CanonPath & path, bool recurse);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/nar-info-disk-cache.hh b/src/libstore/include/nix/store/nar-info-disk-cache.hh
index a7fde1fbf..253487b30 100644
--- a/src/libstore/include/nix/store/nar-info-disk-cache.hh
+++ b/src/libstore/include/nix/store/nar-info-disk-cache.hh
@@ -12,10 +12,9 @@ class NarInfoDiskCache
 public:
     typedef enum { oValid, oInvalid, oUnknown } Outcome;
 
-    virtual ~NarInfoDiskCache() { }
+    virtual ~NarInfoDiskCache() {}
 
-    virtual int createCache(const std::string & uri, const Path & storeDir,
-        bool wantMassQuery, int priority) = 0;
+    virtual int createCache(const std::string & uri, const Path & storeDir, bool wantMassQuery, int priority) = 0;
 
     struct CacheInfo
     {
@@ -26,21 +25,16 @@ public:
 
     virtual std::optional<CacheInfo> upToDateCacheExists(const std::string & uri) = 0;
 
-    virtual std::pair<Outcome, std::shared_ptr<NarInfo>> lookupNarInfo(
-        const std::string & uri, const std::string & hashPart) = 0;
+    virtual std::pair<Outcome, std::shared_ptr<NarInfo>>
+    lookupNarInfo(const std::string & uri, const std::string & hashPart) = 0;
 
-    virtual void upsertNarInfo(
-        const std::string & uri, const std::string & hashPart,
-        std::shared_ptr<const ValidPathInfo> info) = 0;
+    virtual void
+    upsertNarInfo(const std::string & uri, const std::string & hashPart, std::shared_ptr<const ValidPathInfo> info) = 0;
 
-    virtual void upsertRealisation(
-        const std::string & uri,
-        const Realisation & realisation) = 0;
-    virtual void upsertAbsentRealisation(
-        const std::string & uri,
-        const DrvOutput & id) = 0;
-    virtual std::pair<Outcome, std::shared_ptr<Realisation>> lookupRealisation(
-        const std::string & uri, const DrvOutput & id) = 0;
+    virtual void upsertRealisation(const std::string & uri, const Realisation & realisation) = 0;
+    virtual void upsertAbsentRealisation(const std::string & uri, const DrvOutput & id) = 0;
+    virtual std::pair<Outcome, std::shared_ptr<Realisation>>
+    lookupRealisation(const std::string & uri, const DrvOutput & id) = 0;
 };
 
 /**
@@ -51,4 +45,4 @@ ref<NarInfoDiskCache> getNarInfoDiskCache();
 
 ref<NarInfoDiskCache> getTestNarInfoDiskCache(Path dbPath);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/nar-info.hh b/src/libstore/include/nix/store/nar-info.hh
index d66b6e058..1684837c6 100644
--- a/src/libstore/include/nix/store/nar-info.hh
+++ b/src/libstore/include/nix/store/nar-info.hh
@@ -7,7 +7,7 @@
 
 namespace nix {
 
-class Store;
+struct StoreDirConfig;
 
 struct NarInfo : ValidPathInfo
 {
@@ -17,27 +17,33 @@ struct NarInfo : ValidPathInfo
     uint64_t fileSize = 0;
 
     NarInfo() = delete;
-    NarInfo(const Store & store, std::string name, ContentAddressWithReferences ca, Hash narHash)
-        : ValidPathInfo(store, std::move(name), std::move(ca), narHash)
-    { }
-    NarInfo(StorePath path, Hash narHash) : ValidPathInfo(std::move(path), narHash) { }
-    NarInfo(const ValidPathInfo & info) : ValidPathInfo(info) { }
-    NarInfo(const Store & store, const std::string & s, const std::string & whence);
 
-    bool operator ==(const NarInfo &) const = default;
+    NarInfo(ValidPathInfo info)
+        : ValidPathInfo{std::move(info)}
+    {
+    }
+
+    NarInfo(StorePath path, Hash narHash)
+        : NarInfo{ValidPathInfo{std::move(path), UnkeyedValidPathInfo(narHash)}}
+    {
+    }
+
+    static NarInfo
+    makeFromCA(const StoreDirConfig & store, std::string_view name, ContentAddressWithReferences ca, Hash narHash)
+    {
+        return ValidPathInfo::makeFromCA(store, std::move(name), std::move(ca), narHash);
+    }
+
+    NarInfo(const StoreDirConfig & store, const std::string & s, const std::string & whence);
+
+    bool operator==(const NarInfo &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::optional::operator <=>`, can't do yet
-    //auto operator <=>(const NarInfo &) const = default;
+    // auto operator <=>(const NarInfo &) const = default;
 
-    std::string to_string(const Store & store) const;
+    std::string to_string(const StoreDirConfig & store) const;
 
-    nlohmann::json toJSON(
-        const Store & store,
-        bool includeImpureInfo,
-        HashFormat hashFormat) const override;
-    static NarInfo fromJSON(
-        const Store & store,
-        const StorePath & path,
-        const nlohmann::json & json);
+    nlohmann::json toJSON(const StoreDirConfig & store, bool includeImpureInfo, HashFormat hashFormat) const override;
+    static NarInfo fromJSON(const StoreDirConfig & store, const StorePath & path, const nlohmann::json & json);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/outputs-spec.hh b/src/libstore/include/nix/store/outputs-spec.hh
index 4e874a6f1..5482c0e24 100644
--- a/src/libstore/include/nix/store/outputs-spec.hh
+++ b/src/libstore/include/nix/store/outputs-spec.hh
@@ -23,11 +23,13 @@ typedef std::string OutputName;
  */
 typedef std::string_view OutputNameView;
 
-struct OutputsSpec {
+struct OutputsSpec
+{
     /**
      * A non-empty set of outputs, specified by name
      */
-    struct Names : std::set<OutputName, std::less<>> {
+    struct Names : std::set<OutputName, std::less<>>
+    {
     private:
         using BaseType = std::set<OutputName, std::less<>>;
 
@@ -38,14 +40,18 @@ struct OutputsSpec {
 
         Names(const BaseType & s)
             : BaseType(s)
-        { assert(!empty()); }
+        {
+            assert(!empty());
+        }
 
         /**
          * Needs to be "inherited manually"
          */
         Names(BaseType && s)
             : BaseType(std::move(s))
-        { assert(!empty()); }
+        {
+            assert(!empty());
+        }
 
         /* This set should always be non-empty, so we delete this
            constructor in order make creating empty ones by mistake harder.
@@ -56,15 +62,18 @@ struct OutputsSpec {
     /**
      * The set of all outputs, without needing to name them explicitly
      */
-    struct All : std::monostate { };
+    struct All : std::monostate
+    {};
 
     typedef std::variant<All, Names> Raw;
 
     Raw raw;
 
-    bool operator == (const OutputsSpec &) const = default;
+    bool operator==(const OutputsSpec &) const = default;
+
     // TODO libc++ 16 (used by darwin) missing `std::set::operator <=>`, can't do yet.
-    bool operator < (const OutputsSpec & other) const {
+    bool operator<(const OutputsSpec & other) const
+    {
         return raw < other.raw;
     }
 
@@ -97,17 +106,20 @@ struct OutputsSpec {
     std::string to_string() const;
 };
 
-struct ExtendedOutputsSpec {
-    struct Default : std::monostate { };
+struct ExtendedOutputsSpec
+{
+    struct Default : std::monostate
+    {};
+
     using Explicit = OutputsSpec;
 
     typedef std::variant<Default, Explicit> Raw;
 
     Raw raw;
 
-    bool operator == (const ExtendedOutputsSpec &) const = default;
+    bool operator==(const ExtendedOutputsSpec &) const = default;
     // TODO libc++ 16 (used by darwin) missing `std::set::operator <=>`, can't do yet.
-    bool operator < (const ExtendedOutputsSpec &) const;
+    bool operator<(const ExtendedOutputsSpec &) const;
 
     MAKE_WRAPPER_CONSTRUCTOR(ExtendedOutputsSpec);
 
@@ -126,7 +138,7 @@ struct ExtendedOutputsSpec {
     std::string to_string() const;
 };
 
-}
+} // namespace nix
 
 JSON_IMPL(OutputsSpec)
 JSON_IMPL(ExtendedOutputsSpec)
diff --git a/src/libstore/include/nix/store/parsed-derivations.hh b/src/libstore/include/nix/store/parsed-derivations.hh
index a7c053a8f..edef1b2d2 100644
--- a/src/libstore/include/nix/store/parsed-derivations.hh
+++ b/src/libstore/include/nix/store/parsed-derivations.hh
@@ -16,9 +16,34 @@ typedef std::map<std::string, DerivationOutput> DerivationOutputs;
 
 struct StructuredAttrs
 {
+    static constexpr std::string_view envVarName{"__json"};
+
     nlohmann::json structuredAttrs;
 
-    static std::optional<StructuredAttrs> tryParse(const StringPairs & env);
+    bool operator==(const StructuredAttrs &) const = default;
+
+    /**
+     * Unconditionally parse from a JSON string. Used by `tryExtract`.
+     */
+    static StructuredAttrs parse(std::string_view encoded);
+
+    /**
+     * Like `tryParse`, but removes the env var which encoded the structured
+     * attrs from the map if one is found.
+     */
+    static std::optional<StructuredAttrs> tryExtract(StringPairs & env);
+
+    /**
+     * Opposite of `tryParse`, at least if one makes a map from this
+     * single key-value PR.
+     */
+    std::pair<std::string_view, std::string> unparse() const;
+
+    /**
+     * Ensures that the structured attrs "env var" is not in used, so we
+     * are free to use it instead.
+     */
+    static void checkKeyNotInUse(const StringPairs & env);
 
     nlohmann::json prepareStructuredAttrs(
         Store & store,
@@ -40,4 +65,4 @@ struct StructuredAttrs
     static std::string writeShell(const nlohmann::json & prepared);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/path-info.hh b/src/libstore/include/nix/store/path-info.hh
index 690f0f813..cbc5abdb4 100644
--- a/src/libstore/include/nix/store/path-info.hh
+++ b/src/libstore/include/nix/store/path-info.hh
@@ -11,9 +11,8 @@
 
 namespace nix {
 
-
 class Store;
-
+struct StoreDirConfig;
 
 struct SubstitutablePathInfo
 {
@@ -31,7 +30,6 @@ struct SubstitutablePathInfo
 
 using SubstitutablePathInfos = std::map<StorePath, SubstitutablePathInfo>;
 
-
 /**
  * Information about a store object.
  *
@@ -103,35 +101,32 @@ struct UnkeyedValidPathInfo
 
     UnkeyedValidPathInfo(const UnkeyedValidPathInfo & other) = default;
 
-    UnkeyedValidPathInfo(Hash narHash) : narHash(narHash) { };
+    UnkeyedValidPathInfo(Hash narHash)
+        : narHash(narHash) {};
 
-    bool operator == (const UnkeyedValidPathInfo &) const noexcept;
+    bool operator==(const UnkeyedValidPathInfo &) const noexcept;
 
     /**
      * @todo return `std::strong_ordering` once `id` is removed
      */
-    std::weak_ordering operator <=> (const UnkeyedValidPathInfo &) const noexcept;
+    std::weak_ordering operator<=>(const UnkeyedValidPathInfo &) const noexcept;
 
-    virtual ~UnkeyedValidPathInfo() { }
+    virtual ~UnkeyedValidPathInfo() {}
 
     /**
      * @param includeImpureInfo If true, variable elements such as the
      * registration time are included.
      */
-    virtual nlohmann::json toJSON(
-        const Store & store,
-        bool includeImpureInfo,
-        HashFormat hashFormat) const;
-    static UnkeyedValidPathInfo fromJSON(
-        const Store & store,
-        const nlohmann::json & json);
+    virtual nlohmann::json toJSON(const StoreDirConfig & store, bool includeImpureInfo, HashFormat hashFormat) const;
+    static UnkeyedValidPathInfo fromJSON(const StoreDirConfig & store, const nlohmann::json & json);
 };
 
-struct ValidPathInfo : UnkeyedValidPathInfo {
+struct ValidPathInfo : UnkeyedValidPathInfo
+{
     StorePath path;
 
-    bool operator == (const ValidPathInfo &) const = default;
-    auto operator <=> (const ValidPathInfo &) const = default;
+    bool operator==(const ValidPathInfo &) const = default;
+    auto operator<=>(const ValidPathInfo &) const = default;
 
     /**
      * Return a fingerprint of the store path to be used in binary
@@ -141,7 +136,7 @@ struct ValidPathInfo : UnkeyedValidPathInfo {
      * speaking superfluous, but might prevent endless/excessive data
      * attacks.
      */
-    std::string fingerprint(const Store & store) const;
+    std::string fingerprint(const StoreDirConfig & store) const;
 
     void sign(const Store & store, const Signer & signer);
     void sign(const Store & store, const std::vector<std::unique_ptr<Signer>> & signers);
@@ -156,7 +151,7 @@ struct ValidPathInfo : UnkeyedValidPathInfo {
     /**
      * @return true iff the path is verifiably content-addressed.
      */
-    bool isContentAddressed(const Store & store) const;
+    bool isContentAddressed(const StoreDirConfig & store) const;
 
     static const size_t maxSigs = std::numeric_limits<size_t>::max();
 
@@ -165,23 +160,27 @@ struct ValidPathInfo : UnkeyedValidPathInfo {
      * produced by one of the specified keys, or maxSigs if the path
      * is content-addressed.
      */
-    size_t checkSignatures(const Store & store, const PublicKeys & publicKeys) const;
+    size_t checkSignatures(const StoreDirConfig & store, const PublicKeys & publicKeys) const;
 
     /**
      * Verify a single signature.
      */
-    bool checkSignature(const Store & store, const PublicKeys & publicKeys, const std::string & sig) const;
+    bool checkSignature(const StoreDirConfig & store, const PublicKeys & publicKeys, const std::string & sig) const;
 
     /**
      * References as store path basenames, including a self reference if it has one.
      */
     Strings shortRefs() const;
 
-    ValidPathInfo(StorePath && path, UnkeyedValidPathInfo info) : UnkeyedValidPathInfo(info), path(std::move(path)) { };
-    ValidPathInfo(const StorePath & path, UnkeyedValidPathInfo info) : UnkeyedValidPathInfo(info), path(path) { };
+    ValidPathInfo(StorePath && path, UnkeyedValidPathInfo info)
+        : UnkeyedValidPathInfo(info)
+        , path(std::move(path)) {};
+    ValidPathInfo(const StorePath & path, UnkeyedValidPathInfo info)
+        : UnkeyedValidPathInfo(info)
+        , path(path) {};
 
-    ValidPathInfo(const Store & store,
-        std::string_view name, ContentAddressWithReferences && ca, Hash narHash);
+    static ValidPathInfo
+    makeFromCA(const StoreDirConfig & store, std::string_view name, ContentAddressWithReferences && ca, Hash narHash);
 };
 
 static_assert(std::is_move_assignable_v<ValidPathInfo>);
@@ -191,4 +190,4 @@ static_assert(std::is_move_constructible_v<ValidPathInfo>);
 
 using ValidPathInfos = std::map<StorePath, ValidPathInfo>;
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/path-references.hh b/src/libstore/include/nix/store/path-references.hh
index b8d0b4dd0..66d0da268 100644
--- a/src/libstore/include/nix/store/path-references.hh
+++ b/src/libstore/include/nix/store/path-references.hh
@@ -1,13 +1,11 @@
 #pragma once
 ///@file
 
-#include "nix/util/references.hh"
+#include "nix/store/references.hh"
 #include "nix/store/path.hh"
 
 namespace nix {
 
-std::pair<StorePathSet, HashResult> scanForReferences(const Path & path, const StorePathSet & refs);
-
 StorePathSet scanForReferences(Sink & toTee, const Path & path, const StorePathSet & refs);
 
 class PathRefScanSink : public RefScanSink
@@ -23,4 +21,4 @@ public:
     StorePathSet getResultPaths();
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/path-regex.hh b/src/libstore/include/nix/store/path-regex.hh
index e34a305c5..2fbe0ba6b 100644
--- a/src/libstore/include/nix/store/path-regex.hh
+++ b/src/libstore/include/nix/store/path-regex.hh
@@ -5,11 +5,11 @@
 
 namespace nix {
 
-
 static constexpr std::string_view nameRegexStr =
     // This uses a negative lookahead: (?!\.\.?(-|$))
     //   - deny ".", "..", or those strings followed by '-'
-    //   - when it's not those, start again at the start of the input and apply the next regex, which is [0-9a-zA-Z\+\-\._\?=]+
+    //   - when it's not those, start again at the start of the input and apply the next regex, which is
+    //   [0-9a-zA-Z\+\-\._\?=]+
     R"((?!\.\.?(-|$))[0-9a-zA-Z\+\-\._\?=]+)";
 
 }
diff --git a/src/libstore/include/nix/store/path-with-outputs.hh b/src/libstore/include/nix/store/path-with-outputs.hh
index 368667c47..b93da082b 100644
--- a/src/libstore/include/nix/store/path-with-outputs.hh
+++ b/src/libstore/include/nix/store/path-with-outputs.hh
@@ -45,4 +45,4 @@ class Store;
 
 StorePathWithOutputs followLinksToStorePathWithOutputs(const Store & store, std::string_view pathWithOutputs);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/path.hh b/src/libstore/include/nix/store/path.hh
index 279e9dba4..784298daa 100644
--- a/src/libstore/include/nix/store/path.hh
+++ b/src/libstore/include/nix/store/path.hh
@@ -12,7 +12,8 @@ struct Hash;
 /**
  * Check whether a name is a valid store path name.
  *
- * @throws BadStorePathName if the name is invalid. The message is of the format "name %s is not valid, for this specific reason".
+ * @throws BadStorePathName if the name is invalid. The message is of the format "name %s is not valid, for this
+ * specific reason".
  */
 void checkName(std::string_view name);
 
@@ -49,8 +50,8 @@ public:
         return baseName;
     }
 
-    bool operator == (const StorePath & other) const noexcept = default;
-    auto operator <=> (const StorePath & other) const noexcept = default;
+    bool operator==(const StorePath & other) const noexcept = default;
+    auto operator<=>(const StorePath & other) const noexcept = default;
 
     /**
      * Check whether a file name ends with the extension for derivations.
@@ -86,15 +87,17 @@ typedef std::vector<StorePath> StorePaths;
  */
 constexpr std::string_view drvExtension = ".drv";
 
-}
+} // namespace nix
 
 namespace std {
 
-template<> struct hash<nix::StorePath> {
+template<>
+struct hash<nix::StorePath>
+{
     std::size_t operator()(const nix::StorePath & path) const noexcept
     {
-        return * (std::size_t *) path.to_string().data();
+        return *(std::size_t *) path.to_string().data();
     }
 };
 
-}
+} // namespace std
diff --git a/src/libstore/include/nix/store/pathlocks.hh b/src/libstore/include/nix/store/pathlocks.hh
index 33cad7868..05c7e079a 100644
--- a/src/libstore/include/nix/store/pathlocks.hh
+++ b/src/libstore/include/nix/store/pathlocks.hh
@@ -30,11 +30,8 @@ private:
 
 public:
     PathLocks();
-    PathLocks(const PathSet & paths,
-        const std::string & waitMsg = "");
-    bool lockPaths(const PathSet & _paths,
-        const std::string & waitMsg = "",
-        bool wait = true);
+    PathLocks(const PathSet & paths, const std::string & waitMsg = "");
+    bool lockPaths(const PathSet & _paths, const std::string & waitMsg = "", bool wait = true);
     ~PathLocks();
     void unlock();
     void setDeletion(bool deletePaths);
@@ -54,4 +51,4 @@ struct FdLock
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/posix-fs-canonicalise.hh b/src/libstore/include/nix/store/posix-fs-canonicalise.hh
index 1d6696023..629759cfe 100644
--- a/src/libstore/include/nix/store/posix-fs-canonicalise.hh
+++ b/src/libstore/include/nix/store/posix-fs-canonicalise.hh
@@ -12,7 +12,6 @@ namespace nix {
 typedef std::pair<dev_t, ino_t> Inode;
 typedef std::set<Inode> InodesSeen;
 
-
 /**
  * "Fix", or canonicalise, the meta-data of the files in a store path
  * after it has been built.  In particular:
@@ -40,12 +39,13 @@ void canonicalisePathMetaData(
 void canonicalisePathMetaData(
     const Path & path
 #ifndef _WIN32
-    , std::optional<std::pair<uid_t, uid_t>> uidRange = std::nullopt
+    ,
+    std::optional<std::pair<uid_t, uid_t>> uidRange = std::nullopt
 #endif
-    );
+);
 
 void canonicaliseTimestampAndPermissions(const Path & path);
 
 MakeError(PathInUse, Error);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/profiles.hh b/src/libstore/include/nix/store/profiles.hh
index e20e1198e..75cd11340 100644
--- a/src/libstore/include/nix/store/profiles.hh
+++ b/src/libstore/include/nix/store/profiles.hh
@@ -13,12 +13,10 @@
 #include <optional>
 #include <time.h>
 
-
 namespace nix {
 
 class StorePath;
 
-
 /**
  * A positive number identifying a generation for a given profile.
  *
@@ -66,7 +64,6 @@ struct Generation
  */
 typedef std::list<Generation> Generations;
 
-
 /**
  * Find all generations for the given profile.
  *
@@ -119,7 +116,8 @@ void deleteGeneration(const Path & profile, GenerationNumber gen);
 /**
  * Delete the given set of generations.
  *
- * @param profile The profile, specified by its name and location combined into a path, whose generations we want to delete.
+ * @param profile The profile, specified by its name and location combined into a path, whose generations we want to
+ * delete.
  *
  * @param gensToDelete The generations to delete, specified by a set of
  * numbers.
@@ -135,7 +133,8 @@ void deleteGenerations(const Path & profile, const std::set<GenerationNumber> &
 /**
  * Delete generations older than `max` passed the current generation.
  *
- * @param profile The profile, specified by its name and location combined into a path, whose generations we want to delete.
+ * @param profile The profile, specified by its name and location combined into a path, whose generations we want to
+ * delete.
  *
  * @param max How many generations to keep up to the current one. Must
  * be at least 1 so we don't delete the current one.
@@ -148,7 +147,8 @@ void deleteGenerationsGreaterThan(const Path & profile, GenerationNumber max, bo
 /**
  * Delete all generations other than the current one
  *
- * @param profile The profile, specified by its name and location combined into a path, whose generations we want to delete.
+ * @param profile The profile, specified by its name and location combined into a path, whose generations we want to
+ * delete.
  *
  * @param dryRun Log what would be deleted instead of actually doing
  * so.
@@ -159,7 +159,8 @@ void deleteOldGenerations(const Path & profile, bool dryRun);
  * Delete generations older than `t`, except for the most recent one
  * older than `t`.
  *
- * @param profile The profile, specified by its name and location combined into a path, whose generations we want to delete.
+ * @param profile The profile, specified by its name and location combined into a path, whose generations we want to
+ * delete.
  *
  * @param dryRun Log what would be deleted instead of actually doing
  * so.
@@ -185,10 +186,7 @@ void switchLink(Path link, Path target);
  * Roll back a profile to the specified generation, or to the most
  * recent one older than the current.
  */
-void switchGeneration(
-    const Path & profile,
-    std::optional<GenerationNumber> dstGen,
-    bool dryRun);
+void switchGeneration(const Path & profile, std::optional<GenerationNumber> dstGen, bool dryRun);
 
 /**
  * Ensure exclusive access to a profile.  Any command that modifies
@@ -237,4 +235,4 @@ Path rootChannelsDir();
  */
 Path getDefaultProfile();
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/realisation.hh b/src/libstore/include/nix/store/realisation.hh
index b93ae37b6..6eb3eecf3 100644
--- a/src/libstore/include/nix/store/realisation.hh
+++ b/src/libstore/include/nix/store/realisation.hh
@@ -21,7 +21,8 @@ struct OutputsSpec;
  * This is similar to a `DerivedPath::Opaque`, but the derivation is
  * identified by its "hash modulo" instead of by its store path.
  */
-struct DrvOutput {
+struct DrvOutput
+{
     /**
      * The hash modulo of the derivation.
      *
@@ -39,14 +40,17 @@ struct DrvOutput {
     std::string to_string() const;
 
     std::string strHash() const
-    { return drvHash.to_string(HashFormat::Base16, true); }
+    {
+        return drvHash.to_string(HashFormat::Base16, true);
+    }
 
     static DrvOutput parse(const std::string &);
 
     GENERATE_CMP(DrvOutput, me->drvHash, me->outputName);
 };
 
-struct Realisation {
+struct Realisation
+{
     DrvOutput id;
     StorePath outPath;
 
@@ -61,7 +65,7 @@ struct Realisation {
     std::map<DrvOutput, StorePath> dependentRealisations;
 
     nlohmann::json toJSON() const;
-    static Realisation fromJSON(const nlohmann::json& json, const std::string& whence);
+    static Realisation fromJSON(const nlohmann::json & json, const std::string & whence);
 
     std::string fingerprint() const;
     void sign(const Signer &);
@@ -73,7 +77,10 @@ struct Realisation {
 
     bool isCompatibleWith(const Realisation & other) const;
 
-    StorePath getPath() const { return outPath; }
+    StorePath getPath() const
+    {
+        return outPath;
+    }
 
     GENERATE_CMP(Realisation, me->id, me->outPath);
 };
@@ -95,27 +102,23 @@ typedef std::map<OutputName, Realisation> SingleDrvOutputs;
  */
 typedef std::map<DrvOutput, Realisation> DrvOutputs;
 
-/**
- * Filter a SingleDrvOutputs to include only specific output names
- *
- * Moves the `outputs` input.
- */
-SingleDrvOutputs filterDrvOutputs(const OutputsSpec&, SingleDrvOutputs&&);
-
-
-struct OpaquePath {
+struct OpaquePath
+{
     StorePath path;
 
-    StorePath getPath() const { return path; }
+    StorePath getPath() const
+    {
+        return path;
+    }
 
     GENERATE_CMP(OpaquePath, me->path);
 };
 
-
 /**
  * A store path with all the history of how it went into the store
  */
-struct RealisedPath {
+struct RealisedPath
+{
     /*
      * A path is either the result of the realisation of a derivation or
      * an opaque blob that has been directly added to the store
@@ -125,17 +128,24 @@ struct RealisedPath {
 
     using Set = std::set<RealisedPath>;
 
-    RealisedPath(StorePath path) : raw(OpaquePath{path}) {}
-    RealisedPath(Realisation r) : raw(r) {}
+    RealisedPath(StorePath path)
+        : raw(OpaquePath{path})
+    {
+    }
+
+    RealisedPath(Realisation r)
+        : raw(r)
+    {
+    }
 
     /**
      * Get the raw store path associated to this
      */
     StorePath path() const;
 
-    void closure(Store& store, Set& ret) const;
-    static void closure(Store& store, const Set& startPaths, Set& ret);
-    Set closure(Store& store) const;
+    void closure(Store & store, Set & ret) const;
+    static void closure(Store & store, const Set & startPaths, Set & ret);
+    Set closure(Store & store) const;
 
     GENERATE_CMP(RealisedPath, me->raw);
 };
@@ -145,13 +155,17 @@ class MissingRealisation : public Error
 public:
     MissingRealisation(DrvOutput & outputId)
         : MissingRealisation(outputId.outputName, outputId.strHash())
-    {}
+    {
+    }
+
     MissingRealisation(std::string_view drv, OutputName outputName)
-        : Error( "cannot operate on output '%s' of the "
-                "unbuilt derivation '%s'",
-                outputName,
-                drv)
-    {}
+        : Error(
+              "cannot operate on output '%s' of the "
+              "unbuilt derivation '%s'",
+              outputName,
+              drv)
+    {
+    }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/references.hh b/src/libstore/include/nix/store/references.hh
similarity index 73%
rename from src/libutil/include/nix/util/references.hh
rename to src/libstore/include/nix/store/references.hh
index 89a42e009..1d5648075 100644
--- a/src/libutil/include/nix/util/references.hh
+++ b/src/libstore/include/nix/store/references.hh
@@ -14,13 +14,17 @@ class RefScanSink : public Sink
 
 public:
 
-    RefScanSink(StringSet && hashes) : hashes(hashes)
-    { }
+    RefScanSink(StringSet && hashes)
+        : hashes(hashes)
+    {
+    }
 
     StringSet & getResult()
-    { return seen; }
+    {
+        return seen;
+    }
 
-    void operator () (std::string_view data) override;
+    void operator()(std::string_view data) override;
 };
 
 struct RewritingSink : Sink
@@ -36,7 +40,7 @@ struct RewritingSink : Sink
     RewritingSink(const std::string & from, const std::string & to, Sink & nextSink);
     RewritingSink(const StringMap & rewrites, Sink & nextSink);
 
-    void operator () (std::string_view data) override;
+    void operator()(std::string_view data) override;
 
     void flush();
 };
@@ -48,9 +52,9 @@ struct HashModuloSink : AbstractHashSink
 
     HashModuloSink(HashAlgorithm ha, const std::string & modulus);
 
-    void operator () (std::string_view data) override;
+    void operator()(std::string_view data) override;
 
     HashResult finish() override;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/remote-fs-accessor.hh b/src/libstore/include/nix/store/remote-fs-accessor.hh
index 75bb40dfb..fa0555d9b 100644
--- a/src/libstore/include/nix/store/remote-fs-accessor.hh
+++ b/src/libstore/include/nix/store/remote-fs-accessor.hh
@@ -27,9 +27,8 @@ class RemoteFSAccessor : public SourceAccessor
 
 public:
 
-    RemoteFSAccessor(ref<Store> store,
-        bool requireValidPath = true,
-        const /* FIXME: use std::optional */ Path & cacheDir = "");
+    RemoteFSAccessor(
+        ref<Store> store, bool requireValidPath = true, const /* FIXME: use std::optional */ Path & cacheDir = "");
 
     std::optional<Stat> maybeLstat(const CanonPath & path) override;
 
@@ -40,4 +39,4 @@ public:
     std::string readLink(const CanonPath & path) override;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/remote-store-connection.hh b/src/libstore/include/nix/store/remote-store-connection.hh
index 33ec265c2..c2010818c 100644
--- a/src/libstore/include/nix/store/remote-store-connection.hh
+++ b/src/libstore/include/nix/store/remote-store-connection.hh
@@ -15,8 +15,7 @@ namespace nix {
  * Contains `Source` and `Sink` for actual communication, along with
  * other information learned when negotiating the connection.
  */
-struct RemoteStore::Connection : WorkerProto::BasicClientConnection,
-  WorkerProto::ClientHandshakeInfo
+struct RemoteStore::Connection : WorkerProto::BasicClientConnection, WorkerProto::ClientHandshakeInfo
 {
     /**
      * Time this connection was established.
@@ -38,20 +37,29 @@ struct RemoteStore::ConnectionHandle
 
     ConnectionHandle(Pool<RemoteStore::Connection>::Handle && handle)
         : handle(std::move(handle))
-    { }
+    {
+    }
 
     ConnectionHandle(ConnectionHandle && h) noexcept
         : handle(std::move(h.handle))
-    { }
+    {
+    }
 
     ~ConnectionHandle();
 
-    RemoteStore::Connection & operator * () { return *handle; }
-    RemoteStore::Connection * operator -> () { return &*handle; }
+    RemoteStore::Connection & operator*()
+    {
+        return *handle;
+    }
+
+    RemoteStore::Connection * operator->()
+    {
+        return &*handle;
+    }
 
     void processStderr(Sink * sink = 0, Source * source = 0, bool flush = true, bool block = true);
 
     void withFramedSink(std::function<void(Sink & sink)> fun);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/remote-store.hh b/src/libstore/include/nix/store/remote-store.hh
index 18c02456f..76591cf93 100644
--- a/src/libstore/include/nix/store/remote-store.hh
+++ b/src/libstore/include/nix/store/remote-store.hh
@@ -8,24 +8,24 @@
 #include "nix/store/gc-store.hh"
 #include "nix/store/log-store.hh"
 
-
 namespace nix {
 
-
 class Pipe;
 class Pid;
 struct FdSink;
 struct FdSource;
-template<typename T> class Pool;
+template<typename T>
+class Pool;
 
 struct RemoteStoreConfig : virtual StoreConfig
 {
     using StoreConfig::StoreConfig;
 
-    const Setting<int> maxConnections{this, 1, "max-connections",
-        "Maximum number of concurrent connections to the Nix daemon."};
+    const Setting<int> maxConnections{
+        this, 1, "max-connections", "Maximum number of concurrent connections to the Nix daemon."};
 
-    const Setting<unsigned int> maxConnectionAge{this,
+    const Setting<unsigned int> maxConnectionAge{
+        this,
         std::numeric_limits<unsigned int>::max(),
         "max-connection-age",
         "Maximum age of a connection before it is closed."};
@@ -35,10 +35,7 @@ struct RemoteStoreConfig : virtual StoreConfig
  * \todo RemoteStore is a misnomer - should be something like
  * DaemonStore.
  */
-struct RemoteStore :
-    public virtual Store,
-    public virtual GcStore,
-    public virtual LogStore
+struct RemoteStore : public virtual Store, public virtual GcStore, public virtual LogStore
 {
     using Config = RemoteStoreConfig;
 
@@ -50,13 +47,12 @@ struct RemoteStore :
 
     bool isValidPathUncached(const StorePath & path) override;
 
-    StorePathSet queryValidPaths(const StorePathSet & paths,
-        SubstituteFlag maybeSubstitute = NoSubstitute) override;
+    StorePathSet queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute = NoSubstitute) override;
 
     StorePathSet queryAllValidPaths() override;
 
-    void queryPathInfoUncached(const StorePath & path,
-        Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
+    void queryPathInfoUncached(
+        const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept override;
 
     void queryReferrers(const StorePath & path, StorePathSet & referrers) override;
 
@@ -64,24 +60,24 @@ struct RemoteStore :
 
     StorePathSet queryDerivationOutputs(const StorePath & path) override;
 
-    std::map<std::string, std::optional<StorePath>> queryPartialDerivationOutputMap(const StorePath & path, Store * evalStore = nullptr) override;
+    std::map<std::string, std::optional<StorePath>>
+    queryPartialDerivationOutputMap(const StorePath & path, Store * evalStore = nullptr) override;
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override;
 
     StorePathSet querySubstitutablePaths(const StorePathSet & paths) override;
 
-    void querySubstitutablePathInfos(const StorePathCAMap & paths,
-        SubstitutablePathInfos & infos) override;
+    void querySubstitutablePathInfos(const StorePathCAMap & paths, SubstitutablePathInfos & infos) override;
 
     /**
      * Add a content-addressable store path. `dump` will be drained.
      */
     ref<const ValidPathInfo> addCAToStore(
-            Source & dump,
-            std::string_view name,
-            ContentAddressMethod caMethod,
-            HashAlgorithm hashAlgo,
-            const StorePathSet & references,
-            RepairFlag repair);
+        Source & dump,
+        std::string_view name,
+        ContentAddressMethod caMethod,
+        HashAlgorithm hashAlgo,
+        const StorePathSet & references,
+        RepairFlag repair);
 
     /**
      * Add a content-addressable store path. `dump` will be drained.
@@ -95,34 +91,25 @@ struct RemoteStore :
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) override;
 
-    void addToStore(const ValidPathInfo & info, Source & nar,
-        RepairFlag repair, CheckSigsFlag checkSigs) override;
+    void addToStore(const ValidPathInfo & info, Source & nar, RepairFlag repair, CheckSigsFlag checkSigs) override;
 
-    void addMultipleToStore(
-        Source & source,
-        RepairFlag repair,
-        CheckSigsFlag checkSigs) override;
+    void addMultipleToStore(Source & source, RepairFlag repair, CheckSigsFlag checkSigs) override;
 
-    void addMultipleToStore(
-        PathsSource && pathsToCopy,
-        Activity & act,
-        RepairFlag repair,
-        CheckSigsFlag checkSigs) override;
+    void
+    addMultipleToStore(PathsSource && pathsToCopy, Activity & act, RepairFlag repair, CheckSigsFlag checkSigs) override;
 
     void registerDrvOutput(const Realisation & info) override;
 
-    void queryRealisationUncached(const DrvOutput &,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
+    void queryRealisationUncached(
+        const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept override;
 
-    void buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
+    void
+    buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
 
     std::vector<KeyedBuildResult> buildPathsWithResults(
-        const std::vector<DerivedPath> & paths,
-        BuildMode buildMode,
-        std::shared_ptr<Store> evalStore) override;
+        const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
 
-    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
-        BuildMode buildMode) override;
+    BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode) override;
 
     void ensurePath(const StorePath & path) override;
 
@@ -145,7 +132,9 @@ struct RemoteStore :
      * without it being a breaking change.
      */
     void repairPath(const StorePath & path) override
-    { unsupported("repairPath"); }
+    {
+        unsupported("repairPath");
+    }
 
     void addSignatures(const StorePath & storePath, const StringSet & sigs) override;
 
@@ -193,9 +182,7 @@ private:
 
     std::atomic_bool failed{false};
 
-    void copyDrvsFromEvalStore(
-        const std::vector<DerivedPath> & paths,
-        std::shared_ptr<Store> evalStore);
+    void copyDrvsFromEvalStore(const std::vector<DerivedPath> & paths, std::shared_ptr<Store> evalStore);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/restricted-store.hh b/src/libstore/include/nix/store/restricted-store.hh
index 6f2122c7b..8bbb2ff54 100644
--- a/src/libstore/include/nix/store/restricted-store.hh
+++ b/src/libstore/include/nix/store/restricted-store.hh
@@ -1,10 +1,13 @@
 #pragma once
 ///@file
 
-#include "nix/store/local-store.hh"
+#include "nix/store/store-api.hh"
 
 namespace nix {
 
+class LocalStore;
+struct LocalStoreConfig;
+
 /**
  * A restricted store has a pointer to one of these, which manages the
  * restrictions that are in place.
@@ -55,6 +58,6 @@ struct RestrictionContext
 /**
  * Create a shared pointer to a restricted store.
  */
-ref<Store> makeRestrictedStore(ref<LocalStore::Config> config, ref<LocalStore> next, RestrictionContext & context);
+ref<Store> makeRestrictedStore(ref<LocalStoreConfig> config, ref<LocalStore> next, RestrictionContext & context);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/s3-binary-cache-store.hh b/src/libstore/include/nix/store/s3-binary-cache-store.hh
index c38591e60..2fe66b0ad 100644
--- a/src/libstore/include/nix/store/s3-binary-cache-store.hh
+++ b/src/libstore/include/nix/store/s3-binary-cache-store.hh
@@ -106,6 +106,8 @@ public:
     static std::string doc();
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override;
 };
 
 struct S3BinaryCacheStore : virtual BinaryCacheStore
@@ -130,6 +132,6 @@ struct S3BinaryCacheStore : virtual BinaryCacheStore
     virtual const Stats & getS3Stats() = 0;
 };
 
-}
+} // namespace nix
 
 #endif
diff --git a/src/libstore/include/nix/store/s3.hh b/src/libstore/include/nix/store/s3.hh
index 9c159ba0f..0270eeda6 100644
--- a/src/libstore/include/nix/store/s3.hh
+++ b/src/libstore/include/nix/store/s3.hh
@@ -1,15 +1,27 @@
 #pragma once
 ///@file
-#include "store-config-private.hh"
+#include "nix/store/config.hh"
 #if NIX_WITH_S3_SUPPORT
 
-#include "nix/util/ref.hh"
+#  include "nix/util/ref.hh"
+#  include "nix/util/url.hh"
+#  include "nix/util/util.hh"
 
-#include <optional>
-#include <string>
+#  include <optional>
+#  include <string>
+#  include <variant>
 
-namespace Aws { namespace Client { struct ClientConfiguration; } }
-namespace Aws { namespace S3 { class S3Client; } }
+namespace Aws {
+namespace Client {
+struct ClientConfiguration;
+}
+} // namespace Aws
+
+namespace Aws {
+namespace S3 {
+class S3Client;
+}
+} // namespace Aws
 
 namespace nix {
 
@@ -18,9 +30,14 @@ struct S3Helper
     ref<Aws::Client::ClientConfiguration> config;
     ref<Aws::S3::S3Client> client;
 
-    S3Helper(const std::string & profile, const std::string & region, const std::string & scheme, const std::string & endpoint);
+    S3Helper(
+        const std::string & profile,
+        const std::string & region,
+        const std::string & scheme,
+        const std::string & endpoint);
 
-    ref<Aws::Client::ClientConfiguration> makeConfig(const std::string & region, const std::string & scheme, const std::string & endpoint);
+    ref<Aws::Client::ClientConfiguration>
+    makeConfig(const std::string & region, const std::string & scheme, const std::string & endpoint);
 
     struct FileTransferResult
     {
@@ -28,10 +45,50 @@ struct S3Helper
         unsigned int durationMs;
     };
 
-    FileTransferResult getObject(
-        const std::string & bucketName, const std::string & key);
+    FileTransferResult getObject(const std::string & bucketName, const std::string & key);
 };
 
-}
+/**
+ * Parsed S3 URL.
+ */
+struct ParsedS3URL
+{
+    std::string bucket;
+    /**
+     * @see ParsedURL::path. This is a vector for the same reason.
+     * Unlike ParsedURL::path this doesn't include the leading empty segment,
+     * since the bucket name is necessary.
+     */
+    std::vector<std::string> key;
+    std::optional<std::string> profile;
+    std::optional<std::string> region;
+    std::optional<std::string> scheme;
+    /**
+     * The endpoint can be either missing, be an absolute URI (with a scheme like `http:`)
+     * or an authority (so an IP address or a registered name).
+     */
+    std::variant<std::monostate, ParsedURL, ParsedURL::Authority> endpoint;
+
+    std::optional<std::string> getEncodedEndpoint() const
+    {
+        return std::visit(
+            overloaded{
+                [](std::monostate) -> std::optional<std::string> { return std::nullopt; },
+                [](const auto & authorityOrUrl) -> std::optional<std::string> { return authorityOrUrl.to_string(); },
+            },
+            endpoint);
+    }
+
+    static ParsedS3URL parse(const ParsedURL & uri);
+
+    /**
+     * Convert this ParsedS3URL to HTTPS ParsedURL for use with curl's AWS SigV4 authentication
+     */
+    ParsedURL toHttpsUrl() const;
+
+    auto operator<=>(const ParsedS3URL & other) const = default;
+};
+
+} // namespace nix
 
 #endif
diff --git a/src/libstore/include/nix/store/serve-protocol-connection.hh b/src/libstore/include/nix/store/serve-protocol-connection.hh
index 5822b4990..873277db9 100644
--- a/src/libstore/include/nix/store/serve-protocol-connection.hh
+++ b/src/libstore/include/nix/store/serve-protocol-connection.hh
@@ -82,8 +82,6 @@ struct ServeProto::BasicClientConnection
     BuildResult getBuildDerivationResponse(const StoreDirConfig & store);
 
     void narFromPath(const StoreDirConfig & store, const StorePath & path, std::function<void(Source &)> fun);
-
-    void importPaths(const StoreDirConfig & store, std::function<void(Sink &)> fun);
 };
 
 struct ServeProto::BasicServerConnection
@@ -105,4 +103,4 @@ struct ServeProto::BasicServerConnection
     static ServeProto::Version handshake(BufferedSink & to, Source & from, ServeProto::Version localVersion);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/serve-protocol-impl.hh b/src/libstore/include/nix/store/serve-protocol-impl.hh
index 4e66ca542..a9617165a 100644
--- a/src/libstore/include/nix/store/serve-protocol-impl.hh
+++ b/src/libstore/include/nix/store/serve-protocol-impl.hh
@@ -15,14 +15,15 @@ namespace nix {
 
 /* protocol-agnostic templates */
 
-#define SERVE_USE_LENGTH_PREFIX_SERIALISER(TEMPLATE, T) \
-    TEMPLATE T ServeProto::Serialise< T >::read(const StoreDirConfig & store, ServeProto::ReadConn conn) \
-    { \
-        return LengthPrefixedProtoHelper<ServeProto, T >::read(store, conn); \
-    } \
-    TEMPLATE void ServeProto::Serialise< T >::write(const StoreDirConfig & store, ServeProto::WriteConn conn, const T & t) \
-    { \
-        LengthPrefixedProtoHelper<ServeProto, T >::write(store, conn, t); \
+#define SERVE_USE_LENGTH_PREFIX_SERIALISER(TEMPLATE, T)                                                \
+    TEMPLATE T ServeProto::Serialise<T>::read(const StoreDirConfig & store, ServeProto::ReadConn conn) \
+    {                                                                                                  \
+        return LengthPrefixedProtoHelper<ServeProto, T>::read(store, conn);                            \
+    }                                                                                                  \
+    TEMPLATE void ServeProto::Serialise<T>::write(                                                     \
+        const StoreDirConfig & store, ServeProto::WriteConn conn, const T & t)                         \
+    {                                                                                                  \
+        LengthPrefixedProtoHelper<ServeProto, T>::write(store, conn, t);                               \
     }
 
 SERVE_USE_LENGTH_PREFIX_SERIALISER(template<typename T>, std::vector<T>)
@@ -44,17 +45,15 @@ struct ServeProto::Serialise
 {
     static T read(const StoreDirConfig & store, ServeProto::ReadConn conn)
     {
-        return CommonProto::Serialise<T>::read(store,
-            CommonProto::ReadConn { .from = conn.from });
+        return CommonProto::Serialise<T>::read(store, CommonProto::ReadConn{.from = conn.from});
     }
+
     static void write(const StoreDirConfig & store, ServeProto::WriteConn conn, const T & t)
     {
-        CommonProto::Serialise<T>::write(store,
-            CommonProto::WriteConn { .to = conn.to },
-            t);
+        CommonProto::Serialise<T>::write(store, CommonProto::WriteConn{.to = conn.to}, t);
     }
 };
 
 /* protocol-specific templates */
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/serve-protocol.hh b/src/libstore/include/nix/store/serve-protocol.hh
index 6f6bf6b60..4c2043f17 100644
--- a/src/libstore/include/nix/store/serve-protocol.hh
+++ b/src/libstore/include/nix/store/serve-protocol.hh
@@ -12,7 +12,6 @@ namespace nix {
 #define GET_PROTOCOL_MAJOR(x) ((x) & 0xff00)
 #define GET_PROTOCOL_MINOR(x) ((x) & 0x00ff)
 
-
 struct StoreDirConfig;
 struct Source;
 
@@ -20,7 +19,6 @@ struct Source;
 struct BuildResult;
 struct UnkeyedValidPathInfo;
 
-
 /**
  * The "serve protocol", used by ssh:// stores.
  *
@@ -45,7 +43,8 @@ struct ServeProto
      * A unidirectional read connection, to be used by the read half of the
      * canonical serializers below.
      */
-    struct ReadConn {
+    struct ReadConn
+    {
         Source & from;
         Version version;
     };
@@ -54,7 +53,8 @@ struct ServeProto
      * A unidirectional write connection, to be used by the write half of the
      * canonical serializers below.
      */
-    struct WriteConn {
+    struct WriteConn
+    {
         Sink & to;
         Version version;
     };
@@ -104,21 +104,18 @@ struct ServeProto
     struct BuildOptions;
 };
 
-enum struct ServeProto::Command : uint64_t
-{
+enum struct ServeProto::Command : uint64_t {
     QueryValidPaths = 1,
     QueryPathInfos = 2,
     DumpStorePath = 3,
-    ImportPaths = 4,
-    ExportPaths = 5,
     BuildPaths = 6,
     QueryClosure = 7,
     BuildDerivation = 8,
     AddToStoreNar = 9,
 };
 
-
-struct ServeProto::BuildOptions {
+struct ServeProto::BuildOptions
+{
     /**
      * Default value in this and every other field is so tests pass when
      * testing older deserialisers which do not set all the fields.
@@ -130,7 +127,7 @@ struct ServeProto::BuildOptions {
     bool enforceDeterminism = -1;
     bool keepFailed = -1;
 
-    bool operator == (const ServeProto::BuildOptions &) const = default;
+    bool operator==(const ServeProto::BuildOptions &) const = default;
 };
 
 /**
@@ -139,7 +136,7 @@ struct ServeProto::BuildOptions {
  * @todo Switch to using `ServeProto::Serialize` instead probably. But
  * this was not done at this time so there would be less churn.
  */
-inline Sink & operator << (Sink & sink, ServeProto::Command op)
+inline Sink & operator<<(Sink & sink, ServeProto::Command op)
 {
     return sink << (uint64_t) op;
 }
@@ -149,7 +146,7 @@ inline Sink & operator << (Sink & sink, ServeProto::Command op)
  *
  * @todo Perhaps render known opcodes more nicely.
  */
-inline std::ostream & operator << (std::ostream & s, ServeProto::Command op)
+inline std::ostream & operator<<(std::ostream & s, ServeProto::Command op)
 {
     return s << (uint64_t) op;
 }
@@ -164,10 +161,10 @@ inline std::ostream & operator << (std::ostream & s, ServeProto::Command op)
  * be legal specialization syntax. See below for what that looks like in
  * practice.
  */
-#define DECLARE_SERVE_SERIALISER(T) \
-    struct ServeProto::Serialise< T > \
-    { \
-        static T read(const StoreDirConfig & store, ServeProto::ReadConn conn); \
+#define DECLARE_SERVE_SERIALISER(T)                                                               \
+    struct ServeProto::Serialise<T>                                                               \
+    {                                                                                             \
+        static T read(const StoreDirConfig & store, ServeProto::ReadConn conn);                   \
         static void write(const StoreDirConfig & store, ServeProto::WriteConn conn, const T & t); \
     };
 
@@ -190,4 +187,4 @@ template<typename K, typename V>
 DECLARE_SERVE_SERIALISER(std::map<K COMMA_ V>);
 #undef COMMA_
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/sqlite.hh b/src/libstore/include/nix/store/sqlite.hh
index 266930d75..3495c0bd1 100644
--- a/src/libstore/include/nix/store/sqlite.hh
+++ b/src/libstore/include/nix/store/sqlite.hh
@@ -1,6 +1,7 @@
 #pragma once
 ///@file
 
+#include <filesystem>
 #include <functional>
 #include <string>
 
@@ -38,14 +39,27 @@ enum class SQLiteOpenMode {
 struct SQLite
 {
     sqlite3 * db = 0;
-    SQLite() { }
-    SQLite(const Path & path, SQLiteOpenMode mode = SQLiteOpenMode::Normal);
+
+    SQLite() {}
+
+    SQLite(const std::filesystem::path & path, SQLiteOpenMode mode = SQLiteOpenMode::Normal);
     SQLite(const SQLite & from) = delete;
-    SQLite& operator = (const SQLite & from) = delete;
+    SQLite & operator=(const SQLite & from) = delete;
+
     // NOTE: This is noexcept since we are only copying and assigning raw pointers.
-    SQLite& operator = (SQLite && from) noexcept { db = from.db; from.db = 0; return *this; }
+    SQLite & operator=(SQLite && from) noexcept
+    {
+        db = from.db;
+        from.db = 0;
+        return *this;
+    }
+
     ~SQLite();
-    operator sqlite3 * () { return db; }
+
+    operator sqlite3 *()
+    {
+        return db;
+    }
 
     /**
      * Disable synchronous mode, set truncate journal mode.
@@ -65,11 +79,21 @@ struct SQLiteStmt
     sqlite3 * db = 0;
     sqlite3_stmt * stmt = 0;
     std::string sql;
-    SQLiteStmt() { }
-    SQLiteStmt(sqlite3 * db, const std::string & sql) { create(db, sql); }
+
+    SQLiteStmt() {}
+
+    SQLiteStmt(sqlite3 * db, const std::string & sql)
+    {
+        create(db, sql);
+    }
+
     void create(sqlite3 * db, const std::string & s);
     ~SQLiteStmt();
-    operator sqlite3_stmt * () { return stmt; }
+
+    operator sqlite3_stmt *()
+    {
+        return stmt;
+    }
 
     /**
      * Helper for binding / executing statements.
@@ -89,9 +113,9 @@ struct SQLiteStmt
         /**
          * Bind the next parameter.
          */
-        Use & operator () (std::string_view value, bool notNull = true);
-        Use & operator () (const unsigned char * data, size_t len, bool notNull = true);
-        Use & operator () (int64_t value, bool notNull = true);
+        Use & operator()(std::string_view value, bool notNull = true);
+        Use & operator()(const unsigned char * data, size_t len, bool notNull = true);
+        Use & operator()(int64_t value, bool notNull = true);
         Use & bind(); // null
 
         int step();
@@ -134,7 +158,6 @@ struct SQLiteTxn
     ~SQLiteTxn();
 };
 
-
 struct SQLiteError : Error
 {
     std::string path;
@@ -142,21 +165,29 @@ struct SQLiteError : Error
     int errNo, extendedErrNo, offset;
 
     template<typename... Args>
-    [[noreturn]] static void throw_(sqlite3 * db, const std::string & fs, const Args & ... args) {
+    [[noreturn]] static void throw_(sqlite3 * db, const std::string & fs, const Args &... args)
+    {
         throw_(db, HintFmt(fs, args...));
     }
 
-    SQLiteError(const char *path, const char *errMsg, int errNo, int extendedErrNo, int offset, HintFmt && hf);
+    SQLiteError(const char * path, const char * errMsg, int errNo, int extendedErrNo, int offset, HintFmt && hf);
 
 protected:
 
     template<typename... Args>
-    SQLiteError(const char *path, const char *errMsg, int errNo, int extendedErrNo, int offset, const std::string & fs, const Args & ... args)
-      : SQLiteError(path, errMsg, errNo, extendedErrNo, offset, HintFmt(fs, args...))
-    { }
+    SQLiteError(
+        const char * path,
+        const char * errMsg,
+        int errNo,
+        int extendedErrNo,
+        int offset,
+        const std::string & fs,
+        const Args &... args)
+        : SQLiteError(path, errMsg, errNo, extendedErrNo, offset, HintFmt(fs, args...))
+    {
+    }
 
     [[noreturn]] static void throw_(sqlite3 * db, HintFmt && hf);
-
 };
 
 MakeError(SQLiteBusy, SQLiteError);
@@ -181,4 +212,4 @@ T retrySQLite(F && fun)
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/ssh-store.hh b/src/libstore/include/nix/store/ssh-store.hh
index fde165445..9584a1a86 100644
--- a/src/libstore/include/nix/store/ssh-store.hh
+++ b/src/libstore/include/nix/store/ssh-store.hh
@@ -33,6 +33,8 @@ struct SSHStoreConfig : std::enable_shared_from_this<SSHStoreConfig>,
     static std::string doc();
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override;
 };
 
 struct MountedSSHStoreConfig : virtual SSHStoreConfig, virtual LocalFSStoreConfig
@@ -60,4 +62,4 @@ struct MountedSSHStoreConfig : virtual SSHStoreConfig, virtual LocalFSStoreConfi
     ref<Store> openStore() const override;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/ssh.hh b/src/libstore/include/nix/store/ssh.hh
index be9cf0c48..574cb5cf4 100644
--- a/src/libstore/include/nix/store/ssh.hh
+++ b/src/libstore/include/nix/store/ssh.hh
@@ -1,17 +1,22 @@
 #pragma once
 ///@file
 
+#include "nix/util/ref.hh"
 #include "nix/util/sync.hh"
+#include "nix/util/url.hh"
 #include "nix/util/processes.hh"
 #include "nix/util/file-system.hh"
 
 namespace nix {
 
+Strings getNixSshOpts();
+
 class SSHMaster
 {
 private:
 
-    const std::string host;
+    ParsedURL::Authority authority;
+    std::string hostnameAndUser;
     bool fakeSSH;
     const std::string keyFile;
     /**
@@ -22,12 +27,13 @@ private:
     const bool compress;
     const Descriptor logFD;
 
+    const ref<const AutoDelete> tmpDir;
+
     struct State
     {
 #ifndef _WIN32 // TODO re-enable on Windows, once we can start processes.
         Pid sshMaster;
 #endif
-        std::unique_ptr<AutoDelete> tmpDir;
         Path socketPath;
     };
 
@@ -43,10 +49,12 @@ private:
 public:
 
     SSHMaster(
-        std::string_view host,
+        const ParsedURL::Authority & authority,
         std::string_view keyFile,
         std::string_view sshPublicHostKey,
-        bool useMaster, bool compress, Descriptor logFD = INVALID_DESCRIPTOR);
+        bool useMaster,
+        bool compress,
+        Descriptor logFD = INVALID_DESCRIPTOR);
 
     struct Connection
     {
@@ -75,9 +83,7 @@ public:
      * execute). Will not be used when "fake SSHing" to the local
      * machine.
      */
-    std::unique_ptr<Connection> startCommand(
-        Strings && command,
-        Strings && extraSshArgs = {});
+    std::unique_ptr<Connection> startCommand(Strings && command, Strings && extraSshArgs = {});
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/store-api.hh b/src/libstore/include/nix/store/store-api.hh
index e0a3e67d1..2519002b3 100644
--- a/src/libstore/include/nix/store/store-api.hh
+++ b/src/libstore/include/nix/store/store-api.hh
@@ -8,7 +8,6 @@
 #include "nix/util/serialise.hh"
 #include "nix/util/lru-cache.hh"
 #include "nix/util/sync.hh"
-#include "nix/store/globals.hh"
 #include "nix/util/configuration.hh"
 #include "nix/store/path-info.hh"
 #include "nix/util/repair-flag.hh"
@@ -23,14 +22,8 @@
 #include <string>
 #include <chrono>
 
-
 namespace nix {
 
-MakeError(SubstError, Error);
-/**
- * denotes a permanent build failure
- */
-MakeError(BuildError, Error);
 MakeError(InvalidPath, Error);
 MakeError(Unsupported, Error);
 MakeError(SubstituteGone, Error);
@@ -49,26 +42,19 @@ struct SourceAccessor;
 class NarInfoDiskCache;
 class Store;
 
-
 typedef std::map<std::string, StorePath> OutputPathMap;
 
-
 enum CheckSigsFlag : bool { NoCheckSigs = false, CheckSigs = true };
+
 enum SubstituteFlag : bool { NoSubstitute = false, Substitute = true };
 
-/**
- * Magic header of exportPath() output (obsolete).
- */
-const uint32_t exportMagic = 0x4558494e;
-
-
 enum BuildMode : uint8_t { bmNormal, bmRepair, bmCheck };
+
 enum TrustedFlag : bool { NotTrusted = false, Trusted = true };
 
 struct BuildResult;
 struct KeyedBuildResult;
 
-
 typedef std::map<StorePath, std::optional<ContentAddress>> StorePathCAMap;
 
 /**
@@ -84,6 +70,35 @@ struct MissingPaths
     uint64_t narSize{0};
 };
 
+/**
+ * Need to make this a separate class so I can get the right
+ * initialization order in the constructor for `StoreConfig`.
+ */
+struct StoreConfigBase : Config
+{
+    using Config::Config;
+
+private:
+
+    /**
+     * An indirection so that we don't need to refer to global settings
+     * in headers.
+     */
+    static Path getDefaultNixStoreDir();
+
+public:
+
+    const PathSetting storeDir_{
+        this,
+        getDefaultNixStoreDir(),
+        "store",
+        R"(
+          Logical location of the Nix store, usually
+          `/nix/store`. Note that you can only copy store paths
+          between stores if they have the same `store` setting.
+        )"};
+};
+
 /**
  * About the class hierarchy of the store types:
  *
@@ -110,14 +125,21 @@ struct MissingPaths
  * ```
  * cpp static RegisterStoreImplementation<FooConfig> regStore;
  * ```
+ *
+ * @note The order of `StoreConfigBase` and then `StorerConfig` is
+ * very important. This ensures that `StoreConfigBase::storeDir_`
+ * is initialized before we have our one chance (because references are
+ * immutable) to initialize `StoreConfig::storeDir`.
  */
-struct StoreConfig : public StoreDirConfig
+struct StoreConfig : public StoreConfigBase, public StoreDirConfig
 {
-    using StoreDirConfig::StoreDirConfig;
+    using Params = StoreReference::Params;
+
+    StoreConfig(const Params & params);
 
     StoreConfig() = delete;
 
-    virtual ~StoreConfig() { }
+    virtual ~StoreConfig() {}
 
     static StringSet getDefaultSystemFeatures();
 
@@ -129,6 +151,19 @@ struct StoreConfig : public StoreDirConfig
         return "";
     }
 
+    /**
+     * Get overridden store reference query parameters.
+     */
+    StringMap getQueryParams() const
+    {
+        auto queryParams = std::map<std::string, AbstractConfig::SettingInfo>{};
+        getSettings(queryParams, /*overriddenOnly=*/true);
+        StringMap res;
+        for (const auto & [name, info] : queryParams)
+            res.insert({name, info.value});
+        return res;
+    }
+
     /**
      * An experimental feature this type store is gated, if it is to be
      * experimental.
@@ -138,10 +173,13 @@ struct StoreConfig : public StoreDirConfig
         return std::nullopt;
     }
 
-    Setting<int> pathInfoCacheSize{this, 65536, "path-info-cache-size",
-        "Size of the in-memory store path metadata cache."};
+    Setting<int> pathInfoCacheSize{
+        this, 65536, "path-info-cache-size", "Size of the in-memory store path metadata cache."};
 
-    Setting<bool> isTrusted{this, false, "trusted",
+    Setting<bool> isTrusted{
+        this,
+        false,
+        "trusted",
         R"(
           Whether paths from this store can be used as substitutes
           even if they are not signed by a key listed in the
@@ -149,18 +187,26 @@ struct StoreConfig : public StoreDirConfig
           setting.
         )"};
 
-    Setting<int> priority{this, 0, "priority",
+    Setting<int> priority{
+        this,
+        0,
+        "priority",
         R"(
           Priority of this store when used as a [substituter](@docroot@/command-ref/conf-file.md#conf-substituters).
           A lower value means a higher priority.
         )"};
 
-    Setting<bool> wantMassQuery{this, false, "want-mass-query",
+    Setting<bool> wantMassQuery{
+        this,
+        false,
+        "want-mass-query",
         R"(
           Whether this store can be queried efficiently for path validity when used as a [substituter](@docroot@/command-ref/conf-file.md#conf-substituters).
         )"};
 
-    Setting<StringSet> systemFeatures{this, getDefaultSystemFeatures(),
+    Setting<StringSet> systemFeatures{
+        this,
+        getDefaultSystemFeatures(),
         "system-features",
         R"(
           Optional [system features](@docroot@/command-ref/conf-file.md#conf-system-features) available on the system this store uses to build derivations.
@@ -176,6 +222,29 @@ struct StoreConfig : public StoreDirConfig
      * type.
      */
     virtual ref<Store> openStore() const = 0;
+
+    /**
+     * Render the config back to a `StoreReference`. It should round-trip
+     * with `resolveStoreConfig` (for stores configs that are
+     * registered).
+     */
+    virtual StoreReference getReference() const;
+
+    /**
+     * Get a textual representation of the store reference.
+     *
+     * @warning This is only suitable for logging or error messages.
+     * This will not roundtrip when parsed as a StoreReference.
+     * Must NOT be used as a cache key or otherwise be relied upon to
+     * be stable.
+     *
+     * Can be implemented by subclasses to make the URI more legible,
+     * e.g. when some query parameters are necessary to make sense of the URI.
+     */
+    virtual std::string getHumanReadableURI() const
+    {
+        return getReference().render(/*withParams=*/false);
+    }
 };
 
 /**
@@ -189,7 +258,7 @@ struct StoreConfig : public StoreDirConfig
  * underlying resource, which could be an external process (daemon
  * server), file system state, etc.
  */
-class Store : public std::enable_shared_from_this<Store>, public MixStoreDirMethods
+class Store : public std::enable_shared_from_this<Store>, public StoreDirConfig
 {
 public:
 
@@ -200,11 +269,15 @@ public:
     /**
      * @note Avoid churn, since we used to inherit from `Config`.
      */
-    operator const Config &() const { return config; }
+    operator const Config &() const
+    {
+        return config;
+    }
 
 protected:
 
-    struct PathInfoCacheValue {
+    struct PathInfoCacheValue
+    {
 
         /**
          * Time of cache entry creation or update
@@ -226,17 +299,17 @@ protected:
          * Past tense, because a path can only be assumed to exists when
          * isKnownNow() && didExist()
          */
-        inline bool didExist() {
-          return value != nullptr;
+        inline bool didExist()
+        {
+            return value != nullptr;
         }
     };
 
-    struct State
-    {
-        LRUCache<std::string, PathInfoCacheValue> pathInfoCache;
-    };
+    void invalidatePathInfoCacheFor(const StorePath & path);
 
-    SharedSync<State> state;
+    // Note: this is a `ref` to avoid false sharing with immutable
+    // bits of `Store`.
+    ref<SharedSync<LRUCache<std::string, PathInfoCacheValue>>> pathInfoCache;
 
     std::shared_ptr<NarInfoDiskCache> diskCache;
 
@@ -249,13 +322,7 @@ public:
      */
     virtual void init() {};
 
-    virtual ~Store() { }
-
-    /**
-     * @todo move to `StoreConfig` one we store enough information in
-     * those to recover the scheme and authority in all cases.
-     */
-    virtual std::string getUri() = 0;
+    virtual ~Store() {}
 
     /**
      * Follow symlinks until we end up with a path in the Nix store.
@@ -290,8 +357,7 @@ public:
      * Query which of the given paths is valid. Optionally, try to
      * substitute missing paths.
      */
-    virtual StorePathSet queryValidPaths(const StorePathSet & paths,
-        SubstituteFlag maybeSubstitute = NoSubstitute);
+    virtual StorePathSet queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute = NoSubstitute);
 
     /**
      * Query the set of all valid paths. Note that for some store
@@ -302,7 +368,9 @@ public:
      * `std::variant<StorePath, HashPart>` to get rid of this hack.
      */
     virtual StorePathSet queryAllValidPaths()
-    { unsupported("queryAllValidPaths"); }
+    {
+        unsupported("queryAllValidPaths");
+    }
 
     constexpr static const char * MissingName = "x";
 
@@ -315,8 +383,7 @@ public:
     /**
      * Asynchronous version of queryPathInfo().
      */
-    void queryPathInfo(const StorePath & path,
-        Callback<ref<const ValidPathInfo>> callback) noexcept;
+    void queryPathInfo(const StorePath & path, Callback<ref<const ValidPathInfo>> callback) noexcept;
 
     /**
      * Version of queryPathInfo() that only queries the local narinfo cache and not
@@ -336,9 +403,7 @@ public:
     /**
      * Asynchronous version of queryRealisation().
      */
-    void queryRealisation(const DrvOutput &,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept;
-
+    void queryRealisation(const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept;
 
     /**
      * Check whether the given valid path info is sufficiently attested, by
@@ -356,17 +421,17 @@ public:
         return true;
     }
 
-    virtual bool realisationIsUntrusted(const Realisation & )
+    virtual bool realisationIsUntrusted(const Realisation &)
     {
         return true;
     }
 
 protected:
 
-    virtual void queryPathInfoUncached(const StorePath & path,
-        Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept = 0;
-    virtual void queryRealisationUncached(const DrvOutput &,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept = 0;
+    virtual void
+    queryPathInfoUncached(const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept = 0;
+    virtual void
+    queryRealisationUncached(const DrvOutput &, Callback<std::shared_ptr<const Realisation>> callback) noexcept = 0;
 
 public:
 
@@ -375,7 +440,9 @@ public:
      * The result is not cleared.
      */
     virtual void queryReferrers(const StorePath & path, StorePathSet & referrers)
-    { unsupported("queryReferrers"); }
+    {
+        unsupported("queryReferrers");
+    }
 
     /**
      * @return all currently valid derivations that have `path` as an
@@ -385,7 +452,10 @@ public:
      * was actually used to produce `path`, which may not exist
      * anymore.)
      */
-    virtual StorePathSet queryValidDerivers(const StorePath & path) { return {}; };
+    virtual StorePathSet queryValidDerivers(const StorePath & path)
+    {
+        return {};
+    };
 
     /**
      * Query the outputs of the derivation denoted by `path`.
@@ -397,9 +467,8 @@ public:
      * derivation. All outputs are mentioned so ones missing the mapping
      * are mapped to `std::nullopt`.
      */
-    virtual std::map<std::string, std::optional<StorePath>> queryPartialDerivationOutputMap(
-        const StorePath & path,
-        Store * evalStore = nullptr);
+    virtual std::map<std::string, std::optional<StorePath>>
+    queryPartialDerivationOutputMap(const StorePath & path, Store * evalStore = nullptr);
 
     /**
      * Like `queryPartialDerivationOutputMap` but only considers
@@ -409,8 +478,8 @@ public:
      * Just a helper function for implementing
      * `queryPartialDerivationOutputMap`.
      */
-    virtual std::map<std::string, std::optional<StorePath>> queryStaticPartialDerivationOutputMap(
-        const StorePath & path);
+    virtual std::map<std::string, std::optional<StorePath>>
+    queryStaticPartialDerivationOutputMap(const StorePath & path);
 
     /**
      * Query the mapping outputName=>outputPath for the given derivation.
@@ -427,7 +496,10 @@ public:
     /**
      * Query which of the given paths have substitutes.
      */
-    virtual StorePathSet querySubstitutablePaths(const StorePathSet & paths) { return {}; };
+    virtual StorePathSet querySubstitutablePaths(const StorePathSet & paths)
+    {
+        return {};
+    };
 
     /**
      * Query substitute info (i.e. references, derivers and download
@@ -436,14 +508,16 @@ public:
      * If a path does not have substitute info, it's omitted from the
      * resulting ‘infos’ map.
      */
-    virtual void querySubstitutablePathInfos(const StorePathCAMap & paths,
-        SubstitutablePathInfos & infos);
+    virtual void querySubstitutablePathInfos(const StorePathCAMap & paths, SubstitutablePathInfos & infos);
 
     /**
      * Import a path into the store.
      */
-    virtual void addToStore(const ValidPathInfo & info, Source & narSource,
-        RepairFlag repair = NoRepair, CheckSigsFlag checkSigs = CheckSigs) = 0;
+    virtual void addToStore(
+        const ValidPathInfo & info,
+        Source & narSource,
+        RepairFlag repair = NoRepair,
+        CheckSigsFlag checkSigs = CheckSigs) = 0;
 
     /**
      * A list of paths infos along with a source providing the content
@@ -454,16 +528,10 @@ public:
     /**
      * Import multiple paths into the store.
      */
-    virtual void addMultipleToStore(
-        Source & source,
-        RepairFlag repair = NoRepair,
-        CheckSigsFlag checkSigs = CheckSigs);
+    virtual void addMultipleToStore(Source & source, RepairFlag repair = NoRepair, CheckSigsFlag checkSigs = CheckSigs);
 
     virtual void addMultipleToStore(
-        PathsSource && pathsToCopy,
-        Activity & act,
-        RepairFlag repair = NoRepair,
-        CheckSigsFlag checkSigs = CheckSigs);
+        PathsSource && pathsToCopy, Activity & act, RepairFlag repair = NoRepair, CheckSigsFlag checkSigs = CheckSigs);
 
     /**
      * Copy the contents of a path to the store and register the
@@ -531,9 +599,14 @@ public:
      * retrieve this information otherwise.
      */
     virtual void registerDrvOutput(const Realisation & output)
-    { unsupported("registerDrvOutput"); }
+    {
+        unsupported("registerDrvOutput");
+    }
+
     virtual void registerDrvOutput(const Realisation & output, CheckSigsFlag checkSigs)
-    { return registerDrvOutput(output); }
+    {
+        return registerDrvOutput(output);
+    }
 
     /**
      * Write a NAR dump of a store path.
@@ -601,8 +674,8 @@ public:
      *     up with multiple different versions of dependencies without
      *     explicitly choosing to allow it).
      */
-    virtual BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
-        BuildMode buildMode = bmNormal);
+    virtual BuildResult
+    buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode = bmNormal);
 
     /**
      * Ensure that a path is valid.  If it is not currently valid, it
@@ -616,28 +689,32 @@ public:
      * The root disappears as soon as we exit.
      */
     virtual void addTempRoot(const StorePath & path)
-    { debug("not creating temporary root, store doesn't support GC"); }
+    {
+        debug("not creating temporary root, store doesn't support GC");
+    }
 
     /**
      * @return a string representing information about the path that
      * can be loaded into the database using `nix-store --load-db` or
      * `nix-store --register-validity`.
      */
-    std::string makeValidityRegistration(const StorePathSet & paths,
-        bool showDerivers, bool showHash);
+    std::string makeValidityRegistration(const StorePathSet & paths, bool showDerivers, bool showHash);
 
     /**
      * Optimise the disk space usage of the Nix store by hard-linking files
      * with the same contents.
      */
-    virtual void optimiseStore() { };
+    virtual void optimiseStore() {};
 
     /**
      * Check the integrity of the Nix store.
      *
      * @return true if errors remain.
      */
-    virtual bool verifyStore(bool checkContents, RepairFlag repair = NoRepair) { return false; };
+    virtual bool verifyStore(bool checkContents, RepairFlag repair = NoRepair)
+    {
+        return false;
+    };
 
     /**
      * @return An object to access files in the Nix store.
@@ -655,7 +732,9 @@ public:
      * not verified.
      */
     virtual void addSignatures(const StorePath & storePath, const StringSet & sigs)
-    { unsupported("addSignatures"); }
+    {
+        unsupported("addSignatures");
+    }
 
     /**
      * Add signatures to a ValidPathInfo or Realisation using the secret keys
@@ -693,13 +772,19 @@ public:
      * `referrers` relation instead of the `references` relation is
      * returned.
      */
-    virtual void computeFSClosure(const StorePathSet & paths,
-        StorePathSet & out, bool flipDirection = false,
-        bool includeOutputs = false, bool includeDerivers = false);
+    virtual void computeFSClosure(
+        const StorePathSet & paths,
+        StorePathSet & out,
+        bool flipDirection = false,
+        bool includeOutputs = false,
+        bool includeDerivers = false);
 
-    void computeFSClosure(const StorePath & path,
-        StorePathSet & out, bool flipDirection = false,
-        bool includeOutputs = false, bool includeDerivers = false);
+    void computeFSClosure(
+        const StorePath & path,
+        StorePathSet & out,
+        bool flipDirection = false,
+        bool includeOutputs = false,
+        bool includeDerivers = false);
 
     /**
      * Given a set of paths that are to be built, return the set of
@@ -714,21 +799,6 @@ public:
      */
     StorePaths topoSortPaths(const StorePathSet & paths);
 
-    /**
-     * Export multiple paths in the format expected by ‘nix-store
-     * --import’.
-     */
-    void exportPaths(const StorePathSet & paths, Sink & sink);
-
-    void exportPath(const StorePath & path, Sink & sink);
-
-    /**
-     * Import a sequence of NAR dumps created by exportPaths() into the
-     * Nix store. Optionally, the contents of the NARs are preloaded
-     * into the specified FS accessor to speed up subsequent access.
-     */
-    StorePaths importPaths(Source & source, CheckSigsFlag checkSigs = CheckSigs);
-
     struct Stats
     {
         std::atomic<uint64_t> narInfoRead{0};
@@ -767,14 +837,14 @@ public:
      */
     void clearPathInfoCache()
     {
-        state.lock()->pathInfoCache.clear();
+        pathInfoCache->lock()->clear();
     }
 
     /**
      * Establish a connection to the store, for store types that have
      * a notion of connection. Otherwise this is a no-op.
      */
-    virtual void connect() { };
+    virtual void connect() {};
 
     /**
      * Get the protocol version of this store or it's connection.
@@ -794,7 +864,6 @@ public:
      */
     virtual std::optional<TrustedFlag> isTrustedClient() = 0;
 
-
     virtual Path toRealPath(const Path & storePath)
     {
         return storePath;
@@ -809,9 +878,12 @@ public:
      * Synchronises the options of the client with those of the daemon
      * (a no-op when there’s no daemon)
      */
-    virtual void setOptions() { }
+    virtual void setOptions() {}
 
-    virtual std::optional<std::string> getVersion() { return {}; }
+    virtual std::optional<std::string> getVersion()
+    {
+        return {};
+    }
 
 protected:
 
@@ -826,12 +898,10 @@ protected:
      */
     [[noreturn]] void unsupported(const std::string & op)
     {
-        throw Unsupported("operation '%s' is not supported by store '%s'", op, getUri());
+        throw Unsupported("operation '%s' is not supported by store '%s'", op, config.getHumanReadableURI());
     }
-
 };
 
-
 /**
  * Copy a path from one store to another.
  */
@@ -842,7 +912,6 @@ void copyStorePath(
     RepairFlag repair = NoRepair,
     CheckSigsFlag checkSigs = CheckSigs);
 
-
 /**
  * Copy store paths from one store to another. The paths may be copied
  * in parallel. They are copied in a topologically sorted order (i.e. if
@@ -852,14 +921,16 @@ void copyStorePath(
  * @return a map of what each path was copied to the dstStore as.
  */
 std::map<StorePath, StorePath> copyPaths(
-    Store & srcStore, Store & dstStore,
+    Store & srcStore,
+    Store & dstStore,
     const std::set<RealisedPath> &,
     RepairFlag repair = NoRepair,
     CheckSigsFlag checkSigs = CheckSigs,
     SubstituteFlag substitute = NoSubstitute);
 
 std::map<StorePath, StorePath> copyPaths(
-    Store & srcStore, Store & dstStore,
+    Store & srcStore,
+    Store & dstStore,
     const StorePathSet & paths,
     RepairFlag repair = NoRepair,
     CheckSigsFlag checkSigs = CheckSigs,
@@ -869,14 +940,16 @@ std::map<StorePath, StorePath> copyPaths(
  * Copy the closure of `paths` from `srcStore` to `dstStore`.
  */
 void copyClosure(
-    Store & srcStore, Store & dstStore,
+    Store & srcStore,
+    Store & dstStore,
     const std::set<RealisedPath> & paths,
     RepairFlag repair = NoRepair,
     CheckSigsFlag checkSigs = CheckSigs,
     SubstituteFlag substitute = NoSubstitute);
 
 void copyClosure(
-    Store & srcStore, Store & dstStore,
+    Store & srcStore,
+    Store & dstStore,
     const StorePathSet & paths,
     RepairFlag repair = NoRepair,
     CheckSigsFlag checkSigs = CheckSigs,
@@ -889,7 +962,6 @@ void copyClosure(
  */
 void removeTempRoots();
 
-
 /**
  * Resolve the derived path completely, failing if any derivation output
  * is unknown.
@@ -897,25 +969,18 @@ void removeTempRoots();
 StorePath resolveDerivedPath(Store &, const SingleDerivedPath &, Store * evalStore = nullptr);
 OutputPathMap resolveDerivedPath(Store &, const DerivedPath::Built &, Store * evalStore = nullptr);
 
-
 /**
  * Display a set of paths in human-readable form (i.e., between quotes
  * and separated by commas).
  */
 std::string showPaths(const PathSet & paths);
 
-
-std::optional<ValidPathInfo> decodeValidPathInfo(
-    const Store & store,
-    std::istream & str,
-    std::optional<HashResult> hashGiven = std::nullopt);
+std::optional<ValidPathInfo>
+decodeValidPathInfo(const Store & store, std::istream & str, std::optional<HashResult> hashGiven = std::nullopt);
 
 const ContentAddress * getDerivationCA(const BasicDerivation & drv);
 
-std::map<DrvOutput, StorePath> drvOutputReferences(
-    Store & store,
-    const Derivation & drv,
-    const StorePath & outputPath,
-    Store * evalStore = nullptr);
+std::map<DrvOutput, StorePath>
+drvOutputReferences(Store & store, const Derivation & drv, const StorePath & outputPath, Store * evalStore = nullptr);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/store-cast.hh b/src/libstore/include/nix/store/store-cast.hh
index 0bf61bb77..1e0b14914 100644
--- a/src/libstore/include/nix/store/store-cast.hh
+++ b/src/libstore/include/nix/store/store-cast.hh
@@ -17,8 +17,8 @@ T & require(Store & store)
 {
     auto * castedStore = dynamic_cast<T *>(&store);
     if (!castedStore)
-        throw UsageError("%s not supported by store '%s'", T::operationName, store.getUri());
+        throw UsageError("%s not supported by store '%s'", T::operationName, store.config.getHumanReadableURI());
     return *castedStore;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/store-dir-config.hh b/src/libstore/include/nix/store/store-dir-config.hh
index 14e3e7db8..07cda5c12 100644
--- a/src/libstore/include/nix/store/store-dir-config.hh
+++ b/src/libstore/include/nix/store/store-dir-config.hh
@@ -3,14 +3,12 @@
 #include "nix/store/path.hh"
 #include "nix/util/hash.hh"
 #include "nix/store/content-address.hh"
-#include "nix/store/globals.hh"
 #include "nix/util/configuration.hh"
 
 #include <map>
 #include <string>
 #include <variant>
 
-
 namespace nix {
 
 struct SourcePath;
@@ -19,15 +17,17 @@ MakeError(BadStorePath, Error);
 MakeError(BadStorePathName, BadStorePath);
 
 /**
- * @todo This should just be part of `StoreDirConfig`. However, it would
- * be a huge amount of churn if `Store` didn't have these methods
+ * @todo This should just be inherited by `StoreConfig`. However, it
+ * would be a huge amount of churn if `Store` didn't have these methods
  * anymore, forcing a bunch of code to go from `store.method(...)` to
  * `store.config.method(...)`.
  *
- * So we instead pull out the methods into their own mix-in, so can put
- * them directly on the Store too.
+ * @todo this should not have "config" in its name, because it no longer
+ * uses the configuration system for `storeDir` --- in fact, `storeDir`
+ * isn't even owned, but a mere reference. But doing that rename would
+ * cause a bunch of churn.
  */
-struct MixStoreDirMethods
+struct StoreDirConfig
 {
     const Path & storeDir;
 
@@ -75,13 +75,10 @@ struct MixStoreDirMethods
     /**
      * Constructs a unique store path name.
      */
-    StorePath makeStorePath(std::string_view type,
-        std::string_view hash, std::string_view name) const;
-    StorePath makeStorePath(std::string_view type,
-        const Hash & hash, std::string_view name) const;
+    StorePath makeStorePath(std::string_view type, std::string_view hash, std::string_view name) const;
+    StorePath makeStorePath(std::string_view type, const Hash & hash, std::string_view name) const;
 
-    StorePath makeOutputPath(std::string_view id,
-        const Hash & hash, std::string_view name) const;
+    StorePath makeOutputPath(std::string_view id, const Hash & hash, std::string_view name) const;
 
     StorePath makeFixedOutputPath(std::string_view name, const FixedOutputInfo & info) const;
 
@@ -100,38 +97,4 @@ struct MixStoreDirMethods
         PathFilter & filter = defaultPathFilter) const;
 };
 
-/**
- * Need to make this a separate class so I can get the right
- * initialization order in the constructor for `StoreDirConfig`.
- */
-struct StoreDirConfigBase : Config
-{
-    using Config::Config;
-
-    const PathSetting storeDir_{this, settings.nixStore,
-        "store",
-        R"(
-          Logical location of the Nix store, usually
-          `/nix/store`. Note that you can only copy store paths
-          between stores if they have the same `store` setting.
-        )"};
-};
-
-/**
- * The order of `StoreDirConfigBase` and then `MixStoreDirMethods` is
- * very important. This ensures that `StoreDirConfigBase::storeDir_`
- * is initialized before we have our one chance (because references are
- * immutable) to initialize `MixStoreDirMethods::storeDir`.
- */
-struct StoreDirConfig : StoreDirConfigBase, MixStoreDirMethods
-{
-    using Params = StringMap;
-
-    StoreDirConfig(const Params & params);
-
-    StoreDirConfig() = delete;
-
-    virtual ~StoreDirConfig() = default;
-};
-
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/store-open.hh b/src/libstore/include/nix/store/store-open.hh
index 7c1cda5be..ef7d81675 100644
--- a/src/libstore/include/nix/store/store-open.hh
+++ b/src/libstore/include/nix/store/store-open.hh
@@ -30,9 +30,12 @@ ref<Store> openStore(StoreReference && storeURI);
  * Opens the store at `uri`, where `uri` is in the format expected by
  * `StoreReference::parse`
  */
-ref<Store> openStore(
-    const std::string & uri = settings.storeUri.get(),
-    const StoreReference::Params & extraParams = StoreReference::Params());
+ref<Store> openStore(const std::string & uri, const StoreReference::Params & extraParams = StoreReference::Params());
+
+/**
+ * Short-hand which opens the default store, according to global settings
+ */
+ref<Store> openStore();
 
 /**
  * @return the default substituter stores, defined by the
@@ -40,4 +43,4 @@ ref<Store> openStore(
  */
 std::list<ref<Store>> getDefaultSubstituters();
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/store-reference.hh b/src/libstore/include/nix/store/store-reference.hh
index c1b681ba1..dc34500d9 100644
--- a/src/libstore/include/nix/store/store-reference.hh
+++ b/src/libstore/include/nix/store/store-reference.hh
@@ -64,7 +64,29 @@ struct StoreReference
         auto operator<=>(const Specified & rhs) const = default;
     };
 
-    typedef std::variant<Auto, Specified> Variant;
+    /**
+     * Special case for `daemon` to avoid normalization.
+     */
+    struct Daemon : Specified
+    {
+        Daemon()
+            : Specified({.scheme = "unix"})
+        {
+        }
+    };
+
+    /**
+     * Special case for `local` to avoid normalization.
+     */
+    struct Local : Specified
+    {
+        Local()
+            : Specified({.scheme = "local"})
+        {
+        }
+    };
+
+    typedef std::variant<Auto, Specified, Daemon, Local> Variant;
 
     Variant variant;
 
@@ -73,9 +95,14 @@ struct StoreReference
     bool operator==(const StoreReference & rhs) const = default;
 
     /**
-     * Render the whole store reference as a URI, including parameters.
+     * Render the whole store reference as a URI, optionally including parameters.
      */
-    std::string render() const;
+    std::string render(bool withParams = true) const;
+
+    std::string to_string() const
+    {
+        return render();
+    }
 
     /**
      * Parse a URI into a store reference.
@@ -83,9 +110,14 @@ struct StoreReference
     static StoreReference parse(const std::string & uri, const Params & extraParams = Params{});
 };
 
+static inline std::ostream & operator<<(std::ostream & os, const StoreReference & ref)
+{
+    return os << ref.render();
+}
+
 /**
  * Split URI into protocol+hierarchy part and its parameter set.
  */
 std::pair<std::string, StoreReference::Params> splitUriAndParams(const std::string & uri);
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/store-registration.hh b/src/libstore/include/nix/store/store-registration.hh
index 17298118e..8b0f344ba 100644
--- a/src/libstore/include/nix/store/store-registration.hh
+++ b/src/libstore/include/nix/store/store-registration.hh
@@ -85,4 +85,4 @@ struct RegisterStoreImplementation
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/uds-remote-store.hh b/src/libstore/include/nix/store/uds-remote-store.hh
index e9793a9ee..37c239796 100644
--- a/src/libstore/include/nix/store/uds-remote-store.hh
+++ b/src/libstore/include/nix/store/uds-remote-store.hh
@@ -7,10 +7,9 @@
 
 namespace nix {
 
-struct UDSRemoteStoreConfig :
-    std::enable_shared_from_this<UDSRemoteStoreConfig>,
-    virtual LocalFSStoreConfig,
-    virtual RemoteStoreConfig
+struct UDSRemoteStoreConfig : std::enable_shared_from_this<UDSRemoteStoreConfig>,
+                              virtual LocalFSStoreConfig,
+                              virtual RemoteStoreConfig
 {
     // TODO(fzakaria): Delete this constructor once moved over to the factory pattern
     // outlined in https://github.com/NixOS/nix/issues/10766
@@ -20,14 +19,14 @@ struct UDSRemoteStoreConfig :
     /**
      * @param authority is the socket path.
      */
-    UDSRemoteStoreConfig(
-        std::string_view scheme,
-        std::string_view authority,
-        const Params & params);
+    UDSRemoteStoreConfig(std::string_view scheme, std::string_view authority, const Params & params);
 
     UDSRemoteStoreConfig(const Params & params);
 
-    static const std::string name() { return "Local Daemon Store"; }
+    static const std::string name()
+    {
+        return "Local Daemon Store";
+    }
 
     static std::string doc();
 
@@ -40,14 +39,16 @@ struct UDSRemoteStoreConfig :
     Path path;
 
     static StringSet uriSchemes()
-    { return {"unix"}; }
+    {
+        return {"unix"};
+    }
 
     ref<Store> openStore() const override;
+
+    StoreReference getReference() const override;
 };
 
-struct UDSRemoteStore :
-    virtual IndirectRootStore,
-    virtual RemoteStore
+struct UDSRemoteStore : virtual IndirectRootStore, virtual RemoteStore
 {
     using Config = UDSRemoteStoreConfig;
 
@@ -55,13 +56,15 @@ struct UDSRemoteStore :
 
     UDSRemoteStore(ref<const Config>);
 
-    std::string getUri() override;
-
     ref<SourceAccessor> getFSAccessor(bool requireValidPath = true) override
-    { return LocalFSStore::getFSAccessor(requireValidPath); }
+    {
+        return LocalFSStore::getFSAccessor(requireValidPath);
+    }
 
     void narFromPath(const StorePath & path, Sink & sink) override
-    { LocalFSStore::narFromPath(path, sink); }
+    {
+        LocalFSStore::narFromPath(path, sink);
+    }
 
     /**
      * Implementation of `IndirectRootStore::addIndirectRoot()` which
@@ -84,4 +87,4 @@ private:
     ref<RemoteStore::Connection> openConnection() override;
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/worker-protocol-connection.hh b/src/libstore/include/nix/store/worker-protocol-connection.hh
index ce7e9aef4..31436395f 100644
--- a/src/libstore/include/nix/store/worker-protocol-connection.hh
+++ b/src/libstore/include/nix/store/worker-protocol-connection.hh
@@ -109,7 +109,8 @@ struct WorkerProto::BasicClientConnection : WorkerProto::BasicConnection
         const StorePathSet & paths,
         SubstituteFlag maybeSubstitute);
 
-    UnkeyedValidPathInfo queryPathInfo(const StoreDirConfig & store, bool * daemonException, const StorePath & path);
+    std::optional<UnkeyedValidPathInfo>
+    queryPathInfo(const StoreDirConfig & store, bool * daemonException, const StorePath & path);
 
     void putBuildDerivationRequest(
         const StoreDirConfig & store,
@@ -129,8 +130,6 @@ struct WorkerProto::BasicClientConnection : WorkerProto::BasicConnection
         bool * daemonException,
         const StorePath & path,
         std::function<void(Source &)> fun);
-
-    void importPaths(const StoreDirConfig & store, bool * daemonException, Source & source);
 };
 
 struct WorkerProto::BasicServerConnection : WorkerProto::BasicConnection
@@ -162,4 +161,4 @@ struct WorkerProto::BasicServerConnection : WorkerProto::BasicConnection
     void postHandshake(const StoreDirConfig & store, const ClientHandshakeInfo & info);
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/worker-protocol-impl.hh b/src/libstore/include/nix/store/worker-protocol-impl.hh
index 23e6068e9..26f6b9d44 100644
--- a/src/libstore/include/nix/store/worker-protocol-impl.hh
+++ b/src/libstore/include/nix/store/worker-protocol-impl.hh
@@ -15,14 +15,15 @@ namespace nix {
 
 /* protocol-agnostic templates */
 
-#define WORKER_USE_LENGTH_PREFIX_SERIALISER(TEMPLATE, T) \
-    TEMPLATE T WorkerProto::Serialise< T >::read(const StoreDirConfig & store, WorkerProto::ReadConn conn) \
-    { \
-        return LengthPrefixedProtoHelper<WorkerProto, T >::read(store, conn); \
-    } \
-    TEMPLATE void WorkerProto::Serialise< T >::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const T & t) \
-    { \
-        LengthPrefixedProtoHelper<WorkerProto, T >::write(store, conn, t); \
+#define WORKER_USE_LENGTH_PREFIX_SERIALISER(TEMPLATE, T)                                                 \
+    TEMPLATE T WorkerProto::Serialise<T>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn) \
+    {                                                                                                    \
+        return LengthPrefixedProtoHelper<WorkerProto, T>::read(store, conn);                             \
+    }                                                                                                    \
+    TEMPLATE void WorkerProto::Serialise<T>::write(                                                      \
+        const StoreDirConfig & store, WorkerProto::WriteConn conn, const T & t)                          \
+    {                                                                                                    \
+        LengthPrefixedProtoHelper<WorkerProto, T>::write(store, conn, t);                                \
     }
 
 WORKER_USE_LENGTH_PREFIX_SERIALISER(template<typename T>, std::vector<T>)
@@ -44,17 +45,15 @@ struct WorkerProto::Serialise
 {
     static T read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
     {
-        return CommonProto::Serialise<T>::read(store,
-            CommonProto::ReadConn { .from = conn.from });
+        return CommonProto::Serialise<T>::read(store, CommonProto::ReadConn{.from = conn.from});
     }
+
     static void write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const T & t)
     {
-        CommonProto::Serialise<T>::write(store,
-            CommonProto::WriteConn { .to = conn.to },
-            t);
+        CommonProto::Serialise<T>::write(store, CommonProto::WriteConn{.to = conn.to}, t);
     }
 };
 
 /* protocol-specific templates */
 
-}
+} // namespace nix
diff --git a/src/libstore/include/nix/store/worker-protocol.hh b/src/libstore/include/nix/store/worker-protocol.hh
index 9630a88c0..29d4828c2 100644
--- a/src/libstore/include/nix/store/worker-protocol.hh
+++ b/src/libstore/include/nix/store/worker-protocol.hh
@@ -7,7 +7,6 @@
 
 namespace nix {
 
-
 #define WORKER_MAGIC_1 0x6e697863
 #define WORKER_MAGIC_2 0x6478696f
 
@@ -17,16 +16,14 @@ namespace nix {
 #define GET_PROTOCOL_MAJOR(x) ((x) & 0xff00)
 #define GET_PROTOCOL_MINOR(x) ((x) & 0x00ff)
 
-
-#define STDERR_NEXT  0x6f6c6d67
-#define STDERR_READ  0x64617461 // data needed from source
+#define STDERR_NEXT 0x6f6c6d67
+#define STDERR_READ 0x64617461  // data needed from source
 #define STDERR_WRITE 0x64617416 // data for sink
-#define STDERR_LAST  0x616c7473
+#define STDERR_LAST 0x616c7473
 #define STDERR_ERROR 0x63787470
 #define STDERR_START_ACTIVITY 0x53545254
-#define STDERR_STOP_ACTIVITY  0x53544f50
-#define STDERR_RESULT         0x52534c54
-
+#define STDERR_STOP_ACTIVITY 0x53544f50
+#define STDERR_RESULT 0x52534c54
 
 struct StoreDirConfig;
 struct Source;
@@ -40,7 +37,6 @@ struct UnkeyedValidPathInfo;
 enum BuildMode : uint8_t;
 enum TrustedFlag : bool;
 
-
 /**
  * The "worker protocol", used by unix:// and ssh-ng:// stores.
  *
@@ -65,7 +61,8 @@ struct WorkerProto
      * A unidirectional read connection, to be used by the read half of the
      * canonical serializers below.
      */
-    struct ReadConn {
+    struct ReadConn
+    {
         Source & from;
         Version version;
     };
@@ -74,7 +71,8 @@ struct WorkerProto
      * A unidirectional write connection, to be used by the write half of the
      * canonical serializers below.
      */
-    struct WriteConn {
+    struct WriteConn
+    {
         Sink & to;
         Version version;
     };
@@ -140,11 +138,10 @@ struct WorkerProto
     static const FeatureSet allFeatures;
 };
 
-enum struct WorkerProto::Op : uint64_t
-{
+enum struct WorkerProto::Op : uint64_t {
     IsValidPath = 1,
     HasSubstitutes = 3,
-    QueryPathHash = 4, // obsolete
+    QueryPathHash = 4,   // obsolete
     QueryReferences = 5, // obsolete
     QueryReferrers = 6,
     AddToStore = 7,
@@ -155,7 +152,6 @@ enum struct WorkerProto::Op : uint64_t
     AddIndirectRoot = 12,
     SyncWithGC = 13,
     FindRoots = 14,
-    ExportPath = 16, // obsolete
     QueryDeriver = 18, // obsolete
     SetOptions = 19,
     CollectGarbage = 20,
@@ -165,7 +161,6 @@ enum struct WorkerProto::Op : uint64_t
     QueryFailedPaths = 24,
     ClearFailedPaths = 25,
     QueryPathInfo = 26,
-    ImportPaths = 27, // obsolete
     QueryDerivationOutputNames = 28, // obsolete
     QueryPathFromHashPart = 29,
     QuerySubstitutablePathInfos = 30,
@@ -211,7 +206,7 @@ struct WorkerProto::ClientHandshakeInfo
      */
     std::optional<TrustedFlag> remoteTrustsUs;
 
-    bool operator == (const ClientHandshakeInfo &) const = default;
+    bool operator==(const ClientHandshakeInfo &) const = default;
 };
 
 /**
@@ -220,7 +215,7 @@ struct WorkerProto::ClientHandshakeInfo
  * @todo Switch to using `WorkerProto::Serialise` instead probably. But
  * this was not done at this time so there would be less churn.
  */
-inline Sink & operator << (Sink & sink, WorkerProto::Op op)
+inline Sink & operator<<(Sink & sink, WorkerProto::Op op)
 {
     return sink << static_cast<uint64_t>(op);
 }
@@ -230,7 +225,7 @@ inline Sink & operator << (Sink & sink, WorkerProto::Op op)
  *
  * @todo Perhaps render known opcodes more nicely.
  */
-inline std::ostream & operator << (std::ostream & s, WorkerProto::Op op)
+inline std::ostream & operator<<(std::ostream & s, WorkerProto::Op op)
 {
     return s << static_cast<uint64_t>(op);
 }
@@ -245,10 +240,10 @@ inline std::ostream & operator << (std::ostream & s, WorkerProto::Op op)
  * be legal specialization syntax. See below for what that looks like in
  * practice.
  */
-#define DECLARE_WORKER_SERIALISER(T) \
-    struct WorkerProto::Serialise< T > \
-    { \
-        static T read(const StoreDirConfig & store, WorkerProto::ReadConn conn); \
+#define DECLARE_WORKER_SERIALISER(T)                                                               \
+    struct WorkerProto::Serialise<T>                                                               \
+    {                                                                                              \
+        static T read(const StoreDirConfig & store, WorkerProto::ReadConn conn);                   \
         static void write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const T & t); \
     };
 
@@ -283,4 +278,4 @@ template<typename K, typename V>
 DECLARE_WORKER_SERIALISER(std::map<K COMMA_ V>);
 #undef COMMA_
 
-}
+} // namespace nix
diff --git a/src/libstore/indirect-root-store.cc b/src/libstore/indirect-root-store.cc
index e23c01e5d..b882b2568 100644
--- a/src/libstore/indirect-root-store.cc
+++ b/src/libstore/indirect-root-store.cc
@@ -42,4 +42,4 @@ Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _g
     return gcRoot;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/keys.cc b/src/libstore/keys.cc
index 9abea9520..8b02e7a66 100644
--- a/src/libstore/keys.cc
+++ b/src/libstore/keys.cc
@@ -28,4 +28,4 @@ PublicKeys getDefaultPublicKeys()
     return publicKeys;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index 9ec9e6eec..f935de206 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -13,49 +13,44 @@
 #include "nix/store/derivations.hh"
 #include "nix/util/callback.hh"
 #include "nix/store/store-registration.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
-LegacySSHStoreConfig::LegacySSHStoreConfig(
-    std::string_view scheme,
-    std::string_view authority,
-    const Params & params)
+LegacySSHStoreConfig::LegacySSHStoreConfig(std::string_view scheme, std::string_view authority, const Params & params)
     : StoreConfig(params)
-    , CommonSSHStoreConfig(scheme, authority, params)
+    , CommonSSHStoreConfig(scheme, ParsedURL::Authority::parse(authority), params)
 {
 }
 
 std::string LegacySSHStoreConfig::doc()
 {
     return
-      #include "legacy-ssh-store.md"
-      ;
+#include "legacy-ssh-store.md"
+        ;
 }
 
-
 struct LegacySSHStore::Connection : public ServeProto::BasicClientConnection
 {
     std::unique_ptr<SSHMaster::Connection> sshConn;
     bool good = true;
 };
 
-
 LegacySSHStore::LegacySSHStore(ref<const Config> config)
     : Store{*config}
     , config{config}
-    , connections(make_ref<Pool<Connection>>(
-        std::max(1, (int) config->maxConnections),
-        [this]() { return openConnection(); },
-        [](const ref<Connection> & r) { return r->good; }
-        ))
+    , connections(
+          make_ref<Pool<Connection>>(
+              std::max(1, (int) config->maxConnections),
+              [this]() { return openConnection(); },
+              [](const ref<Connection> & r) { return r->good; }))
     , master(config->createSSHMaster(
-        // Use SSH master only if using more than 1 connection.
-        connections->capacity() > 1,
-        config->logFD))
+          // Use SSH master only if using more than 1 connection.
+          connections->capacity() > 1,
+          config->logFD))
 {
 }
 
-
 ref<LegacySSHStore::Connection> LegacySSHStore::openConnection()
 {
     auto conn = make_ref<Connection>();
@@ -76,8 +71,8 @@ ref<LegacySSHStore::Connection> LegacySSHStore::openConnection()
     StringSink saved;
     TeeSource tee(conn->from, saved);
     try {
-        conn->remoteVersion = ServeProto::BasicClientConnection::handshake(
-            conn->to, tee, SERVE_PROTOCOL_VERSION, config->host);
+        conn->remoteVersion =
+            ServeProto::BasicClientConnection::handshake(conn->to, tee, SERVE_PROTOCOL_VERSION, config->authority.host);
     } catch (SerialisationError & e) {
         // in.close(): Don't let the remote block on us not writing.
         conn->sshConn->in.close();
@@ -85,30 +80,35 @@ ref<LegacySSHStore::Connection> LegacySSHStore::openConnection()
             NullSink nullSink;
             tee.drainInto(nullSink);
         }
-        throw Error("'nix-store --serve' protocol mismatch from '%s', got '%s'",
-            config->host, chomp(saved.s));
+        throw Error(
+            "'nix-store --serve' protocol mismatch from '%s', got '%s'", config->authority.host, chomp(saved.s));
     } catch (EndOfFile & e) {
-        throw Error("cannot connect to '%1%'", config->host);
+        throw Error("cannot connect to '%1%'", config->authority.host);
     }
 
     return conn;
 };
 
-
-std::string LegacySSHStore::getUri()
+StoreReference LegacySSHStoreConfig::getReference() const
 {
-    return *Config::uriSchemes().begin() + "://" + config->host;
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = *uriSchemes().begin(),
+                .authority = authority.to_string(),
+            },
+        .params = getQueryParams(),
+    };
 }
 
-std::map<StorePath, UnkeyedValidPathInfo> LegacySSHStore::queryPathInfosUncached(
-    const StorePathSet & paths)
+std::map<StorePath, UnkeyedValidPathInfo> LegacySSHStore::queryPathInfosUncached(const StorePathSet & paths)
 {
     auto conn(connections->get());
 
-    /* No longer support missing NAR hash */
-    assert(GET_PROTOCOL_MINOR(conn->remoteVersion) >= 4);
-
-    debug("querying remote host '%s' for info on '%s'", config->host, concatStringsSep(", ", printStorePathSet(paths)));
+    debug(
+        "querying remote host '%s' for info on '%s'",
+        config->authority.host,
+        concatStringsSep(", ", printStorePathSet(paths)));
 
     auto infos = conn->queryPathInfos(*this, paths);
 
@@ -120,8 +120,8 @@ std::map<StorePath, UnkeyedValidPathInfo> LegacySSHStore::queryPathInfosUncached
     return infos;
 }
 
-void LegacySSHStore::queryPathInfoUncached(const StorePath & path,
-    Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
+void LegacySSHStore::queryPathInfoUncached(
+    const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
 {
     try {
         auto infos = queryPathInfosUncached({path});
@@ -133,88 +133,50 @@ void LegacySSHStore::queryPathInfoUncached(const StorePath & path,
             auto & [path2, info] = *infos.begin();
 
             assert(path == path2);
-            return callback(std::make_shared<ValidPathInfo>(
-                std::move(path),
-                std::move(info)
-            ));
+            return callback(std::make_shared<ValidPathInfo>(std::move(path), std::move(info)));
         }
         default:
             throw Error("More path infos returned than queried");
         }
-    } catch (...) { callback.rethrow(); }
-}
-
-
-void LegacySSHStore::addToStore(const ValidPathInfo & info, Source & source,
-    RepairFlag repair, CheckSigsFlag checkSigs)
-{
-    debug("adding path '%s' to remote host '%s'", printStorePath(info.path), config->host);
-
-    auto conn(connections->get());
-
-    if (GET_PROTOCOL_MINOR(conn->remoteVersion) >= 5) {
-
-        conn->to
-            << ServeProto::Command::AddToStoreNar
-            << printStorePath(info.path)
-            << (info.deriver ? printStorePath(*info.deriver) : "")
-            << info.narHash.to_string(HashFormat::Base16, false);
-        ServeProto::write(*this, *conn, info.references);
-        conn->to
-            << info.registrationTime
-            << info.narSize
-            << info.ultimate
-            << info.sigs
-            << renderContentAddress(info.ca);
-        try {
-            copyNAR(source, conn->to);
-        } catch (...) {
-            conn->good = false;
-            throw;
-        }
-        conn->to.flush();
-
-        if (readInt(conn->from) != 1)
-            throw Error("failed to add path '%s' to remote host '%s'", printStorePath(info.path), config->host);
-
-    } else {
-
-        conn->importPaths(*this, [&](Sink & sink) {
-            try {
-                copyNAR(source, sink);
-            } catch (...) {
-                conn->good = false;
-                throw;
-            }
-            sink
-                << exportMagic
-                << printStorePath(info.path);
-            ServeProto::write(*this, *conn, info.references);
-            sink
-                << (info.deriver ? printStorePath(*info.deriver) : "")
-                << 0
-                << 0;
-        });
-
+    } catch (...) {
+        callback.rethrow();
     }
 }
 
+void LegacySSHStore::addToStore(const ValidPathInfo & info, Source & source, RepairFlag repair, CheckSigsFlag checkSigs)
+{
+    debug("adding path '%s' to remote host '%s'", printStorePath(info.path), config->authority.host);
+
+    auto conn(connections->get());
+
+    conn->to << ServeProto::Command::AddToStoreNar << printStorePath(info.path)
+             << (info.deriver ? printStorePath(*info.deriver) : "")
+             << info.narHash.to_string(HashFormat::Base16, false);
+    ServeProto::write(*this, *conn, info.references);
+    conn->to << info.registrationTime << info.narSize << info.ultimate << info.sigs << renderContentAddress(info.ca);
+    try {
+        copyNAR(source, conn->to);
+    } catch (...) {
+        conn->good = false;
+        throw;
+    }
+    conn->to.flush();
+
+    if (readInt(conn->from) != 1)
+        throw Error("failed to add path '%s' to remote host '%s'", printStorePath(info.path), config->authority.host);
+}
 
 void LegacySSHStore::narFromPath(const StorePath & path, Sink & sink)
 {
-    narFromPath(path, [&](auto & source) {
-        copyNAR(source, sink);
-    });
+    narFromPath(path, [&](auto & source) { copyNAR(source, sink); });
 }
 
-
 void LegacySSHStore::narFromPath(const StorePath & path, std::function<void(Source &)> fun)
 {
     auto conn(connections->get());
     conn->narFromPath(*this, path, fun);
 }
 
-
 static ServeProto::BuildOptions buildSettings()
 {
     return {
@@ -227,9 +189,7 @@ static ServeProto::BuildOptions buildSettings()
     };
 }
 
-
-BuildResult LegacySSHStore::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
-    BuildMode buildMode)
+BuildResult LegacySSHStore::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
 {
     auto conn(connections->get());
 
@@ -239,20 +199,17 @@ BuildResult LegacySSHStore::buildDerivation(const StorePath & drvPath, const Bas
 }
 
 std::function<BuildResult()> LegacySSHStore::buildDerivationAsync(
-    const StorePath & drvPath, const BasicDerivation & drv,
-    const ServeProto::BuildOptions & options)
+    const StorePath & drvPath, const BasicDerivation & drv, const ServeProto::BuildOptions & options)
 {
     // Until we have C++23 std::move_only_function
     auto conn = std::make_shared<Pool<Connection>::Handle>(connections->get());
     (*conn)->putBuildDerivationRequest(*this, drvPath, drv, options);
 
-    return [this,conn]() -> BuildResult {
-        return (*conn)->getBuildDerivationResponse(*this);
-    };
+    return [this, conn]() -> BuildResult { return (*conn)->getBuildDerivationResponse(*this); };
 }
 
-
-void LegacySSHStore::buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+void LegacySSHStore::buildPaths(
+    const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
 {
     if (evalStore && evalStore.get() != this)
         throw Error("building on an SSH store is incompatible with '--eval-store'");
@@ -263,17 +220,20 @@ void LegacySSHStore::buildPaths(const std::vector<DerivedPath> & drvPaths, Build
     Strings ss;
     for (auto & p : drvPaths) {
         auto sOrDrvPath = StorePathWithOutputs::tryFromDerivedPath(p);
-        std::visit(overloaded {
-            [&](const StorePathWithOutputs & s) {
-                ss.push_back(s.to_string(*this));
+        std::visit(
+            overloaded{
+                [&](const StorePathWithOutputs & s) { ss.push_back(s.to_string(*this)); },
+                [&](const StorePath & drvPath) {
+                    throw Error(
+                        "wanted to fetch '%s' but the legacy ssh protocol doesn't support merely substituting drv files via the build paths command. It would build them instead. Try using ssh-ng://",
+                        printStorePath(drvPath));
+                },
+                [&](std::monostate) {
+                    throw Error(
+                        "wanted build derivation that is itself a build product, but the legacy ssh protocol doesn't support that. Try using ssh-ng://");
+                },
             },
-            [&](const StorePath & drvPath) {
-                throw Error("wanted to fetch '%s' but the legacy ssh protocol doesn't support merely substituting drv files via the build paths command. It would build them instead. Try using ssh-ng://", printStorePath(drvPath));
-            },
-            [&](std::monostate) {
-                throw Error("wanted build derivation that is itself a build product, but the legacy ssh protocol doesn't support that. Try using ssh-ng://");
-            },
-        }, sOrDrvPath);
+            sOrDrvPath);
     }
     conn->to << ss;
 
@@ -290,10 +250,8 @@ void LegacySSHStore::buildPaths(const std::vector<DerivedPath> & drvPaths, Build
     }
 }
 
-
-void LegacySSHStore::computeFSClosure(const StorePathSet & paths,
-    StorePathSet & out, bool flipDirection,
-    bool includeOutputs, bool includeDerivers)
+void LegacySSHStore::computeFSClosure(
+    const StorePathSet & paths, StorePathSet & out, bool flipDirection, bool includeOutputs, bool includeDerivers)
 {
     if (flipDirection || includeDerivers) {
         Store::computeFSClosure(paths, out, flipDirection, includeOutputs, includeDerivers);
@@ -302,9 +260,7 @@ void LegacySSHStore::computeFSClosure(const StorePathSet & paths,
 
     auto conn(connections->get());
 
-    conn->to
-        << ServeProto::Command::QueryClosure
-        << includeOutputs;
+    conn->to << ServeProto::Command::QueryClosure << includeOutputs;
     ServeProto::write(*this, *conn, paths);
     conn->to.flush();
 
@@ -312,55 +268,29 @@ void LegacySSHStore::computeFSClosure(const StorePathSet & paths,
         out.insert(i);
 }
 
-
-StorePathSet LegacySSHStore::queryValidPaths(const StorePathSet & paths,
-    SubstituteFlag maybeSubstitute)
+StorePathSet LegacySSHStore::queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute)
 {
     auto conn(connections->get());
-    return conn->queryValidPaths(*this,
-        false, paths, maybeSubstitute);
+    return conn->queryValidPaths(*this, false, paths, maybeSubstitute);
 }
 
-
-StorePathSet LegacySSHStore::queryValidPaths(const StorePathSet & paths,
-    bool lock, SubstituteFlag maybeSubstitute)
+StorePathSet LegacySSHStore::queryValidPaths(const StorePathSet & paths, bool lock, SubstituteFlag maybeSubstitute)
 {
     auto conn(connections->get());
-    return conn->queryValidPaths(*this,
-        lock, paths, maybeSubstitute);
+    return conn->queryValidPaths(*this, lock, paths, maybeSubstitute);
 }
 
-
-void LegacySSHStore::addMultipleToStoreLegacy(Store & srcStore, const StorePathSet & paths)
-{
-    auto conn(connections->get());
-    conn->to << ServeProto::Command::ImportPaths;
-    try {
-        srcStore.exportPaths(paths, conn->to);
-    } catch (...) {
-        conn->good = false;
-        throw;
-    }
-    conn->to.flush();
-
-    if (readInt(conn->from) != 1)
-        throw Error("remote machine failed to import closure");
-}
-
-
 void LegacySSHStore::connect()
 {
     auto conn(connections->get());
 }
 
-
 unsigned int LegacySSHStore::getProtocol()
 {
     auto conn(connections->get());
     return conn->remoteVersion;
 }
 
-
 pid_t LegacySSHStore::getConnectionPid()
 {
     auto conn(connections->get());
@@ -372,7 +302,6 @@ pid_t LegacySSHStore::getConnectionPid()
 #endif
 }
 
-
 LegacySSHStore::ConnectionStats LegacySSHStore::getConnectionStats()
 {
     auto conn(connections->get());
@@ -382,7 +311,6 @@ LegacySSHStore::ConnectionStats LegacySSHStore::getConnectionStats()
     };
 }
 
-
 /**
  * The legacy ssh protocol doesn't support checking for trusted-user.
  * Try using ssh-ng:// instead if you want to know.
@@ -392,12 +320,11 @@ std::optional<TrustedFlag> LegacySSHStore::isTrustedClient()
     return std::nullopt;
 }
 
-
-ref<Store> LegacySSHStore::Config::openStore() const {
+ref<Store> LegacySSHStore::Config::openStore() const
+{
     return make_ref<LegacySSHStore>(ref{shared_from_this()});
 }
 
-
 static RegisterStoreImplementation<LegacySSHStore::Config> regLegacySSHStore;
 
-}
+} // namespace nix
diff --git a/src/libstore/legacy-ssh-store.md b/src/libstore/legacy-ssh-store.md
index 043acebd6..c33fc8992 100644
--- a/src/libstore/legacy-ssh-store.md
+++ b/src/libstore/legacy-ssh-store.md
@@ -1,6 +1,6 @@
 R"(
 
-**Store URL format**: `ssh://[username@]hostname`
+**Store URL format**: `ssh://[username@]hostname[:port]`
 
 This store type allows limited access to a remote store on another
 machine via SSH.
diff --git a/src/libstore/linux/fchmodat2-compat.hh b/src/libstore/linux/fchmodat2-compat.hh
index 42b3f3a35..907695c31 100644
--- a/src/libstore/linux/fchmodat2-compat.hh
+++ b/src/libstore/linux/fchmodat2-compat.hh
@@ -1,4 +1,5 @@
 #include "store-config-private.hh"
+#include <cstdint>
 
 /*
  * Determine the syscall number for `fchmodat2`.
diff --git a/src/libstore/linux/include/nix/store/meson.build b/src/libstore/linux/include/nix/store/meson.build
index c8e6a8268..a664aefa9 100644
--- a/src/libstore/linux/include/nix/store/meson.build
+++ b/src/libstore/linux/include/nix/store/meson.build
@@ -2,5 +2,4 @@ include_dirs += include_directories('../..')
 
 headers += files(
   'personality.hh',
-  # hack for trailing newline
 )
diff --git a/src/libstore/linux/include/nix/store/personality.hh b/src/libstore/linux/include/nix/store/personality.hh
index 6a6376f8f..01bf2bf33 100644
--- a/src/libstore/linux/include/nix/store/personality.hh
+++ b/src/libstore/linux/include/nix/store/personality.hh
@@ -8,5 +8,3 @@ namespace nix::linux {
 void setPersonality(std::string_view system);
 
 }
-
-
diff --git a/src/libstore/linux/meson.build b/src/libstore/linux/meson.build
index 5771cead5..6fc193cf8 100644
--- a/src/libstore/linux/meson.build
+++ b/src/libstore/linux/meson.build
@@ -1,6 +1,5 @@
 sources += files(
   'personality.cc',
-  # hack for trailing newline
 )
 
 subdir('include/nix/store')
diff --git a/src/libstore/linux/personality.cc b/src/libstore/linux/personality.cc
index e87006d86..d268706b2 100644
--- a/src/libstore/linux/personality.cc
+++ b/src/libstore/linux/personality.cc
@@ -10,32 +10,31 @@ namespace nix::linux {
 
 void setPersonality(std::string_view system)
 {
-        /* Change the personality to 32-bit if we're doing an
-           i686-linux build on an x86_64-linux machine. */
-        struct utsname utsbuf;
-        uname(&utsbuf);
-        if ((system == "i686-linux"
-                && (std::string_view(NIX_LOCAL_SYSTEM) == "x86_64-linux"
-                    || (!strcmp(utsbuf.sysname, "Linux") && !strcmp(utsbuf.machine, "x86_64"))))
-            || system == "armv7l-linux"
-            || system == "armv6l-linux"
-            || system == "armv5tel-linux")
-        {
-            if (personality(PER_LINUX32) == -1)
-                throw SysError("cannot set 32-bit personality");
-        }
+    /* Change the personality to 32-bit if we're doing an
+       i686-linux build on an x86_64-linux machine. */
+    struct utsname utsbuf;
+    uname(&utsbuf);
+    if ((system == "i686-linux"
+         && (std::string_view(NIX_LOCAL_SYSTEM) == "x86_64-linux"
+             || (!strcmp(utsbuf.sysname, "Linux") && !strcmp(utsbuf.machine, "x86_64"))))
+        || system == "armv7l-linux" || system == "armv6l-linux" || system == "armv5tel-linux") {
+        if (personality(PER_LINUX32) == -1)
+            throw SysError("cannot set 32-bit personality");
+    }
 
-        /* Impersonate a Linux 2.6 machine to get some determinism in
-           builds that depend on the kernel version. */
-        if ((system == "i686-linux" || system == "x86_64-linux") && settings.impersonateLinux26) {
-            int cur = personality(0xffffffff);
-            if (cur != -1) personality(cur | 0x0020000 /* == UNAME26 */);
-        }
-
-        /* Disable address space randomization for improved
-           determinism. */
+    /* Impersonate a Linux 2.6 machine to get some determinism in
+       builds that depend on the kernel version. */
+    if ((system == "i686-linux" || system == "x86_64-linux") && settings.impersonateLinux26) {
         int cur = personality(0xffffffff);
-        if (cur != -1) personality(cur | ADDR_NO_RANDOMIZE);
+        if (cur != -1)
+            personality(cur | 0x0020000 /* == UNAME26 */);
+    }
+
+    /* Disable address space randomization for improved
+       determinism. */
+    int cur = personality(0xffffffff);
+    if (cur != -1)
+        personality(cur | ADDR_NO_RANDOMIZE);
 }
 
-}
+} // namespace nix::linux
diff --git a/src/libstore/local-binary-cache-store.cc b/src/libstore/local-binary-cache-store.cc
index 2f23135fa..b5e43de68 100644
--- a/src/libstore/local-binary-cache-store.cc
+++ b/src/libstore/local-binary-cache-store.cc
@@ -9,26 +9,32 @@
 namespace nix {
 
 LocalBinaryCacheStoreConfig::LocalBinaryCacheStoreConfig(
-    std::string_view scheme,
-    PathView binaryCacheDir,
-    const StoreReference::Params & params)
+    std::string_view scheme, PathView binaryCacheDir, const StoreReference::Params & params)
     : Store::Config{params}
     , BinaryCacheStoreConfig{params}
     , binaryCacheDir(binaryCacheDir)
 {
 }
 
-
 std::string LocalBinaryCacheStoreConfig::doc()
 {
     return
-      #include "local-binary-cache-store.md"
-      ;
+#include "local-binary-cache-store.md"
+        ;
 }
 
+StoreReference LocalBinaryCacheStoreConfig::getReference() const
+{
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = "file",
+                .authority = binaryCacheDir,
+            },
+    };
+}
 
-struct LocalBinaryCacheStore :
-    virtual BinaryCacheStore
+struct LocalBinaryCacheStore : virtual BinaryCacheStore
 {
     using Config = LocalBinaryCacheStoreConfig;
 
@@ -39,21 +45,16 @@ struct LocalBinaryCacheStore :
         , BinaryCacheStore{*config}
         , config{config}
     {
-        init();
     }
 
     void init() override;
 
-    std::string getUri() override
-    {
-        return "file://" + config->binaryCacheDir;
-    }
-
 protected:
 
     bool fileExists(const std::string & path) override;
 
-    void upsertFile(const std::string & path,
+    void upsertFile(
+        const std::string & path,
         std::shared_ptr<std::basic_iostream<char>> istream,
         const std::string & mimeType) override
     {
@@ -85,12 +86,9 @@ protected:
         for (auto & entry : DirectoryIterator{config->binaryCacheDir}) {
             checkInterrupt();
             auto name = entry.path().filename().string();
-            if (name.size() != 40 ||
-                !hasSuffix(name, ".narinfo"))
+            if (name.size() != 40 || !hasSuffix(name, ".narinfo"))
                 continue;
-            paths.insert(parseStorePath(
-                    storeDir + "/" + name.substr(0, name.size() - 8)
-                    + "-" + MissingName));
+            paths.insert(parseStorePath(storeDir + "/" + name.substr(0, name.size() - 8) + "-" + MissingName));
         }
 
         return paths;
@@ -125,13 +123,15 @@ StringSet LocalBinaryCacheStoreConfig::uriSchemes()
         return {"file"};
 }
 
-ref<Store> LocalBinaryCacheStoreConfig::openStore() const {
-    return make_ref<LocalBinaryCacheStore>(ref{
-        // FIXME we shouldn't actually need a mutable config
-        std::const_pointer_cast<LocalBinaryCacheStore::Config>(shared_from_this())
-    });
+ref<Store> LocalBinaryCacheStoreConfig::openStore() const
+{
+    auto store = make_ref<LocalBinaryCacheStore>(
+        ref{// FIXME we shouldn't actually need a mutable config
+            std::const_pointer_cast<LocalBinaryCacheStore::Config>(shared_from_this())});
+    store->init();
+    return store;
 }
 
 static RegisterStoreImplementation<LocalBinaryCacheStore::Config> regLocalBinaryCacheStore;
 
-}
+} // namespace nix
diff --git a/src/libstore/local-fs-store.cc b/src/libstore/local-fs-store.cc
index add3b04d2..e0f07b91b 100644
--- a/src/libstore/local-fs-store.cc
+++ b/src/libstore/local-fs-store.cc
@@ -8,17 +8,25 @@
 
 namespace nix {
 
+Path LocalFSStoreConfig::getDefaultStateDir()
+{
+    return settings.nixStateDir;
+}
+
+Path LocalFSStoreConfig::getDefaultLogDir()
+{
+    return settings.nixLogDir;
+}
+
 LocalFSStoreConfig::LocalFSStoreConfig(PathView rootDir, const Params & params)
     : StoreConfig(params)
     // Default `?root` from `rootDir` if non set
     // FIXME don't duplicate description once we don't have root setting
     , rootDir{
-        this,
-        !rootDir.empty() && params.count("root") == 0
-            ? (std::optional<Path>{rootDir})
-            : std::nullopt,
-        "root",
-        "Directory prefixed to all other paths."}
+          this,
+          !rootDir.empty() && params.count("root") == 0 ? (std::optional<Path>{rootDir}) : std::nullopt,
+          "root",
+          "Directory prefixed to all other paths."}
 {
 }
 
@@ -40,7 +48,6 @@ struct LocalStoreAccessor : PosixSourceAccessor
     {
     }
 
-
     void requireStoreObject(const CanonPath & path)
     {
         auto [storePath, rest] = store->toStorePath(store->storeDir + path.abs());
@@ -53,7 +60,7 @@ struct LocalStoreAccessor : PosixSourceAccessor
         /* Also allow `path` to point to the entire store, which is
            needed for resolving symlinks. */
         if (path.isRoot())
-            return Stat{ .type = tDirectory };
+            return Stat{.type = tDirectory};
 
         requireStoreObject(path);
         return PosixSourceAccessor::maybeLstat(path);
@@ -65,10 +72,7 @@ struct LocalStoreAccessor : PosixSourceAccessor
         return PosixSourceAccessor::readDirectory(path);
     }
 
-    void readFile(
-        const CanonPath & path,
-        Sink & sink,
-        std::function<void(uint64_t)> sizeCallback) override
+    void readFile(const CanonPath & path, Sink & sink, std::function<void(uint64_t)> sizeCallback) override
     {
         requireStoreObject(path);
         return PosixSourceAccessor::readFile(path, sink, sizeCallback);
@@ -83,9 +87,8 @@ struct LocalStoreAccessor : PosixSourceAccessor
 
 ref<SourceAccessor> LocalFSStore::getFSAccessor(bool requireValidPath)
 {
-    return make_ref<LocalStoreAccessor>(ref<LocalFSStore>(
-            std::dynamic_pointer_cast<LocalFSStore>(shared_from_this())),
-        requireValidPath);
+    return make_ref<LocalStoreAccessor>(
+        ref<LocalFSStore>(std::dynamic_pointer_cast<LocalFSStore>(shared_from_this())), requireValidPath);
 }
 
 void LocalFSStore::narFromPath(const StorePath & path, Sink & sink)
@@ -104,9 +107,8 @@ std::optional<std::string> LocalFSStore::getBuildLogExact(const StorePath & path
     for (int j = 0; j < 2; j++) {
 
         Path logPath =
-            j == 0
-            ? fmt("%s/%s/%s/%s", config.logDir.get(), drvsLogDir, baseName.substr(0, 2), baseName.substr(2))
-            : fmt("%s/%s/%s", config.logDir.get(), drvsLogDir, baseName);
+            j == 0 ? fmt("%s/%s/%s/%s", config.logDir.get(), drvsLogDir, baseName.substr(0, 2), baseName.substr(2))
+                   : fmt("%s/%s/%s", config.logDir.get(), drvsLogDir, baseName);
         Path logBz2Path = logPath + ".bz2";
 
         if (pathExists(logPath))
@@ -115,12 +117,12 @@ std::optional<std::string> LocalFSStore::getBuildLogExact(const StorePath & path
         else if (pathExists(logBz2Path)) {
             try {
                 return decompress("bzip2", readFile(logBz2Path));
-            } catch (Error &) { }
+            } catch (Error &) {
+            }
         }
-
     }
 
     return std::nullopt;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/local-overlay-store.cc b/src/libstore/local-overlay-store.cc
index e40c5fa6e..2b000b3db 100644
--- a/src/libstore/local-overlay-store.cc
+++ b/src/libstore/local-overlay-store.cc
@@ -13,24 +13,31 @@ namespace nix {
 std::string LocalOverlayStoreConfig::doc()
 {
     return
-        #include "local-overlay-store.md"
+#include "local-overlay-store.md"
         ;
 }
 
 ref<Store> LocalOverlayStoreConfig::openStore() const
 {
-    return make_ref<LocalOverlayStore>(ref{
-        std::dynamic_pointer_cast<const LocalOverlayStoreConfig>(shared_from_this())
-    });
+    return make_ref<LocalOverlayStore>(
+        ref{std::dynamic_pointer_cast<const LocalOverlayStoreConfig>(shared_from_this())});
 }
 
+StoreReference LocalOverlayStoreConfig::getReference() const
+{
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = *uriSchemes().begin(),
+            },
+    };
+}
 
 Path LocalOverlayStoreConfig::toUpperPath(const StorePath & path) const
 {
     return upperLayer + "/" + path.to_string();
 }
 
-
 LocalOverlayStore::LocalOverlayStore(ref<const Config> config)
     : Store{*config}
     , LocalFSStore{*config}
@@ -60,13 +67,11 @@ LocalOverlayStore::LocalOverlayStore(ref<const Config> config)
             debug("expected lowerdir: %s", expectedLowerDir);
             debug("expected upperdir: %s", config->upperLayer);
             debug("actual mount: %s", mountInfo);
-            throw Error("overlay filesystem '%s' mounted incorrectly",
-                config->realStoreDir.get());
+            throw Error("overlay filesystem '%s' mounted incorrectly", config->realStoreDir.get());
         }
     }
 }
 
-
 void LocalOverlayStore::registerDrvOutput(const Realisation & info)
 {
     // First do queryRealisation on lower layer to populate DB
@@ -77,14 +82,13 @@ void LocalOverlayStore::registerDrvOutput(const Realisation & info)
     LocalStore::registerDrvOutput(info);
 }
 
-
-void LocalOverlayStore::queryPathInfoUncached(const StorePath & path,
-    Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
+void LocalOverlayStore::queryPathInfoUncached(
+    const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
 {
     auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback));
 
-    LocalStore::queryPathInfoUncached(path,
-        {[this, path, callbackPtr](std::future<std::shared_ptr<const ValidPathInfo>> fut) {
+    LocalStore::queryPathInfoUncached(
+        path, {[this, path, callbackPtr](std::future<std::shared_ptr<const ValidPathInfo>> fut) {
             try {
                 auto info = fut.get();
                 if (info)
@@ -93,25 +97,23 @@ void LocalOverlayStore::queryPathInfoUncached(const StorePath & path,
                 return callbackPtr->rethrow();
             }
             // If we don't have it, check lower store
-            lowerStore->queryPathInfo(path,
-                {[path, callbackPtr](std::future<ref<const ValidPathInfo>> fut) {
-                    try {
-                        (*callbackPtr)(fut.get().get_ptr());
-                    } catch (...) {
-                        return callbackPtr->rethrow();
-                    }
-                }});
+            lowerStore->queryPathInfo(path, {[path, callbackPtr](std::future<ref<const ValidPathInfo>> fut) {
+                                          try {
+                                              (*callbackPtr)(fut.get().get_ptr());
+                                          } catch (...) {
+                                              return callbackPtr->rethrow();
+                                          }
+                                      }});
         }});
 }
 
-
-void LocalOverlayStore::queryRealisationUncached(const DrvOutput & drvOutput,
-    Callback<std::shared_ptr<const Realisation>> callback) noexcept
+void LocalOverlayStore::queryRealisationUncached(
+    const DrvOutput & drvOutput, Callback<std::shared_ptr<const Realisation>> callback) noexcept
 {
     auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback));
 
-    LocalStore::queryRealisationUncached(drvOutput,
-        {[this, drvOutput, callbackPtr](std::future<std::shared_ptr<const Realisation>> fut) {
+    LocalStore::queryRealisationUncached(
+        drvOutput, {[this, drvOutput, callbackPtr](std::future<std::shared_ptr<const Realisation>> fut) {
             try {
                 auto info = fut.get();
                 if (info)
@@ -120,8 +122,8 @@ void LocalOverlayStore::queryRealisationUncached(const DrvOutput & drvOutput,
                 return callbackPtr->rethrow();
             }
             // If we don't have it, check lower store
-            lowerStore->queryRealisation(drvOutput,
-                {[callbackPtr](std::future<std::shared_ptr<const Realisation>> fut) {
+            lowerStore->queryRealisation(
+                drvOutput, {[callbackPtr](std::future<std::shared_ptr<const Realisation>> fut) {
                     try {
                         (*callbackPtr)(fut.get());
                     } catch (...) {
@@ -131,11 +133,11 @@ void LocalOverlayStore::queryRealisationUncached(const DrvOutput & drvOutput,
         }});
 }
 
-
 bool LocalOverlayStore::isValidPathUncached(const StorePath & path)
 {
     auto res = LocalStore::isValidPathUncached(path);
-    if (res) return res;
+    if (res)
+        return res;
     res = lowerStore->isValidPath(path);
     if (res) {
         // Get path info from lower store so upper DB genuinely has it.
@@ -149,20 +151,17 @@ bool LocalOverlayStore::isValidPathUncached(const StorePath & path)
     return res;
 }
 
-
 void LocalOverlayStore::queryReferrers(const StorePath & path, StorePathSet & referrers)
 {
     LocalStore::queryReferrers(path, referrers);
     lowerStore->queryReferrers(path, referrers);
 }
 
-
 void LocalOverlayStore::queryGCReferrers(const StorePath & path, StorePathSet & referrers)
 {
     LocalStore::queryReferrers(path, referrers);
 }
 
-
 StorePathSet LocalOverlayStore::queryValidDerivers(const StorePath & path)
 {
     auto res = LocalStore::queryValidDerivers(path);
@@ -171,7 +170,6 @@ StorePathSet LocalOverlayStore::queryValidDerivers(const StorePath & path)
     return res;
 }
 
-
 std::optional<StorePath> LocalOverlayStore::queryPathFromHashPart(const std::string & hashPart)
 {
     auto res = LocalStore::queryPathFromHashPart(hashPart);
@@ -181,7 +179,6 @@ std::optional<StorePath> LocalOverlayStore::queryPathFromHashPart(const std::str
         return lowerStore->queryPathFromHashPart(hashPart);
 }
 
-
 void LocalOverlayStore::registerValidPaths(const ValidPathInfos & infos)
 {
     // First, get any from lower store so we merge
@@ -200,7 +197,6 @@ void LocalOverlayStore::registerValidPaths(const ValidPathInfos & infos)
     LocalStore::registerValidPaths(infos);
 }
 
-
 void LocalOverlayStore::collectGarbage(const GCOptions & options, GCResults & results)
 {
     LocalStore::collectGarbage(options, results);
@@ -208,7 +204,6 @@ void LocalOverlayStore::collectGarbage(const GCOptions & options, GCResults & re
     remountIfNecessary();
 }
 
-
 void LocalOverlayStore::deleteStorePath(const Path & path, uint64_t & bytesFreed)
 {
     auto mergedDir = config->realStoreDir.get() + "/";
@@ -236,7 +231,6 @@ void LocalOverlayStore::deleteStorePath(const Path & path, uint64_t & bytesFreed
     }
 }
 
-
 void LocalOverlayStore::optimiseStore()
 {
     Activity act(*logger, actOptimiseStore);
@@ -261,7 +255,6 @@ void LocalOverlayStore::optimiseStore()
     remountIfNecessary();
 }
 
-
 LocalStore::VerificationResult LocalOverlayStore::verifyAllValidPaths(RepairFlag repair)
 {
     StorePathSet done;
@@ -282,10 +275,10 @@ LocalStore::VerificationResult LocalOverlayStore::verifyAllValidPaths(RepairFlag
     };
 }
 
-
 void LocalOverlayStore::remountIfNecessary()
 {
-    if (!_remountRequired) return;
+    if (!_remountRequired)
+        return;
 
     if (config->remountHook.get().empty()) {
         warn("'%s' needs remounting, set remount-hook to do this automatically", config->realStoreDir.get());
@@ -296,7 +289,6 @@ void LocalOverlayStore::remountIfNecessary()
     _remountRequired = false;
 }
 
-
 static RegisterStoreImplementation<LocalOverlayStore::Config> regLocalOverlayStore;
 
-}
+} // namespace nix
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 0d2d96e61..4cadf5282 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -7,7 +7,7 @@
 #include "nix/store/derivations.hh"
 #include "nix/store/realisation.hh"
 #include "nix/store/nar-info.hh"
-#include "nix/util/references.hh"
+#include "nix/store/references.hh"
 #include "nix/util/callback.hh"
 #include "nix/util/topo-sort.hh"
 #include "nix/util/finally.hh"
@@ -16,6 +16,7 @@
 #include "nix/store/posix-fs-canonicalise.hh"
 #include "nix/util/posix-source-accessor.hh"
 #include "nix/store/keys.hh"
+#include "nix/util/url.hh"
 #include "nix/util/users.hh"
 #include "nix/store/store-open.hh"
 #include "nix/store/store-registration.hh"
@@ -37,17 +38,17 @@
 #include <time.h>
 
 #ifndef _WIN32
-# include <grp.h>
+#  include <grp.h>
 #endif
 
 #ifdef __linux__
-# include <sched.h>
-# include <sys/statvfs.h>
-# include <sys/mount.h>
+#  include <sched.h>
+#  include <sys/statvfs.h>
+#  include <sys/mount.h>
 #endif
 
 #ifdef __CYGWIN__
-# include <windows.h>
+#  include <windows.h>
 #endif
 
 #include <sqlite3.h>
@@ -58,13 +59,9 @@
 
 #include "store-config-private.hh"
 
-
 namespace nix {
 
-LocalStoreConfig::LocalStoreConfig(
-    std::string_view scheme,
-    std::string_view authority,
-    const Params & params)
+LocalStoreConfig::LocalStoreConfig(std::string_view scheme, std::string_view authority, const Params & params)
     : StoreConfig(params)
     , LocalFSStoreConfig(authority, params)
 {
@@ -73,18 +70,15 @@ LocalStoreConfig::LocalStoreConfig(
 std::string LocalStoreConfig::doc()
 {
     return
-        #include "local-store.md"
+#include "local-store.md"
         ;
 }
 
 Path LocalBuildStoreConfig::getBuildDir() const
 {
-    return
-        settings.buildDir.get().has_value()
-        ? *settings.buildDir.get()
-        : buildDir.get().has_value()
-        ? *buildDir.get()
-        : stateDir.get() + "/builds";
+    return settings.buildDir.get().has_value() ? *settings.buildDir.get()
+           : buildDir.get().has_value()        ? *buildDir.get()
+                                               : stateDir.get() + "/builds";
 }
 
 ref<Store> LocalStore::Config::openStore() const
@@ -92,7 +86,13 @@ ref<Store> LocalStore::Config::openStore() const
     return make_ref<LocalStore>(ref{shared_from_this()});
 }
 
-struct LocalStore::State::Stmts {
+bool LocalStoreConfig::getDefaultRequireSigs()
+{
+    return settings.requireSigs;
+}
+
+struct LocalStore::State::Stmts
+{
     /* Some precompiled SQLite statements. */
     SQLiteStmt RegisterValidPath;
     SQLiteStmt UpdatePathInfo;
@@ -118,6 +118,7 @@ LocalStore::LocalStore(ref<const Config> config)
     : Store{*config}
     , LocalFSStore{*config}
     , config{config}
+    , _state(make_ref<Sync<State>>())
     , dbDir(config->stateDir + "/db")
     , linksDir(config->realStoreDir + "/.links")
     , reservedPath(dbDir + "/reserved")
@@ -125,7 +126,7 @@ LocalStore::LocalStore(ref<const Config> config)
     , tempRootsDir(config->stateDir + "/temproots")
     , fnTempRoots(fmt("%s/%d", tempRootsDir, getpid()))
 {
-    auto state(_state.lock());
+    auto state(_state->lock());
     state->stmts = std::make_unique<State::Stmts>();
 
     /* Create missing state directories if they don't already exist. */
@@ -164,7 +165,8 @@ LocalStore::LocalStore(ref<const Config> config)
 
         struct group * gr = getgrnam(settings.buildUsersGroup.get().c_str());
         if (!gr)
-            printError("warning: the group '%1%' specified in 'build-users-group' does not exist", settings.buildUsersGroup);
+            printError(
+                "warning: the group '%1%' specified in 'build-users-group' does not exist", settings.buildUsersGroup);
         else if (!config->readOnly) {
             struct stat st;
             if (stat(config->realStoreDir.get().c_str(), &st))
@@ -187,9 +189,9 @@ LocalStore::LocalStore(ref<const Config> config)
         while (path != root) {
             if (std::filesystem::is_symlink(path))
                 throw Error(
-                        "the path '%1%' is a symlink; "
-                        "this is not allowed for the Nix store and its parent directories",
-                        path);
+                    "the path '%1%' is a symlink; "
+                    "this is not allowed for the Nix store and its parent directories",
+                    path);
             path = path.parent_path();
         }
     }
@@ -200,14 +202,15 @@ LocalStore::LocalStore(ref<const Config> config)
        before doing a garbage collection. */
     try {
         struct stat st;
-        if (stat(reservedPath.c_str(), &st) == -1 ||
-            st.st_size != settings.reservedSize)
-        {
-            AutoCloseFD fd = toDescriptor(open(reservedPath.c_str(), O_WRONLY | O_CREAT
+        if (stat(reservedPath.c_str(), &st) == -1 || st.st_size != settings.reservedSize) {
+            AutoCloseFD fd = toDescriptor(open(
+                reservedPath.c_str(),
+                O_WRONLY | O_CREAT
 #ifndef _WIN32
-                | O_CLOEXEC
+                    | O_CLOEXEC
 #endif
-                , 0600));
+                ,
+                0600));
             int res = -1;
 #if HAVE_POSIX_FALLOCATE
             res = posix_fallocate(fd.get(), 0, settings.reservedSize);
@@ -231,7 +234,17 @@ LocalStore::LocalStore(ref<const Config> config)
        schema upgrade is in progress. */
     if (!config->readOnly) {
         Path globalLockPath = dbDir + "/big-lock";
-        globalLock = openLockFile(globalLockPath.c_str(), true);
+        try {
+            globalLock = openLockFile(globalLockPath.c_str(), true);
+        } catch (SysError & e) {
+            if (e.errNo == EACCES || e.errNo == EPERM) {
+                e.addTrace(
+                    {},
+                    "This command may have been run as non-root in a single-user Nix installation,\n"
+                    "or the Nix daemon may have crashed.");
+            }
+            throw;
+        }
     }
 
     if (!config->readOnly && !lockFile(globalLock.get(), ltRead, false)) {
@@ -245,14 +258,13 @@ LocalStore::LocalStore(ref<const Config> config)
     if (config->readOnly && curSchema < nixSchemaVersion) {
         debug("current schema version: %d", curSchema);
         debug("supported schema version: %d", nixSchemaVersion);
-        throw Error(curSchema == 0 ?
-            "database does not exist, and cannot be created in read-only mode" :
-            "database schema needs migrating, but this cannot be done in read-only mode");
+        throw Error(
+            curSchema == 0 ? "database does not exist, and cannot be created in read-only mode"
+                           : "database schema needs migrating, but this cannot be done in read-only mode");
     }
 
     if (curSchema > nixSchemaVersion)
-        throw Error("current Nix store schema is version %1%, but I only support %2%",
-             curSchema, nixSchemaVersion);
+        throw Error("current Nix store schema is version %1%, but I only support %2%", curSchema, nixSchemaVersion);
 
     else if (curSchema == 0) { /* new store */
         curSchema = nixSchemaVersion;
@@ -275,7 +287,8 @@ LocalStore::LocalStore(ref<const Config> config)
 
         if (!lockFile(globalLock.get(), ltWrite, false)) {
             printInfo("waiting for exclusive access to the Nix store...");
-            lockFile(globalLock.get(), ltNone, false); // We have acquired a shared lock; release it to prevent deadlocks
+            lockFile(
+                globalLock.get(), ltNone, false); // We have acquired a shared lock; release it to prevent deadlocks
             lockFile(globalLock.get(), ltWrite, true);
         }
 
@@ -313,44 +326,46 @@ LocalStore::LocalStore(ref<const Config> config)
         lockFile(globalLock.get(), ltRead, true);
     }
 
-    else openDB(*state, false);
+    else
+        openDB(*state, false);
 
     upgradeDBSchema(*state);
 
     /* Prepare SQL statements. */
-    state->stmts->RegisterValidPath.create(state->db,
+    state->stmts->RegisterValidPath.create(
+        state->db,
         "insert into ValidPaths (path, hash, registrationTime, deriver, narSize, ultimate, sigs, ca) values (?, ?, ?, ?, ?, ?, ?, ?);");
-    state->stmts->UpdatePathInfo.create(state->db,
-        "update ValidPaths set narSize = ?, hash = ?, ultimate = ?, sigs = ?, ca = ? where path = ?;");
-    state->stmts->AddReference.create(state->db,
-        "insert or replace into Refs (referrer, reference) values (?, ?);");
-    state->stmts->QueryPathInfo.create(state->db,
+    state->stmts->UpdatePathInfo.create(
+        state->db, "update ValidPaths set narSize = ?, hash = ?, ultimate = ?, sigs = ?, ca = ? where path = ?;");
+    state->stmts->AddReference.create(state->db, "insert or replace into Refs (referrer, reference) values (?, ?);");
+    state->stmts->QueryPathInfo.create(
+        state->db,
         "select id, hash, registrationTime, deriver, narSize, ultimate, sigs, ca from ValidPaths where path = ?;");
-    state->stmts->QueryReferences.create(state->db,
-        "select path from Refs join ValidPaths on reference = id where referrer = ?;");
-    state->stmts->QueryReferrers.create(state->db,
+    state->stmts->QueryReferences.create(
+        state->db, "select path from Refs join ValidPaths on reference = id where referrer = ?;");
+    state->stmts->QueryReferrers.create(
+        state->db,
         "select path from Refs join ValidPaths on referrer = id where reference = (select id from ValidPaths where path = ?);");
-    state->stmts->InvalidatePath.create(state->db,
-        "delete from ValidPaths where path = ?;");
-    state->stmts->AddDerivationOutput.create(state->db,
-        "insert or replace into DerivationOutputs (drv, id, path) values (?, ?, ?);");
-    state->stmts->QueryValidDerivers.create(state->db,
-        "select v.id, v.path from DerivationOutputs d join ValidPaths v on d.drv = v.id where d.path = ?;");
-    state->stmts->QueryDerivationOutputs.create(state->db,
-        "select id, path from DerivationOutputs where drv = ?;");
+    state->stmts->InvalidatePath.create(state->db, "delete from ValidPaths where path = ?;");
+    state->stmts->AddDerivationOutput.create(
+        state->db, "insert or replace into DerivationOutputs (drv, id, path) values (?, ?, ?);");
+    state->stmts->QueryValidDerivers.create(
+        state->db, "select v.id, v.path from DerivationOutputs d join ValidPaths v on d.drv = v.id where d.path = ?;");
+    state->stmts->QueryDerivationOutputs.create(state->db, "select id, path from DerivationOutputs where drv = ?;");
     // Use "path >= ?" with limit 1 rather than "path like '?%'" to
     // ensure efficient lookup.
-    state->stmts->QueryPathFromHashPart.create(state->db,
-        "select path from ValidPaths where path >= ? limit 1;");
+    state->stmts->QueryPathFromHashPart.create(state->db, "select path from ValidPaths where path >= ? limit 1;");
     state->stmts->QueryValidPaths.create(state->db, "select path from ValidPaths");
     if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
-        state->stmts->RegisterRealisedOutput.create(state->db,
+        state->stmts->RegisterRealisedOutput.create(
+            state->db,
             R"(
                 insert into Realisations (drvPath, outputName, outputPath, signatures)
                 values (?, ?, (select id from ValidPaths where path = ?), ?)
                 ;
             )");
-        state->stmts->UpdateRealisedOutput.create(state->db,
+        state->stmts->UpdateRealisedOutput.create(
+            state->db,
             R"(
                 update Realisations
                     set signatures = ?
@@ -359,27 +374,31 @@ LocalStore::LocalStore(ref<const Config> config)
                     outputName = ?
                 ;
             )");
-        state->stmts->QueryRealisedOutput.create(state->db,
+        state->stmts->QueryRealisedOutput.create(
+            state->db,
             R"(
                 select Realisations.id, Output.path, Realisations.signatures from Realisations
                     inner join ValidPaths as Output on Output.id = Realisations.outputPath
                     where drvPath = ? and outputName = ?
                     ;
             )");
-        state->stmts->QueryAllRealisedOutputs.create(state->db,
+        state->stmts->QueryAllRealisedOutputs.create(
+            state->db,
             R"(
                 select outputName, Output.path from Realisations
                     inner join ValidPaths as Output on Output.id = Realisations.outputPath
                     where drvPath = ?
                     ;
             )");
-        state->stmts->QueryRealisationReferences.create(state->db,
+        state->stmts->QueryRealisationReferences.create(
+            state->db,
             R"(
                 select drvPath, outputName from Realisations
                     join RealisationsRefs on realisationReference = Realisations.id
                     where referrer = ?;
             )");
-        state->stmts->AddRealisationReference.create(state->db,
+        state->stmts->AddRealisationReference.create(
+            state->db,
             R"(
                 insert or replace into RealisationsRefs (referrer, realisationReference)
                 values (
@@ -389,33 +408,33 @@ LocalStore::LocalStore(ref<const Config> config)
     }
 }
 
-
 AutoCloseFD LocalStore::openGCLock()
 {
     Path fnGCLock = config->stateDir + "/gc.lock";
-    auto fdGCLock = open(fnGCLock.c_str(), O_RDWR | O_CREAT
+    auto fdGCLock = open(
+        fnGCLock.c_str(),
+        O_RDWR | O_CREAT
 #ifndef _WIN32
-        | O_CLOEXEC
+            | O_CLOEXEC
 #endif
-        , 0600);
+        ,
+        0600);
     if (!fdGCLock)
         throw SysError("opening global GC lock '%1%'", fnGCLock);
     return toDescriptor(fdGCLock);
 }
 
-
 void LocalStore::deleteStorePath(const Path & path, uint64_t & bytesFreed)
 {
     deletePath(path, bytesFreed);
 }
 
-
 LocalStore::~LocalStore()
 {
     std::shared_future<void> future;
 
     {
-        auto state(_state.lock());
+        auto state(_state->lock());
         if (state->gcRunning)
             future = state->gcFuture;
     }
@@ -436,13 +455,22 @@ LocalStore::~LocalStore()
     }
 }
 
-
-std::string LocalStore::getUri()
+StoreReference LocalStoreConfig::getReference() const
 {
-    return "local";
+    auto params = getQueryParams();
+    /* Back-compatibility kludge. Tools like nix-output-monitor expect 'local'
+       and can't parse 'local://'. */
+    if (params.empty())
+        return {.variant = StoreReference::Local{}};
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = *uriSchemes().begin(),
+            },
+        .params = std::move(params),
+    };
 }
 
-
 int LocalStore::getSchema()
 {
     int curSchema = 0;
@@ -466,12 +494,11 @@ void LocalStore::openDB(State & state, bool create)
         throw SysError("Nix database directory '%1%' is not writable", dbDir);
 
     /* Open the Nix database. */
-    std::string dbPath = dbDir + "/db.sqlite";
     auto & db(state.db);
     auto openMode = config->readOnly ? SQLiteOpenMode::Immutable
-                  : create ? SQLiteOpenMode::Normal
-                  : SQLiteOpenMode::NoCreate;
-    state.db = SQLite(dbPath, openMode);
+                    : create         ? SQLiteOpenMode::Normal
+                                     : SQLiteOpenMode::NoCreate;
+    state.db = SQLite(std::filesystem::path(dbDir) / "db.sqlite", openMode);
 
 #ifdef __CYGWIN__
     /* The cygwin version of sqlite3 has a patch which calls
@@ -504,8 +531,8 @@ void LocalStore::openDB(State & state, bool create)
             SQLiteError::throw_(db, "querying journal mode");
         prevMode = std::string((const char *) sqlite3_column_text(stmt, 0));
     }
-    if (prevMode != mode &&
-        sqlite3_exec(db, ("pragma main.journal_mode = " + mode + ";").c_str(), 0, 0, 0) != SQLITE_OK)
+    if (prevMode != mode
+        && sqlite3_exec(db, ("pragma main.journal_mode = " + mode + ";").c_str(), 0, 0, 0) != SQLITE_OK)
         SQLiteError::throw_(db, "setting journal mode");
 
     if (mode == "wal") {
@@ -536,7 +563,6 @@ void LocalStore::openDB(State & state, bool create)
     }
 }
 
-
 void LocalStore::upgradeDBSchema(State & state)
 {
     state.db.exec("create table if not exists SchemaMigrations (migration text primary key not null);");
@@ -551,8 +577,7 @@ void LocalStore::upgradeDBSchema(State & state)
             schemaMigrations.insert(useQuerySchemaMigrations.getStr(0));
     }
 
-    auto doUpgrade = [&](const std::string & migrationName, const std::string & stmt)
-    {
+    auto doUpgrade = [&](const std::string & migrationName, const std::string & stmt) {
         if (schemaMigrations.contains(migrationName))
             return;
 
@@ -568,17 +593,17 @@ void LocalStore::upgradeDBSchema(State & state)
     if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations))
         doUpgrade(
             "20220326-ca-derivations",
-            #include "ca-specific-schema.sql.gen.hh"
-            );
+#include "ca-specific-schema.sql.gen.hh"
+        );
 }
 
-
 /* To improve purity, users may want to make the Nix store a read-only
    bind mount.  So make the Nix store writable for this process. */
 void LocalStore::makeStoreWritable()
 {
 #ifdef __linux__
-    if (!isRootUser()) return;
+    if (!isRootUser())
+        return;
     /* Check if /nix/store is on a read-only mount. */
     struct statvfs stat;
     if (statvfs(config->realStoreDir.get().c_str(), &stat) != 0)
@@ -591,102 +616,86 @@ void LocalStore::makeStoreWritable()
 #endif
 }
 
-
 void LocalStore::registerDrvOutput(const Realisation & info, CheckSigsFlag checkSigs)
 {
     experimentalFeatureSettings.require(Xp::CaDerivations);
     if (checkSigs == NoCheckSigs || !realisationIsUntrusted(info))
         registerDrvOutput(info);
     else
-        throw Error("cannot register realisation '%s' because it lacks a signature by a trusted key", info.outPath.to_string());
+        throw Error(
+            "cannot register realisation '%s' because it lacks a signature by a trusted key", info.outPath.to_string());
 }
 
 void LocalStore::registerDrvOutput(const Realisation & info)
 {
     experimentalFeatureSettings.require(Xp::CaDerivations);
     retrySQLite<void>([&]() {
-        auto state(_state.lock());
+        auto state(_state->lock());
         if (auto oldR = queryRealisation_(*state, info.id)) {
             if (info.isCompatibleWith(*oldR)) {
                 auto combinedSignatures = oldR->signatures;
-                combinedSignatures.insert(info.signatures.begin(),
-                    info.signatures.end());
-                state->stmts->UpdateRealisedOutput.use()
-                    (concatStringsSep(" ", combinedSignatures))
-                    (info.id.strHash())
-                    (info.id.outputName)
+                combinedSignatures.insert(info.signatures.begin(), info.signatures.end());
+                state->stmts->UpdateRealisedOutput
+                    .use()(concatStringsSep(" ", combinedSignatures))(info.id.strHash())(info.id.outputName)
                     .exec();
             } else {
-                throw Error("Trying to register a realisation of '%s', but we already "
-                            "have another one locally.\n"
-                            "Local:  %s\n"
-                            "Remote: %s",
+                throw Error(
+                    "Trying to register a realisation of '%s', but we already "
+                    "have another one locally.\n"
+                    "Local:  %s\n"
+                    "Remote: %s",
                     info.id.to_string(),
                     printStorePath(oldR->outPath),
-                    printStorePath(info.outPath)
-                );
+                    printStorePath(info.outPath));
             }
         } else {
-            state->stmts->RegisterRealisedOutput.use()
-                (info.id.strHash())
-                (info.id.outputName)
-                (printStorePath(info.outPath))
-                (concatStringsSep(" ", info.signatures))
+            state->stmts->RegisterRealisedOutput
+                .use()(info.id.strHash())(info.id.outputName)(printStorePath(info.outPath))(
+                    concatStringsSep(" ", info.signatures))
                 .exec();
         }
         for (auto & [outputId, depPath] : info.dependentRealisations) {
             auto localRealisation = queryRealisationCore_(*state, outputId);
             if (!localRealisation)
-                throw Error("unable to register the derivation '%s' as it "
-                            "depends on the non existent '%s'",
-                    info.id.to_string(), outputId.to_string());
+                throw Error(
+                    "unable to register the derivation '%s' as it "
+                    "depends on the non existent '%s'",
+                    info.id.to_string(),
+                    outputId.to_string());
             if (localRealisation->second.outPath != depPath)
-                throw Error("unable to register the derivation '%s' as it "
-                            "depends on a realisation of '%s' that doesn’t"
-                            "match what we have locally",
-                    info.id.to_string(), outputId.to_string());
-            state->stmts->AddRealisationReference.use()
-                (info.id.strHash())
-                (info.id.outputName)
-                (outputId.strHash())
-                (outputId.outputName)
+                throw Error(
+                    "unable to register the derivation '%s' as it "
+                    "depends on a realisation of '%s' that doesn’t"
+                    "match what we have locally",
+                    info.id.to_string(),
+                    outputId.to_string());
+            state->stmts->AddRealisationReference
+                .use()(info.id.strHash())(info.id.outputName)(outputId.strHash())(outputId.outputName)
                 .exec();
         }
     });
 }
 
 void LocalStore::cacheDrvOutputMapping(
-    State & state,
-    const uint64_t deriver,
-    const std::string & outputName,
-    const StorePath & output)
+    State & state, const uint64_t deriver, const std::string & outputName, const StorePath & output)
 {
-    retrySQLite<void>([&]() {
-        state.stmts->AddDerivationOutput.use()
-            (deriver)
-            (outputName)
-            (printStorePath(output))
-            .exec();
-    });
+    retrySQLite<void>(
+        [&]() { state.stmts->AddDerivationOutput.use()(deriver)(outputName) (printStorePath(output)).exec(); });
 }
 
-
-uint64_t LocalStore::addValidPath(State & state,
-    const ValidPathInfo & info, bool checkOutputs)
+uint64_t LocalStore::addValidPath(State & state, const ValidPathInfo & info, bool checkOutputs)
 {
     if (info.ca.has_value() && !info.isContentAddressed(*this))
-        throw Error("cannot add path '%s' to the Nix store because it claims to be content-addressed but isn't",
+        throw Error(
+            "cannot add path '%s' to the Nix store because it claims to be content-addressed but isn't",
             printStorePath(info.path));
 
-    state.stmts->RegisterValidPath.use()
-        (printStorePath(info.path))
-        (info.narHash.to_string(HashFormat::Base16, true))
-        (info.registrationTime == 0 ? time(0) : info.registrationTime)
-        (info.deriver ? printStorePath(*info.deriver) : "", (bool) info.deriver)
-        (info.narSize, info.narSize != 0)
-        (info.ultimate ? 1 : 0, info.ultimate)
-        (concatStringsSep(" ", info.sigs), !info.sigs.empty())
-        (renderContentAddress(info.ca), (bool) info.ca)
+    state.stmts->RegisterValidPath
+        .use()(printStorePath(info.path))(info.narHash.to_string(HashFormat::Base16, true))(
+            info.registrationTime == 0 ? time(0) : info.registrationTime)(
+            info.deriver ? printStorePath(*info.deriver) : "",
+            (bool) info.deriver)(info.narSize, info.narSize != 0)(info.ultimate ? 1 : 0, info.ultimate)(
+            concatStringsSep(" ", info.sigs), !info.sigs.empty())(renderContentAddress(info.ca), (bool) info.ca)
         .exec();
     uint64_t id = state.db.getLastInsertedRowId();
 
@@ -702,7 +711,8 @@ uint64_t LocalStore::addValidPath(State & state,
            derivations).  Note that if this throws an error, then the
            DB transaction is rolled back, so the path validity
            registration above is undone. */
-        if (checkOutputs) drv.checkInvariants(*this, info.path);
+        if (checkOutputs)
+            drv.checkInvariants(*this, info.path);
 
         for (auto & i : drv.outputsAndOptPaths(*this)) {
             /* Floating CA derivations have indeterminate output paths until
@@ -712,29 +722,25 @@ uint64_t LocalStore::addValidPath(State & state,
         }
     }
 
-    {
-        auto state_(Store::state.lock());
-        state_->pathInfoCache.upsert(std::string(info.path.to_string()),
-            PathInfoCacheValue{ .value = std::make_shared<const ValidPathInfo>(info) });
-    }
+    pathInfoCache->lock()->upsert(
+        std::string(info.path.to_string()), PathInfoCacheValue{.value = std::make_shared<const ValidPathInfo>(info)});
 
     return id;
 }
 
-
-void LocalStore::queryPathInfoUncached(const StorePath & path,
-    Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
+void LocalStore::queryPathInfoUncached(
+    const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
 {
     try {
         callback(retrySQLite<std::shared_ptr<const ValidPathInfo>>([&]() {
-            auto state(_state.lock());
-            return queryPathInfoInternal(*state, path);
+            return queryPathInfoInternal(*_state->lock(), path);
         }));
 
-    } catch (...) { callback.rethrow(); }
+    } catch (...) {
+        callback.rethrow();
+    }
 }
 
-
 std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & state, const StorePath & path)
 {
     /* Get the path info. */
@@ -759,7 +765,8 @@ std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & s
     info->registrationTime = useQueryPathInfo.getInt(2);
 
     auto s = (const char *) sqlite3_column_text(state.stmts->QueryPathInfo, 3);
-    if (s) info->deriver = parseStorePath(s);
+    if (s)
+        info->deriver = parseStorePath(s);
 
     /* Note that narSize = NULL yields 0. */
     info->narSize = useQueryPathInfo.getInt(4);
@@ -767,10 +774,12 @@ std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & s
     info->ultimate = useQueryPathInfo.getInt(5) == 1;
 
     s = (const char *) sqlite3_column_text(state.stmts->QueryPathInfo, 6);
-    if (s) info->sigs = tokenizeString<StringSet>(s, " ");
+    if (s)
+        info->sigs = tokenizeString<StringSet>(s, " ");
 
     s = (const char *) sqlite3_column_text(state.stmts->QueryPathInfo, 7);
-    if (s) info->ca = ContentAddress::parseOpt(s);
+    if (s)
+        info->ca = ContentAddress::parseOpt(s);
 
     /* Get the references. */
     auto useQueryReferences(state.stmts->QueryReferences.use()(info->id));
@@ -781,21 +790,16 @@ std::shared_ptr<const ValidPathInfo> LocalStore::queryPathInfoInternal(State & s
     return info;
 }
 
-
 /* Update path info in the database. */
 void LocalStore::updatePathInfo(State & state, const ValidPathInfo & info)
 {
-    state.stmts->UpdatePathInfo.use()
-        (info.narSize, info.narSize != 0)
-        (info.narHash.to_string(HashFormat::Base16, true))
-        (info.ultimate ? 1 : 0, info.ultimate)
-        (concatStringsSep(" ", info.sigs), !info.sigs.empty())
-        (renderContentAddress(info.ca), (bool) info.ca)
-        (printStorePath(info.path))
+    state.stmts->UpdatePathInfo
+        .use()(info.narSize, info.narSize != 0)(info.narHash.to_string(HashFormat::Base16, true))(
+            info.ultimate ? 1 : 0, info.ultimate)(concatStringsSep(" ", info.sigs), !info.sigs.empty())(
+            renderContentAddress(info.ca), (bool) info.ca)(printStorePath(info.path))
         .exec();
 }
 
-
 uint64_t LocalStore::queryValidPathId(State & state, const StorePath & path)
 {
     auto use(state.stmts->QueryPathInfo.use()(printStorePath(path)));
@@ -804,43 +808,37 @@ uint64_t LocalStore::queryValidPathId(State & state, const StorePath & path)
     return use.getInt(0);
 }
 
-
 bool LocalStore::isValidPath_(State & state, const StorePath & path)
 {
     return state.stmts->QueryPathInfo.use()(printStorePath(path)).next();
 }
 
-
 bool LocalStore::isValidPathUncached(const StorePath & path)
 {
-    return retrySQLite<bool>([&]() {
-        auto state(_state.lock());
-        return isValidPath_(*state, path);
-    });
+    return retrySQLite<bool>([&]() { return isValidPath_(*_state->lock(), path); });
 }
 
-
 StorePathSet LocalStore::queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute)
 {
     StorePathSet res;
     for (auto & i : paths)
-        if (isValidPath(i)) res.insert(i);
+        if (isValidPath(i))
+            res.insert(i);
     return res;
 }
 
-
 StorePathSet LocalStore::queryAllValidPaths()
 {
     return retrySQLite<StorePathSet>([&]() {
-        auto state(_state.lock());
+        auto state(_state->lock());
         auto use(state->stmts->QueryValidPaths.use());
         StorePathSet res;
-        while (use.next()) res.insert(parseStorePath(use.getStr(0)));
+        while (use.next())
+            res.insert(parseStorePath(use.getStr(0)));
         return res;
     });
 }
 
-
 void LocalStore::queryReferrers(State & state, const StorePath & path, StorePathSet & referrers)
 {
     auto useQueryReferrers(state.stmts->QueryReferrers.use()(printStorePath(path)));
@@ -849,20 +847,15 @@ void LocalStore::queryReferrers(State & state, const StorePath & path, StorePath
         referrers.insert(parseStorePath(useQueryReferrers.getStr(0)));
 }
 
-
 void LocalStore::queryReferrers(const StorePath & path, StorePathSet & referrers)
 {
-    return retrySQLite<void>([&]() {
-        auto state(_state.lock());
-        queryReferrers(*state, path, referrers);
-    });
+    return retrySQLite<void>([&]() { queryReferrers(*_state->lock(), path, referrers); });
 }
 
-
 StorePathSet LocalStore::queryValidDerivers(const StorePath & path)
 {
     return retrySQLite<StorePathSet>([&]() {
-        auto state(_state.lock());
+        auto state(_state->lock());
 
         auto useQueryValidDerivers(state->stmts->QueryValidDerivers.use()(printStorePath(path)));
 
@@ -874,19 +867,17 @@ StorePathSet LocalStore::queryValidDerivers(const StorePath & path)
     });
 }
 
-
 std::map<std::string, std::optional<StorePath>>
 LocalStore::queryStaticPartialDerivationOutputMap(const StorePath & path)
 {
     return retrySQLite<std::map<std::string, std::optional<StorePath>>>([&]() {
-        auto state(_state.lock());
+        auto state(_state->lock());
         std::map<std::string, std::optional<StorePath>> outputs;
         uint64_t drvId;
         drvId = queryValidPathId(*state, path);
         auto use(state->stmts->QueryDerivationOutputs.use()(drvId));
         while (use.next())
-            outputs.insert_or_assign(
-                use.getStr(0), parseStorePath(use.getStr(1)));
+            outputs.insert_or_assign(use.getStr(0), parseStorePath(use.getStr(1)));
 
         return outputs;
     });
@@ -894,16 +885,18 @@ LocalStore::queryStaticPartialDerivationOutputMap(const StorePath & path)
 
 std::optional<StorePath> LocalStore::queryPathFromHashPart(const std::string & hashPart)
 {
-    if (hashPart.size() != StorePath::HashLen) throw Error("invalid hash part");
+    if (hashPart.size() != StorePath::HashLen)
+        throw Error("invalid hash part");
 
     Path prefix = storeDir + "/" + hashPart;
 
     return retrySQLite<std::optional<StorePath>>([&]() -> std::optional<StorePath> {
-        auto state(_state.lock());
+        auto state(_state->lock());
 
         auto useQueryPathFromHashPart(state->stmts->QueryPathFromHashPart.use()(prefix));
 
-        if (!useQueryPathFromHashPart.next()) return {};
+        if (!useQueryPathFromHashPart.next())
+            return {};
 
         const char * s = (const char *) sqlite3_column_text(state->stmts->QueryPathFromHashPart, 0);
         if (s && prefix.compare(0, prefix.size(), s, prefix.size()) == 0)
@@ -912,10 +905,10 @@ std::optional<StorePath> LocalStore::queryPathFromHashPart(const std::string & h
     });
 }
 
-
 StorePathSet LocalStore::querySubstitutablePaths(const StorePathSet & paths)
 {
-    if (!settings.useSubstitutes) return StorePathSet();
+    if (!settings.useSubstitutes)
+        return StorePathSet();
 
     StorePathSet remaining;
     for (auto & i : paths)
@@ -924,9 +917,12 @@ StorePathSet LocalStore::querySubstitutablePaths(const StorePathSet & paths)
     StorePathSet res;
 
     for (auto & sub : getDefaultSubstituters()) {
-        if (remaining.empty()) break;
-        if (sub->storeDir != storeDir) continue;
-        if (!sub->config.wantMassQuery) continue;
+        if (remaining.empty())
+            break;
+        if (sub->storeDir != storeDir)
+            continue;
+        if (!sub->config.wantMassQuery)
+            continue;
 
         auto valid = sub->queryValidPaths(remaining);
 
@@ -943,13 +939,11 @@ StorePathSet LocalStore::querySubstitutablePaths(const StorePathSet & paths)
     return res;
 }
 
-
 void LocalStore::registerValidPath(const ValidPathInfo & info)
 {
     registerValidPaths({{info.path, info}});
 }
 
-
 void LocalStore::registerValidPaths(const ValidPathInfos & infos)
 {
 #ifndef _WIN32
@@ -957,11 +951,12 @@ void LocalStore::registerValidPaths(const ValidPathInfos & infos)
        be fsync-ed.  So some may want to fsync them before registering
        the validity, at the expense of some speed of the path
        registering operation. */
-    if (settings.syncBeforeRegistering) sync();
+    if (settings.syncBeforeRegistering)
+        sync();
 #endif
 
     return retrySQLite<void>([&]() {
-        auto state(_state.lock());
+        auto state(_state->lock());
 
         SQLiteTxn txn(state->db);
         StorePathSet paths;
@@ -994,13 +989,15 @@ void LocalStore::registerValidPaths(const ValidPathInfos & infos)
            error if a cycle is detected and roll back the
            transaction.  Cycles can only occur when a derivation
            has multiple outputs. */
-        topoSort(paths,
+        topoSort(
+            paths,
             {[&](const StorePath & path) {
                 auto i = infos.find(path);
                 return i == infos.end() ? StorePathSet() : i->second.references;
             }},
             {[&](const StorePath & path, const StorePath & parent) {
                 return BuildError(
+                    BuildResult::OutputRejected,
                     "cycle detected in the references of '%s' from '%s'",
                     printStorePath(path),
                     printStorePath(parent));
@@ -1010,7 +1007,6 @@ void LocalStore::registerValidPaths(const ValidPathInfos & infos)
     });
 }
 
-
 /* Invalidate a path.  The caller is responsible for checking that
    there are no referrers. */
 void LocalStore::invalidatePath(State & state, const StorePath & path)
@@ -1022,15 +1018,12 @@ void LocalStore::invalidatePath(State & state, const StorePath & path)
     /* Note that the foreign key constraints on the Refs table take
        care of deleting the references entries for `path'. */
 
-    {
-        auto state_(Store::state.lock());
-        state_->pathInfoCache.erase(std::string(path.to_string()));
-    }
+    pathInfoCache->lock()->erase(std::string(path.to_string()));
 }
 
 const PublicKeys & LocalStore::getPublicKeys()
 {
-    auto state(_state.lock());
+    auto state(_state->lock());
     if (!state->publicKeys)
         state->publicKeys = std::make_unique<PublicKeys>(getDefaultPublicKeys());
     return *state->publicKeys;
@@ -1046,8 +1039,7 @@ bool LocalStore::realisationIsUntrusted(const Realisation & realisation)
     return config->requireSigs && !realisation.checkSignatures(getPublicKeys());
 }
 
-void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
-    RepairFlag repair, CheckSigsFlag checkSigs)
+void LocalStore::addToStore(const ValidPathInfo & info, Source & source, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     if (checkSigs && pathInfoIsUntrusted(info))
         throw Error("cannot add path '%s' because it lacks a signature by a trusted key", printStorePath(info.path));
@@ -1089,51 +1081,57 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
                 of the NAR. */
                 HashSink hashSink(HashAlgorithm::SHA256);
 
-                TeeSource wrapperSource { source, hashSink };
+                TeeSource wrapperSource{source, hashSink};
 
                 narRead = true;
                 restorePath(realPath, wrapperSource, settings.fsyncStorePaths);
 
                 auto hashResult = hashSink.finish();
 
-                if (hashResult.first != info.narHash)
-                    throw Error("hash mismatch importing path '%s';\n  specified: %s\n  got:       %s",
-                                printStorePath(info.path), info.narHash.to_string(HashFormat::Nix32, true), hashResult.first.to_string(HashFormat::Nix32, true));
+                if (hashResult.hash != info.narHash)
+                    throw Error(
+                        "hash mismatch importing path '%s';\n  specified: %s\n  got:       %s",
+                        printStorePath(info.path),
+                        info.narHash.to_string(HashFormat::Nix32, true),
+                        hashResult.hash.to_string(HashFormat::Nix32, true));
 
-                if (hashResult.second != info.narSize)
-                    throw Error("size mismatch importing path '%s';\n  specified: %s\n  got:       %s",
-                        printStorePath(info.path), info.narSize, hashResult.second);
+                if (hashResult.numBytesDigested != info.narSize)
+                    throw Error(
+                        "size mismatch importing path '%s';\n  specified: %s\n  got:       %s",
+                        printStorePath(info.path),
+                        info.narSize,
+                        hashResult.numBytesDigested);
 
                 if (info.ca) {
                     auto & specified = *info.ca;
                     auto actualHash = ({
                         auto accessor = getFSAccessor(false);
-                        CanonPath path { info.path.to_string() };
-                        Hash h { HashAlgorithm::SHA256 }; // throwaway def to appease C++
+                        CanonPath path{info.path.to_string()};
+                        Hash h{HashAlgorithm::SHA256}; // throwaway def to appease C++
                         auto fim = specified.method.getFileIngestionMethod();
                         switch (fim) {
                         case FileIngestionMethod::Flat:
-                        case FileIngestionMethod::NixArchive:
-                        {
-                            HashModuloSink caSink {
+                        case FileIngestionMethod::NixArchive: {
+                            HashModuloSink caSink{
                                 specified.hash.algo,
-                                std::string { info.path.hashPart() },
+                                std::string{info.path.hashPart()},
                             };
                             dumpPath({accessor, path}, caSink, (FileSerialisationMethod) fim);
-                            h = caSink.finish().first;
+                            h = caSink.finish().hash;
                             break;
                         }
                         case FileIngestionMethod::Git:
                             h = git::dumpHash(specified.hash.algo, {accessor, path}).hash;
                             break;
                         }
-                        ContentAddress {
+                        ContentAddress{
                             .method = specified.method,
                             .hash = std::move(h),
                         };
                     });
                     if (specified.hash != actualHash.hash) {
-                        throw Error("ca hash mismatch importing path '%s';\n  specified: %s\n  got:       %s",
+                        throw Error(
+                            "ca hash mismatch importing path '%s';\n  specified: %s\n  got:       %s",
                             printStorePath(info.path),
                             specified.hash.to_string(HashFormat::Nix32, true),
                             actualHash.hash.to_string(HashFormat::Nix32, true));
@@ -1162,7 +1160,6 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
     checkInterrupt();
 }
 
-
 StorePath LocalStore::addToStoreFromDump(
     Source & source0,
     std::string_view name,
@@ -1174,7 +1171,7 @@ StorePath LocalStore::addToStoreFromDump(
 {
     /* For computing the store path. */
     auto hashSink = std::make_unique<HashSink>(hashAlgo);
-    TeeSource source { source0, *hashSink };
+    TeeSource source{source0, *hashSink};
 
     /* Read the source path into memory, but only if it's up to
        narBufferSize bytes. If it's larger, write it to a temporary
@@ -1184,9 +1181,14 @@ StorePath LocalStore::addToStoreFromDump(
        path. */
     bool inMemory = false;
 
-    struct Free {
-        void operator()(void* v) { free(v); }
+    struct Free
+    {
+        void operator()(void * v)
+        {
+            free(v);
+        }
     };
+
     std::unique_ptr<char, Free> dumpBuffer(nullptr);
     std::string_view dump;
 
@@ -1199,14 +1201,12 @@ StorePath LocalStore::addToStoreFromDump(
         auto want = std::min(chunkSize, settings.narBufferSize - oldSize);
         if (auto tmp = realloc(dumpBuffer.get(), oldSize + want)) {
             dumpBuffer.release();
-            dumpBuffer.reset((char*) tmp);
+            dumpBuffer.reset((char *) tmp);
         } else {
             throw std::bad_alloc();
         }
         auto got = 0;
-        Finally cleanup([&]() {
-            dump = {dumpBuffer.get(), dump.size() + got};
-        });
+        Finally cleanup([&]() { dump = {dumpBuffer.get(), dump.size() + got}; });
         try {
             got = source.read(dumpBuffer.get() + oldSize, want);
         } catch (EndOfFile &) {
@@ -1228,8 +1228,8 @@ StorePath LocalStore::addToStoreFromDump(
 
     if (!inMemoryAndDontNeedRestore) {
         /* Drain what we pulled so far, and then keep on pulling */
-        StringSource dumpSource { dump };
-        ChainSource bothSource { dumpSource, source };
+        StringSource dumpSource{dump};
+        ChainSource bothSource{dumpSource, source};
 
         std::tie(tempDir, tempDirFd) = createTempDirInStore();
         delTempDir = std::make_unique<AutoDelete>(tempDir);
@@ -1247,9 +1247,8 @@ StorePath LocalStore::addToStoreFromDump(
         hashMethod,
         methodsMatch
             ? dumpHash
-            : hashPath(
-                PosixSourceAccessor::createAtRoot(tempPath),
-                hashMethod.getFileIngestionMethod(), hashAlgo).first,
+            : hashPath(PosixSourceAccessor::createAtRoot(tempPath), hashMethod.getFileIngestionMethod(), hashAlgo)
+                  .first,
         {
             .others = references,
             // caller is not capable of creating a self-reference, because this is content-addressed without modulus
@@ -1276,7 +1275,7 @@ StorePath LocalStore::addToStoreFromDump(
             autoGC();
 
             if (inMemoryAndDontNeedRestore) {
-                StringSource dumpSource { dump };
+                StringSource dumpSource{dump};
                 /* Restore from the buffer in memory. */
                 auto fim = hashMethod.getFileIngestionMethod();
                 switch (fim) {
@@ -1296,9 +1295,9 @@ StorePath LocalStore::addToStoreFromDump(
 
             /* For computing the nar hash. In recursive SHA-256 mode, this
                is the same as the store hash, so no need to do it again. */
-            auto narHash = std::pair { dumpHash, size };
+            HashResult narHash = {dumpHash, size};
             if (dumpMethod != FileSerialisationMethod::NixArchive || hashAlgo != HashAlgorithm::SHA256) {
-                HashSink narSink { HashAlgorithm::SHA256 };
+                HashSink narSink{HashAlgorithm::SHA256};
                 dumpPath(realPath, narSink);
                 narHash = narSink.finish();
             }
@@ -1312,13 +1311,8 @@ StorePath LocalStore::addToStoreFromDump(
                 syncParent(realPath);
             }
 
-            ValidPathInfo info {
-                *this,
-                name,
-                std::move(desc),
-                narHash.first
-            };
-            info.narSize = narHash.second;
+            auto info = ValidPathInfo::makeFromCA(*this, name, std::move(desc), narHash.hash);
+            info.narSize = narHash.numBytesDigested;
             registerValidPath(info);
         }
 
@@ -1328,7 +1322,6 @@ StorePath LocalStore::addToStoreFromDump(
     return dstPath;
 }
 
-
 /* Create a temporary directory in the store that won't be
    garbage-collected until the returned FD is closed. */
 std::pair<std::filesystem::path, AutoCloseFD> LocalStore::createTempDirInStore()
@@ -1350,20 +1343,20 @@ std::pair<std::filesystem::path, AutoCloseFD> LocalStore::createTempDirInStore()
     return {tmpDirFn, std::move(tmpDirFd)};
 }
 
-
 void LocalStore::invalidatePathChecked(const StorePath & path)
 {
     retrySQLite<void>([&]() {
-        auto state(_state.lock());
+        auto state(_state->lock());
 
         SQLiteTxn txn(state->db);
 
         if (isValidPath_(*state, path)) {
-            StorePathSet referrers; queryReferrers(*state, path, referrers);
+            StorePathSet referrers;
+            queryReferrers(*state, path, referrers);
             referrers.erase(path); /* ignore self-references */
             if (!referrers.empty())
-                throw PathInUse("cannot delete path '%s' because it is in use by %s",
-                    printStorePath(path), showPaths(referrers));
+                throw PathInUse(
+                    "cannot delete path '%s' because it is in use by %s", printStorePath(path), showPaths(referrers));
             invalidatePath(*state, path);
         }
 
@@ -1371,7 +1364,6 @@ void LocalStore::invalidatePathChecked(const StorePath & path)
     });
 }
 
-
 bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
 {
     printInfo("reading the Nix store...");
@@ -1394,11 +1386,12 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
             printMsg(lvlTalkative, "checking contents of '%s'", name);
             PosixSourceAccessor accessor;
             std::string hash = hashPath(
-                PosixSourceAccessor::createAtRoot(link.path()),
-                FileIngestionMethod::NixArchive, HashAlgorithm::SHA256).first.to_string(HashFormat::Nix32, false);
+                                   PosixSourceAccessor::createAtRoot(link.path()),
+                                   FileIngestionMethod::NixArchive,
+                                   HashAlgorithm::SHA256)
+                                   .first.to_string(HashFormat::Nix32, false);
             if (hash != name.string()) {
-                printError("link '%s' was modified! expected hash '%s', got '%s'",
-                    link.path(), name, hash);
+                printError("link '%s' was modified! expected hash '%s', got '%s'", link.path(), name, hash);
                 if (repair) {
                     std::filesystem::remove(link.path());
                     printInfo("removed link '%s'", link.path());
@@ -1414,7 +1407,8 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
 
         for (auto & i : validPaths) {
             try {
-                auto info = std::const_pointer_cast<ValidPathInfo>(std::shared_ptr<const ValidPathInfo>(queryPathInfo(i)));
+                auto info =
+                    std::const_pointer_cast<ValidPathInfo>(std::shared_ptr<const ValidPathInfo>(queryPathInfo(i)));
 
                 /* Check the content hash (optionally - slow). */
                 printMsg(lvlTalkative, "checking contents of '%s'", printStorePath(i));
@@ -1424,10 +1418,16 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
                 dumpPath(Store::toRealPath(i), hashSink);
                 auto current = hashSink.finish();
 
-                if (info->narHash != nullHash && info->narHash != current.first) {
-                    printError("path '%s' was modified! expected hash '%s', got '%s'",
-                               printStorePath(i), info->narHash.to_string(HashFormat::Nix32, true), current.first.to_string(HashFormat::Nix32, true));
-                    if (repair) repairPath(i); else errors = true;
+                if (info->narHash != nullHash && info->narHash != current.hash) {
+                    printError(
+                        "path '%s' was modified! expected hash '%s', got '%s'",
+                        printStorePath(i),
+                        info->narHash.to_string(HashFormat::Nix32, true),
+                        current.hash.to_string(HashFormat::Nix32, true));
+                    if (repair)
+                        repairPath(i);
+                    else
+                        errors = true;
                 } else {
 
                     bool update = false;
@@ -1435,22 +1435,19 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
                     /* Fill in missing hashes. */
                     if (info->narHash == nullHash) {
                         printInfo("fixing missing hash on '%s'", printStorePath(i));
-                        info->narHash = current.first;
+                        info->narHash = current.hash;
                         update = true;
                     }
 
                     /* Fill in missing narSize fields (from old stores). */
                     if (info->narSize == 0) {
-                        printInfo("updating size field on '%s' to %s", printStorePath(i), current.second);
-                        info->narSize = current.second;
+                        printInfo("updating size field on '%s' to %s", printStorePath(i), current.numBytesDigested);
+                        info->narSize = current.numBytesDigested;
                         update = true;
                     }
 
-                    if (update) {
-                        auto state(_state.lock());
-                        updatePathInfo(*state, *info);
-                    }
-
+                    if (update)
+                        updatePathInfo(*_state->lock(), *info);
                 }
 
             } catch (Error & e) {
@@ -1468,7 +1465,6 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
     return errors;
 }
 
-
 LocalStore::VerificationResult LocalStore::verifyAllValidPaths(RepairFlag repair)
 {
     StorePathSet storePathsInStoreDir;
@@ -1485,7 +1481,8 @@ LocalStore::VerificationResult LocalStore::verifyAllValidPaths(RepairFlag repair
         checkInterrupt();
         try {
             storePathsInStoreDir.insert({i.path().filename().string()});
-        } catch (BadStorePath &) { }
+        } catch (BadStorePath &) {
+        }
     }
 
     /* Check whether all valid paths actually exist. */
@@ -1493,9 +1490,7 @@ LocalStore::VerificationResult LocalStore::verifyAllValidPaths(RepairFlag repair
 
     StorePathSet done;
 
-    auto existsInStoreDir = [&](const StorePath & storePath) {
-        return storePathsInStoreDir.count(storePath);
-    };
+    auto existsInStoreDir = [&](const StorePath & storePath) { return storePathsInStoreDir.count(storePath); };
 
     bool errors = false;
     StorePathSet validPaths;
@@ -1509,19 +1504,25 @@ LocalStore::VerificationResult LocalStore::verifyAllValidPaths(RepairFlag repair
     };
 }
 
-
-void LocalStore::verifyPath(const StorePath & path, std::function<bool(const StorePath &)> existsInStoreDir,
-    StorePathSet & done, StorePathSet & validPaths, RepairFlag repair, bool & errors)
+void LocalStore::verifyPath(
+    const StorePath & path,
+    std::function<bool(const StorePath &)> existsInStoreDir,
+    StorePathSet & done,
+    StorePathSet & validPaths,
+    RepairFlag repair,
+    bool & errors)
 {
     checkInterrupt();
 
-    if (!done.insert(path).second) return;
+    if (!done.insert(path).second)
+        return;
 
     if (!existsInStoreDir(path)) {
         /* Check any referrers first.  If we can invalidate them
            first, then we can invalidate this path as well. */
         bool canInvalidate = true;
-        StorePathSet referrers; queryReferrers(path, referrers);
+        StorePathSet referrers;
+        queryReferrers(path, referrers);
         for (auto & i : referrers)
             if (i != path) {
                 verifyPath(i, existsInStoreDir, done, validPaths, repair, errors);
@@ -1533,8 +1534,7 @@ void LocalStore::verifyPath(const StorePath & path, std::function<bool(const Sto
 
         if (canInvalidate) {
             printInfo("path '%s' disappeared, removing from database...", pathS);
-            auto state(_state.lock());
-            invalidatePath(*state, path);
+            invalidatePath(*_state->lock(), path);
         } else {
             printError("path '%s' disappeared, but it still has valid referrers!", pathS);
             if (repair)
@@ -1544,7 +1544,8 @@ void LocalStore::verifyPath(const StorePath & path, std::function<bool(const Sto
                     logWarning(e.info());
                     errors = true;
                 }
-            else errors = true;
+            else
+                errors = true;
         }
 
         return;
@@ -1553,7 +1554,6 @@ void LocalStore::verifyPath(const StorePath & path, std::function<bool(const Sto
     validPaths.insert(std::move(path));
 }
 
-
 unsigned int LocalStore::getProtocol()
 {
     return PROTOCOL_VERSION;
@@ -1564,18 +1564,15 @@ std::optional<TrustedFlag> LocalStore::isTrustedClient()
     return Trusted;
 }
 
-
 void LocalStore::vacuumDB()
 {
-    auto state(_state.lock());
-    state->db.exec("vacuum");
+    _state->lock()->db.exec("vacuum");
 }
 
-
 void LocalStore::addSignatures(const StorePath & storePath, const StringSet & sigs)
 {
     retrySQLite<void>([&]() {
-        auto state(_state.lock());
+        auto state(_state->lock());
 
         SQLiteTxn txn(state->db);
 
@@ -1589,35 +1586,26 @@ void LocalStore::addSignatures(const StorePath & storePath, const StringSet & si
     });
 }
 
-
-std::optional<std::pair<int64_t, Realisation>> LocalStore::queryRealisationCore_(
-        LocalStore::State & state,
-        const DrvOutput & id)
+std::optional<std::pair<int64_t, Realisation>>
+LocalStore::queryRealisationCore_(LocalStore::State & state, const DrvOutput & id)
 {
-    auto useQueryRealisedOutput(
-            state.stmts->QueryRealisedOutput.use()
-                (id.strHash())
-                (id.outputName));
+    auto useQueryRealisedOutput(state.stmts->QueryRealisedOutput.use()(id.strHash())(id.outputName));
     if (!useQueryRealisedOutput.next())
         return std::nullopt;
     auto realisationDbId = useQueryRealisedOutput.getInt(0);
     auto outputPath = parseStorePath(useQueryRealisedOutput.getStr(1));
-    auto signatures =
-        tokenizeString<StringSet>(useQueryRealisedOutput.getStr(2));
+    auto signatures = tokenizeString<StringSet>(useQueryRealisedOutput.getStr(2));
 
-    return {{
-        realisationDbId,
-        Realisation{
-            .id = id,
-            .outPath = outputPath,
-            .signatures = signatures,
-        }
-    }};
+    return {
+        {realisationDbId,
+         Realisation{
+             .id = id,
+             .outPath = outputPath,
+             .signatures = signatures,
+         }}};
 }
 
-std::optional<const Realisation> LocalStore::queryRealisation_(
-            LocalStore::State & state,
-            const DrvOutput & id)
+std::optional<const Realisation> LocalStore::queryRealisation_(LocalStore::State & state, const DrvOutput & id)
 {
     auto maybeCore = queryRealisationCore_(state, id);
     if (!maybeCore)
@@ -1625,11 +1613,9 @@ std::optional<const Realisation> LocalStore::queryRealisation_(
     auto [realisationDbId, res] = *maybeCore;
 
     std::map<DrvOutput, StorePath> dependentRealisations;
-    auto useRealisationRefs(
-        state.stmts->QueryRealisationReferences.use()
-            (realisationDbId));
+    auto useRealisationRefs(state.stmts->QueryRealisationReferences.use()(realisationDbId));
     while (useRealisationRefs.next()) {
-        auto depId = DrvOutput {
+        auto depId = DrvOutput{
             Hash::parseAnyPrefixed(useRealisationRefs.getStr(0)),
             useRealisationRefs.getStr(1),
         };
@@ -1641,21 +1627,17 @@ std::optional<const Realisation> LocalStore::queryRealisation_(
 
     res.dependentRealisations = dependentRealisations;
 
-    return { res };
+    return {res};
 }
 
-void LocalStore::queryRealisationUncached(const DrvOutput & id,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept
+void LocalStore::queryRealisationUncached(
+    const DrvOutput & id, Callback<std::shared_ptr<const Realisation>> callback) noexcept
 {
     try {
-        auto maybeRealisation
-            = retrySQLite<std::optional<const Realisation>>([&]() {
-                  auto state(_state.lock());
-                  return queryRealisation_(*state, id);
-              });
+        auto maybeRealisation =
+            retrySQLite<std::optional<const Realisation>>([&]() { return queryRealisation_(*_state->lock(), id); });
         if (maybeRealisation)
-            callback(
-                std::make_shared<const Realisation>(maybeRealisation.value()));
+            callback(std::make_shared<const Realisation>(maybeRealisation.value()));
         else
             callback(nullptr);
 
@@ -1672,7 +1654,8 @@ void LocalStore::addBuildLog(const StorePath & drvPath, std::string_view log)
 
     auto logPath = fmt("%s/%s/%s/%s.bz2", config->logDir, drvsLogDir, baseName.substr(0, 2), baseName.substr(2));
 
-    if (pathExists(logPath)) return;
+    if (pathExists(logPath))
+        return;
 
     createDirs(dirOf(logPath));
 
@@ -1690,4 +1673,4 @@ std::optional<std::string> LocalStore::getVersion()
 
 static RegisterStoreImplementation<LocalStore::Config> regLocalStore;
 
-}  // namespace nix
+} // namespace nix
diff --git a/src/libstore/log-store.cc b/src/libstore/log-store.cc
index 2ef791e19..fd03bb30e 100644
--- a/src/libstore/log-store.cc
+++ b/src/libstore/log-store.cc
@@ -2,11 +2,12 @@
 
 namespace nix {
 
-std::optional<std::string> LogStore::getBuildLog(const StorePath & path) {
+std::optional<std::string> LogStore::getBuildLog(const StorePath & path)
+{
     auto maybePath = getBuildDerivationPath(path);
     if (!maybePath)
         return std::nullopt;
     return getBuildLogExact(maybePath.value());
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/machines.cc b/src/libstore/machines.cc
index 483b337bf..d61467666 100644
--- a/src/libstore/machines.cc
+++ b/src/libstore/machines.cc
@@ -1,3 +1,4 @@
+#include "nix/util/base-n.hh"
 #include "nix/store/machines.hh"
 #include "nix/store/globals.hh"
 #include "nix/store/store-open.hh"
@@ -14,29 +15,24 @@ Machine::Machine(
     decltype(speedFactor) speedFactor,
     decltype(supportedFeatures) supportedFeatures,
     decltype(mandatoryFeatures) mandatoryFeatures,
-    decltype(sshPublicHostKey) sshPublicHostKey) :
-    storeUri(StoreReference::parse(
-        // Backwards compatibility: if the URI is schemeless, is not a path,
-        // and is not one of the special store connection words, prepend
-        // ssh://.
-        storeUri.find("://") != std::string::npos
-        || storeUri.find("/") != std::string::npos
-        || storeUri == "auto"
-        || storeUri == "daemon"
-        || storeUri == "local"
-        || hasPrefix(storeUri, "auto?")
-        || hasPrefix(storeUri, "daemon?")
-        || hasPrefix(storeUri, "local?")
-        || hasPrefix(storeUri, "?")
-        ? storeUri
-        : "ssh://" + storeUri)),
-    systemTypes(systemTypes),
-    sshKey(sshKey),
-    maxJobs(maxJobs),
-    speedFactor(speedFactor == 0.0f ? 1.0f : speedFactor),
-    supportedFeatures(supportedFeatures),
-    mandatoryFeatures(mandatoryFeatures),
-    sshPublicHostKey(sshPublicHostKey)
+    decltype(sshPublicHostKey) sshPublicHostKey)
+    : storeUri(
+          StoreReference::parse(
+              // Backwards compatibility: if the URI is schemeless, is not a path,
+              // and is not one of the special store connection words, prepend
+              // ssh://.
+              storeUri.find("://") != std::string::npos || storeUri.find("/") != std::string::npos || storeUri == "auto"
+                      || storeUri == "daemon" || storeUri == "local" || hasPrefix(storeUri, "auto?")
+                      || hasPrefix(storeUri, "daemon?") || hasPrefix(storeUri, "local?") || hasPrefix(storeUri, "?")
+                  ? storeUri
+                  : "ssh://" + storeUri))
+    , systemTypes(systemTypes)
+    , sshKey(sshKey)
+    , maxJobs(maxJobs)
+    , speedFactor(speedFactor == 0.0f ? 1.0f : speedFactor)
+    , supportedFeatures(supportedFeatures)
+    , mandatoryFeatures(mandatoryFeatures)
+    , sshPublicHostKey(sshPublicHostKey)
 {
     if (speedFactor < 0.0)
         throw UsageError("speed factor must be >= 0");
@@ -49,19 +45,16 @@ bool Machine::systemSupported(const std::string & system) const
 
 bool Machine::allSupported(const StringSet & features) const
 {
-    return std::all_of(features.begin(), features.end(),
-        [&](const std::string & feature) {
-            return supportedFeatures.count(feature) ||
-                mandatoryFeatures.count(feature);
-        });
+    return std::all_of(features.begin(), features.end(), [&](const std::string & feature) {
+        return supportedFeatures.count(feature) || mandatoryFeatures.count(feature);
+    });
 }
 
 bool Machine::mandatoryMet(const StringSet & features) const
 {
-    return std::all_of(mandatoryFeatures.begin(), mandatoryFeatures.end(),
-        [&](const std::string & feature) {
-            return features.count(feature);
-        });
+    return std::all_of(mandatoryFeatures.begin(), mandatoryFeatures.end(), [&](const std::string & feature) {
+        return features.count(feature);
+    });
 }
 
 StoreReference Machine::completeStoreReference() const
@@ -86,7 +79,8 @@ StoreReference Machine::completeStoreReference() const
         auto & fs = storeUri.params["system-features"];
         auto append = [&](auto feats) {
             for (auto & f : feats) {
-                if (fs.size() > 0) fs += ' ';
+                if (fs.size() > 0)
+                    fs += ' ';
                 fs += f;
             }
         };
@@ -145,7 +139,10 @@ static Machine parseBuilderLine(const StringSet & defaultSystems, const std::str
     auto parseUnsignedIntField = [&](size_t fieldIndex) {
         const auto result = string2Int<unsigned int>(tokens[fieldIndex]);
         if (!result) {
-            throw FormatError("bad machine specification: failed to convert column #%lu in a row: '%s' to 'unsigned int'", fieldIndex, line);
+            throw FormatError(
+                "bad machine specification: failed to convert column #%lu in a row: '%s' to 'unsigned int'",
+                fieldIndex,
+                line);
         }
         return result.value();
     };
@@ -153,7 +150,8 @@ static Machine parseBuilderLine(const StringSet & defaultSystems, const std::str
     auto parseFloatField = [&](size_t fieldIndex) {
         const auto result = string2Float<float>(tokens[fieldIndex]);
         if (!result) {
-            throw FormatError("bad machine specification: failed to convert column #%lu in a row: '%s' to 'float'", fieldIndex, line);
+            throw FormatError(
+                "bad machine specification: failed to convert column #%lu in a row: '%s' to 'float'", fieldIndex, line);
         }
         return result.value();
     };
@@ -161,7 +159,7 @@ static Machine parseBuilderLine(const StringSet & defaultSystems, const std::str
     auto ensureBase64 = [&](size_t fieldIndex) {
         const auto & str = tokens[fieldIndex];
         try {
-            base64Decode(str);
+            base64::decode(str);
         } catch (FormatError & e) {
             e.addTrace({}, "while parsing machine specification at a column #%lu in a row: '%s'", fieldIndex, line);
             throw;
@@ -170,7 +168,8 @@ static Machine parseBuilderLine(const StringSet & defaultSystems, const std::str
     };
 
     if (!isSet(0))
-        throw FormatError("bad machine specification: store URL was not found at the first column of a row: '%s'", line);
+        throw FormatError(
+            "bad machine specification: store URL was not found at the first column of a row: '%s'", line);
 
     // TODO use designated initializers, once C++ supports those with
     // custom constructors.
@@ -190,16 +189,15 @@ static Machine parseBuilderLine(const StringSet & defaultSystems, const std::str
         // `mandatoryFeatures`
         isSet(6) ? tokenizeString<StringSet>(tokens[6], ",") : StringSet{},
         // `sshPublicHostKey`
-        isSet(7) ? ensureBase64(7) : ""
-    };
+        isSet(7) ? ensureBase64(7) : ""};
 }
 
 static Machines parseBuilderLines(const StringSet & defaultSystems, const std::vector<std::string> & builders)
 {
     Machines result;
-    std::transform(
-        builders.begin(), builders.end(), std::back_inserter(result),
-        [&](auto && line) { return parseBuilderLine(defaultSystems, line); });
+    std::transform(builders.begin(), builders.end(), std::back_inserter(result), [&](auto && line) {
+        return parseBuilderLine(defaultSystems, line);
+    });
     return result;
 }
 
@@ -214,4 +212,4 @@ Machines getMachines()
     return Machine::parseConfig({settings.thisSystem}, settings.builders);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/make-content-addressed.cc b/src/libstore/make-content-addressed.cc
index 606d72866..4a7b21c3b 100644
--- a/src/libstore/make-content-addressed.cc
+++ b/src/libstore/make-content-addressed.cc
@@ -1,12 +1,9 @@
 #include "nix/store/make-content-addressed.hh"
-#include "nix/util/references.hh"
+#include "nix/store/references.hh"
 
 namespace nix {
 
-std::map<StorePath, StorePath> makeContentAddressed(
-    Store & srcStore,
-    Store & dstStore,
-    const StorePathSet & storePaths)
+std::map<StorePath, StorePath> makeContentAddressed(Store & srcStore, Store & dstStore, const StorePathSet & storePaths)
 {
     StorePathSet closure;
     srcStore.computeFSClosure(storePaths, closure);
@@ -46,18 +43,17 @@ std::map<StorePath, StorePath> makeContentAddressed(
         HashModuloSink hashModuloSink(HashAlgorithm::SHA256, oldHashPart);
         hashModuloSink(sink.s);
 
-        auto narModuloHash = hashModuloSink.finish().first;
+        auto narModuloHash = hashModuloSink.finish().hash;
 
-        ValidPathInfo info {
+        auto info = ValidPathInfo::makeFromCA(
             dstStore,
             path.name(),
-            FixedOutputInfo {
+            FixedOutputInfo{
                 .method = FileIngestionMethod::NixArchive,
                 .hash = narModuloHash,
                 .references = std::move(refs),
             },
-            Hash::dummy,
-        };
+            Hash::dummy);
 
         printInfo("rewriting '%s' to '%s'", pathS, dstStore.printStorePath(info.path));
 
@@ -78,15 +74,12 @@ std::map<StorePath, StorePath> makeContentAddressed(
     return remappings;
 }
 
-StorePath makeContentAddressed(
-    Store & srcStore,
-    Store & dstStore,
-    const StorePath & fromPath)
+StorePath makeContentAddressed(Store & srcStore, Store & dstStore, const StorePath & fromPath)
 {
-    auto remappings = makeContentAddressed(srcStore, dstStore, StorePathSet { fromPath });
+    auto remappings = makeContentAddressed(srcStore, dstStore, StorePathSet{fromPath});
     auto i = remappings.find(fromPath);
     assert(i != remappings.end());
     return i->second;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index d82bcddc1..7aeacbab7 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -1,7 +1,9 @@
-project('nix-store', 'cpp',
+project(
+  'nix-store',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -21,35 +23,40 @@ configdata_priv = configuration_data()
 # TODO rename, because it will conflict with downstream projects
 configdata_priv.set_quoted('PACKAGE_VERSION', meson.project_version())
 
+subdir('nix-meson-build-support/default-system-cpu')
+
 # Used in public header.
 configdata_pub.set_quoted(
   'NIX_LOCAL_SYSTEM',
-  host_machine.cpu_family() + '-' + host_machine.system(),
-  description :
-    'This is the system name Nix expects for local running instance of Nix.\n\n'
+  nix_system_cpu + '-' + host_machine.system(),
+  description : 'This is the system name Nix expects for local running instance of Nix.\n\n'
     + 'See the "system" setting for additional details',
 )
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
 ]
 subdir('nix-meson-build-support/subprojects')
 
-run_command('ln', '-s',
+run_command(
+  'ln',
+  '-s',
   meson.project_build_root() / '__nothing_link_target',
   meson.project_build_root() / '__nothing_symlink',
   # native doesn't allow dangling symlinks, which the tests require
-  env : { 'MSYS' : 'winsymlinks:lnk' },
+  env : {'MSYS' : 'winsymlinks:lnk'},
   check : true,
 )
-can_link_symlink = run_command('ln',
+can_link_symlink = run_command(
+  'ln',
   meson.project_build_root() / '__nothing_symlink',
   meson.project_build_root() / '__nothing_hardlink',
   check : false,
 ).returncode() == 0
-run_command('rm', '-f',
+run_command(
+  'rm',
+  '-f',
   meson.project_build_root() / '__nothing_symlink',
   meson.project_build_root() / '__nothing_hardlink',
   check : true,
@@ -82,20 +89,25 @@ configdata_pub.set(
 
 if host_machine.system() == 'darwin'
   sandbox = cxx.find_library('sandbox')
-  deps_other += [sandbox]
+  deps_other += [ sandbox ]
 endif
 
 if host_machine.system() == 'windows'
   wsock32 = cxx.find_library('wsock32')
-  deps_other += [wsock32]
+  deps_other += [ wsock32 ]
 endif
 
 subdir('nix-meson-build-support/libatomic')
 
 boost = dependency(
   'boost',
-  modules : ['container', 'regex'],
-  include_type: 'system',
+  modules : [
+    'container',
+    # Shouldn't list, because can header-only, and Meson currently looks for libs
+    #'regex',
+    'url',
+  ],
+  include_type : 'system',
 )
 # boost is a public dependency, but not a pkg-config dependency unfortunately, so we
 # put in `deps_other`.
@@ -110,9 +122,16 @@ seccomp_required = get_option('seccomp-sandboxing')
 if not is_linux and seccomp_required.enabled()
   warning('Force-enabling seccomp on non-Linux does not make sense')
 endif
-seccomp = dependency('libseccomp', 'seccomp', required : seccomp_required, version : '>=2.5.5')
+seccomp = dependency(
+  'libseccomp',
+  'seccomp',
+  required : seccomp_required,
+  version : '>=2.5.5',
+)
 if is_linux and not seccomp.found()
-  warning('Sandbox security is reduced because libseccomp has not been found! Please provide libseccomp if it supports your CPU architecture.')
+  warning(
+    'Sandbox security is reduced because libseccomp has not been found! Please provide libseccomp if it supports your CPU architecture.',
+  )
 endif
 configdata_priv.set('HAVE_SECCOMP', seccomp.found().to_int())
 deps_private += seccomp
@@ -130,8 +149,8 @@ aws_s3 = dependency('aws-cpp-sdk-s3', required : false)
 configdata_pub.set('NIX_WITH_S3_SUPPORT', aws_s3.found().to_int())
 if aws_s3.found()
   aws_s3 = declare_dependency(
-    include_directories: include_directories(aws_s3.get_variable('includedir')),
-    link_args: [
+    include_directories : include_directories(aws_s3.get_variable('includedir')),
+    link_args : [
       '-L' + aws_s3.get_variable('libdir'),
       '-laws-cpp-sdk-transfer',
       '-laws-cpp-sdk-s3',
@@ -157,7 +176,10 @@ endforeach
 
 busybox = find_program(get_option('sandbox-shell'), required : false)
 
-configdata_priv.set('HAVE_EMBEDDED_SANDBOX_SHELL', get_option('embedded-sandbox-shell').to_int())
+configdata_priv.set(
+  'HAVE_EMBEDDED_SANDBOX_SHELL',
+  get_option('embedded-sandbox-shell').to_int(),
+)
 
 if get_option('embedded-sandbox-shell')
   configdata_priv.set_quoted('SANDBOX_SHELL', '__embedded_sandbox_shell__')
@@ -169,12 +191,7 @@ if get_option('embedded-sandbox-shell')
   hexdump = find_program('hexdump', native : true)
   embedded_sandbox_shell_gen = custom_target(
     'embedded-sandbox-shell.gen.hh',
-    command : [
-      hexdump,
-      '-v',
-      '-e',
-      '1/1 "0x%x," "\n"'
-    ],
+    command : [ hexdump, '-v', '-e', '1/1 "0x%x," "\n"' ],
     input : busybox.full_path(),
     output : 'embedded-sandbox-shell.gen.hh',
     capture : true,
@@ -226,21 +243,20 @@ endif
 # Aside from prefix itself, each of these was made into an absolute path
 # by joining it with prefix, unless it was already an absolute path
 # (which is the default for store-dir, localstatedir, and log-dir).
-configdata_priv.set_quoted('NIX_PREFIX',    prefix)
+configdata_priv.set_quoted('NIX_PREFIX', prefix)
 configdata_priv.set_quoted('NIX_STORE_DIR', store_dir)
-configdata_priv.set_quoted('NIX_DATA_DIR',  datadir)
+configdata_priv.set_quoted('NIX_DATA_DIR', datadir)
 configdata_priv.set_quoted('NIX_STATE_DIR', localstatedir / 'nix')
-configdata_priv.set_quoted('NIX_LOG_DIR',   log_dir)
-configdata_priv.set_quoted('NIX_CONF_DIR',  sysconfdir / 'nix')
-configdata_priv.set_quoted('NIX_MAN_DIR',   mandir)
+configdata_priv.set_quoted('NIX_LOG_DIR', log_dir)
+configdata_priv.set_quoted('NIX_CONF_DIR', sysconfdir / 'nix')
+configdata_priv.set_quoted('NIX_MAN_DIR', mandir)
 
 lsof = find_program('lsof', required : false)
 configdata_priv.set_quoted(
   'LSOF',
-  lsof.found()
-    ? lsof.full_path()
-    # Just look up on the PATH
-    : 'lsof',
+  lsof.found() ? lsof.full_path()
+  # Just look up on the PATH
+: 'lsof',
 )
 
 config_priv_h = configure_file(
@@ -253,8 +269,10 @@ subdir('nix-meson-build-support/common')
 sources = files(
   'binary-cache-store.cc',
   'build-result.cc',
-  'build/derivation-goal.cc',
   'build/derivation-building-goal.cc',
+  'build/derivation-check.cc',
+  'build/derivation-env-desugar.cc',
+  'build/derivation-goal.cc',
   'build/derivation-trampoline-goal.cc',
   'build/drv-output-substitution-goal.cc',
   'build/entry-points.cc',
@@ -268,8 +286,8 @@ sources = files(
   'common-ssh-store-config.cc',
   'content-address.cc',
   'daemon.cc',
-  'derivations.cc',
   'derivation-options.cc',
+  'derivations.cc',
   'derived-path-map.cc',
   'derived-path.cc',
   'downstream-placeholder.cc',
@@ -305,10 +323,12 @@ sources = files(
   'posix-fs-canonicalise.cc',
   'profiles.cc',
   'realisation.cc',
+  'references.cc',
   'remote-fs-accessor.cc',
   'remote-store.cc',
   'restricted-store.cc',
   's3-binary-cache-store.cc',
+  's3.cc',
   'serve-protocol-connection.cc',
   'serve-protocol.cc',
   'sqlite.cc',
@@ -316,8 +336,8 @@ sources = files(
   'ssh.cc',
   'store-api.cc',
   'store-dir-config.cc',
-  'store-registration.cc',
   'store-reference.cc',
+  'store-registration.cc',
   'uds-remote-store.cc',
   'worker-protocol-connection.cc',
   'worker-protocol.cc',
@@ -345,9 +365,10 @@ this_library = library(
   config_priv_h,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 install_headers(headers, subdir : 'nix/store', preserve_path : true)
diff --git a/src/libstore/meson.options b/src/libstore/meson.options
index ebad24dc4..b8414068d 100644
--- a/src/libstore/meson.options
+++ b/src/libstore/meson.options
@@ -1,21 +1,35 @@
 # vim: filetype=meson
 
-option('embedded-sandbox-shell', type : 'boolean', value : false,
+option(
+  'embedded-sandbox-shell',
+  type : 'boolean',
+  value : false,
   description : 'include the sandbox shell in the Nix binary',
 )
 
-option('seccomp-sandboxing', type : 'feature',
+option(
+  'seccomp-sandboxing',
+  type : 'feature',
   description : 'build support for seccomp sandboxing (recommended unless your arch doesn\'t support libseccomp, only relevant on Linux)',
 )
 
-option('sandbox-shell', type : 'string', value : 'busybox',
+option(
+  'sandbox-shell',
+  type : 'string',
+  value : 'busybox',
   description : 'path to a statically-linked shell to use as /bin/sh in sandboxes (usually busybox)',
 )
 
-option('store-dir', type : 'string', value : '/nix/store',
+option(
+  'store-dir',
+  type : 'string',
+  value : '/nix/store',
   description : 'path of the Nix store',
 )
 
-option('log-dir', type : 'string', value : '/nix/var/log/nix',
+option(
+  'log-dir',
+  type : 'string',
+  value : '/nix/var/log/nix',
   description : 'path to store logs in for Nix',
 )
diff --git a/src/libstore/misc.cc b/src/libstore/misc.cc
index 7c97dbc57..c5e1747c1 100644
--- a/src/libstore/misc.cc
+++ b/src/libstore/misc.cc
@@ -1,5 +1,3 @@
-#include <unordered_set>
-
 #include "nix/store/derivations.hh"
 #include "nix/store/parsed-derivations.hh"
 #include "nix/store/derivation-options.hh"
@@ -13,43 +11,47 @@
 #include "nix/store/filetransfer.hh"
 #include "nix/util/strings.hh"
 
+#include <boost/unordered/unordered_flat_set.hpp>
+
 namespace nix {
 
-void Store::computeFSClosure(const StorePathSet & startPaths,
-    StorePathSet & paths_, bool flipDirection, bool includeOutputs, bool includeDerivers)
+void Store::computeFSClosure(
+    const StorePathSet & startPaths,
+    StorePathSet & paths_,
+    bool flipDirection,
+    bool includeOutputs,
+    bool includeDerivers)
 {
     std::function<std::set<StorePath>(const StorePath & path, std::future<ref<const ValidPathInfo>> &)> queryDeps;
     if (flipDirection)
-        queryDeps = [&](const StorePath& path,
-                        std::future<ref<const ValidPathInfo>> & fut) {
+        queryDeps = [&](const StorePath & path, std::future<ref<const ValidPathInfo>> & fut) {
             StorePathSet res;
             StorePathSet referrers;
             queryReferrers(path, referrers);
-            for (auto& ref : referrers)
+            for (auto & ref : referrers)
                 if (ref != path)
                     res.insert(ref);
 
             if (includeOutputs)
-                for (auto& i : queryValidDerivers(path))
+                for (auto & i : queryValidDerivers(path))
                     res.insert(i);
 
             if (includeDerivers && path.isDerivation())
-                for (auto& [_, maybeOutPath] : queryPartialDerivationOutputMap(path))
+                for (auto & [_, maybeOutPath] : queryPartialDerivationOutputMap(path))
                     if (maybeOutPath && isValidPath(*maybeOutPath))
                         res.insert(*maybeOutPath);
             return res;
         };
     else
-        queryDeps = [&](const StorePath& path,
-                        std::future<ref<const ValidPathInfo>> & fut) {
+        queryDeps = [&](const StorePath & path, std::future<ref<const ValidPathInfo>> & fut) {
             StorePathSet res;
             auto info = fut.get();
-            for (auto& ref : info->references)
+            for (auto & ref : info->references)
                 if (ref != path)
                     res.insert(ref);
 
             if (includeOutputs && path.isDerivation())
-                for (auto& [_, maybeOutPath] : queryPartialDerivationOutputMap(path))
+                for (auto & [_, maybeOutPath] : queryPartialDerivationOutputMap(path))
                     if (maybeOutPath && isValidPath(*maybeOutPath))
                         res.insert(*maybeOutPath);
 
@@ -59,34 +61,31 @@ void Store::computeFSClosure(const StorePathSet & startPaths,
         };
 
     computeClosure<StorePath>(
-        startPaths, paths_,
-        [&](const StorePath& path,
-            std::function<void(std::promise<std::set<StorePath>>&)>
-                processEdges) {
+        startPaths,
+        paths_,
+        [&](const StorePath & path, std::function<void(std::promise<std::set<StorePath>> &)> processEdges) {
             std::promise<std::set<StorePath>> promise;
-            std::function<void(std::future<ref<const ValidPathInfo>>)>
-                getDependencies =
-                    [&](std::future<ref<const ValidPathInfo>> fut) {
-                        try {
-                            promise.set_value(queryDeps(path, fut));
-                        } catch (...) {
-                            promise.set_exception(std::current_exception());
-                        }
-                    };
+            std::function<void(std::future<ref<const ValidPathInfo>>)> getDependencies =
+                [&](std::future<ref<const ValidPathInfo>> fut) {
+                    try {
+                        promise.set_value(queryDeps(path, fut));
+                    } catch (...) {
+                        promise.set_exception(std::current_exception());
+                    }
+                };
             queryPathInfo(path, getDependencies);
             processEdges(promise);
         });
 }
 
-void Store::computeFSClosure(const StorePath & startPath,
-    StorePathSet & paths_, bool flipDirection, bool includeOutputs, bool includeDerivers)
+void Store::computeFSClosure(
+    const StorePath & startPath, StorePathSet & paths_, bool flipDirection, bool includeOutputs, bool includeDerivers)
 {
     StorePathSet paths;
     paths.insert(startPath);
     computeFSClosure(paths, paths_, flipDirection, includeOutputs, includeDerivers);
 }
 
-
 const ContentAddress * getDerivationCA(const BasicDerivation & drv)
 {
     auto out = drv.outputs.find("out");
@@ -107,7 +106,7 @@ MissingPaths Store::queryMissing(const std::vector<DerivedPath> & targets)
 
     struct State
     {
-        std::unordered_set<std::string> done;
+        boost::unordered_flat_set<std::string> done;
         MissingPaths res;
     };
 
@@ -116,7 +115,11 @@ MissingPaths Store::queryMissing(const std::vector<DerivedPath> & targets)
         size_t left;
         bool done = false;
         StorePathSet outPaths;
-        DrvState(size_t left) : left(left) { }
+
+        DrvState(size_t left)
+            : left(left)
+        {
+        }
     };
 
     Sync<State> state_;
@@ -127,11 +130,9 @@ MissingPaths Store::queryMissing(const std::vector<DerivedPath> & targets)
 
     enqueueDerivedPaths = [&](ref<SingleDerivedPath> inputDrv, const DerivedPathMap<StringSet>::ChildNode & inputNode) {
         if (!inputNode.value.empty())
-            pool.enqueue(std::bind(doPath, DerivedPath::Built { inputDrv, inputNode.value }));
+            pool.enqueue(std::bind(doPath, DerivedPath::Built{inputDrv, inputNode.value}));
         for (const auto & [outputName, childNode] : inputNode.childMap)
-            enqueueDerivedPaths(
-                make_ref<SingleDerivedPath>(SingleDerivedPath::Built { inputDrv, outputName }),
-                childNode);
+            enqueueDerivedPaths(make_ref<SingleDerivedPath>(SingleDerivedPath::Built{inputDrv, outputName}), childNode);
     };
 
     auto mustBuildDrv = [&](const StorePath & drvPath, const Derivation & drv) {
@@ -145,155 +146,159 @@ MissingPaths Store::queryMissing(const std::vector<DerivedPath> & targets)
         }
     };
 
-    auto checkOutput = [&](
-        const StorePath & drvPath, ref<Derivation> drv, const StorePath & outPath, ref<Sync<DrvState>> drvState_)
-    {
-        if (drvState_->lock()->done) return;
-
-        SubstitutablePathInfos infos;
-        auto * cap = getDerivationCA(*drv);
-        querySubstitutablePathInfos({
-            {
-                outPath,
-                cap ? std::optional { *cap } : std::nullopt,
-            },
-        }, infos);
-
-        if (infos.empty()) {
-            drvState_->lock()->done = true;
-            mustBuildDrv(drvPath, *drv);
-        } else {
-            {
-                auto drvState(drvState_->lock());
-                if (drvState->done) return;
-                assert(drvState->left);
-                drvState->left--;
-                drvState->outPaths.insert(outPath);
-                if (!drvState->left) {
-                    for (auto & path : drvState->outPaths)
-                        pool.enqueue(std::bind(doPath, DerivedPath::Opaque { path } ));
-                }
-            }
-        }
-    };
-
-    doPath = [&](const DerivedPath & req) {
-
-        {
-            auto state(state_.lock());
-            if (!state->done.insert(req.to_string(*this)).second) return;
-        }
-
-        std::visit(overloaded {
-          [&](const DerivedPath::Built & bfd) {
-            auto drvPathP = std::get_if<DerivedPath::Opaque>(&*bfd.drvPath);
-            if (!drvPathP) {
-                // TODO make work in this case.
-                warn("Ignoring dynamic derivation %s while querying missing paths; not yet implemented", bfd.drvPath->to_string(*this));
+    auto checkOutput =
+        [&](const StorePath & drvPath, ref<Derivation> drv, const StorePath & outPath, ref<Sync<DrvState>> drvState_) {
+            if (drvState_->lock()->done)
                 return;
-            }
-            auto & drvPath = drvPathP->path;
-
-            if (!isValidPath(drvPath)) {
-                // FIXME: we could try to substitute the derivation.
-                auto state(state_.lock());
-                state->res.unknown.insert(drvPath);
-                return;
-            }
-
-            StorePathSet invalid;
-            /* true for regular derivations, and CA derivations for which we
-               have a trust mapping for all wanted outputs. */
-            auto knownOutputPaths = true;
-            for (auto & [outputName, pathOpt] : queryPartialDerivationOutputMap(drvPath)) {
-                if (!pathOpt) {
-                    knownOutputPaths = false;
-                    break;
-                }
-                if (bfd.outputs.contains(outputName) && !isValidPath(*pathOpt))
-                    invalid.insert(*pathOpt);
-            }
-            if (knownOutputPaths && invalid.empty()) return;
-
-            auto drv = make_ref<Derivation>(derivationFromPath(drvPath));
-            auto parsedDrv = StructuredAttrs::tryParse(drv->env);
-            DerivationOptions drvOptions;
-            try {
-                // FIXME: this is a lot of work just to get the value
-                // of `allowSubstitutes`.
-                drvOptions = DerivationOptions::fromStructuredAttrs(
-                    drv->env,
-                    parsedDrv ? &*parsedDrv : nullptr);
-            } catch (Error & e) {
-                e.addTrace({}, "while parsing derivation '%s'", printStorePath(drvPath));
-                throw;
-            }
-
-            if (!knownOutputPaths && settings.useSubstitutes && drvOptions.substitutesAllowed()) {
-                experimentalFeatureSettings.require(Xp::CaDerivations);
-
-                // If there are unknown output paths, attempt to find if the
-                // paths are known to substituters through a realisation.
-                auto outputHashes = staticOutputHashes(*this, *drv);
-                knownOutputPaths = true;
-
-                for (auto [outputName, hash] : outputHashes) {
-                    if (!bfd.outputs.contains(outputName))
-                        continue;
-
-                    bool found = false;
-                    for (auto &sub : getDefaultSubstituters()) {
-                        auto realisation = sub->queryRealisation({hash, outputName});
-                        if (!realisation)
-                            continue;
-                        found = true;
-                        if (!isValidPath(realisation->outPath))
-                            invalid.insert(realisation->outPath);
-                        break;
-                    }
-                    if (!found) {
-                        // Some paths did not have a realisation, this must be built.
-                        knownOutputPaths = false;
-                        break;
-                    }
-                }
-            }
-
-            if (knownOutputPaths && settings.useSubstitutes && drvOptions.substitutesAllowed()) {
-                auto drvState = make_ref<Sync<DrvState>>(DrvState(invalid.size()));
-                for (auto & output : invalid)
-                    pool.enqueue(std::bind(checkOutput, drvPath, drv, output, drvState));
-            } else
-                mustBuildDrv(drvPath, *drv);
-
-          },
-          [&](const DerivedPath::Opaque & bo) {
-
-            if (isValidPath(bo.path)) return;
 
             SubstitutablePathInfos infos;
-            querySubstitutablePathInfos({{bo.path, std::nullopt}}, infos);
+            auto * cap = getDerivationCA(*drv);
+            querySubstitutablePathInfos(
+                {
+                    {
+                        outPath,
+                        cap ? std::optional{*cap} : std::nullopt,
+                    },
+                },
+                infos);
 
             if (infos.empty()) {
-                auto state(state_.lock());
-                state->res.unknown.insert(bo.path);
+                drvState_->lock()->done = true;
+                mustBuildDrv(drvPath, *drv);
+            } else {
+                {
+                    auto drvState(drvState_->lock());
+                    if (drvState->done)
+                        return;
+                    assert(drvState->left);
+                    drvState->left--;
+                    drvState->outPaths.insert(outPath);
+                    if (!drvState->left) {
+                        for (auto & path : drvState->outPaths)
+                            pool.enqueue(std::bind(doPath, DerivedPath::Opaque{path}));
+                    }
+                }
+            }
+        };
+
+    doPath = [&](const DerivedPath & req) {
+        {
+            auto state(state_.lock());
+            if (!state->done.insert(req.to_string(*this)).second)
                 return;
-            }
+        }
 
-            auto info = infos.find(bo.path);
-            assert(info != infos.end());
+        std::visit(
+            overloaded{
+                [&](const DerivedPath::Built & bfd) {
+                    auto drvPathP = std::get_if<DerivedPath::Opaque>(&*bfd.drvPath);
+                    if (!drvPathP) {
+                        // TODO make work in this case.
+                        warn(
+                            "Ignoring dynamic derivation %s while querying missing paths; not yet implemented",
+                            bfd.drvPath->to_string(*this));
+                        return;
+                    }
+                    auto & drvPath = drvPathP->path;
 
-            {
-                auto state(state_.lock());
-                state->res.willSubstitute.insert(bo.path);
-                state->res.downloadSize += info->second.downloadSize;
-                state->res.narSize += info->second.narSize;
-            }
+                    if (!isValidPath(drvPath)) {
+                        // FIXME: we could try to substitute the derivation.
+                        auto state(state_.lock());
+                        state->res.unknown.insert(drvPath);
+                        return;
+                    }
 
-            for (auto & ref : info->second.references)
-                pool.enqueue(std::bind(doPath, DerivedPath::Opaque { ref }));
-          },
-        }, req.raw());
+                    StorePathSet invalid;
+                    /* true for regular derivations, and CA derivations for which we
+                       have a trust mapping for all wanted outputs. */
+                    auto knownOutputPaths = true;
+                    for (auto & [outputName, pathOpt] : queryPartialDerivationOutputMap(drvPath)) {
+                        if (!pathOpt) {
+                            knownOutputPaths = false;
+                            break;
+                        }
+                        if (bfd.outputs.contains(outputName) && !isValidPath(*pathOpt))
+                            invalid.insert(*pathOpt);
+                    }
+                    if (knownOutputPaths && invalid.empty())
+                        return;
+
+                    auto drv = make_ref<Derivation>(derivationFromPath(drvPath));
+                    DerivationOptions drvOptions;
+                    try {
+                        // FIXME: this is a lot of work just to get the value
+                        // of `allowSubstitutes`.
+                        drvOptions = DerivationOptions::fromStructuredAttrs(drv->env, drv->structuredAttrs);
+                    } catch (Error & e) {
+                        e.addTrace({}, "while parsing derivation '%s'", printStorePath(drvPath));
+                        throw;
+                    }
+
+                    if (!knownOutputPaths && settings.useSubstitutes && drvOptions.substitutesAllowed()) {
+                        experimentalFeatureSettings.require(Xp::CaDerivations);
+
+                        // If there are unknown output paths, attempt to find if the
+                        // paths are known to substituters through a realisation.
+                        auto outputHashes = staticOutputHashes(*this, *drv);
+                        knownOutputPaths = true;
+
+                        for (auto [outputName, hash] : outputHashes) {
+                            if (!bfd.outputs.contains(outputName))
+                                continue;
+
+                            bool found = false;
+                            for (auto & sub : getDefaultSubstituters()) {
+                                auto realisation = sub->queryRealisation({hash, outputName});
+                                if (!realisation)
+                                    continue;
+                                found = true;
+                                if (!isValidPath(realisation->outPath))
+                                    invalid.insert(realisation->outPath);
+                                break;
+                            }
+                            if (!found) {
+                                // Some paths did not have a realisation, this must be built.
+                                knownOutputPaths = false;
+                                break;
+                            }
+                        }
+                    }
+
+                    if (knownOutputPaths && settings.useSubstitutes && drvOptions.substitutesAllowed()) {
+                        auto drvState = make_ref<Sync<DrvState>>(DrvState(invalid.size()));
+                        for (auto & output : invalid)
+                            pool.enqueue(std::bind(checkOutput, drvPath, drv, output, drvState));
+                    } else
+                        mustBuildDrv(drvPath, *drv);
+                },
+                [&](const DerivedPath::Opaque & bo) {
+                    if (isValidPath(bo.path))
+                        return;
+
+                    SubstitutablePathInfos infos;
+                    querySubstitutablePathInfos({{bo.path, std::nullopt}}, infos);
+
+                    if (infos.empty()) {
+                        auto state(state_.lock());
+                        state->res.unknown.insert(bo.path);
+                        return;
+                    }
+
+                    auto info = infos.find(bo.path);
+                    assert(info != infos.end());
+
+                    {
+                        auto state(state_.lock());
+                        state->res.willSubstitute.insert(bo.path);
+                        state->res.downloadSize += info->second.downloadSize;
+                        state->res.narSize += info->second.narSize;
+                    }
+
+                    for (auto & ref : info->second.references)
+                        pool.enqueue(std::bind(doPath, DerivedPath::Opaque{ref}));
+                },
+            },
+            req.raw());
     };
 
     for (auto & path : targets)
@@ -304,10 +309,10 @@ MissingPaths Store::queryMissing(const std::vector<DerivedPath> & targets)
     return std::move(state_.lock()->res);
 }
 
-
 StorePaths Store::topoSortPaths(const StorePathSet & paths)
 {
-    return topoSort(paths,
+    return topoSort(
+        paths,
         {[&](const StorePath & path) {
             try {
                 return queryPathInfo(path)->references;
@@ -317,15 +322,15 @@ StorePaths Store::topoSortPaths(const StorePathSet & paths)
         }},
         {[&](const StorePath & path, const StorePath & parent) {
             return BuildError(
+                BuildResult::OutputRejected,
                 "cycle detected in the references of '%s' from '%s'",
                 printStorePath(path),
                 printStorePath(parent));
         }});
 }
 
-std::map<DrvOutput, StorePath> drvOutputReferences(
-    const std::set<Realisation> & inputRealisations,
-    const StorePathSet & pathReferences)
+std::map<DrvOutput, StorePath>
+drvOutputReferences(const std::set<Realisation> & inputRealisations, const StorePathSet & pathReferences)
 {
     std::map<DrvOutput, StorePath> res;
 
@@ -338,11 +343,8 @@ std::map<DrvOutput, StorePath> drvOutputReferences(
     return res;
 }
 
-std::map<DrvOutput, StorePath> drvOutputReferences(
-    Store & store,
-    const Derivation & drv,
-    const StorePath & outputPath,
-    Store * evalStore_)
+std::map<DrvOutput, StorePath>
+drvOutputReferences(Store & store, const Derivation & drv, const StorePath & outputPath, Store * evalStore_)
 {
     auto & evalStore = evalStore_ ? *evalStore_ : store;
 
@@ -352,27 +354,23 @@ std::map<DrvOutput, StorePath> drvOutputReferences(
 
     accumRealisations = [&](const StorePath & inputDrv, const DerivedPathMap<StringSet>::ChildNode & inputNode) {
         if (!inputNode.value.empty()) {
-            auto outputHashes =
-                staticOutputHashes(evalStore, evalStore.readDerivation(inputDrv));
+            auto outputHashes = staticOutputHashes(evalStore, evalStore.readDerivation(inputDrv));
             for (const auto & outputName : inputNode.value) {
                 auto outputHash = get(outputHashes, outputName);
                 if (!outputHash)
                     throw Error(
-                        "output '%s' of derivation '%s' isn't realised", outputName,
-                        store.printStorePath(inputDrv));
-                auto thisRealisation = store.queryRealisation(
-                    DrvOutput{*outputHash, outputName});
+                        "output '%s' of derivation '%s' isn't realised", outputName, store.printStorePath(inputDrv));
+                auto thisRealisation = store.queryRealisation(DrvOutput{*outputHash, outputName});
                 if (!thisRealisation)
                     throw Error(
-                        "output '%s' of derivation '%s' isn’t built", outputName,
-                        store.printStorePath(inputDrv));
+                        "output '%s' of derivation '%s' isn’t built", outputName, store.printStorePath(inputDrv));
                 inputRealisations.insert(*thisRealisation);
             }
         }
         if (!inputNode.value.empty()) {
             auto d = makeConstantStorePathRef(inputDrv);
             for (const auto & [outputName, childNode] : inputNode.childMap) {
-                SingleDerivedPath next = SingleDerivedPath::Built { d, outputName };
+                SingleDerivedPath next = SingleDerivedPath::Built{d, outputName};
                 accumRealisations(
                     // TODO deep resolutions for dynamic derivations, issue #8947, would go here.
                     resolveDerivedPath(store, next, evalStore_),
@@ -395,25 +393,28 @@ OutputPathMap resolveDerivedPath(Store & store, const DerivedPath::Built & bfd,
 
     auto outputsOpt_ = store.queryPartialDerivationOutputMap(drvPath, evalStore_);
 
-    auto outputsOpt = std::visit(overloaded {
-        [&](const OutputsSpec::All &) {
-            // Keep all outputs
-            return std::move(outputsOpt_);
+    auto outputsOpt = std::visit(
+        overloaded{
+            [&](const OutputsSpec::All &) {
+                // Keep all outputs
+                return std::move(outputsOpt_);
+            },
+            [&](const OutputsSpec::Names & names) {
+                // Get just those mentioned by name
+                std::map<std::string, std::optional<StorePath>> outputsOpt;
+                for (auto & output : names) {
+                    auto * pOutputPathOpt = get(outputsOpt_, output);
+                    if (!pOutputPathOpt)
+                        throw Error(
+                            "the derivation '%s' doesn't have an output named '%s'",
+                            bfd.drvPath->to_string(store),
+                            output);
+                    outputsOpt.insert_or_assign(output, std::move(*pOutputPathOpt));
+                }
+                return outputsOpt;
+            },
         },
-        [&](const OutputsSpec::Names & names) {
-            // Get just those mentioned by name
-            std::map<std::string, std::optional<StorePath>> outputsOpt;
-            for (auto & output : names) {
-                auto * pOutputPathOpt = get(outputsOpt_, output);
-                if (!pOutputPathOpt)
-                    throw Error(
-                        "the derivation '%s' doesn't have an output named '%s'",
-                        bfd.drvPath->to_string(store), output);
-                outputsOpt.insert_or_assign(output, std::move(*pOutputPathOpt));
-            }
-            return outputsOpt;
-        },
-    }, bfd.outputs.raw);
+        bfd.outputs.raw);
 
     OutputPathMap outputs;
     for (auto & [outputName, outputPathOpt] : outputsOpt) {
@@ -425,42 +426,40 @@ OutputPathMap resolveDerivedPath(Store & store, const DerivedPath::Built & bfd,
     return outputs;
 }
 
-
 StorePath resolveDerivedPath(Store & store, const SingleDerivedPath & req, Store * evalStore_)
 {
     auto & evalStore = evalStore_ ? *evalStore_ : store;
 
-    return std::visit(overloaded {
-        [&](const SingleDerivedPath::Opaque & bo) {
-            return bo.path;
+    return std::visit(
+        overloaded{
+            [&](const SingleDerivedPath::Opaque & bo) { return bo.path; },
+            [&](const SingleDerivedPath::Built & bfd) {
+                auto drvPath = resolveDerivedPath(store, *bfd.drvPath, evalStore_);
+                auto outputPaths = evalStore.queryPartialDerivationOutputMap(drvPath, evalStore_);
+                if (outputPaths.count(bfd.output) == 0)
+                    throw Error(
+                        "derivation '%s' does not have an output named '%s'",
+                        store.printStorePath(drvPath),
+                        bfd.output);
+                auto & optPath = outputPaths.at(bfd.output);
+                if (!optPath)
+                    throw MissingRealisation(bfd.drvPath->to_string(store), bfd.output);
+                return *optPath;
+            },
         },
-        [&](const SingleDerivedPath::Built & bfd) {
-            auto drvPath = resolveDerivedPath(store, *bfd.drvPath, evalStore_);
-            auto outputPaths = evalStore.queryPartialDerivationOutputMap(drvPath, evalStore_);
-            if (outputPaths.count(bfd.output) == 0)
-                throw Error("derivation '%s' does not have an output named '%s'",
-                    store.printStorePath(drvPath), bfd.output);
-            auto & optPath = outputPaths.at(bfd.output);
-            if (!optPath)
-                throw MissingRealisation(bfd.drvPath->to_string(store), bfd.output);
-            return *optPath;
-        },
-    }, req.raw());
+        req.raw());
 }
 
-
 OutputPathMap resolveDerivedPath(Store & store, const DerivedPath::Built & bfd)
 {
     auto drvPath = resolveDerivedPath(store, *bfd.drvPath);
     auto outputMap = store.queryDerivationOutputMap(drvPath);
-    auto outputsLeft = std::visit(overloaded {
-        [&](const OutputsSpec::All &) {
-            return StringSet {};
+    auto outputsLeft = std::visit(
+        overloaded{
+            [&](const OutputsSpec::All &) { return StringSet{}; },
+            [&](const OutputsSpec::Names & names) { return static_cast<StringSet>(names); },
         },
-        [&](const OutputsSpec::Names & names) {
-            return static_cast<StringSet>(names);
-        },
-    }, bfd.outputs.raw);
+        bfd.outputs.raw);
     for (auto iter = outputMap.begin(); iter != outputMap.end();) {
         auto & outputName = iter->first;
         if (bfd.outputs.contains(outputName)) {
@@ -471,10 +470,11 @@ OutputPathMap resolveDerivedPath(Store & store, const DerivedPath::Built & bfd)
         }
     }
     if (!outputsLeft.empty())
-        throw Error("derivation '%s' does not have an outputs %s",
+        throw Error(
+            "derivation '%s' does not have an outputs %s",
             store.printStorePath(drvPath),
             concatStringsSep(", ", quoteStrings(std::get<OutputsSpec::Names>(bfd.outputs.raw))));
     return outputMap;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/names.cc b/src/libstore/names.cc
index 998b9356a..263007e03 100644
--- a/src/libstore/names.cc
+++ b/src/libstore/names.cc
@@ -3,28 +3,25 @@
 
 #include <regex>
 
-
 namespace nix {
 
-
 struct Regex
 {
     std::regex regex;
 };
 
-
 DrvName::DrvName()
 {
     name = "";
 }
 
-
 /* Parse a derivation name.  The `name' part of a derivation name is
    everything up to but not including the first dash *not* followed by
    a letter.  The `version' part is the rest (excluding the separating
    dash).  E.g., `apache-httpd-2.0.48' is parsed to (`apache-httpd',
    '2.0.48'). */
-DrvName::DrvName(std::string_view s) : hits(0)
+DrvName::DrvName(std::string_view s)
+    : hits(0)
 {
     name = fullName = std::string(s);
     for (unsigned int i = 0; i < s.size(); ++i) {
@@ -37,10 +34,7 @@ DrvName::DrvName(std::string_view s) : hits(0)
     }
 }
 
-
-DrvName::~DrvName()
-{ }
-
+DrvName::~DrvName() {}
 
 bool DrvName::matches(const DrvName & n)
 {
@@ -49,27 +43,30 @@ bool DrvName::matches(const DrvName & n)
             regex = std::make_unique<Regex>();
             regex->regex = std::regex(name, std::regex::extended);
         }
-        if (!std::regex_match(n.name, regex->regex)) return false;
+        if (!std::regex_match(n.name, regex->regex))
+            return false;
     }
-    if (version != "" && version != n.version) return false;
+    if (version != "" && version != n.version)
+        return false;
     return true;
 }
 
-
-std::string_view nextComponent(std::string_view::const_iterator & p,
-    const std::string_view::const_iterator end)
+std::string_view nextComponent(std::string_view::const_iterator & p, const std::string_view::const_iterator end)
 {
     /* Skip any dots and dashes (component separators). */
-    while (p != end && (*p == '.' || *p == '-')) ++p;
+    while (p != end && (*p == '.' || *p == '-'))
+        ++p;
 
-    if (p == end) return "";
+    if (p == end)
+        return "";
 
     /* If the first character is a digit, consume the longest sequence
        of digits.  Otherwise, consume the longest sequence of
        non-digit, non-separator characters. */
     auto s = p;
     if (isdigit(*p))
-        while (p != end && isdigit(*p)) p++;
+        while (p != end && isdigit(*p))
+            p++;
     else
         while (p != end && (!isdigit(*p) && *p != '.' && *p != '-'))
             p++;
@@ -77,23 +74,28 @@ std::string_view nextComponent(std::string_view::const_iterator & p,
     return {s, size_t(p - s)};
 }
 
-
 static bool componentsLT(const std::string_view c1, const std::string_view c2)
 {
     auto n1 = string2Int<int>(c1);
     auto n2 = string2Int<int>(c2);
 
-    if (n1 && n2) return *n1 < *n2;
-    else if (c1 == "" && n2) return true;
-    else if (c1 == "pre" && c2 != "pre") return true;
-    else if (c2 == "pre") return false;
+    if (n1 && n2)
+        return *n1 < *n2;
+    else if (c1 == "" && n2)
+        return true;
+    else if (c1 == "pre" && c2 != "pre")
+        return true;
+    else if (c2 == "pre")
+        return false;
     /* Assume that `2.3a' < `2.3.1'. */
-    else if (n2) return true;
-    else if (n1) return false;
-    else return c1 < c2;
+    else if (n2)
+        return true;
+    else if (n1)
+        return false;
+    else
+        return c1 < c2;
 }
 
-
 std::strong_ordering compareVersions(const std::string_view v1, const std::string_view v2)
 {
     auto p1 = v1.begin();
@@ -102,14 +104,15 @@ std::strong_ordering compareVersions(const std::string_view v1, const std::strin
     while (p1 != v1.end() || p2 != v2.end()) {
         auto c1 = nextComponent(p1, v1.end());
         auto c2 = nextComponent(p2, v2.end());
-        if (componentsLT(c1, c2)) return std::strong_ordering::less;
-        else if (componentsLT(c2, c1)) return std::strong_ordering::greater;
+        if (componentsLT(c1, c2))
+            return std::strong_ordering::less;
+        else if (componentsLT(c2, c1))
+            return std::strong_ordering::greater;
     }
 
     return std::strong_ordering::equal;
 }
 
-
 DrvNames drvNamesFromArgs(const Strings & opArgs)
 {
     DrvNames result;
@@ -118,5 +121,4 @@ DrvNames drvNamesFromArgs(const Strings & opArgs)
     return result;
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/nar-accessor.cc b/src/libstore/nar-accessor.cc
index 6aba68a36..63fe774c9 100644
--- a/src/libstore/nar-accessor.cc
+++ b/src/libstore/nar-accessor.cc
@@ -29,8 +29,10 @@ private:
 public:
 
     NarMemberConstructor(NarMember & nm, uint64_t & pos)
-        : narMember(nm), pos(pos)
-    { }
+        : narMember(nm)
+        , pos(pos)
+    {
+    }
 
     void isExecutable() override
     {
@@ -43,8 +45,7 @@ public:
         narMember.stat.narOffset = pos;
     }
 
-    void operator () (std::string_view data) override
-    { }
+    void operator()(std::string_view data) override {}
 };
 
 struct NarAccessor : public SourceAccessor
@@ -67,18 +68,21 @@ struct NarAccessor : public SourceAccessor
         uint64_t pos = 0;
 
         NarIndexer(NarAccessor & acc, Source & source)
-            : acc(acc), source(source)
-        { }
+            : acc(acc)
+            , source(source)
+        {
+        }
 
         NarMember & createMember(const CanonPath & path, NarMember member)
         {
             size_t level = 0;
             for (auto _ : path) {
-                (void)_;
+                (void) _;
                 ++level;
             }
 
-            while (parents.size() > level) parents.pop();
+            while (parents.size() > level)
+                parents.pop();
 
             if (parents.empty()) {
                 acc.root = std::move(member);
@@ -96,32 +100,23 @@ struct NarAccessor : public SourceAccessor
 
         void createDirectory(const CanonPath & path) override
         {
-            createMember(path, NarMember{ .stat = {
-                .type = Type::tDirectory,
-                .fileSize = 0,
-                .isExecutable = false,
-                .narOffset = 0
-            } });
+            createMember(
+                path,
+                NarMember{.stat = {.type = Type::tDirectory, .fileSize = 0, .isExecutable = false, .narOffset = 0}});
         }
 
         void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func) override
         {
-            auto & nm = createMember(path, NarMember{ .stat = {
-                .type = Type::tRegular,
-                .fileSize = 0,
-                .isExecutable = false,
-                .narOffset = 0
-            } });
-            NarMemberConstructor nmc { nm, pos };
+            auto & nm = createMember(
+                path,
+                NarMember{.stat = {.type = Type::tRegular, .fileSize = 0, .isExecutable = false, .narOffset = 0}});
+            NarMemberConstructor nmc{nm, pos};
             func(nmc);
         }
 
         void createSymlink(const CanonPath & path, const std::string & target) override
         {
-            createMember(path,
-                NarMember{
-                    .stat = {.type = Type::tSymlink},
-                    .target = target});
+            createMember(path, NarMember{.stat = {.type = Type::tSymlink}, .target = target});
         }
 
         size_t read(char * data, size_t len) override
@@ -132,7 +127,8 @@ struct NarAccessor : public SourceAccessor
         }
     };
 
-    NarAccessor(std::string && _nar) : nar(_nar)
+    NarAccessor(std::string && _nar)
+        : nar(_nar)
     {
         StringSource source(*nar);
         NarIndexer indexer(*this, source);
@@ -157,7 +153,7 @@ struct NarAccessor : public SourceAccessor
 
             if (type == "directory") {
                 member.stat = {.type = Type::tDirectory};
-                for (const auto &[name, function] : v["entries"].items()) {
+                for (const auto & [name, function] : v["entries"].items()) {
                     recurse(member.children[name], function);
                 }
             } else if (type == "regular") {
@@ -165,12 +161,12 @@ struct NarAccessor : public SourceAccessor
                     .type = Type::tRegular,
                     .fileSize = v["size"],
                     .isExecutable = v.value("executable", false),
-                    .narOffset = v["narOffset"]
-                };
+                    .narOffset = v["narOffset"]};
             } else if (type == "symlink") {
                 member.stat = {.type = Type::tSymlink};
                 member.target = v.value("target", "");
-            } else return;
+            } else
+                return;
         };
 
         json v = json::parse(listing);
@@ -182,16 +178,19 @@ struct NarAccessor : public SourceAccessor
         NarMember * current = &root;
 
         for (const auto & i : path) {
-            if (current->stat.type != Type::tDirectory) return nullptr;
+            if (current->stat.type != Type::tDirectory)
+                return nullptr;
             auto child = current->children.find(std::string(i));
-            if (child == current->children.end()) return nullptr;
+            if (child == current->children.end())
+                return nullptr;
             current = &child->second;
         }
 
         return current;
     }
 
-    NarMember & get(const CanonPath & path) {
+    NarMember & get(const CanonPath & path)
+    {
         auto result = find(path);
         if (!result)
             throw Error("NAR file does not contain path '%1%'", path);
@@ -226,7 +225,8 @@ struct NarAccessor : public SourceAccessor
         if (i.stat.type != Type::tRegular)
             throw Error("path '%1%' inside NAR file is not a regular file", path);
 
-        if (getNarBytes) return getNarBytes(*i.stat.narOffset, *i.stat.fileSize);
+        if (getNarBytes)
+            return getNarBytes(*i.stat.narOffset, *i.stat.fileSize);
 
         assert(nar);
         return std::string(*nar, *i.stat.narOffset, *i.stat.fileSize);
@@ -251,13 +251,13 @@ ref<SourceAccessor> makeNarAccessor(Source & source)
     return make_ref<NarAccessor>(source);
 }
 
-ref<SourceAccessor> makeLazyNarAccessor(const std::string & listing,
-    GetNarBytes getNarBytes)
+ref<SourceAccessor> makeLazyNarAccessor(const std::string & listing, GetNarBytes getNarBytes)
 {
     return make_ref<NarAccessor>(listing, getNarBytes);
 }
 
 using nlohmann::json;
+
 json listNar(ref<SourceAccessor> accessor, const CanonPath & path, bool recurse)
 {
     auto st = accessor->lstat(path);
@@ -278,7 +278,7 @@ json listNar(ref<SourceAccessor> accessor, const CanonPath & path, bool recurse)
         obj["type"] = "directory";
         {
             obj["entries"] = json::object();
-            json &res2 = obj["entries"];
+            json & res2 = obj["entries"];
             for (const auto & [name, type] : accessor->readDirectory(path)) {
                 if (recurse) {
                     res2[name] = listNar(accessor, path / name, true);
@@ -301,4 +301,4 @@ json listNar(ref<SourceAccessor> accessor, const CanonPath & path, bool recurse)
     return obj;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/nar-info-disk-cache.cc b/src/libstore/nar-info-disk-cache.cc
index 5d72ba8ae..69d8d2e14 100644
--- a/src/libstore/nar-info-disk-cache.cc
+++ b/src/libstore/nar-info-disk-cache.cc
@@ -79,15 +79,14 @@ public:
     struct State
     {
         SQLite db;
-        SQLiteStmt insertCache, queryCache, insertNAR, insertMissingNAR,
-            queryNAR, insertRealisation, insertMissingRealisation,
-            queryRealisation, purgeCache;
+        SQLiteStmt insertCache, queryCache, insertNAR, insertMissingNAR, queryNAR, insertRealisation,
+            insertMissingRealisation, queryRealisation, purgeCache;
         std::map<std::string, Cache> caches;
     };
 
     Sync<State> _state;
 
-    NarInfoDiskCacheImpl(Path dbPath = getCacheDir() + "/binary-cache-v6.sqlite")
+    NarInfoDiskCacheImpl(Path dbPath = getCacheDir() + "/binary-cache-v7.sqlite")
     {
         auto state(_state.lock());
 
@@ -99,35 +98,42 @@ public:
 
         state->db.exec(schema);
 
-        state->insertCache.create(state->db,
+        state->insertCache.create(
+            state->db,
             "insert into BinaryCaches(url, timestamp, storeDir, wantMassQuery, priority) values (?1, ?2, ?3, ?4, ?5) on conflict (url) do update set timestamp = ?2, storeDir = ?3, wantMassQuery = ?4, priority = ?5 returning id;");
 
-        state->queryCache.create(state->db,
+        state->queryCache.create(
+            state->db,
             "select id, storeDir, wantMassQuery, priority from BinaryCaches where url = ? and timestamp > ?");
 
-        state->insertNAR.create(state->db,
+        state->insertNAR.create(
+            state->db,
             "insert or replace into NARs(cache, hashPart, namePart, url, compression, fileHash, fileSize, narHash, "
             "narSize, refs, deriver, sigs, ca, timestamp, present) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)");
 
-        state->insertMissingNAR.create(state->db,
-            "insert or replace into NARs(cache, hashPart, timestamp, present) values (?, ?, ?, 0)");
+        state->insertMissingNAR.create(
+            state->db, "insert or replace into NARs(cache, hashPart, timestamp, present) values (?, ?, ?, 0)");
 
-        state->queryNAR.create(state->db,
+        state->queryNAR.create(
+            state->db,
             "select present, namePart, url, compression, fileHash, fileSize, narHash, narSize, refs, deriver, sigs, ca from NARs where cache = ? and hashPart = ? and ((present = 0 and timestamp > ?) or (present = 1 and timestamp > ?))");
 
-        state->insertRealisation.create(state->db,
+        state->insertRealisation.create(
+            state->db,
             R"(
                 insert or replace into Realisations(cache, outputId, content, timestamp)
                     values (?, ?, ?, ?)
             )");
 
-        state->insertMissingRealisation.create(state->db,
+        state->insertMissingRealisation.create(
+            state->db,
             R"(
                 insert or replace into Realisations(cache, outputId, timestamp)
                     values (?, ?, ?)
             )");
 
-        state->queryRealisation.create(state->db,
+        state->queryRealisation.create(
+            state->db,
             R"(
                 select content from Realisations
                     where cache = ? and outputId = ?  and
@@ -143,20 +149,21 @@ public:
             auto queryLastPurge_(queryLastPurge.use());
 
             if (!queryLastPurge_.next() || queryLastPurge_.getInt(0) < now - purgeInterval) {
-                SQLiteStmt(state->db,
+                SQLiteStmt(
+                    state->db,
                     "delete from NARs where ((present = 0 and timestamp < ?) or (present = 1 and timestamp < ?))")
                     .use()
                     // Use a minimum TTL to prevent --refresh from
                     // nuking the entire disk cache.
-                    (now - std::max(settings.ttlNegativeNarInfoCache.get(), 3600U))
-                    (now - std::max(settings.ttlPositiveNarInfoCache.get(), 30 * 24 * 3600U))
+                    (now - std::max(settings.ttlNegativeNarInfoCache.get(), 3600U))(
+                        now - std::max(settings.ttlPositiveNarInfoCache.get(), 30 * 24 * 3600U))
                     .exec();
 
                 debug("deleted %d entries from the NAR info disk cache", sqlite3_changes(state->db));
 
-                SQLiteStmt(state->db,
-                    "insert or replace into LastPurge(dummy, value) values ('', ?)")
-                    .use()(now).exec();
+                SQLiteStmt(state->db, "insert or replace into LastPurge(dummy, value) values ('', ?)")
+                    .use()(now)
+                    .exec();
             }
         });
     }
@@ -164,7 +171,8 @@ public:
     Cache & getCache(State & state, const std::string & uri)
     {
         auto i = state.caches.find(uri);
-        if (i == state.caches.end()) unreachable();
+        if (i == state.caches.end())
+            unreachable();
         return i->second;
     }
 
@@ -177,7 +185,7 @@ private:
             auto queryCache(state.queryCache.use()(uri)(time(0) - cacheInfoTtl));
             if (!queryCache.next())
                 return std::nullopt;
-            auto cache = Cache {
+            auto cache = Cache{
                 .id = (int) queryCache.getInt(0),
                 .storeDir = queryCache.getStr(1),
                 .wantMassQuery = queryCache.getInt(2) != 0,
@@ -202,7 +210,7 @@ public:
             if (cache)
                 return cache->id;
 
-            Cache ret {
+            Cache ret{
                 .id = -1, // set below
                 .storeDir = storeDir,
                 .wantMassQuery = wantMassQuery,
@@ -210,8 +218,10 @@ public:
             };
 
             {
-                auto r(state->insertCache.use()(uri)(time(0))(storeDir)(wantMassQuery)(priority));
-                if (!r.next()) { unreachable(); }
+                auto r(state->insertCache.use()(uri)(time(0))(storeDir) (wantMassQuery) (priority));
+                if (!r.next()) {
+                    unreachable();
+                }
                 ret.id = (int) r.getInt(0);
             }
 
@@ -229,94 +239,80 @@ public:
             auto cache(queryCacheRaw(*state, uri));
             if (!cache)
                 return std::nullopt;
-            return CacheInfo {
-                .id = cache->id,
-                .wantMassQuery = cache->wantMassQuery,
-                .priority = cache->priority
-            };
+            return CacheInfo{.id = cache->id, .wantMassQuery = cache->wantMassQuery, .priority = cache->priority};
         });
     }
 
-    std::pair<Outcome, std::shared_ptr<NarInfo>> lookupNarInfo(
-        const std::string & uri, const std::string & hashPart) override
+    std::pair<Outcome, std::shared_ptr<NarInfo>>
+    lookupNarInfo(const std::string & uri, const std::string & hashPart) override
     {
         return retrySQLite<std::pair<Outcome, std::shared_ptr<NarInfo>>>(
             [&]() -> std::pair<Outcome, std::shared_ptr<NarInfo>> {
-            auto state(_state.lock());
+                auto state(_state.lock());
 
-            auto & cache(getCache(*state, uri));
+                auto & cache(getCache(*state, uri));
 
-            auto now = time(0);
+                auto now = time(0);
 
-            auto queryNAR(state->queryNAR.use()
-                (cache.id)
-                (hashPart)
-                (now - settings.ttlNegativeNarInfoCache)
-                (now - settings.ttlPositiveNarInfoCache));
+                auto queryNAR(state->queryNAR.use()(cache.id)(hashPart) (now - settings.ttlNegativeNarInfoCache)(
+                    now - settings.ttlPositiveNarInfoCache));
 
-            if (!queryNAR.next())
-                return {oUnknown, 0};
+                if (!queryNAR.next())
+                    return {oUnknown, 0};
 
-            if (!queryNAR.getInt(0))
-                return {oInvalid, 0};
+                if (!queryNAR.getInt(0))
+                    return {oInvalid, 0};
 
-            auto namePart = queryNAR.getStr(1);
-            auto narInfo = make_ref<NarInfo>(
-                StorePath(hashPart + "-" + namePart),
-                Hash::parseAnyPrefixed(queryNAR.getStr(6)));
-            narInfo->url = queryNAR.getStr(2);
-            narInfo->compression = queryNAR.getStr(3);
-            if (!queryNAR.isNull(4))
-                narInfo->fileHash = Hash::parseAnyPrefixed(queryNAR.getStr(4));
-            narInfo->fileSize = queryNAR.getInt(5);
-            narInfo->narSize = queryNAR.getInt(7);
-            for (auto & r : tokenizeString<Strings>(queryNAR.getStr(8), " "))
-                narInfo->references.insert(StorePath(r));
-            if (!queryNAR.isNull(9))
-                narInfo->deriver = StorePath(queryNAR.getStr(9));
-            for (auto & sig : tokenizeString<Strings>(queryNAR.getStr(10), " "))
-                narInfo->sigs.insert(sig);
-            narInfo->ca = ContentAddress::parseOpt(queryNAR.getStr(11));
+                auto namePart = queryNAR.getStr(1);
+                auto narInfo =
+                    make_ref<NarInfo>(StorePath(hashPart + "-" + namePart), Hash::parseAnyPrefixed(queryNAR.getStr(6)));
+                narInfo->url = queryNAR.getStr(2);
+                narInfo->compression = queryNAR.getStr(3);
+                if (!queryNAR.isNull(4))
+                    narInfo->fileHash = Hash::parseAnyPrefixed(queryNAR.getStr(4));
+                narInfo->fileSize = queryNAR.getInt(5);
+                narInfo->narSize = queryNAR.getInt(7);
+                for (auto & r : tokenizeString<Strings>(queryNAR.getStr(8), " "))
+                    narInfo->references.insert(StorePath(r));
+                if (!queryNAR.isNull(9))
+                    narInfo->deriver = StorePath(queryNAR.getStr(9));
+                for (auto & sig : tokenizeString<Strings>(queryNAR.getStr(10), " "))
+                    narInfo->sigs.insert(sig);
+                narInfo->ca = ContentAddress::parseOpt(queryNAR.getStr(11));
 
-            return {oValid, narInfo};
-        });
+                return {oValid, narInfo};
+            });
     }
 
-    std::pair<Outcome, std::shared_ptr<Realisation>> lookupRealisation(
-        const std::string & uri, const DrvOutput & id) override
+    std::pair<Outcome, std::shared_ptr<Realisation>>
+    lookupRealisation(const std::string & uri, const DrvOutput & id) override
     {
         return retrySQLite<std::pair<Outcome, std::shared_ptr<Realisation>>>(
             [&]() -> std::pair<Outcome, std::shared_ptr<Realisation>> {
-            auto state(_state.lock());
+                auto state(_state.lock());
 
-            auto & cache(getCache(*state, uri));
+                auto & cache(getCache(*state, uri));
 
-            auto now = time(0);
+                auto now = time(0);
 
-            auto queryRealisation(state->queryRealisation.use()
-                (cache.id)
-                (id.to_string())
-                (now - settings.ttlNegativeNarInfoCache)
-                (now - settings.ttlPositiveNarInfoCache));
+                auto queryRealisation(state->queryRealisation.use()(cache.id)(id.to_string())(
+                    now - settings.ttlNegativeNarInfoCache)(now - settings.ttlPositiveNarInfoCache));
 
-            if (!queryRealisation.next())
-                return {oUnknown, 0};
+                if (!queryRealisation.next())
+                    return {oUnknown, 0};
 
-            if (queryRealisation.isNull(0))
-                return {oInvalid, 0};
+                if (queryRealisation.isNull(0))
+                    return {oInvalid, 0};
 
-            auto realisation =
-                std::make_shared<Realisation>(Realisation::fromJSON(
-                    nlohmann::json::parse(queryRealisation.getStr(0)),
-                    "Local disk cache"));
+                auto realisation = std::make_shared<Realisation>(
+                    Realisation::fromJSON(nlohmann::json::parse(queryRealisation.getStr(0)), "Local disk cache"));
 
-            return {oValid, realisation};
-        });
+                return {oValid, realisation};
+            });
     }
 
     void upsertNarInfo(
-        const std::string & uri, const std::string & hashPart,
-        std::shared_ptr<const ValidPathInfo> info) override
+        const std::string & uri, const std::string & hashPart, std::shared_ptr<const ValidPathInfo> info) override
     {
         retrySQLite<void>([&]() {
             auto state(_state.lock());
@@ -327,63 +323,44 @@ public:
 
                 auto narInfo = std::dynamic_pointer_cast<const NarInfo>(info);
 
-                //assert(hashPart == storePathToHash(info->path));
+                // assert(hashPart == storePathToHash(info->path));
 
-                state->insertNAR.use()
-                    (cache.id)
-                    (hashPart)
-                    (std::string(info->path.name()))
-                    (narInfo ? narInfo->url : "", narInfo != 0)
-                    (narInfo ? narInfo->compression : "", narInfo != 0)
-                    (narInfo && narInfo->fileHash ? narInfo->fileHash->to_string(HashFormat::Nix32, true) : "", narInfo && narInfo->fileHash)
-                    (narInfo ? narInfo->fileSize : 0, narInfo != 0 && narInfo->fileSize)
-                    (info->narHash.to_string(HashFormat::Nix32, true))
-                    (info->narSize)
-                    (concatStringsSep(" ", info->shortRefs()))
-                    (info->deriver ? std::string(info->deriver->to_string()) : "", (bool) info->deriver)
-                    (concatStringsSep(" ", info->sigs))
-                    (renderContentAddress(info->ca))
-                    (time(0)).exec();
+                state->insertNAR
+                    .use()(cache.id)(hashPart) (std::string(info->path.name()))(
+                        narInfo ? narInfo->url : "", narInfo != 0)(narInfo ? narInfo->compression : "", narInfo != 0)(
+                        narInfo && narInfo->fileHash ? narInfo->fileHash->to_string(HashFormat::Nix32, true) : "",
+                        narInfo && narInfo->fileHash)(
+                        narInfo ? narInfo->fileSize : 0, narInfo != 0 && narInfo->fileSize)(info->narHash.to_string(
+                        HashFormat::Nix32, true))(info->narSize)(concatStringsSep(" ", info->shortRefs()))(
+                        info->deriver ? std::string(info->deriver->to_string()) : "", (bool) info->deriver)(
+                        concatStringsSep(" ", info->sigs))(renderContentAddress(info->ca))(time(0))
+                    .exec();
 
             } else {
-                state->insertMissingNAR.use()
-                    (cache.id)
-                    (hashPart)
-                    (time(0)).exec();
+                state->insertMissingNAR.use()(cache.id)(hashPart) (time(0)).exec();
             }
         });
     }
 
-    void upsertRealisation(
-        const std::string & uri,
-        const Realisation & realisation) override
+    void upsertRealisation(const std::string & uri, const Realisation & realisation) override
     {
         retrySQLite<void>([&]() {
             auto state(_state.lock());
 
             auto & cache(getCache(*state, uri));
 
-            state->insertRealisation.use()
-                (cache.id)
-                (realisation.id.to_string())
-                (realisation.toJSON().dump())
-                (time(0)).exec();
+            state->insertRealisation.use()(cache.id)(realisation.id.to_string())(realisation.toJSON().dump())(time(0))
+                .exec();
         });
-
     }
 
-    virtual void upsertAbsentRealisation(
-        const std::string & uri,
-        const DrvOutput & id) override
+    virtual void upsertAbsentRealisation(const std::string & uri, const DrvOutput & id) override
     {
         retrySQLite<void>([&]() {
             auto state(_state.lock());
 
             auto & cache(getCache(*state, uri));
-            state->insertMissingRealisation.use()
-                (cache.id)
-                (id.to_string())
-                (time(0)).exec();
+            state->insertMissingRealisation.use()(cache.id)(id.to_string())(time(0)).exec();
         });
     }
 };
@@ -399,4 +376,4 @@ ref<NarInfoDiskCache> getTestNarInfoDiskCache(Path dbPath)
     return make_ref<NarInfoDiskCacheImpl>(dbPath);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/nar-info.cc b/src/libstore/nar-info.cc
index ef7af6126..1e7c48287 100644
--- a/src/libstore/nar-info.cc
+++ b/src/libstore/nar-info.cc
@@ -6,13 +6,15 @@
 
 namespace nix {
 
-NarInfo::NarInfo(const Store & store, const std::string & s, const std::string & whence)
+NarInfo::NarInfo(const StoreDirConfig & store, const std::string & s, const std::string & whence)
     : ValidPathInfo(StorePath(StorePath::dummy), Hash(Hash::dummy)) // FIXME: hack
 {
     unsigned line = 1;
 
     auto corrupt = [&](const char * reason) {
-        return Error("NAR info file '%1%' is corrupt: %2%", whence,
+        return Error(
+            "NAR info file '%1%' is corrupt: %2%",
+            whence,
             std::string(reason) + (line > 0 ? " at line " + std::to_string(line) : ""));
     };
 
@@ -31,20 +33,21 @@ NarInfo::NarInfo(const Store & store, const std::string & s, const std::string &
     while (pos < s.size()) {
 
         size_t colon = s.find(':', pos);
-        if (colon == s.npos) throw corrupt("expecting ':'");
+        if (colon == s.npos)
+            throw corrupt("expecting ':'");
 
         std::string name(s, pos, colon - pos);
 
         size_t eol = s.find('\n', colon + 2);
-        if (eol == s.npos) throw corrupt("expecting '\\n'");
+        if (eol == s.npos)
+            throw corrupt("expecting '\\n'");
 
         std::string value(s, colon + 2, eol - colon - 2);
 
         if (name == "StorePath") {
             path = store.parseStorePath(value);
             havePath = true;
-        }
-        else if (name == "URL")
+        } else if (name == "URL")
             url = value;
         else if (name == "Compression")
             compression = value;
@@ -52,32 +55,31 @@ NarInfo::NarInfo(const Store & store, const std::string & s, const std::string &
             fileHash = parseHashField(value);
         else if (name == "FileSize") {
             auto n = string2Int<decltype(fileSize)>(value);
-            if (!n) throw corrupt("invalid FileSize");
+            if (!n)
+                throw corrupt("invalid FileSize");
             fileSize = *n;
-        }
-        else if (name == "NarHash") {
+        } else if (name == "NarHash") {
             narHash = parseHashField(value);
             haveNarHash = true;
-        }
-        else if (name == "NarSize") {
+        } else if (name == "NarSize") {
             auto n = string2Int<decltype(narSize)>(value);
-            if (!n) throw corrupt("invalid NarSize");
+            if (!n)
+                throw corrupt("invalid NarSize");
             narSize = *n;
-        }
-        else if (name == "References") {
+        } else if (name == "References") {
             auto refs = tokenizeString<Strings>(value, " ");
-            if (!references.empty()) throw corrupt("extra References");
+            if (!references.empty())
+                throw corrupt("extra References");
             for (auto & r : refs)
                 references.insert(StorePath(r));
-        }
-        else if (name == "Deriver") {
+        } else if (name == "Deriver") {
             if (value != "unknown-deriver")
                 deriver = StorePath(value);
-        }
-        else if (name == "Sig")
+        } else if (name == "Sig")
             sigs.insert(value);
         else if (name == "CA") {
-            if (ca) throw corrupt("extra CA");
+            if (ca)
+                throw corrupt("extra CA");
             // FIXME: allow blank ca or require skipping field?
             ca = ContentAddress::parseOpt(value);
         }
@@ -86,20 +88,21 @@ NarInfo::NarInfo(const Store & store, const std::string & s, const std::string &
         line += 1;
     }
 
-    if (compression == "") compression = "bzip2";
+    if (compression == "")
+        compression = "bzip2";
 
     if (!havePath || !haveNarHash || url.empty() || narSize == 0) {
         line = 0; // don't include line information in the error
         throw corrupt(
-            !havePath ? "StorePath missing" :
-            !haveNarHash ? "NarHash missing" :
-            url.empty() ? "URL missing" :
-            narSize == 0 ? "NarSize missing or zero"
-            : "?");
+            !havePath      ? "StorePath missing"
+            : !haveNarHash ? "NarHash missing"
+            : url.empty()  ? "URL missing"
+            : narSize == 0 ? "NarSize missing or zero"
+                           : "?");
     }
 }
 
-std::string NarInfo::to_string(const Store & store) const
+std::string NarInfo::to_string(const StoreDirConfig & store) const
 {
     std::string res;
     res += "StorePath: " + store.printStorePath(path) + "\n";
@@ -127,10 +130,7 @@ std::string NarInfo::to_string(const Store & store) const
     return res;
 }
 
-nlohmann::json NarInfo::toJSON(
-    const Store & store,
-    bool includeImpureInfo,
-    HashFormat hashFormat) const
+nlohmann::json NarInfo::toJSON(const StoreDirConfig & store, bool includeImpureInfo, HashFormat hashFormat) const
 {
     using nlohmann::json;
 
@@ -150,19 +150,14 @@ nlohmann::json NarInfo::toJSON(
     return jsonObject;
 }
 
-NarInfo NarInfo::fromJSON(
-    const Store & store,
-    const StorePath & path,
-    const nlohmann::json & json)
+NarInfo NarInfo::fromJSON(const StoreDirConfig & store, const StorePath & path, const nlohmann::json & json)
 {
     using nlohmann::detail::value_t;
 
-    NarInfo res {
-        ValidPathInfo {
-            path,
-            UnkeyedValidPathInfo::fromJSON(store, json),
-        }
-    };
+    NarInfo res{ValidPathInfo{
+        path,
+        UnkeyedValidPathInfo::fromJSON(store, json),
+    }};
 
     if (json.contains("url"))
         res.url = getString(valueAt(json, "url"));
@@ -171,9 +166,7 @@ NarInfo NarInfo::fromJSON(
         res.compression = getString(valueAt(json, "compression"));
 
     if (json.contains("downloadHash"))
-        res.fileHash = Hash::parseAny(
-            getString(valueAt(json, "downloadHash")),
-            std::nullopt);
+        res.fileHash = Hash::parseAny(getString(valueAt(json, "downloadHash")), std::nullopt);
 
     if (json.contains("downloadSize"))
         res.fileSize = getUnsigned(valueAt(json, "downloadSize"));
@@ -181,4 +174,4 @@ NarInfo NarInfo::fromJSON(
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc
index e47c0707c..1cf28e022 100644
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -17,7 +17,6 @@
 
 namespace nix {
 
-
 static void makeWritable(const Path & path)
 {
     auto st = lstat(path);
@@ -25,30 +24,35 @@ static void makeWritable(const Path & path)
         throw SysError("changing writability of '%1%'", path);
 }
 
-
 struct MakeReadOnly
 {
     Path path;
-    MakeReadOnly(const PathView path) : path(path) { }
+
+    MakeReadOnly(const PathView path)
+        : path(path)
+    {
+    }
+
     ~MakeReadOnly()
     {
         try {
             /* This will make the path read-only. */
-            if (path != "") canonicaliseTimestampAndPermissions(path);
+            if (path != "")
+                canonicaliseTimestampAndPermissions(path);
         } catch (...) {
             ignoreExceptionInDestructor();
         }
     }
 };
 
-
 LocalStore::InodeHash LocalStore::loadInodeHash()
 {
     debug("loading hash inodes in memory");
     InodeHash inodeHash;
 
     AutoCloseDir dir(opendir(linksDir.c_str()));
-    if (!dir) throw SysError("opening directory '%1%'", linksDir);
+    if (!dir)
+        throw SysError("opening directory '%1%'", linksDir);
 
     struct dirent * dirent;
     while (errno = 0, dirent = readdir(dir.get())) { /* sic */
@@ -56,20 +60,21 @@ LocalStore::InodeHash LocalStore::loadInodeHash()
         // We don't care if we hit non-hash files, anything goes
         inodeHash.insert(dirent->d_ino);
     }
-    if (errno) throw SysError("reading directory '%1%'", linksDir);
+    if (errno)
+        throw SysError("reading directory '%1%'", linksDir);
 
     printMsg(lvlTalkative, "loaded %1% hash inodes", inodeHash.size());
 
     return inodeHash;
 }
 
-
 Strings LocalStore::readDirectoryIgnoringInodes(const Path & path, const InodeHash & inodeHash)
 {
     Strings names;
 
     AutoCloseDir dir(opendir(path.c_str()));
-    if (!dir) throw SysError("opening directory '%1%'", path);
+    if (!dir)
+        throw SysError("opening directory '%1%'", path);
 
     struct dirent * dirent;
     while (errno = 0, dirent = readdir(dir.get())) { /* sic */
@@ -81,17 +86,18 @@ Strings LocalStore::readDirectoryIgnoringInodes(const Path & path, const InodeHa
         }
 
         std::string name = dirent->d_name;
-        if (name == "." || name == "..") continue;
+        if (name == "." || name == "..")
+            continue;
         names.push_back(name);
     }
-    if (errno) throw SysError("reading directory '%1%'", path);
+    if (errno)
+        throw SysError("reading directory '%1%'", path);
 
     return names;
 }
 
-
-void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
-    const Path & path, InodeHash & inodeHash, RepairFlag repair)
+void LocalStore::optimisePath_(
+    Activity * act, OptimiseStats & stats, const Path & path, InodeHash & inodeHash, RepairFlag repair)
 {
     checkInterrupt();
 
@@ -104,8 +110,7 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
        See https://github.com/NixOS/nix/issues/1443 and
        https://github.com/NixOS/nix/pull/2230 for more discussion. */
 
-    if (std::regex_search(path, std::regex("\\.app/Contents/.+$")))
-    {
+    if (std::regex_search(path, std::regex("\\.app/Contents/.+$"))) {
         debug("'%1%' is not allowed to be linked in macOS", path);
         return;
     }
@@ -123,7 +128,8 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
 #if CAN_LINK_SYMLINK
         && !S_ISLNK(st.st_mode)
 #endif
-        ) return;
+    )
+        return;
 
     /* Sometimes SNAFUs can cause files in the Nix store to be
        modified, in particular when running programs as root under
@@ -152,7 +158,9 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
     Hash hash = ({
         hashPath(
             {make_ref<PosixSourceAccessor>(), CanonPath(path)},
-            FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256).first;
+            FileSerialisationMethod::NixArchive,
+            HashAlgorithm::SHA256)
+            .hash;
     });
     debug("'%1%' has hash '%2%'", path, hash.to_string(HashFormat::Nix32, true));
 
@@ -162,17 +170,18 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
     /* Maybe delete the link, if it has been corrupted. */
     if (std::filesystem::exists(std::filesystem::symlink_status(linkPath))) {
         auto stLink = lstat(linkPath.string());
-        if (st.st_size != stLink.st_size
-            || (repair && hash != ({
-                hashPath(
-                    PosixSourceAccessor::createAtRoot(linkPath),
-                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256).first;
-           })))
-        {
+        if (st.st_size != stLink.st_size || (repair && hash != ({
+                                                           hashPath(
+                                                               PosixSourceAccessor::createAtRoot(linkPath),
+                                                               FileSerialisationMethod::NixArchive,
+                                                               HashAlgorithm::SHA256)
+                                                               .hash;
+                                                       }))) {
             // XXX: Consider overwriting linkPath with our valid version.
             warn("removing corrupted link %s", linkPath);
-            warn("There may be more corrupted paths."
-                 "\nYou should run `nix-store --verify --check-contents --repair` to fix them all");
+            warn(
+                "There may be more corrupted paths."
+                "\nYou should run `nix-store --verify --check-contents --repair` to fix them all");
             std::filesystem::remove(linkPath);
         }
     }
@@ -197,7 +206,8 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
                 return;
             }
 
-            else throw;
+            else
+                throw;
         }
     }
 
@@ -217,7 +227,8 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
        permissions). */
     const Path dirOfPath(dirOf(path));
     bool mustToggle = dirOfPath != config->realStoreDir.get();
-    if (mustToggle) makeWritable(dirOfPath);
+    if (mustToggle)
+        makeWritable(dirOfPath);
 
     /* When we're done, make the directory read-only again and reset
        its timestamp back to 0. */
@@ -245,7 +256,7 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
         std::filesystem::rename(tempLink, path);
     } catch (std::filesystem::filesystem_error & e) {
         std::filesystem::remove(tempLink);
-            printError("unable to unlink '%1%'", tempLink);
+        printError("unable to unlink '%1%'", tempLink);
         if (e.code() == std::errc::too_many_links) {
             /* Some filesystems generate too many links on the rename,
                rather than on the original link.  (Probably it
@@ -261,14 +272,16 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
     stats.bytesFreed += st.st_size;
 
     if (act)
-        act->result(resFileLinked, st.st_size
+        act->result(
+            resFileLinked,
+            st.st_size
 #ifndef _WIN32
-            , st.st_blocks
+            ,
+            st.st_blocks
 #endif
-            );
+        );
 }
 
-
 void LocalStore::optimiseStore(OptimiseStats & stats)
 {
     Activity act(*logger, actOptimiseStore);
@@ -282,7 +295,8 @@ void LocalStore::optimiseStore(OptimiseStats & stats)
 
     for (auto & i : paths) {
         addTempRoot(i);
-        if (!isValidPath(i)) continue; /* path was GC'ed, probably */
+        if (!isValidPath(i))
+            continue; /* path was GC'ed, probably */
         {
             Activity act(*logger, lvlTalkative, actUnknown, fmt("optimising path '%s'", printStorePath(i)));
             optimisePath_(&act, stats, config->realStoreDir + "/" + std::string(i.to_string()), inodeHash, NoRepair);
@@ -298,9 +312,7 @@ void LocalStore::optimiseStore()
 
     optimiseStore(stats);
 
-    printInfo("%s freed by hard-linking %d files",
-        showBytes(stats.bytesFreed),
-        stats.filesLinked);
+    printInfo("%s freed by hard-linking %d files", showBytes(stats.bytesFreed), stats.filesLinked);
 }
 
 void LocalStore::optimisePath(const Path & path, RepairFlag repair)
@@ -308,8 +320,8 @@ void LocalStore::optimisePath(const Path & path, RepairFlag repair)
     OptimiseStats stats;
     InodeHash inodeHash;
 
-    if (settings.autoOptimiseStore) optimisePath_(nullptr, stats, path, inodeHash, repair);
+    if (settings.autoOptimiseStore)
+        optimisePath_(nullptr, stats, path, inodeHash, repair);
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/outputs-spec.cc b/src/libstore/outputs-spec.cc
index 28fe45de9..7f73c7d35 100644
--- a/src/libstore/outputs-spec.cc
+++ b/src/libstore/outputs-spec.cc
@@ -11,39 +11,33 @@ namespace nix {
 
 bool OutputsSpec::contains(const std::string & outputName) const
 {
-    return std::visit(overloaded {
-        [&](const OutputsSpec::All &) {
-            return true;
+    return std::visit(
+        overloaded{
+            [&](const OutputsSpec::All &) { return true; },
+            [&](const OutputsSpec::Names & outputNames) { return outputNames.count(outputName) > 0; },
         },
-        [&](const OutputsSpec::Names & outputNames) {
-            return outputNames.count(outputName) > 0;
-        },
-    }, raw);
+        raw);
 }
 
-static std::string outputSpecRegexStr =
-    regex::either(
-        regex::group(R"(\*)"),
-        regex::group(regex::list(nameRegexStr)));
+static std::string outputSpecRegexStr = regex::either(regex::group(R"(\*)"), regex::group(regex::list(nameRegexStr)));
 
 std::optional<OutputsSpec> OutputsSpec::parseOpt(std::string_view s)
 {
-    static std::regex regex(std::string { outputSpecRegexStr });
+    static std::regex regex(std::string{outputSpecRegexStr});
 
     std::cmatch match;
     if (!std::regex_match(s.cbegin(), s.cend(), match, regex))
         return std::nullopt;
 
     if (match[1].matched)
-        return { OutputsSpec::All {} };
+        return {OutputsSpec::All{}};
 
     if (match[2].matched)
-        return OutputsSpec::Names { tokenizeString<StringSet>({match[2].first, match[2].second}, ",") };
+        return OutputsSpec::Names{tokenizeString<StringSet>({match[2].first, match[2].second}, ",")};
 
     assert(false);
 }
 
-
 OutputsSpec OutputsSpec::parse(std::string_view s)
 {
     std::optional spec = parseOpt(s);
@@ -52,21 +46,19 @@ OutputsSpec OutputsSpec::parse(std::string_view s)
     return std::move(*spec);
 }
 
-
 std::optional<std::pair<std::string_view, ExtendedOutputsSpec>> ExtendedOutputsSpec::parseOpt(std::string_view s)
 {
     auto found = s.rfind('^');
 
     if (found == std::string::npos)
-        return std::pair { s, ExtendedOutputsSpec::Default {} };
+        return std::pair{s, ExtendedOutputsSpec::Default{}};
 
     auto specOpt = OutputsSpec::parseOpt(s.substr(found + 1));
     if (!specOpt)
         return std::nullopt;
-    return std::pair { s.substr(0, found), ExtendedOutputsSpec::Explicit { std::move(*specOpt) } };
+    return std::pair{s.substr(0, found), ExtendedOutputsSpec::Explicit{std::move(*specOpt)}};
 }
 
-
 std::pair<std::string_view, ExtendedOutputsSpec> ExtendedOutputsSpec::parse(std::string_view s)
 {
     std::optional spec = parseOpt(s);
@@ -75,79 +67,73 @@ std::pair<std::string_view, ExtendedOutputsSpec> ExtendedOutputsSpec::parse(std:
     return *spec;
 }
 
-
 std::string OutputsSpec::to_string() const
 {
-    return std::visit(overloaded {
-        [&](const OutputsSpec::All &) -> std::string {
-            return "*";
+    return std::visit(
+        overloaded{
+            [&](const OutputsSpec::All &) -> std::string { return "*"; },
+            [&](const OutputsSpec::Names & outputNames) -> std::string { return concatStringsSep(",", outputNames); },
         },
-        [&](const OutputsSpec::Names & outputNames) -> std::string {
-            return concatStringsSep(",", outputNames);
-        },
-    }, raw);
+        raw);
 }
 
-
 std::string ExtendedOutputsSpec::to_string() const
 {
-    return std::visit(overloaded {
-        [&](const ExtendedOutputsSpec::Default &) -> std::string {
-            return "";
+    return std::visit(
+        overloaded{
+            [&](const ExtendedOutputsSpec::Default &) -> std::string { return ""; },
+            [&](const ExtendedOutputsSpec::Explicit & outputSpec) -> std::string {
+                return "^" + outputSpec.to_string();
+            },
         },
-        [&](const ExtendedOutputsSpec::Explicit & outputSpec) -> std::string {
-            return "^" + outputSpec.to_string();
-        },
-    }, raw);
+        raw);
 }
 
-
 OutputsSpec OutputsSpec::union_(const OutputsSpec & that) const
 {
-    return std::visit(overloaded {
-        [&](const OutputsSpec::All &) -> OutputsSpec {
-            return OutputsSpec::All { };
+    return std::visit(
+        overloaded{
+            [&](const OutputsSpec::All &) -> OutputsSpec { return OutputsSpec::All{}; },
+            [&](const OutputsSpec::Names & theseNames) -> OutputsSpec {
+                return std::visit(
+                    overloaded{
+                        [&](const OutputsSpec::All &) -> OutputsSpec { return OutputsSpec::All{}; },
+                        [&](const OutputsSpec::Names & thoseNames) -> OutputsSpec {
+                            OutputsSpec::Names ret = theseNames;
+                            ret.insert(thoseNames.begin(), thoseNames.end());
+                            return ret;
+                        },
+                    },
+                    that.raw);
+            },
         },
-        [&](const OutputsSpec::Names & theseNames) -> OutputsSpec {
-            return std::visit(overloaded {
-                [&](const OutputsSpec::All &) -> OutputsSpec {
-                    return OutputsSpec::All {};
-                },
-                [&](const OutputsSpec::Names & thoseNames) -> OutputsSpec {
-                    OutputsSpec::Names ret = theseNames;
-                    ret.insert(thoseNames.begin(), thoseNames.end());
-                    return ret;
-                },
-            }, that.raw);
-        },
-    }, raw);
+        raw);
 }
 
-
 bool OutputsSpec::isSubsetOf(const OutputsSpec & that) const
 {
-    return std::visit(overloaded {
-        [&](const OutputsSpec::All &) {
-            return true;
+    return std::visit(
+        overloaded{
+            [&](const OutputsSpec::All &) { return true; },
+            [&](const OutputsSpec::Names & thoseNames) {
+                return std::visit(
+                    overloaded{
+                        [&](const OutputsSpec::All &) { return false; },
+                        [&](const OutputsSpec::Names & theseNames) {
+                            bool ret = true;
+                            for (auto & o : theseNames)
+                                if (thoseNames.count(o) == 0)
+                                    ret = false;
+                            return ret;
+                        },
+                    },
+                    raw);
+            },
         },
-        [&](const OutputsSpec::Names & thoseNames) {
-            return std::visit(overloaded {
-                [&](const OutputsSpec::All &) {
-                    return false;
-                },
-                [&](const OutputsSpec::Names & theseNames) {
-                    bool ret = true;
-                    for (auto & o : theseNames)
-                        if (thoseNames.count(o) == 0)
-                            ret = false;
-                    return ret;
-                },
-            }, raw);
-        },
-    }, that.raw);
+        that.raw);
 }
 
-}
+} // namespace nix
 
 namespace nlohmann {
 
@@ -159,44 +145,40 @@ OutputsSpec adl_serializer<OutputsSpec>::from_json(const json & json)
 {
     auto names = json.get<StringSet>();
     if (names == StringSet({"*"}))
-        return OutputsSpec::All {};
+        return OutputsSpec::All{};
     else
-        return OutputsSpec::Names { std::move(names) };
+        return OutputsSpec::Names{std::move(names)};
 }
 
 void adl_serializer<OutputsSpec>::to_json(json & json, OutputsSpec t)
 {
-    std::visit(overloaded {
-        [&](const OutputsSpec::All &) {
-            json = std::vector<std::string>({"*"});
+    std::visit(
+        overloaded{
+            [&](const OutputsSpec::All &) { json = std::vector<std::string>({"*"}); },
+            [&](const OutputsSpec::Names & names) { json = names; },
         },
-        [&](const OutputsSpec::Names & names) {
-            json = names;
-        },
-    }, t.raw);
+        t.raw);
 }
 
 ExtendedOutputsSpec adl_serializer<ExtendedOutputsSpec>::from_json(const json & json)
 {
     if (json.is_null())
-        return ExtendedOutputsSpec::Default {};
+        return ExtendedOutputsSpec::Default{};
     else {
-        return ExtendedOutputsSpec::Explicit { json.get<OutputsSpec>() };
+        return ExtendedOutputsSpec::Explicit{json.get<OutputsSpec>()};
     }
 }
 
 void adl_serializer<ExtendedOutputsSpec>::to_json(json & json, ExtendedOutputsSpec t)
 {
-    std::visit(overloaded {
-        [&](const ExtendedOutputsSpec::Default &) {
-            json = nullptr;
+    std::visit(
+        overloaded{
+            [&](const ExtendedOutputsSpec::Default &) { json = nullptr; },
+            [&](const ExtendedOutputsSpec::Explicit & e) { adl_serializer<OutputsSpec>::to_json(json, e); },
         },
-        [&](const ExtendedOutputsSpec::Explicit & e) {
-            adl_serializer<OutputsSpec>::to_json(json, e);
-        },
-    }, t.raw);
+        t.raw);
 }
 
 #endif
 
-}
+} // namespace nlohmann
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index 775776139..d890d2256 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -58,30 +58,26 @@ mkMesonLibrary (finalAttrs: {
 
   nativeBuildInputs = lib.optional embeddedSandboxShell unixtools.hexdump;
 
-  buildInputs =
-    [
-      boost
-      curl
-      sqlite
-    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
-    # There have been issues building these dependencies
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox
-    ++ lib.optional withAWS aws-sdk-cpp;
+  buildInputs = [
+    boost
+    curl
+    sqlite
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
+  ++ lib.optional withAWS aws-sdk-cpp;
 
   propagatedBuildInputs = [
     nix-util
     nlohmann_json
   ];
 
-  mesonFlags =
-    [
-      (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
-      (lib.mesonBool "embedded-sandbox-shell" embeddedSandboxShell)
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
-    ];
+  mesonFlags = [
+    (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
+    (lib.mesonBool "embedded-sandbox-shell" embeddedSandboxShell)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+  ];
 
   meta = {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
diff --git a/src/libstore/parsed-derivations.cc b/src/libstore/parsed-derivations.cc
index d6453c6db..9e8d44d6e 100644
--- a/src/libstore/parsed-derivations.cc
+++ b/src/libstore/parsed-derivations.cc
@@ -8,20 +8,39 @@
 
 namespace nix {
 
-std::optional<StructuredAttrs> StructuredAttrs::tryParse(const StringPairs & env)
+StructuredAttrs StructuredAttrs::parse(std::string_view encoded)
+{
+    try {
+        return StructuredAttrs{
+            .structuredAttrs = nlohmann::json::parse(encoded),
+        };
+    } catch (std::exception & e) {
+        throw Error("cannot process %s attribute: %s", envVarName, e.what());
+    }
+}
+
+std::optional<StructuredAttrs> StructuredAttrs::tryExtract(StringPairs & env)
 {
     /* Parse the __json attribute, if any. */
-    auto jsonAttr = env.find("__json");
+    auto jsonAttr = env.find(envVarName);
     if (jsonAttr != env.end()) {
-        try {
-            return StructuredAttrs {
-                .structuredAttrs = nlohmann::json::parse(jsonAttr->second),
-            };
-        } catch (std::exception & e) {
-            throw Error("cannot process __json attribute: %s", e.what());
-        }
-    }
-    return {};
+        auto encoded = std::move(jsonAttr->second);
+        env.erase(jsonAttr);
+        return parse(encoded);
+    } else
+        return {};
+}
+
+std::pair<std::string_view, std::string> StructuredAttrs::unparse() const
+{
+    return {envVarName, structuredAttrs.dump()};
+}
+
+void StructuredAttrs::checkKeyNotInUse(const StringPairs & env)
+{
+    if (env.count(envVarName))
+        throw Error(
+            "Cannot have an environment variable named '__json'. This key is reserved for encoding structured attrs");
 }
 
 static std::regex shVarName("[A-Za-z_][A-Za-z0-9_]*");
@@ -36,9 +55,7 @@ static std::regex shVarName("[A-Za-z_][A-Za-z0-9_]*");
  * mechanism to allow this to evolve again and get back in sync, but for
  * now we must not change - not even extend - the behavior.
  */
-static nlohmann::json pathInfoToJSON(
-    Store & store,
-    const StorePathSet & storePaths)
+static nlohmann::json pathInfoToJSON(Store & store, const StorePathSet & storePaths)
 {
     using nlohmann::json;
 
@@ -96,12 +113,8 @@ nlohmann::json StructuredAttrs::prepareStructuredAttrs(
     json["outputs"] = std::move(outputsJson);
 
     /* Handle exportReferencesGraph. */
-    for (auto & [key, inputPaths] : drvOptions.exportReferencesGraph) {
-        StorePathSet storePaths;
-        for (auto & p : inputPaths)
-            storePaths.insert(store.toStorePath(p).first);
-        json[key] = pathInfoToJSON(store,
-            store.exportReferences(storePaths, storePaths));
+    for (auto & [key, storePaths] : drvOptions.getParsedExportReferencesGraph(store)) {
+        json[key] = pathInfoToJSON(store, store.exportReferences(storePaths, storePaths));
     }
 
     return json;
@@ -133,7 +146,8 @@ std::string StructuredAttrs::writeShell(const nlohmann::json & json)
 
     for (auto & [key, value] : json.items()) {
 
-        if (!std::regex_match(key, shVarName)) continue;
+        if (!std::regex_match(key, shVarName))
+            continue;
 
         auto s = handleSimpleType(value);
         if (s)
@@ -145,8 +159,12 @@ std::string StructuredAttrs::writeShell(const nlohmann::json & json)
 
             for (auto & value2 : value) {
                 auto s3 = handleSimpleType(value2);
-                if (!s3) { good = false; break; }
-                s2 += *s3; s2 += ' ';
+                if (!s3) {
+                    good = false;
+                    break;
+                }
+                s2 += *s3;
+                s2 += ' ';
             }
 
             if (good)
@@ -159,7 +177,10 @@ std::string StructuredAttrs::writeShell(const nlohmann::json & json)
 
             for (auto & [key2, value2] : value.items()) {
                 auto s3 = handleSimpleType(value2);
-                if (!s3) { good = false; break; }
+                if (!s3) {
+                    good = false;
+                    break;
+                }
                 s2 += fmt("[%s]=%s ", escapeShellArgAlways(key2), *s3);
             }
 
@@ -170,4 +191,5 @@ std::string StructuredAttrs::writeShell(const nlohmann::json & json)
 
     return jsonSh;
 }
-}
+
+} // namespace nix
diff --git a/src/libstore/path-info.cc b/src/libstore/path-info.cc
index 175146435..270c532bb 100644
--- a/src/libstore/path-info.cc
+++ b/src/libstore/path-info.cc
@@ -17,24 +17,20 @@ GENERATE_CMP_EXT(
     me->references,
     me->registrationTime,
     me->narSize,
-    //me->id,
+    // me->id,
     me->ultimate,
     me->sigs,
     me->ca);
 
-std::string ValidPathInfo::fingerprint(const Store & store) const
+std::string ValidPathInfo::fingerprint(const StoreDirConfig & store) const
 {
     if (narSize == 0)
-        throw Error("cannot calculate fingerprint of path '%s' because its size is not known",
-            store.printStorePath(path));
-    return
-            "1;" + store.printStorePath(path) + ";"
-            + narHash.to_string(HashFormat::Nix32, true) + ";"
-            + std::to_string(narSize) + ";"
-        + concatStringsSep(",", store.printStorePathSet(references));
+        throw Error(
+            "cannot calculate fingerprint of path '%s' because its size is not known", store.printStorePath(path));
+    return "1;" + store.printStorePath(path) + ";" + narHash.to_string(HashFormat::Nix32, true) + ";"
+           + std::to_string(narSize) + ";" + concatStringsSep(",", store.printStorePathSet(references));
 }
 
-
 void ValidPathInfo::sign(const Store & store, const Signer & signer)
 {
     sigs.insert(signer.signDetached(fingerprint(store)));
@@ -43,54 +39,53 @@ void ValidPathInfo::sign(const Store & store, const Signer & signer)
 void ValidPathInfo::sign(const Store & store, const std::vector<std::unique_ptr<Signer>> & signers)
 {
     auto fingerprint = this->fingerprint(store);
-    for (auto & signer: signers) {
+    for (auto & signer : signers) {
         sigs.insert(signer->signDetached(fingerprint));
     }
 }
 
 std::optional<ContentAddressWithReferences> ValidPathInfo::contentAddressWithReferences() const
 {
-    if (! ca)
+    if (!ca)
         return std::nullopt;
 
     switch (ca->method.raw) {
-        case ContentAddressMethod::Raw::Text:
-        {
-            assert(references.count(path) == 0);
-            return TextInfo {
-                .hash = ca->hash,
-                .references = references,
-            };
-        }
+    case ContentAddressMethod::Raw::Text: {
+        assert(references.count(path) == 0);
+        return TextInfo{
+            .hash = ca->hash,
+            .references = references,
+        };
+    }
 
-        case ContentAddressMethod::Raw::Flat:
-        case ContentAddressMethod::Raw::NixArchive:
-        case ContentAddressMethod::Raw::Git:
-        default:
-        {
-            auto refs = references;
-            bool hasSelfReference = false;
-            if (refs.count(path)) {
-                hasSelfReference = true;
-                refs.erase(path);
-            }
-            return FixedOutputInfo {
-                .method = ca->method.getFileIngestionMethod(),
-                .hash = ca->hash,
-                .references = {
+    case ContentAddressMethod::Raw::Flat:
+    case ContentAddressMethod::Raw::NixArchive:
+    case ContentAddressMethod::Raw::Git:
+    default: {
+        auto refs = references;
+        bool hasSelfReference = false;
+        if (refs.count(path)) {
+            hasSelfReference = true;
+            refs.erase(path);
+        }
+        return FixedOutputInfo{
+            .method = ca->method.getFileIngestionMethod(),
+            .hash = ca->hash,
+            .references =
+                {
                     .others = std::move(refs),
                     .self = hasSelfReference,
                 },
-            };
-        }
+        };
+    }
     }
 }
 
-bool ValidPathInfo::isContentAddressed(const Store & store) const
+bool ValidPathInfo::isContentAddressed(const StoreDirConfig & store) const
 {
     auto fullCaOpt = contentAddressWithReferences();
 
-    if (! fullCaOpt)
+    if (!fullCaOpt)
         return false;
 
     auto caPath = store.makeFixedOutputPathFromCA(path.name(), *fullCaOpt);
@@ -103,10 +98,10 @@ bool ValidPathInfo::isContentAddressed(const Store & store) const
     return res;
 }
 
-
-size_t ValidPathInfo::checkSignatures(const Store & store, const PublicKeys & publicKeys) const
+size_t ValidPathInfo::checkSignatures(const StoreDirConfig & store, const PublicKeys & publicKeys) const
 {
-    if (isContentAddressed(store)) return maxSigs;
+    if (isContentAddressed(store))
+        return maxSigs;
 
     size_t good = 0;
     for (auto & sig : sigs)
@@ -115,13 +110,12 @@ size_t ValidPathInfo::checkSignatures(const Store & store, const PublicKeys & pu
     return good;
 }
 
-
-bool ValidPathInfo::checkSignature(const Store & store, const PublicKeys & publicKeys, const std::string & sig) const
+bool ValidPathInfo::checkSignature(
+    const StoreDirConfig & store, const PublicKeys & publicKeys, const std::string & sig) const
 {
     return verifyDetached(fingerprint(store), sig, publicKeys);
 }
 
-
 Strings ValidPathInfo::shortRefs() const
 {
     Strings refs;
@@ -130,35 +124,33 @@ Strings ValidPathInfo::shortRefs() const
     return refs;
 }
 
-ValidPathInfo::ValidPathInfo(
-    const Store & store,
-    std::string_view name,
-    ContentAddressWithReferences && ca,
-    Hash narHash)
-      : UnkeyedValidPathInfo(narHash)
-      , path(store.makeFixedOutputPathFromCA(name, ca))
+ValidPathInfo ValidPathInfo::makeFromCA(
+    const StoreDirConfig & store, std::string_view name, ContentAddressWithReferences && ca, Hash narHash)
 {
-    this->ca = ContentAddress {
+    ValidPathInfo res{
+        store.makeFixedOutputPathFromCA(name, ca),
+        narHash,
+    };
+    res.ca = ContentAddress{
         .method = ca.getMethod(),
         .hash = ca.getHash(),
     };
-    std::visit(overloaded {
-        [this](TextInfo && ti) {
-            this->references = std::move(ti.references);
+    res.references = std::visit(
+        overloaded{
+            [&](TextInfo && ti) { return std::move(ti.references); },
+            [&](FixedOutputInfo && foi) {
+                auto references = std::move(foi.references.others);
+                if (foi.references.self)
+                    references.insert(res.path);
+                return references;
+            },
         },
-        [this](FixedOutputInfo && foi) {
-            this->references = std::move(foi.references.others);
-            if (foi.references.self)
-                this->references.insert(path);
-        },
-    }, std::move(ca).raw);
+        std::move(ca).raw);
+    return res;
 }
 
-
-nlohmann::json UnkeyedValidPathInfo::toJSON(
-    const Store & store,
-    bool includeImpureInfo,
-    HashFormat hashFormat) const
+nlohmann::json
+UnkeyedValidPathInfo::toJSON(const StoreDirConfig & store, bool includeImpureInfo, HashFormat hashFormat) const
 {
     using nlohmann::json;
 
@@ -173,12 +165,12 @@ nlohmann::json UnkeyedValidPathInfo::toJSON(
             jsonRefs.emplace_back(store.printStorePath(ref));
     }
 
-    jsonObject["ca"] = ca ? (std::optional { renderContentAddress(*ca) }) : std::nullopt;
+    jsonObject["ca"] = ca ? (std::optional{renderContentAddress(*ca)}) : std::nullopt;
 
     if (includeImpureInfo) {
-        jsonObject["deriver"] = deriver ? (std::optional { store.printStorePath(*deriver) }) : std::nullopt;
+        jsonObject["deriver"] = deriver ? (std::optional{store.printStorePath(*deriver)}) : std::nullopt;
 
-        jsonObject["registrationTime"] = registrationTime ? (std::optional { registrationTime }) : std::nullopt;
+        jsonObject["registrationTime"] = registrationTime ? (std::optional{registrationTime}) : std::nullopt;
 
         jsonObject["ultimate"] = ultimate;
 
@@ -190,11 +182,9 @@ nlohmann::json UnkeyedValidPathInfo::toJSON(
     return jsonObject;
 }
 
-UnkeyedValidPathInfo UnkeyedValidPathInfo::fromJSON(
-    const Store & store,
-    const nlohmann::json & _json)
+UnkeyedValidPathInfo UnkeyedValidPathInfo::fromJSON(const StoreDirConfig & store, const nlohmann::json & _json)
 {
-    UnkeyedValidPathInfo res {
+    UnkeyedValidPathInfo res{
         Hash(Hash::dummy),
     };
 
@@ -205,8 +195,7 @@ UnkeyedValidPathInfo UnkeyedValidPathInfo::fromJSON(
     try {
         auto references = getStringList(valueAt(json, "references"));
         for (auto & input : references)
-            res.references.insert(store.parseStorePath(static_cast<const std::string &>
-(input)));
+            res.references.insert(store.parseStorePath(static_cast<const std::string &>(input)));
     } catch (Error & e) {
         e.addTrace({}, "while reading key 'references'");
         throw;
@@ -235,4 +224,4 @@ UnkeyedValidPathInfo UnkeyedValidPathInfo::fromJSON(
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/path-references.cc b/src/libstore/path-references.cc
index c06647eb1..8b167e902 100644
--- a/src/libstore/path-references.cc
+++ b/src/libstore/path-references.cc
@@ -7,14 +7,13 @@
 #include <mutex>
 #include <algorithm>
 
-
 namespace nix {
 
-
 PathRefScanSink::PathRefScanSink(StringSet && hashes, std::map<std::string, StorePath> && backMap)
     : RefScanSink(std::move(hashes))
     , backMap(std::move(backMap))
-{ }
+{
+}
 
 PathRefScanSink PathRefScanSink::fromPaths(const StorePathSet & refs)
 {
@@ -44,24 +43,10 @@ StorePathSet PathRefScanSink::getResultPaths()
     return found;
 }
 
-
-std::pair<StorePathSet, HashResult> scanForReferences(
-    const std::string & path,
-    const StorePathSet & refs)
-{
-    HashSink hashSink { HashAlgorithm::SHA256 };
-    auto found = scanForReferences(hashSink, path, refs);
-    auto hash = hashSink.finish();
-    return std::pair<StorePathSet, HashResult>(found, hash);
-}
-
-StorePathSet scanForReferences(
-    Sink & toTee,
-    const Path & path,
-    const StorePathSet & refs)
+StorePathSet scanForReferences(Sink & toTee, const Path & path, const StorePathSet & refs)
 {
     PathRefScanSink refsSink = PathRefScanSink::fromPaths(refs);
-    TeeSink sink { refsSink, toTee };
+    TeeSink sink{refsSink, toTee};
 
     /* Look for the hashes in the NAR dump of the path. */
     dumpPath(path, sink);
@@ -69,4 +54,4 @@ StorePathSet scanForReferences(
     return refsSink.getResultPaths();
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/path-with-outputs.cc b/src/libstore/path-with-outputs.cc
index f3fc534ef..4309ceac5 100644
--- a/src/libstore/path-with-outputs.cc
+++ b/src/libstore/path-with-outputs.cc
@@ -4,101 +4,96 @@
 #include "nix/store/store-api.hh"
 #include "nix/util/strings.hh"
 
-
 namespace nix {
 
 std::string StorePathWithOutputs::to_string(const StoreDirConfig & store) const
 {
-    return outputs.empty()
-        ? store.printStorePath(path)
-        : store.printStorePath(path) + "!" + concatStringsSep(",", outputs);
+    return outputs.empty() ? store.printStorePath(path)
+                           : store.printStorePath(path) + "!" + concatStringsSep(",", outputs);
 }
 
-
 DerivedPath StorePathWithOutputs::toDerivedPath() const
 {
     if (!outputs.empty()) {
-        return DerivedPath::Built {
+        return DerivedPath::Built{
             .drvPath = makeConstantStorePathRef(path),
-            .outputs = OutputsSpec::Names { outputs },
+            .outputs = OutputsSpec::Names{outputs},
         };
     } else if (path.isDerivation()) {
         assert(outputs.empty());
-        return DerivedPath::Built {
+        return DerivedPath::Built{
             .drvPath = makeConstantStorePathRef(path),
-            .outputs = OutputsSpec::All { },
+            .outputs = OutputsSpec::All{},
         };
     } else {
-        return DerivedPath::Opaque { path };
+        return DerivedPath::Opaque{path};
     }
 }
 
-
 std::vector<DerivedPath> toDerivedPaths(const std::vector<StorePathWithOutputs> ss)
 {
     std::vector<DerivedPath> reqs;
     reqs.reserve(ss.size());
-    for (auto & s : ss) reqs.push_back(s.toDerivedPath());
+    for (auto & s : ss)
+        reqs.push_back(s.toDerivedPath());
     return reqs;
 }
 
-
 StorePathWithOutputs::ParseResult StorePathWithOutputs::tryFromDerivedPath(const DerivedPath & p)
 {
-    return std::visit(overloaded {
-        [&](const DerivedPath::Opaque & bo) -> StorePathWithOutputs::ParseResult {
-            if (bo.path.isDerivation()) {
-                // drv path gets interpreted as "build", not "get drv file itself"
-                return bo.path;
-            }
-            return StorePathWithOutputs { bo.path };
+    return std::visit(
+        overloaded{
+            [&](const DerivedPath::Opaque & bo) -> StorePathWithOutputs::ParseResult {
+                if (bo.path.isDerivation()) {
+                    // drv path gets interpreted as "build", not "get drv file itself"
+                    return bo.path;
+                }
+                return StorePathWithOutputs{bo.path};
+            },
+            [&](const DerivedPath::Built & bfd) -> StorePathWithOutputs::ParseResult {
+                return std::visit(
+                    overloaded{
+                        [&](const SingleDerivedPath::Opaque & bo) -> StorePathWithOutputs::ParseResult {
+                            return StorePathWithOutputs{
+                                .path = bo.path,
+                                // Use legacy encoding of wildcard as empty set
+                                .outputs = std::visit(
+                                    overloaded{
+                                        [&](const OutputsSpec::All &) -> StringSet { return {}; },
+                                        [&](const OutputsSpec::Names & outputs) {
+                                            return static_cast<StringSet>(outputs);
+                                        },
+                                    },
+                                    bfd.outputs.raw),
+                            };
+                        },
+                        [&](const SingleDerivedPath::Built &) -> StorePathWithOutputs::ParseResult {
+                            return std::monostate{};
+                        },
+                    },
+                    bfd.drvPath->raw());
+            },
         },
-        [&](const DerivedPath::Built & bfd) -> StorePathWithOutputs::ParseResult {
-            return std::visit(overloaded {
-                [&](const SingleDerivedPath::Opaque & bo) -> StorePathWithOutputs::ParseResult {
-                    return StorePathWithOutputs {
-                        .path = bo.path,
-                        // Use legacy encoding of wildcard as empty set
-                        .outputs = std::visit(overloaded {
-                            [&](const OutputsSpec::All &) -> StringSet {
-                                return {};
-                            },
-                            [&](const OutputsSpec::Names & outputs) {
-                                return static_cast<StringSet>(outputs);
-                            },
-                        }, bfd.outputs.raw),
-                    };
-                },
-                [&](const SingleDerivedPath::Built &) -> StorePathWithOutputs::ParseResult {
-                    return std::monostate {};
-                },
-            }, bfd.drvPath->raw());
-        },
-    }, p.raw());
+        p.raw());
 }
 
-
 std::pair<std::string_view, StringSet> parsePathWithOutputs(std::string_view s)
 {
     size_t n = s.find("!");
-    return n == s.npos
-        ? std::make_pair(s, StringSet())
-        : std::make_pair(s.substr(0, n),
-            tokenizeString<StringSet>(s.substr(n + 1), ","));
+    return n == s.npos ? std::make_pair(s, StringSet())
+                       : std::make_pair(s.substr(0, n), tokenizeString<StringSet>(s.substr(n + 1), ","));
 }
 
-
 StorePathWithOutputs parsePathWithOutputs(const StoreDirConfig & store, std::string_view pathWithOutputs)
 {
     auto [path, outputs] = parsePathWithOutputs(pathWithOutputs);
-    return StorePathWithOutputs { store.parseStorePath(path), std::move(outputs) };
+    return StorePathWithOutputs{store.parseStorePath(path), std::move(outputs)};
 }
 
-
 StorePathWithOutputs followLinksToStorePathWithOutputs(const Store & store, std::string_view pathWithOutputs)
 {
     auto [path, outputs] = parsePathWithOutputs(pathWithOutputs);
-    return StorePathWithOutputs { store.followLinksToStorePath(path), std::move(outputs) };
+    return StorePathWithOutputs{store.followLinksToStorePath(path), std::move(outputs)};
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/path.cc b/src/libstore/path.cc
index d989b1caa..516b01571 100644
--- a/src/libstore/path.cc
+++ b/src/libstore/path.cc
@@ -14,19 +14,19 @@ void checkName(std::string_view name)
         if (name.size() == 1)
             throw BadStorePathName("name '%s' is not valid", name);
         if (name[1] == '-')
-            throw BadStorePathName("name '%s' is not valid: first dash-separated component must not be '%s'", name, ".");
+            throw BadStorePathName(
+                "name '%s' is not valid: first dash-separated component must not be '%s'", name, ".");
         if (name[1] == '.') {
             if (name.size() == 2)
                 throw BadStorePathName("name '%s' is not valid", name);
             if (name[2] == '-')
-                throw BadStorePathName("name '%s' is not valid: first dash-separated component must not be '%s'", name, "..");
+                throw BadStorePathName(
+                    "name '%s' is not valid: first dash-separated component must not be '%s'", name, "..");
         }
     }
     for (auto c : name)
-        if (!((c >= '0' && c <= '9')
-                || (c >= 'a' && c <= 'z')
-                || (c >= 'A' && c <= 'Z')
-                || c == '+' || c == '-' || c == '.' || c == '_' || c == '?' || c == '='))
+        if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '+' || c == '-'
+              || c == '.' || c == '_' || c == '?' || c == '='))
             throw BadStorePathName("name '%s' contains illegal character '%s'", name, c);
 }
 
@@ -45,8 +45,7 @@ StorePath::StorePath(std::string_view _baseName)
     if (baseName.size() < HashLen + 1)
         throw BadStorePath("'%s' is too short to be a valid store path", baseName);
     for (auto c : hashPart())
-        if (c == 'e' || c == 'o' || c == 'u' || c == 't'
-            || !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'z')))
+        if (c == 'e' || c == 'o' || c == 'u' || c == 't' || !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'z')))
             throw BadStorePath("store path '%s' contains illegal base-32 character '%s'", baseName, c);
     checkPathName(baseName, name());
 }
@@ -75,56 +74,4 @@ StorePath StorePath::random(std::string_view name)
     return StorePath(Hash::random(HashAlgorithm::SHA1), name);
 }
 
-StorePath MixStoreDirMethods::parseStorePath(std::string_view path) const
-{
-    // On Windows, `/nix/store` is not a canonical path. More broadly it
-    // is unclear whether this function should be using the native
-    // notion of a canonical path at all. For example, it makes to
-    // support remote stores whose store dir is a non-native path (e.g.
-    // Windows <-> Unix ssh-ing).
-    auto p =
-#ifdef _WIN32
-        path
-#else
-        canonPath(std::string(path))
-#endif
-        ;
-    if (dirOf(p) != storeDir)
-        throw BadStorePath("path '%s' is not in the Nix store", p);
-    return StorePath(baseNameOf(p));
-}
-
-std::optional<StorePath> MixStoreDirMethods::maybeParseStorePath(std::string_view path) const
-{
-    try {
-        return parseStorePath(path);
-    } catch (Error &) {
-        return {};
-    }
-}
-
-bool MixStoreDirMethods::isStorePath(std::string_view path) const
-{
-    return (bool) maybeParseStorePath(path);
-}
-
-StorePathSet MixStoreDirMethods::parseStorePathSet(const PathSet & paths) const
-{
-    StorePathSet res;
-    for (auto & i : paths) res.insert(parseStorePath(i));
-    return res;
-}
-
-std::string MixStoreDirMethods::printStorePath(const StorePath & path) const
-{
-    return (storeDir + "/").append(path.to_string());
-}
-
-PathSet MixStoreDirMethods::printStorePathSet(const StorePathSet & paths) const
-{
-    PathSet res;
-    for (auto & i : paths) res.insert(printStorePath(i));
-    return res;
-}
-
-}
+} // namespace nix
diff --git a/src/libstore/pathlocks.cc b/src/libstore/pathlocks.cc
index 34acfb02d..068c65625 100644
--- a/src/libstore/pathlocks.cc
+++ b/src/libstore/pathlocks.cc
@@ -6,7 +6,6 @@
 #include <cerrno>
 #include <cstdlib>
 
-
 namespace nix {
 
 PathLocks::PathLocks()
@@ -14,14 +13,12 @@ PathLocks::PathLocks()
 {
 }
 
-
 PathLocks::PathLocks(const PathSet & paths, const std::string & waitMsg)
     : deletePaths(false)
 {
     lockPaths(paths, waitMsg);
 }
 
-
 PathLocks::~PathLocks()
 {
     try {
@@ -31,11 +28,9 @@ PathLocks::~PathLocks()
     }
 }
 
-
 void PathLocks::setDeletion(bool deletePaths)
 {
     this->deletePaths = deletePaths;
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/pch/precompiled-headers.hh b/src/libstore/pch/precompiled-headers.hh
new file mode 100644
index 000000000..ea0dd5d70
--- /dev/null
+++ b/src/libstore/pch/precompiled-headers.hh
@@ -0,0 +1,8 @@
+#include "nix/store/store-api.hh"
+#include "nix/store/realisation.hh"
+#include "nix/store/derived-path.hh"
+#include "nix/store/derivations.hh"
+#include "nix/store/local-store.hh"
+#include "nix/util/util.hh"
+
+#include <nlohmann/json.hpp>
diff --git a/src/libstore/posix-fs-canonicalise.cc b/src/libstore/posix-fs-canonicalise.cc
index 792fe5c76..b6a64e65b 100644
--- a/src/libstore/posix-fs-canonicalise.cc
+++ b/src/libstore/posix-fs-canonicalise.cc
@@ -8,47 +8,40 @@
 #include "store-config-private.hh"
 
 #if NIX_SUPPORT_ACL
-# include <sys/xattr.h>
+#  include <sys/xattr.h>
 #endif
 
 namespace nix {
 
 const time_t mtimeStore = 1; /* 1 second into the epoch */
 
-
 static void canonicaliseTimestampAndPermissions(const Path & path, const struct stat & st)
 {
     if (!S_ISLNK(st.st_mode)) {
 
         /* Mask out all type related bits. */
         mode_t mode = st.st_mode & ~S_IFMT;
-
-        if (mode != 0444 && mode != 0555) {
-            mode = (st.st_mode & S_IFMT)
-                 | 0444
-                 | (st.st_mode & S_IXUSR ? 0111 : 0);
+        bool isDir = S_ISDIR(st.st_mode);
+        if ((mode != 0444 || isDir) && mode != 0555) {
+            mode = (st.st_mode & S_IFMT) | 0444 | (st.st_mode & S_IXUSR || isDir ? 0111 : 0);
             if (chmod(path.c_str(), mode) == -1)
                 throw SysError("changing mode of '%1%' to %2$o", path, mode);
         }
-
     }
 
 #ifndef _WIN32 // TODO implement
     if (st.st_mtime != mtimeStore) {
         struct stat st2 = st;
-        st2.st_mtime = mtimeStore,
-        setWriteTime(path, st2);
+        st2.st_mtime = mtimeStore, setWriteTime(path, st2);
     }
 #endif
 }
 
-
 void canonicaliseTimestampAndPermissions(const Path & path)
 {
     canonicaliseTimestampAndPermissions(path, lstat(path));
 }
 
-
 static void canonicalisePathMetaData_(
     const Path & path,
 #ifndef _WIN32
@@ -87,12 +80,13 @@ static void canonicalisePathMetaData_(
         if ((eaSize = llistxattr(path.c_str(), eaBuf.data(), eaBuf.size())) < 0)
             throw SysError("querying extended attributes of '%s'", path);
 
-        for (auto & eaName: tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) {
-            if (settings.ignoredAcls.get().count(eaName)) continue;
+        for (auto & eaName : tokenizeString<Strings>(std::string(eaBuf.data(), eaSize), std::string("\000", 1))) {
+            if (settings.ignoredAcls.get().count(eaName))
+                continue;
             if (lremovexattr(path.c_str(), eaName.c_str()) == -1)
                 throw SysError("removing extended attribute '%s' from '%s'", eaName, path);
         }
-     }
+    }
 #endif
 
 #ifndef _WIN32
@@ -104,9 +98,11 @@ static void canonicalisePathMetaData_(
        (i.e. "touch $out/foo; ln $out/foo $out/bar"). */
     if (uidRange && (st.st_uid < uidRange->first || st.st_uid > uidRange->second)) {
         if (S_ISDIR(st.st_mode) || !inodesSeen.count(Inode(st.st_dev, st.st_ino)))
-            throw BuildError("invalid ownership on file '%1%'", path);
+            throw BuildError(BuildResult::OutputRejected, "invalid ownership on file '%1%'", path);
         mode_t mode = st.st_mode & ~S_IFMT;
-        assert(S_ISLNK(st.st_mode) || (st.st_uid == geteuid() && (mode == 0444 || mode == 0555) && st.st_mtime == mtimeStore));
+        assert(
+            S_ISLNK(st.st_mode)
+            || (st.st_uid == geteuid() && (mode == 0444 || mode == 0555) && st.st_mtime == mtimeStore));
         return;
     }
 #endif
@@ -124,14 +120,12 @@ static void canonicalisePathMetaData_(
        store (since that directory is group-writable for the Nix build
        users group); we check for this case below. */
     if (st.st_uid != geteuid()) {
-#if HAVE_LCHOWN
+#  if HAVE_LCHOWN
         if (lchown(path.c_str(), geteuid(), getegid()) == -1)
-#else
-        if (!S_ISLNK(st.st_mode) &&
-            chown(path.c_str(), geteuid(), getegid()) == -1)
-#endif
-            throw SysError("changing owner of '%1%' to %2%",
-                path, geteuid());
+#  else
+        if (!S_ISLNK(st.st_mode) && chown(path.c_str(), geteuid(), getegid()) == -1)
+#  endif
+            throw SysError("changing owner of '%1%' to %2%", path, geteuid());
     }
 #endif
 
@@ -148,7 +142,6 @@ static void canonicalisePathMetaData_(
     }
 }
 
-
 void canonicalisePathMetaData(
     const Path & path,
 #ifndef _WIN32
@@ -175,12 +168,13 @@ void canonicalisePathMetaData(
 #endif
 }
 
-
-void canonicalisePathMetaData(const Path & path
+void canonicalisePathMetaData(
+    const Path & path
 #ifndef _WIN32
-    , std::optional<std::pair<uid_t, uid_t>> uidRange
+    ,
+    std::optional<std::pair<uid_t, uid_t>> uidRange
 #endif
-    )
+)
 {
     InodesSeen inodesSeen;
     canonicalisePathMetaData_(
@@ -191,4 +185,4 @@ void canonicalisePathMetaData(const Path & path
         inodesSeen);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index 09ef36705..3f6fcb6ff 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -1,5 +1,6 @@
 #include "nix/store/profiles.hh"
 #include "nix/util/signals.hh"
+#include "nix/store/globals.hh"
 #include "nix/store/store-api.hh"
 #include "nix/store/local-fs-store.hh"
 #include "nix/util/users.hh"
@@ -10,27 +11,26 @@
 #include <errno.h>
 #include <stdio.h>
 
-
 namespace nix {
 
-
 /**
  * Parse a generation name of the format
  * `<profilename>-<number>-link'.
  */
 static std::optional<GenerationNumber> parseName(const std::string & profileName, const std::string & name)
 {
-    if (name.substr(0, profileName.size() + 1) != profileName + "-") return {};
+    if (name.substr(0, profileName.size() + 1) != profileName + "-")
+        return {};
     auto s = name.substr(profileName.size() + 1);
     auto p = s.find("-link");
-    if (p == std::string::npos) return {};
+    if (p == std::string::npos)
+        return {};
     if (auto n = string2Int<unsigned int>(s.substr(0, p)))
         return *n;
     else
         return {};
 }
 
-
 std::pair<Generations, std::optional<GenerationNumber>> findGenerations(Path profile)
 {
     Generations gens;
@@ -42,28 +42,15 @@ std::pair<Generations, std::optional<GenerationNumber>> findGenerations(Path pro
         checkInterrupt();
         if (auto n = parseName(profileName, i.path().filename().string())) {
             auto path = i.path().string();
-            gens.push_back({
-                .number = *n,
-                .path = path,
-                .creationTime = lstat(path).st_mtime
-            });
+            gens.push_back({.number = *n, .path = path, .creationTime = lstat(path).st_mtime});
         }
     }
 
-    gens.sort([](const Generation & a, const Generation & b)
-    {
-        return a.number < b.number;
-    });
+    gens.sort([](const Generation & a, const Generation & b) { return a.number < b.number; });
 
-    return {
-        gens,
-        pathExists(profile)
-        ? parseName(profileName, readLink(profile))
-        : std::nullopt
-    };
+    return {gens, pathExists(profile) ? parseName(profileName, readLink(profile)) : std::nullopt};
 }
 
-
 /**
  * Create a generation name that can be parsed by `parseName()`.
  */
@@ -72,7 +59,6 @@ static Path makeName(const Path & profile, GenerationNumber num)
     return fmt("%s-%s-link", profile, num);
 }
 
-
 Path createGeneration(LocalFSStore & store, Path profile, StorePath outPath)
 {
     /* The new generation number should be higher than old the
@@ -110,14 +96,12 @@ Path createGeneration(LocalFSStore & store, Path profile, StorePath outPath)
     return generation;
 }
 
-
 static void removeFile(const Path & path)
 {
     if (remove(path.c_str()) == -1)
         throw SysError("cannot unlink '%1%'", path);
 }
 
-
 void deleteGeneration(const Path & profile, GenerationNumber gen)
 {
     Path generation = makeName(profile, gen);
@@ -143,7 +127,6 @@ static void deleteGeneration2(const Path & profile, GenerationNumber gen, bool d
     }
 }
 
-
 void deleteGenerations(const Path & profile, const std::set<GenerationNumber> & gensToDelete, bool dryRun)
 {
     PathLocks lock;
@@ -155,7 +138,8 @@ void deleteGenerations(const Path & profile, const std::set<GenerationNumber> &
         throw Error("cannot delete current version of profile %1%'", profile);
 
     for (auto & i : gens) {
-        if (!gensToDelete.count(i.number)) continue;
+        if (!gensToDelete.count(i.number))
+            continue;
         deleteGeneration2(profile, i.number, dryRun);
     }
 }
@@ -165,7 +149,8 @@ void deleteGenerations(const Path & profile, const std::set<GenerationNumber> &
  */
 static inline void iterDropUntil(Generations & gens, auto && i, auto && cond)
 {
-    for (; i != gens.rend() && !cond(*i); ++i);
+    for (; i != gens.rend() && !cond(*i); ++i)
+        ;
 }
 
 void deleteGenerationsGreaterThan(const Path & profile, GenerationNumber max, bool dryRun)
@@ -185,7 +170,8 @@ void deleteGenerationsGreaterThan(const Path & profile, GenerationNumber max, bo
     iterDropUntil(gens, i, [&](auto & g) { return g.number == curGen; });
 
     // Skip over `max` generations, preserving them
-    for (GenerationNumber keep = 0; i != gens.rend() && keep < max; ++i, ++keep);
+    for (GenerationNumber keep = 0; i != gens.rend() && keep < max; ++i, ++keep)
+        ;
 
     // Delete the rest
     for (; i != gens.rend(); ++i)
@@ -204,7 +190,6 @@ void deleteOldGenerations(const Path & profile, bool dryRun)
             deleteGeneration2(profile, i.number, dryRun);
 }
 
-
 void deleteGenerationsOlderThan(const Path & profile, time_t t, bool dryRun)
 {
     PathLocks lock;
@@ -225,7 +210,8 @@ void deleteGenerationsOlderThan(const Path & profile, time_t t, bool dryRun)
        We don't want delete this one yet because it
        existed at the requested point in time, and
        we want to be able to roll back to it. */
-    if (i != gens.rend()) ++i;
+    if (i != gens.rend())
+        ++i;
 
     // Delete all previous generations (unless current).
     for (; i != gens.rend(); ++i) {
@@ -237,7 +223,6 @@ void deleteGenerationsOlderThan(const Path & profile, time_t t, bool dryRun)
     }
 }
 
-
 time_t parseOlderThanTimeSpec(std::string_view timeSpec)
 {
     if (timeSpec.empty() || timeSpec[timeSpec.size() - 1] != 'd')
@@ -253,20 +238,16 @@ time_t parseOlderThanTimeSpec(std::string_view timeSpec)
     return curTime - *days * 24 * 3600;
 }
 
-
 void switchLink(Path link, Path target)
 {
     /* Hacky. */
-    if (dirOf(target) == dirOf(link)) target = baseNameOf(target);
+    if (dirOf(target) == dirOf(link))
+        target = baseNameOf(target);
 
     replaceSymlink(target, link);
 }
 
-
-void switchGeneration(
-    const Path & profile,
-    std::optional<GenerationNumber> dstGen,
-    bool dryRun)
+void switchGeneration(const Path & profile, std::optional<GenerationNumber> dstGen, bool dryRun)
 {
     PathLocks lock;
     lockProfile(lock, profile);
@@ -275,8 +256,7 @@ void switchGeneration(
 
     std::optional<Generation> dst;
     for (auto & i : gens)
-        if ((!dstGen && i.number < curGen) ||
-            (dstGen && i.number == *dstGen))
+        if ((!dstGen && i.number < curGen) || (dstGen && i.number == *dstGen))
             dst = i;
 
     if (!dst) {
@@ -288,31 +268,26 @@ void switchGeneration(
 
     notice("switching profile from version %d to %d", curGen.value_or(0), dst->number);
 
-    if (dryRun) return;
+    if (dryRun)
+        return;
 
     switchLink(profile, dst->path);
 }
 
-
 void lockProfile(PathLocks & lock, const Path & profile)
 {
     lock.lockPaths({profile}, fmt("waiting for lock on profile '%1%'", profile));
     lock.setDeletion(true);
 }
 
-
 std::string optimisticLockProfile(const Path & profile)
 {
     return pathExists(profile) ? readLink(profile) : "";
 }
 
-
 Path profilesDir()
 {
-    auto profileRoot =
-        isRootUser()
-        ? rootProfilesDir()
-        : createNixStateDir() + "/profiles";
+    auto profileRoot = isRootUser() ? rootProfilesDir() : createNixStateDir() + "/profiles";
     createDirs(profileRoot);
     return profileRoot;
 }
@@ -322,7 +297,6 @@ Path rootProfilesDir()
     return settings.nixStateDir + "/profiles/per-user/root";
 }
 
-
 Path getDefaultProfile()
 {
     Path profileLink = settings.useXDGBaseDirectories ? createNixStateDir() + "/profile" : getHome() + "/.nix-profile";
@@ -355,4 +329,4 @@ Path rootChannelsDir()
     return rootProfilesDir() + "/channels";
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/realisation.cc b/src/libstore/realisation.cc
index 9a72422eb..8c3baa73b 100644
--- a/src/libstore/realisation.cc
+++ b/src/libstore/realisation.cc
@@ -8,18 +8,20 @@ namespace nix {
 
 MakeError(InvalidDerivationOutputId, Error);
 
-DrvOutput DrvOutput::parse(const std::string &strRep) {
+DrvOutput DrvOutput::parse(const std::string & strRep)
+{
     size_t n = strRep.find("!");
     if (n == strRep.npos)
         throw InvalidDerivationOutputId("Invalid derivation output id %s", strRep);
 
     return DrvOutput{
         .drvHash = Hash::parseAnyPrefixed(strRep.substr(0, n)),
-        .outputName = strRep.substr(n+1),
+        .outputName = strRep.substr(n + 1),
     };
 }
 
-std::string DrvOutput::to_string() const {
+std::string DrvOutput::to_string() const
+{
     return strHash() + "!" + outputName;
 }
 
@@ -32,23 +34,21 @@ std::set<Realisation> Realisation::closure(Store & store, const std::set<Realisa
 
 void Realisation::closure(Store & store, const std::set<Realisation> & startOutputs, std::set<Realisation> & res)
 {
-    auto getDeps = [&](const Realisation& current) -> std::set<Realisation> {
+    auto getDeps = [&](const Realisation & current) -> std::set<Realisation> {
         std::set<Realisation> res;
-        for (auto& [currentDep, _] : current.dependentRealisations) {
+        for (auto & [currentDep, _] : current.dependentRealisations) {
             if (auto currentRealisation = store.queryRealisation(currentDep))
                 res.insert(*currentRealisation);
             else
-                throw Error(
-                    "Unrealised derivation '%s'", currentDep.to_string());
+                throw Error("Unrealised derivation '%s'", currentDep.to_string());
         }
         return res;
     };
 
     computeClosure<Realisation>(
-        startOutputs, res,
-        [&](const Realisation& current,
-            std::function<void(std::promise<std::set<Realisation>>&)>
-                processEdges) {
+        startOutputs,
+        res,
+        [&](const Realisation & current, std::function<void(std::promise<std::set<Realisation>> &)> processEdges) {
             std::promise<std::set<Realisation>> promise;
             try {
                 auto res = getDeps(current);
@@ -60,7 +60,8 @@ void Realisation::closure(Store & store, const std::set<Realisation> & startOutp
         });
 }
 
-nlohmann::json Realisation::toJSON() const {
+nlohmann::json Realisation::toJSON() const
+{
     auto jsonDependentRealisations = nlohmann::json::object();
     for (auto & [depId, depOutPath] : dependentRealisations)
         jsonDependentRealisations.emplace(depId.to_string(), depOutPath.to_string());
@@ -72,9 +73,8 @@ nlohmann::json Realisation::toJSON() const {
     };
 }
 
-Realisation Realisation::fromJSON(
-    const nlohmann::json& json,
-    const std::string& whence) {
+Realisation Realisation::fromJSON(const nlohmann::json & json, const std::string & whence)
+{
     auto getOptionalField = [&](std::string fieldName) -> std::optional<std::string> {
         auto fieldIterator = json.find(fieldName);
         if (fieldIterator == json.end())
@@ -85,16 +85,14 @@ Realisation Realisation::fromJSON(
         if (auto field = getOptionalField(fieldName))
             return *field;
         else
-            throw Error(
-                "Drv output info file '%1%' is corrupt, missing field %2%",
-                whence, fieldName);
+            throw Error("Drv output info file '%1%' is corrupt, missing field %2%", whence, fieldName);
     };
 
     StringSet signatures;
     if (auto signaturesIterator = json.find("signatures"); signaturesIterator != json.end())
         signatures.insert(signaturesIterator->begin(), signaturesIterator->end());
 
-    std::map <DrvOutput, StorePath> dependentRealisations;
+    std::map<DrvOutput, StorePath> dependentRealisations;
     if (auto jsonDependencies = json.find("dependentRealisations"); jsonDependencies != json.end())
         for (auto & [jsonDepId, jsonDepOutPath] : jsonDependencies->get<StringMap>())
             dependentRealisations.insert({DrvOutput::parse(jsonDepId), StorePath(jsonDepOutPath)});
@@ -114,7 +112,7 @@ std::string Realisation::fingerprint() const
     return serialized.dump();
 }
 
-void Realisation::sign(const Signer &signer)
+void Realisation::sign(const Signer & signer)
 {
     signatures.insert(signer.signDetached(fingerprint()));
 }
@@ -137,26 +135,14 @@ size_t Realisation::checkSignatures(const PublicKeys & publicKeys) const
     return good;
 }
 
-
-SingleDrvOutputs filterDrvOutputs(const OutputsSpec& wanted, SingleDrvOutputs&& outputs)
+StorePath RealisedPath::path() const
 {
-    SingleDrvOutputs ret = std::move(outputs);
-    for (auto it = ret.begin(); it != ret.end(); ) {
-        if (!wanted.contains(it->first))
-            it = ret.erase(it);
-        else
-            ++it;
-    }
-    return ret;
-}
-
-StorePath RealisedPath::path() const {
     return std::visit([](auto && arg) { return arg.getPath(); }, raw);
 }
 
 bool Realisation::isCompatibleWith(const Realisation & other) const
 {
-    assert (id == other.id);
+    assert(id == other.id);
     if (outPath == other.outPath) {
         if (dependentRealisations.empty() != other.dependentRealisations.empty()) {
             warn(
@@ -172,27 +158,24 @@ bool Realisation::isCompatibleWith(const Realisation & other) const
     return false;
 }
 
-void RealisedPath::closure(
-    Store& store,
-    const RealisedPath::Set& startPaths,
-    RealisedPath::Set& ret)
+void RealisedPath::closure(Store & store, const RealisedPath::Set & startPaths, RealisedPath::Set & ret)
 {
     // FIXME: This only builds the store-path closure, not the real realisation
     // closure
     StorePathSet initialStorePaths, pathsClosure;
-    for (auto& path : startPaths)
+    for (auto & path : startPaths)
         initialStorePaths.insert(path.path());
     store.computeFSClosure(initialStorePaths, pathsClosure);
     ret.insert(startPaths.begin(), startPaths.end());
     ret.insert(pathsClosure.begin(), pathsClosure.end());
 }
 
-void RealisedPath::closure(Store& store, RealisedPath::Set & ret) const
+void RealisedPath::closure(Store & store, RealisedPath::Set & ret) const
 {
     RealisedPath::closure(store, {*this}, ret);
 }
 
-RealisedPath::Set RealisedPath::closure(Store& store) const
+RealisedPath::Set RealisedPath::closure(Store & store) const
 {
     RealisedPath::Set ret;
     closure(store, ret);
diff --git a/src/libutil/references.cc b/src/libstore/references.cc
similarity index 67%
rename from src/libutil/references.cc
rename to src/libstore/references.cc
index 66ad9d37c..1620af26e 100644
--- a/src/libutil/references.cc
+++ b/src/libstore/references.cc
@@ -1,42 +1,30 @@
-#include "nix/util/references.hh"
+#include "nix/store/references.hh"
+#include "nix/store/path.hh"
 #include "nix/util/hash.hh"
-#include "nix/util/archive.hh"
+#include "nix/util/base-nix-32.hh"
 
 #include <map>
 #include <cstdlib>
 #include <mutex>
 #include <algorithm>
 
-
 namespace nix {
 
+static constexpr auto refLength = StorePath::HashLen;
 
-static size_t refLength = 32; /* characters */
-
-
-static void search(
-    std::string_view s,
-    StringSet & hashes,
-    StringSet & seen)
+static void search(std::string_view s, StringSet & hashes, StringSet & seen)
 {
-    static std::once_flag initialised;
-    static bool isBase32[256];
-    std::call_once(initialised, [](){
-        for (unsigned int i = 0; i < 256; ++i) isBase32[i] = false;
-        for (unsigned int i = 0; i < nix32Chars.size(); ++i)
-            isBase32[(unsigned char) nix32Chars[i]] = true;
-    });
-
-    for (size_t i = 0; i + refLength <= s.size(); ) {
+    for (size_t i = 0; i + refLength <= s.size();) {
         int j;
         bool match = true;
         for (j = refLength - 1; j >= 0; --j)
-            if (!isBase32[(unsigned char) s[i + j]]) {
+            if (!BaseNix32::lookupReverse(s[i + j])) {
                 i += j + 1;
                 match = false;
                 break;
             }
-        if (!match) continue;
+        if (!match)
+            continue;
         std::string ref(s.substr(i, refLength));
         if (hashes.erase(ref)) {
             debug("found reference to '%1%' at offset '%2%'", ref, i);
@@ -46,8 +34,7 @@ static void search(
     }
 }
 
-
-void RefScanSink::operator () (std::string_view data)
+void RefScanSink::operator()(std::string_view data)
 {
     /* It's possible that a reference spans the previous and current
        fragment, so search in the concatenation of the tail of the
@@ -65,14 +52,14 @@ void RefScanSink::operator () (std::string_view data)
     tail.append(data.data() + data.size() - tailLen, tailLen);
 }
 
-
 RewritingSink::RewritingSink(const std::string & from, const std::string & to, Sink & nextSink)
     : RewritingSink({{from, to}}, nextSink)
 {
 }
 
 RewritingSink::RewritingSink(const StringMap & rewrites, Sink & nextSink)
-    : rewrites(rewrites), nextSink(nextSink)
+    : rewrites(rewrites)
+    , nextSink(nextSink)
 {
     std::string::size_type maxRewriteSize = 0;
     for (auto & [from, to] : rewrites) {
@@ -82,29 +69,29 @@ RewritingSink::RewritingSink(const StringMap & rewrites, Sink & nextSink)
     this->maxRewriteSize = maxRewriteSize;
 }
 
-void RewritingSink::operator () (std::string_view data)
+void RewritingSink::operator()(std::string_view data)
 {
     std::string s(prev);
     s.append(data);
 
     s = rewriteStrings(s, rewrites);
 
-    prev = s.size() < maxRewriteSize
-        ? s
-        : maxRewriteSize == 0
-            ? ""
-            : std::string(s, s.size() - maxRewriteSize + 1, maxRewriteSize - 1);
+    prev = s.size() < maxRewriteSize ? s
+           : maxRewriteSize == 0     ? ""
+                                     : std::string(s, s.size() - maxRewriteSize + 1, maxRewriteSize - 1);
 
     auto consumed = s.size() - prev.size();
 
     pos += consumed;
 
-    if (consumed) nextSink(s.substr(0, consumed));
+    if (consumed)
+        nextSink(s.substr(0, consumed));
 }
 
 void RewritingSink::flush()
 {
-    if (prev.empty()) return;
+    if (prev.empty())
+        return;
     pos += prev.size();
     nextSink(prev);
     prev.clear();
@@ -116,7 +103,7 @@ HashModuloSink::HashModuloSink(HashAlgorithm ha, const std::string & modulus)
 {
 }
 
-void HashModuloSink::operator () (std::string_view data)
+void HashModuloSink::operator()(std::string_view data)
 {
     rewritingSink(data);
 }
@@ -133,7 +120,7 @@ HashResult HashModuloSink::finish()
         hashSink(fmt("|%d", pos));
 
     auto h = hashSink.finish();
-    return {h.first, rewritingSink.pos};
+    return {.hash = h.hash, .numBytesDigested = rewritingSink.pos};
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/remote-fs-accessor.cc b/src/libstore/remote-fs-accessor.cc
index fdbe12fa9..12c810eca 100644
--- a/src/libstore/remote-fs-accessor.cc
+++ b/src/libstore/remote-fs-accessor.cc
@@ -58,7 +58,8 @@ std::pair<ref<SourceAccessor>, CanonPath> RemoteFSAccessor::fetch(const CanonPat
         throw InvalidPath("path '%1%' is not a valid store path", store->printStorePath(storePath));
 
     auto i = nars.find(std::string(storePath.hashPart()));
-    if (i != nars.end()) return {i->second, restPath};
+    if (i != nars.end())
+        return {i->second, restPath};
 
     std::string listing;
     Path cacheFile;
@@ -68,36 +69,38 @@ std::pair<ref<SourceAccessor>, CanonPath> RemoteFSAccessor::fetch(const CanonPat
         try {
             listing = nix::readFile(makeCacheFile(storePath.hashPart(), "ls"));
 
-            auto narAccessor = makeLazyNarAccessor(listing,
-                [cacheFile](uint64_t offset, uint64_t length) {
-
-                    AutoCloseFD fd = toDescriptor(open(cacheFile.c_str(), O_RDONLY
-                    #ifndef _WIN32
+            auto narAccessor = makeLazyNarAccessor(listing, [cacheFile](uint64_t offset, uint64_t length) {
+                AutoCloseFD fd = toDescriptor(open(
+                    cacheFile.c_str(),
+                    O_RDONLY
+#ifndef _WIN32
                         | O_CLOEXEC
-                    #endif
-                        ));
-                    if (!fd)
-                        throw SysError("opening NAR cache file '%s'", cacheFile);
+#endif
+                    ));
+                if (!fd)
+                    throw SysError("opening NAR cache file '%s'", cacheFile);
 
-                    if (lseek(fromDescriptorReadOnly(fd.get()), offset, SEEK_SET) != (off_t) offset)
-                        throw SysError("seeking in '%s'", cacheFile);
+                if (lseek(fromDescriptorReadOnly(fd.get()), offset, SEEK_SET) != (off_t) offset)
+                    throw SysError("seeking in '%s'", cacheFile);
 
-                    std::string buf(length, 0);
-                    readFull(fd.get(), buf.data(), length);
+                std::string buf(length, 0);
+                readFull(fd.get(), buf.data(), length);
 
-                    return buf;
-                });
+                return buf;
+            });
 
             nars.emplace(storePath.hashPart(), narAccessor);
             return {narAccessor, restPath};
 
-        } catch (SystemError &) { }
+        } catch (SystemError &) {
+        }
 
         try {
             auto narAccessor = makeNarAccessor(nix::readFile(cacheFile));
             nars.emplace(storePath.hashPart(), narAccessor);
             return {narAccessor, restPath};
-        } catch (SystemError &) { }
+        } catch (SystemError &) {
+        }
     }
 
     StringSink sink;
@@ -129,4 +132,4 @@ std::string RemoteFSAccessor::readLink(const CanonPath & path)
     return res.first->readLink(res.second);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index 1b8bad048..b918871fa 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -27,34 +27,33 @@ namespace nix {
 RemoteStore::RemoteStore(const Config & config)
     : Store{config}
     , config{config}
-    , connections(make_ref<Pool<Connection>>(
-            std::max(1, config.maxConnections.get()),
-            [this]() {
-                auto conn = openConnectionWrapper();
-                try {
-                    initConnection(*conn);
-                } catch (...) {
-                    failed = true;
-                    throw;
-                }
-                return conn;
-            },
-            [this](const ref<Connection> & r) {
-                return
-                    r->to.good()
-                    && r->from.good()
-                    && std::chrono::duration_cast<std::chrono::seconds>(
-                        std::chrono::steady_clock::now() - r->startTime).count() < this->config.maxConnectionAge;
-            }
-            ))
+    , connections(
+          make_ref<Pool<Connection>>(
+              std::max(1, config.maxConnections.get()),
+              [this]() {
+                  auto conn = openConnectionWrapper();
+                  try {
+                      initConnection(*conn);
+                  } catch (...) {
+                      failed = true;
+                      throw;
+                  }
+                  return conn;
+              },
+              [this](const ref<Connection> & r) {
+                  return r->to.good() && r->from.good()
+                         && std::chrono::duration_cast<std::chrono::seconds>(
+                                std::chrono::steady_clock::now() - r->startTime)
+                                    .count()
+                                < this->config.maxConnectionAge;
+              }))
 {
 }
 
-
 ref<RemoteStore::Connection> RemoteStore::openConnectionWrapper()
 {
     if (failed)
-        throw Error("opening a connection to remote store '%s' previously failed", getUri());
+        throw Error("opening a connection to remote store '%s' previously failed", config.getHumanReadableURI());
     try {
         return openConnection();
     } catch (...) {
@@ -63,7 +62,6 @@ ref<RemoteStore::Connection> RemoteStore::openConnectionWrapper()
     }
 }
 
-
 void RemoteStore::initConnection(Connection & conn)
 {
     /* Send the magic greeting, check for the reply. */
@@ -73,9 +71,10 @@ void RemoteStore::initConnection(Connection & conn)
         StringSink saved;
         TeeSource tee(conn.from, saved);
         try {
-            auto [protoVersion, features] = WorkerProto::BasicClientConnection::handshake(
-                conn.to, tee, PROTOCOL_VERSION,
-                WorkerProto::allFeatures);
+            auto [protoVersion, features] =
+                WorkerProto::BasicClientConnection::handshake(conn.to, tee, PROTOCOL_VERSION, WorkerProto::allFeatures);
+            if (protoVersion < 256 + 18)
+                throw Error("the Nix daemon version is too old");
             conn.protoVersion = protoVersion;
             conn.features = features;
         } catch (SerialisationError & e) {
@@ -95,56 +94,45 @@ void RemoteStore::initConnection(Connection & conn)
             debug("negotiated feature '%s'", feature);
 
         auto ex = conn.processStderrReturn();
-        if (ex) std::rethrow_exception(ex);
-    }
-    catch (Error & e) {
-        throw Error("cannot open connection to remote store '%s': %s", getUri(), e.what());
+        if (ex)
+            std::rethrow_exception(ex);
+    } catch (Error & e) {
+        throw Error("cannot open connection to remote store '%s': %s", config.getHumanReadableURI(), e.what());
     }
 
     setOptions(conn);
 }
 
-
 void RemoteStore::setOptions(Connection & conn)
 {
-    conn.to << WorkerProto::Op::SetOptions
-       << settings.keepFailed
-       << settings.keepGoing
-       << settings.tryFallback
-       << verbosity
-       << settings.maxBuildJobs
-       << settings.maxSilentTime
-       << true
-       << (settings.verboseBuild ? lvlError : lvlVomit)
-       << 0 // obsolete log type
-       << 0 /* obsolete print build trace */
-       << settings.buildCores
-       << settings.useSubstitutes;
+    conn.to << WorkerProto::Op::SetOptions << settings.keepFailed << settings.keepGoing << settings.tryFallback
+            << verbosity << settings.maxBuildJobs << settings.maxSilentTime << true
+            << (settings.verboseBuild ? lvlError : lvlVomit) << 0 // obsolete log type
+            << 0                                                  /* obsolete print build trace */
+            << settings.buildCores << settings.useSubstitutes;
 
-    if (GET_PROTOCOL_MINOR(conn.protoVersion) >= 12) {
-        std::map<std::string, nix::Config::SettingInfo> overrides;
-        settings.getSettings(overrides, true); // libstore settings
-        fileTransferSettings.getSettings(overrides, true);
-        overrides.erase(settings.keepFailed.name);
-        overrides.erase(settings.keepGoing.name);
-        overrides.erase(settings.tryFallback.name);
-        overrides.erase(settings.maxBuildJobs.name);
-        overrides.erase(settings.maxSilentTime.name);
-        overrides.erase(settings.buildCores.name);
-        overrides.erase(settings.useSubstitutes.name);
-        overrides.erase(loggerSettings.showTrace.name);
-        overrides.erase(experimentalFeatureSettings.experimentalFeatures.name);
-        overrides.erase("plugin-files");
-        conn.to << overrides.size();
-        for (auto & i : overrides)
-            conn.to << i.first << i.second.value;
-    }
+    std::map<std::string, nix::Config::SettingInfo> overrides;
+    settings.getSettings(overrides, true); // libstore settings
+    fileTransferSettings.getSettings(overrides, true);
+    overrides.erase(settings.keepFailed.name);
+    overrides.erase(settings.keepGoing.name);
+    overrides.erase(settings.tryFallback.name);
+    overrides.erase(settings.maxBuildJobs.name);
+    overrides.erase(settings.maxSilentTime.name);
+    overrides.erase(settings.buildCores.name);
+    overrides.erase(settings.useSubstitutes.name);
+    overrides.erase(loggerSettings.showTrace.name);
+    overrides.erase(experimentalFeatureSettings.experimentalFeatures.name);
+    overrides.erase("plugin-files");
+    conn.to << overrides.size();
+    for (auto & i : overrides)
+        conn.to << i.first << i.second.value;
 
     auto ex = conn.processStderrReturn();
-    if (ex) std::rethrow_exception(ex);
+    if (ex)
+        std::rethrow_exception(ex);
 }
 
-
 RemoteStore::ConnectionHandle::~ConnectionHandle()
 {
     if (!daemonException && std::uncaught_exceptions()) {
@@ -158,7 +146,6 @@ void RemoteStore::ConnectionHandle::processStderr(Sink * sink, Source * source,
     handle->processStderr(&daemonException, sink, source, flush, block);
 }
 
-
 RemoteStore::ConnectionHandle RemoteStore::getConnection()
 {
     return ConnectionHandle(connections->get());
@@ -177,21 +164,12 @@ bool RemoteStore::isValidPathUncached(const StorePath & path)
     return readInt(conn->from);
 }
 
-
 StorePathSet RemoteStore::queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute)
 {
     auto conn(getConnection());
-    if (GET_PROTOCOL_MINOR(conn->protoVersion) < 12) {
-        StorePathSet res;
-        for (auto & i : paths)
-            if (isValidPath(i)) res.insert(i);
-        return res;
-    } else {
-        return conn->queryValidPaths(*this, &conn.daemonException, paths, maybeSubstitute);
-    }
+    return conn->queryValidPaths(*this, &conn.daemonException, paths, maybeSubstitute);
 }
 
-
 StorePathSet RemoteStore::queryAllValidPaths()
 {
     auto conn(getConnection());
@@ -200,95 +178,61 @@ StorePathSet RemoteStore::queryAllValidPaths()
     return WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
 }
 
-
 StorePathSet RemoteStore::querySubstitutablePaths(const StorePathSet & paths)
 {
     auto conn(getConnection());
-    if (GET_PROTOCOL_MINOR(conn->protoVersion) < 12) {
-        StorePathSet res;
-        for (auto & i : paths) {
-            conn->to << WorkerProto::Op::HasSubstitutes << printStorePath(i);
-            conn.processStderr();
-            if (readInt(conn->from)) res.insert(i);
-        }
-        return res;
-    } else {
-        conn->to << WorkerProto::Op::QuerySubstitutablePaths;
-        WorkerProto::write(*this, *conn, paths);
-        conn.processStderr();
-        return WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
-    }
+    conn->to << WorkerProto::Op::QuerySubstitutablePaths;
+    WorkerProto::write(*this, *conn, paths);
+    conn.processStderr();
+    return WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
 }
 
-
 void RemoteStore::querySubstitutablePathInfos(const StorePathCAMap & pathsMap, SubstitutablePathInfos & infos)
 {
-    if (pathsMap.empty()) return;
+    if (pathsMap.empty())
+        return;
 
     auto conn(getConnection());
 
-    if (GET_PROTOCOL_MINOR(conn->protoVersion) < 12) {
-
-        for (auto & i : pathsMap) {
-            SubstitutablePathInfo info;
-            conn->to << WorkerProto::Op::QuerySubstitutablePathInfo << printStorePath(i.first);
-            conn.processStderr();
-            unsigned int reply = readInt(conn->from);
-            if (reply == 0) continue;
-            auto deriver = readString(conn->from);
-            if (deriver != "")
-                info.deriver = parseStorePath(deriver);
-            info.references = WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
-            info.downloadSize = readLongLong(conn->from);
-            info.narSize = readLongLong(conn->from);
-            infos.insert_or_assign(i.first, std::move(info));
-        }
-
-    } else {
-
-        conn->to << WorkerProto::Op::QuerySubstitutablePathInfos;
-        if (GET_PROTOCOL_MINOR(conn->protoVersion) < 22) {
-            StorePathSet paths;
-            for (auto & path : pathsMap)
-                paths.insert(path.first);
-            WorkerProto::write(*this, *conn, paths);
-        } else
-            WorkerProto::write(*this, *conn, pathsMap);
-        conn.processStderr();
-        size_t count = readNum<size_t>(conn->from);
-        for (size_t n = 0; n < count; n++) {
-            SubstitutablePathInfo & info(infos[parseStorePath(readString(conn->from))]);
-            auto deriver = readString(conn->from);
-            if (deriver != "")
-                info.deriver = parseStorePath(deriver);
-            info.references = WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
-            info.downloadSize = readLongLong(conn->from);
-            info.narSize = readLongLong(conn->from);
-        }
-
+    conn->to << WorkerProto::Op::QuerySubstitutablePathInfos;
+    if (GET_PROTOCOL_MINOR(conn->protoVersion) < 22) {
+        StorePathSet paths;
+        for (auto & path : pathsMap)
+            paths.insert(path.first);
+        WorkerProto::write(*this, *conn, paths);
+    } else
+        WorkerProto::write(*this, *conn, pathsMap);
+    conn.processStderr();
+    size_t count = readNum<size_t>(conn->from);
+    for (size_t n = 0; n < count; n++) {
+        SubstitutablePathInfo & info(infos[parseStorePath(readString(conn->from))]);
+        auto deriver = readString(conn->from);
+        if (deriver != "")
+            info.deriver = parseStorePath(deriver);
+        info.references = WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
+        info.downloadSize = readLongLong(conn->from);
+        info.narSize = readLongLong(conn->from);
     }
 }
 
-
-void RemoteStore::queryPathInfoUncached(const StorePath & path,
-    Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
+void RemoteStore::queryPathInfoUncached(
+    const StorePath & path, Callback<std::shared_ptr<const ValidPathInfo>> callback) noexcept
 {
     try {
-        std::shared_ptr<const ValidPathInfo> info;
-        {
+        auto info = ({
             auto conn(getConnection());
-            info = std::make_shared<ValidPathInfo>(
-                StorePath{path},
-                conn->queryPathInfo(*this, &conn.daemonException, path));
-
-        }
-        callback(std::move(info));
-    } catch (...) { callback.rethrow(); }
+            conn->queryPathInfo(*this, &conn.daemonException, path);
+        });
+        if (!info)
+            callback(nullptr);
+        else
+            callback(std::make_shared<ValidPathInfo>(StorePath{path}, *info));
+    } catch (...) {
+        callback.rethrow();
+    }
 }
 
-
-void RemoteStore::queryReferrers(const StorePath & path,
-    StorePathSet & referrers)
+void RemoteStore::queryReferrers(const StorePath & path, StorePathSet & referrers)
 {
     auto conn(getConnection());
     conn->to << WorkerProto::Op::QueryReferrers << printStorePath(path);
@@ -297,7 +241,6 @@ void RemoteStore::queryReferrers(const StorePath & path,
         referrers.insert(i);
 }
 
-
 StorePathSet RemoteStore::queryValidDerivers(const StorePath & path)
 {
     auto conn(getConnection());
@@ -306,7 +249,6 @@ StorePathSet RemoteStore::queryValidDerivers(const StorePath & path)
     return WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
 }
 
-
 StorePathSet RemoteStore::queryDerivationOutputs(const StorePath & path)
 {
     if (GET_PROTOCOL_MINOR(getProtocol()) >= 0x16) {
@@ -318,8 +260,8 @@ StorePathSet RemoteStore::queryDerivationOutputs(const StorePath & path)
     return WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
 }
 
-
-std::map<std::string, std::optional<StorePath>> RemoteStore::queryPartialDerivationOutputMap(const StorePath & path, Store * evalStore_)
+std::map<std::string, std::optional<StorePath>>
+RemoteStore::queryPartialDerivationOutputMap(const StorePath & path, Store * evalStore_)
 {
     if (GET_PROTOCOL_MINOR(getProtocol()) >= 0x16) {
         if (!evalStore_) {
@@ -358,28 +300,25 @@ std::optional<StorePath> RemoteStore::queryPathFromHashPart(const std::string &
     conn->to << WorkerProto::Op::QueryPathFromHashPart << hashPart;
     conn.processStderr();
     Path path = readString(conn->from);
-    if (path.empty()) return {};
+    if (path.empty())
+        return {};
     return parseStorePath(path);
 }
 
-
 ref<const ValidPathInfo> RemoteStore::addCAToStore(
-        Source & dump,
-        std::string_view name,
-        ContentAddressMethod caMethod,
-        HashAlgorithm hashAlgo,
-        const StorePathSet & references,
-        RepairFlag repair)
+    Source & dump,
+    std::string_view name,
+    ContentAddressMethod caMethod,
+    HashAlgorithm hashAlgo,
+    const StorePathSet & references,
+    RepairFlag repair)
 {
     std::optional<ConnectionHandle> conn_(getConnection());
     auto & conn = *conn_;
 
     if (GET_PROTOCOL_MINOR(conn->protoVersion) >= 25) {
 
-        conn->to
-            << WorkerProto::Op::AddToStore
-            << name
-            << caMethod.renderWithAlgo(hashAlgo);
+        conn->to << WorkerProto::Op::AddToStore << name << caMethod.renderWithAlgo(hashAlgo);
         WorkerProto::write(*this, *conn, references);
         conn->to << repair;
 
@@ -387,66 +326,63 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
         connections->incCapacity();
         {
             Finally cleanup([&]() { connections->decCapacity(); });
-            conn.withFramedSink([&](Sink & sink) {
-                dump.drainInto(sink);
-            });
+            conn.withFramedSink([&](Sink & sink) { dump.drainInto(sink); });
         }
 
-        return make_ref<ValidPathInfo>(
-            WorkerProto::Serialise<ValidPathInfo>::read(*this, *conn));
-    }
-    else {
-        if (repair) throw Error("repairing is not supported when building through the Nix daemon protocol < 1.25");
+        return make_ref<ValidPathInfo>(WorkerProto::Serialise<ValidPathInfo>::read(*this, *conn));
+    } else {
+        if (repair)
+            throw Error("repairing is not supported when building through the Nix daemon protocol < 1.25");
 
         switch (caMethod.raw) {
-            case ContentAddressMethod::Raw::Text:
-            {
-                if (hashAlgo != HashAlgorithm::SHA256)
-                    throw UnimplementedError("When adding text-hashed data called '%s', only SHA-256 is supported but '%s' was given",
-                        name, printHashAlgo(hashAlgo));
-                std::string s = dump.drain();
-                conn->to << WorkerProto::Op::AddTextToStore << name << s;
-                WorkerProto::write(*this, *conn, references);
-                conn.processStderr();
-                break;
-            }
-            case ContentAddressMethod::Raw::Flat:
-            case ContentAddressMethod::Raw::NixArchive:
-            case ContentAddressMethod::Raw::Git:
-            default:
-            {
-                auto fim = caMethod.getFileIngestionMethod();
-                conn->to
-                    << WorkerProto::Op::AddToStore
-                    << name
-                    << ((hashAlgo == HashAlgorithm::SHA256 && fim == FileIngestionMethod::NixArchive) ? 0 : 1) /* backwards compatibility hack */
-                    << (fim == FileIngestionMethod::NixArchive ? 1 : 0)
-                    << printHashAlgo(hashAlgo);
+        case ContentAddressMethod::Raw::Text: {
+            if (hashAlgo != HashAlgorithm::SHA256)
+                throw UnimplementedError(
+                    "When adding text-hashed data called '%s', only SHA-256 is supported but '%s' was given",
+                    name,
+                    printHashAlgo(hashAlgo));
+            std::string s = dump.drain();
+            conn->to << WorkerProto::Op::AddTextToStore << name << s;
+            WorkerProto::write(*this, *conn, references);
+            conn.processStderr();
+            break;
+        }
+        case ContentAddressMethod::Raw::Flat:
+        case ContentAddressMethod::Raw::NixArchive:
+        case ContentAddressMethod::Raw::Git:
+        default: {
+            auto fim = caMethod.getFileIngestionMethod();
+            conn->to << WorkerProto::Op::AddToStore << name
+                     << ((hashAlgo == HashAlgorithm::SHA256 && fim == FileIngestionMethod::NixArchive)
+                             ? 0
+                             : 1) /* backwards compatibility hack */
+                     << (fim == FileIngestionMethod::NixArchive ? 1 : 0) << printHashAlgo(hashAlgo);
 
-                try {
-                    conn->to.written = 0;
-                    connections->incCapacity();
-                    {
-                        Finally cleanup([&]() { connections->decCapacity(); });
-                        if (fim == FileIngestionMethod::NixArchive) {
-                            dump.drainInto(conn->to);
-                        } else {
-                            std::string contents = dump.drain();
-                            dumpString(contents, conn->to);
-                        }
+            try {
+                conn->to.written = 0;
+                connections->incCapacity();
+                {
+                    Finally cleanup([&]() { connections->decCapacity(); });
+                    if (fim == FileIngestionMethod::NixArchive) {
+                        dump.drainInto(conn->to);
+                    } else {
+                        std::string contents = dump.drain();
+                        dumpString(contents, conn->to);
                     }
-                    conn.processStderr();
-                } catch (SysError & e) {
-                    /* Daemon closed while we were sending the path. Probably OOM
-                      or I/O error. */
-                    if (e.errNo == EPIPE)
-                        try {
-                            conn.processStderr();
-                        } catch (EndOfFile & e) { }
-                    throw;
                 }
-                break;
+                conn.processStderr();
+            } catch (SysError & e) {
+                /* Daemon closed while we were sending the path. Probably OOM
+                  or I/O error. */
+                if (e.errNo == EPIPE)
+                    try {
+                        conn.processStderr();
+                    } catch (EndOfFile & e) {
+                    }
+                throw;
             }
+            break;
+        }
         }
         auto path = parseStorePath(readString(conn->from));
         // Release our connection to prevent a deadlock in queryPathInfo().
@@ -455,7 +391,6 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
     }
 }
 
-
 StorePath RemoteStore::addToStoreFromDump(
     Source & dump,
     std::string_view name,
@@ -482,62 +417,34 @@ StorePath RemoteStore::addToStoreFromDump(
     }
     if (fsm != dumpMethod)
         unsupported("RemoteStore::addToStoreFromDump doesn't support this `dumpMethod` `hashMethod` combination");
-    return addCAToStore(dump, name, hashMethod, hashAlgo, references, repair)->path;
+    auto storePath = addCAToStore(dump, name, hashMethod, hashAlgo, references, repair)->path;
+    invalidatePathInfoCacheFor(storePath);
+    return storePath;
 }
 
-
-void RemoteStore::addToStore(const ValidPathInfo & info, Source & source,
-    RepairFlag repair, CheckSigsFlag checkSigs)
+void RemoteStore::addToStore(const ValidPathInfo & info, Source & source, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     auto conn(getConnection());
 
-    if (GET_PROTOCOL_MINOR(conn->protoVersion) < 18) {
-        auto source2 = sinkToSource([&](Sink & sink) {
-            sink << 1 // == path follows
-                ;
-            copyNAR(source, sink);
-            sink
-                << exportMagic
-                << printStorePath(info.path);
-            WorkerProto::write(*this, *conn, info.references);
-            sink
-                << (info.deriver ? printStorePath(*info.deriver) : "")
-                << 0 // == no legacy signature
-                << 0 // == no path follows
-                ;
-        });
-        conn->importPaths(*this, &conn.daemonException, *source2);
-    }
+    conn->to << WorkerProto::Op::AddToStoreNar << printStorePath(info.path)
+             << (info.deriver ? printStorePath(*info.deriver) : "")
+             << info.narHash.to_string(HashFormat::Base16, false);
+    WorkerProto::write(*this, *conn, info.references);
+    conn->to << info.registrationTime << info.narSize << info.ultimate << info.sigs << renderContentAddress(info.ca)
+             << repair << !checkSigs;
 
-    else {
-        conn->to << WorkerProto::Op::AddToStoreNar
-                 << printStorePath(info.path)
-                 << (info.deriver ? printStorePath(*info.deriver) : "")
-                 << info.narHash.to_string(HashFormat::Base16, false);
-        WorkerProto::write(*this, *conn, info.references);
-        conn->to << info.registrationTime << info.narSize
-                 << info.ultimate << info.sigs << renderContentAddress(info.ca)
-                 << repair << !checkSigs;
-
-        if (GET_PROTOCOL_MINOR(conn->protoVersion) >= 23) {
-            conn.withFramedSink([&](Sink & sink) {
-                copyNAR(source, sink);
-            });
-        } else if (GET_PROTOCOL_MINOR(conn->protoVersion) >= 21) {
-            conn.processStderr(0, &source);
-        } else {
-            copyNAR(source, conn->to);
-            conn.processStderr(0, nullptr);
-        }
+    if (GET_PROTOCOL_MINOR(conn->protoVersion) >= 23) {
+        conn.withFramedSink([&](Sink & sink) { copyNAR(source, sink); });
+    } else if (GET_PROTOCOL_MINOR(conn->protoVersion) >= 21) {
+        conn.processStderr(0, &source);
+    } else {
+        copyNAR(source, conn->to);
+        conn.processStderr(0, nullptr);
     }
 }
 
-
 void RemoteStore::addMultipleToStore(
-    PathsSource && pathsToCopy,
-    Activity & act,
-    RepairFlag repair,
-    CheckSigsFlag checkSigs)
+    PathsSource && pathsToCopy, Activity & act, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     // `addMultipleToStore` is single threaded
     size_t bytesExpected = 0;
@@ -555,12 +462,13 @@ void RemoteStore::addMultipleToStore(
             act.progress(nrTotal - pathsToCopy.size(), nrTotal, size_t(1), size_t(0));
 
             auto & [pathInfo, pathSource] = pathsToCopy.back();
-            WorkerProto::Serialise<ValidPathInfo>::write(*this,
-                 WorkerProto::WriteConn {
-                     .to = sink,
-                     .version = 16,
-                 },
-                 pathInfo);
+            WorkerProto::Serialise<ValidPathInfo>::write(
+                *this,
+                WorkerProto::WriteConn{
+                    .to = sink,
+                    .version = 16,
+                },
+                pathInfo);
             pathSource->drainInto(sink);
             pathsToCopy.pop_back();
         }
@@ -569,25 +477,16 @@ void RemoteStore::addMultipleToStore(
     addMultipleToStore(*source, repair, checkSigs);
 }
 
-void RemoteStore::addMultipleToStore(
-    Source & source,
-    RepairFlag repair,
-    CheckSigsFlag checkSigs)
+void RemoteStore::addMultipleToStore(Source & source, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     if (GET_PROTOCOL_MINOR(getConnection()->protoVersion) >= 32) {
         auto conn(getConnection());
-        conn->to
-            << WorkerProto::Op::AddMultipleToStore
-            << repair
-            << !checkSigs;
-        conn.withFramedSink([&](Sink & sink) {
-            source.drainInto(sink);
-        });
+        conn->to << WorkerProto::Op::AddMultipleToStore << repair << !checkSigs;
+        conn.withFramedSink([&](Sink & sink) { source.drainInto(sink); });
     } else
         Store::addMultipleToStore(source, repair, checkSigs);
 }
 
-
 void RemoteStore::registerDrvOutput(const Realisation & info)
 {
     auto conn(getConnection());
@@ -601,8 +500,8 @@ void RemoteStore::registerDrvOutput(const Realisation & info)
     conn.processStderr();
 }
 
-void RemoteStore::queryRealisationUncached(const DrvOutput & id,
-    Callback<std::shared_ptr<const Realisation>> callback) noexcept
+void RemoteStore::queryRealisationUncached(
+    const DrvOutput & id, Callback<std::shared_ptr<const Realisation>> callback) noexcept
 {
     try {
         auto conn(getConnection());
@@ -618,14 +517,12 @@ void RemoteStore::queryRealisationUncached(const DrvOutput & id,
 
         auto real = [&]() -> std::shared_ptr<const Realisation> {
             if (GET_PROTOCOL_MINOR(conn->protoVersion) < 31) {
-                auto outPaths = WorkerProto::Serialise<std::set<StorePath>>::read(
-                    *this, *conn);
+                auto outPaths = WorkerProto::Serialise<std::set<StorePath>>::read(*this, *conn);
                 if (outPaths.empty())
                     return nullptr;
-                return std::make_shared<const Realisation>(Realisation { .id = id, .outPath = *outPaths.begin() });
+                return std::make_shared<const Realisation>(Realisation{.id = id, .outPath = *outPaths.begin()});
             } else {
-                auto realisations = WorkerProto::Serialise<std::set<Realisation>>::read(
-                    *this, *conn);
+                auto realisations = WorkerProto::Serialise<std::set<Realisation>>::read(*this, *conn);
                 if (realisations.empty())
                     return nullptr;
                 return std::make_shared<const Realisation>(*realisations.begin());
@@ -633,54 +530,46 @@ void RemoteStore::queryRealisationUncached(const DrvOutput & id,
         }();
 
         callback(std::shared_ptr<const Realisation>(real));
-    } catch (...) { return callback.rethrow(); }
+    } catch (...) {
+        return callback.rethrow();
+    }
 }
 
-void RemoteStore::copyDrvsFromEvalStore(
-    const std::vector<DerivedPath> & paths,
-    std::shared_ptr<Store> evalStore)
+void RemoteStore::copyDrvsFromEvalStore(const std::vector<DerivedPath> & paths, std::shared_ptr<Store> evalStore)
 {
     if (evalStore && evalStore.get() != this) {
         /* The remote doesn't have a way to access evalStore, so copy
            the .drvs. */
         RealisedPath::Set drvPaths2;
         for (const auto & i : paths) {
-            std::visit(overloaded {
-                [&](const DerivedPath::Opaque & bp) {
-                    // Do nothing, path is hopefully there already
+            std::visit(
+                overloaded{
+                    [&](const DerivedPath::Opaque & bp) {
+                        // Do nothing, path is hopefully there already
+                    },
+                    [&](const DerivedPath::Built & bp) { drvPaths2.insert(bp.drvPath->getBaseStorePath()); },
                 },
-                [&](const DerivedPath::Built & bp) {
-                    drvPaths2.insert(bp.drvPath->getBaseStorePath());
-                },
-            }, i.raw());
+                i.raw());
         }
         copyClosure(*evalStore, *this, drvPaths2);
     }
 }
 
-void RemoteStore::buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+void RemoteStore::buildPaths(
+    const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
 {
     copyDrvsFromEvalStore(drvPaths, evalStore);
 
     auto conn(getConnection());
     conn->to << WorkerProto::Op::BuildPaths;
-    assert(GET_PROTOCOL_MINOR(conn->protoVersion) >= 13);
     WorkerProto::write(*this, *conn, drvPaths);
-    if (GET_PROTOCOL_MINOR(conn->protoVersion) >= 15)
-        conn->to << buildMode;
-    else
-        /* Old daemons did not take a 'buildMode' parameter, so we
-           need to validate it here on the client side.  */
-        if (buildMode != bmNormal)
-            throw Error("repairing or checking is not supported when building through the Nix daemon");
+    conn->to << buildMode;
     conn.processStderr();
     readInt(conn->from);
 }
 
 std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
-    const std::vector<DerivedPath> & paths,
-    BuildMode buildMode,
-    std::shared_ptr<Store> evalStore)
+    const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
 {
     copyDrvsFromEvalStore(paths, evalStore);
 
@@ -705,20 +594,19 @@ std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
 
         for (auto & path : paths) {
             std::visit(
-                overloaded {
+                overloaded{
                     [&](const DerivedPath::Opaque & bo) {
-                        results.push_back(KeyedBuildResult {
-                            {
-                                .status = BuildResult::Substituted,
-                            },
-                            /* .path = */ bo,
-                        });
+                        results.push_back(
+                            KeyedBuildResult{
+                                {
+                                    .status = BuildResult::Substituted,
+                                },
+                                /* .path = */ bo,
+                            });
                     },
                     [&](const DerivedPath::Built & bfd) {
-                        KeyedBuildResult res {
-                            {
-                                .status = BuildResult::Built
-                            },
+                        KeyedBuildResult res{
+                            {.status = BuildResult::Built},
                             /* .path = */ bfd,
                         };
 
@@ -732,18 +620,18 @@ std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
                             if (!outputHash)
                                 throw Error(
                                     "the derivation '%s' doesn't have an output named '%s'",
-                                    printStorePath(drvPath), output);
-                            auto outputId = DrvOutput{ *outputHash, output };
+                                    printStorePath(drvPath),
+                                    output);
+                            auto outputId = DrvOutput{*outputHash, output};
                             if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
-                                auto realisation =
-                                    queryRealisation(outputId);
+                                auto realisation = queryRealisation(outputId);
                                 if (!realisation)
                                     throw MissingRealisation(outputId);
                                 res.builtOutputs.emplace(output, *realisation);
                             } else {
                                 res.builtOutputs.emplace(
                                     output,
-                                    Realisation {
+                                    Realisation{
                                         .id = outputId,
                                         .outPath = outputPath,
                                     });
@@ -751,8 +639,7 @@ std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
                         }
 
                         results.push_back(res);
-                    }
-                },
+                    }},
                 path.raw());
         }
 
@@ -760,9 +647,7 @@ std::vector<KeyedBuildResult> RemoteStore::buildPathsWithResults(
     }
 }
 
-
-BuildResult RemoteStore::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
-    BuildMode buildMode)
+BuildResult RemoteStore::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv, BuildMode buildMode)
 {
     auto conn(getConnection());
     conn->putBuildDerivationRequest(*this, &conn.daemonException, drvPath, drv, buildMode);
@@ -770,7 +655,6 @@ BuildResult RemoteStore::buildDerivation(const StorePath & drvPath, const BasicD
     return WorkerProto::Serialise<BuildResult>::read(*this, *conn);
 }
 
-
 void RemoteStore::ensurePath(const StorePath & path)
 {
     auto conn(getConnection());
@@ -779,14 +663,12 @@ void RemoteStore::ensurePath(const StorePath & path)
     readInt(conn->from);
 }
 
-
 void RemoteStore::addTempRoot(const StorePath & path)
 {
     auto conn(getConnection());
     conn->addTempRoot(*this, &conn.daemonException, path);
 }
 
-
 Roots RemoteStore::findRoots(bool censor)
 {
     auto conn(getConnection());
@@ -802,18 +684,16 @@ Roots RemoteStore::findRoots(bool censor)
     return result;
 }
 
-
 void RemoteStore::collectGarbage(const GCOptions & options, GCResults & results)
 {
     auto conn(getConnection());
 
-    conn->to
-        << WorkerProto::Op::CollectGarbage << options.action;
+    conn->to << WorkerProto::Op::CollectGarbage << options.action;
     WorkerProto::write(*this, *conn, options.pathsToDelete);
     conn->to << options.ignoreLiveness
-        << options.maxFreed
-        /* removed options */
-        << 0 << 0 << 0;
+             << options.maxFreed
+             /* removed options */
+             << 0 << 0 << 0;
 
     conn.processStderr();
 
@@ -821,13 +701,9 @@ void RemoteStore::collectGarbage(const GCOptions & options, GCResults & results)
     results.bytesFreed = readLongLong(conn->from);
     readLongLong(conn->from); // obsolete
 
-    {
-        auto state_(Store::state.lock());
-        state_->pathInfoCache.clear();
-    }
+    pathInfoCache->lock()->clear();
 }
 
-
 void RemoteStore::optimiseStore()
 {
     auto conn(getConnection());
@@ -836,7 +712,6 @@ void RemoteStore::optimiseStore()
     readInt(conn->from);
 }
 
-
 bool RemoteStore::verifyStore(bool checkContents, RepairFlag repair)
 {
     auto conn(getConnection());
@@ -845,7 +720,6 @@ bool RemoteStore::verifyStore(bool checkContents, RepairFlag repair)
     return readInt(conn->from);
 }
 
-
 void RemoteStore::addSignatures(const StorePath & storePath, const StringSet & sigs)
 {
     auto conn(getConnection());
@@ -854,7 +728,6 @@ void RemoteStore::addSignatures(const StorePath & storePath, const StringSet & s
     readInt(conn->from);
 }
 
-
 MissingPaths RemoteStore::queryMissing(const std::vector<DerivedPath> & targets)
 {
     {
@@ -874,36 +747,30 @@ MissingPaths RemoteStore::queryMissing(const std::vector<DerivedPath> & targets)
         return res;
     }
 
- fallback:
+fallback:
     return Store::queryMissing(targets);
 }
 
-
 void RemoteStore::addBuildLog(const StorePath & drvPath, std::string_view log)
 {
     auto conn(getConnection());
     conn->to << WorkerProto::Op::AddBuildLog << drvPath.to_string();
     StringSource source(log);
-    conn.withFramedSink([&](Sink & sink) {
-        source.drainInto(sink);
-    });
+    conn.withFramedSink([&](Sink & sink) { source.drainInto(sink); });
     readInt(conn->from);
 }
 
-
 std::optional<std::string> RemoteStore::getVersion()
 {
     auto conn(getConnection());
     return conn->daemonNixVersion;
 }
 
-
 void RemoteStore::connect()
 {
     auto conn(getConnection());
 }
 
-
 unsigned int RemoteStore::getProtocol()
 {
     auto conn(connections->get());
@@ -924,9 +791,7 @@ void RemoteStore::flushBadConnections()
 void RemoteStore::narFromPath(const StorePath & path, Sink & sink)
 {
     auto conn(getConnection());
-    conn->narFromPath(*this, &conn.daemonException, path, [&](Source & source) {
-        copyNAR(conn->from, sink);
-    });
+    conn->narFromPath(*this, &conn.daemonException, path, [&](Source & source) { copyNAR(conn->from, sink); });
 }
 
 ref<SourceAccessor> RemoteStore::getFSAccessor(bool requireValidPath)
@@ -951,4 +816,4 @@ void RemoteStore::ConnectionHandle::withFramedSink(std::function<void(Sink & sin
     processStderr(nullptr, nullptr, false);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/restricted-store.cc b/src/libstore/restricted-store.cc
index 69435122a..e0f43ab6c 100644
--- a/src/libstore/restricted-store.cc
+++ b/src/libstore/restricted-store.cc
@@ -2,6 +2,7 @@
 #include "nix/store/build-result.hh"
 #include "nix/util/callback.hh"
 #include "nix/store/realisation.hh"
+#include "nix/store/local-store.hh"
 
 namespace nix {
 
@@ -57,11 +58,6 @@ struct RestrictedStore : public virtual IndirectRootStore, public virtual GcStor
         return next->config->realStoreDir;
     }
 
-    std::string getUri() override
-    {
-        return next->getUri();
-    }
-
     StorePathSet queryAllValidPaths() override;
 
     void queryPathInfoUncached(
@@ -323,4 +319,4 @@ MissingPaths RestrictedStore::queryMissing(const std::vector<DerivedPath> & targ
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/s3-binary-cache-store.cc b/src/libstore/s3-binary-cache-store.cc
index 618112d1c..4ad09aff2 100644
--- a/src/libstore/s3-binary-cache-store.cc
+++ b/src/libstore/s3-binary-cache-store.cc
@@ -2,33 +2,33 @@
 
 #if NIX_WITH_S3_SUPPORT
 
-#include <assert.h>
+#  include <assert.h>
 
-#include "nix/store/s3.hh"
-#include "nix/store/nar-info.hh"
-#include "nix/store/nar-info-disk-cache.hh"
-#include "nix/store/globals.hh"
-#include "nix/util/compression.hh"
-#include "nix/store/filetransfer.hh"
-#include "nix/util/signals.hh"
-#include "nix/store/store-registration.hh"
+#  include "nix/store/s3.hh"
+#  include "nix/store/nar-info.hh"
+#  include "nix/store/nar-info-disk-cache.hh"
+#  include "nix/store/globals.hh"
+#  include "nix/util/compression.hh"
+#  include "nix/store/filetransfer.hh"
+#  include "nix/util/signals.hh"
+#  include "nix/store/store-registration.hh"
 
-#include <aws/core/Aws.h>
-#include <aws/core/VersionConfig.h>
-#include <aws/core/auth/AWSCredentialsProvider.h>
-#include <aws/core/auth/AWSCredentialsProviderChain.h>
-#include <aws/core/client/ClientConfiguration.h>
-#include <aws/core/client/DefaultRetryStrategy.h>
-#include <aws/core/utils/logging/FormattedLogSystem.h>
-#include <aws/core/utils/logging/LogMacros.h>
-#include <aws/core/utils/threading/Executor.h>
-#include <aws/identity-management/auth/STSProfileCredentialsProvider.h>
-#include <aws/s3/S3Client.h>
-#include <aws/s3/model/GetObjectRequest.h>
-#include <aws/s3/model/HeadObjectRequest.h>
-#include <aws/s3/model/ListObjectsRequest.h>
-#include <aws/s3/model/PutObjectRequest.h>
-#include <aws/transfer/TransferManager.h>
+#  include <aws/core/Aws.h>
+#  include <aws/core/VersionConfig.h>
+#  include <aws/core/auth/AWSCredentialsProvider.h>
+#  include <aws/core/auth/AWSCredentialsProviderChain.h>
+#  include <aws/core/client/ClientConfiguration.h>
+#  include <aws/core/client/DefaultRetryStrategy.h>
+#  include <aws/core/utils/logging/FormattedLogSystem.h>
+#  include <aws/core/utils/logging/LogMacros.h>
+#  include <aws/core/utils/threading/Executor.h>
+#  include <aws/identity-management/auth/STSProfileCredentialsProvider.h>
+#  include <aws/s3/S3Client.h>
+#  include <aws/s3/model/GetObjectRequest.h>
+#  include <aws/s3/model/HeadObjectRequest.h>
+#  include <aws/s3/model/ListObjectsRequest.h>
+#  include <aws/s3/model/PutObjectRequest.h>
+#  include <aws/transfer/TransferManager.h>
 
 using namespace Aws::Transfer;
 
@@ -37,10 +37,13 @@ namespace nix {
 struct S3Error : public Error
 {
     Aws::S3::S3Errors err;
+    Aws::String exceptionName;
 
     template<typename... Args>
-    S3Error(Aws::S3::S3Errors err, const Args & ... args)
-        : Error(args...), err(err) { };
+    S3Error(Aws::S3::S3Errors err, Aws::String exceptionName, const Args &... args)
+        : Error(args...)
+        , err(err)
+        , exceptionName(exceptionName){};
 };
 
 /* Helper: given an Outcome<R, E>, return R in case of success, or
@@ -51,11 +54,8 @@ R && checkAws(std::string_view s, Aws::Utils::Outcome<R, E> && outcome)
     if (!outcome.IsSuccess())
         throw S3Error(
             outcome.GetError().GetErrorType(),
-            fmt(
-                "%s: %s (request id: %s)",
-                s,
-                outcome.GetError().GetMessage(),
-                outcome.GetError().GetRequestId()));
+            outcome.GetError().GetExceptionName(),
+            fmt("%s: %s (request id: %s)", s, outcome.GetError().GetMessage(), outcome.GetError().GetRequestId()));
     return outcome.GetResultWithOwnership();
 }
 
@@ -68,9 +68,9 @@ class AwsLogger : public Aws::Utils::Logging::FormattedLogSystem
         debug("AWS: %s", chomp(statement));
     }
 
-#if !(AWS_SDK_VERSION_MAJOR <= 1 && AWS_SDK_VERSION_MINOR <= 7 && AWS_SDK_VERSION_PATCH <= 115)
+#  if !(AWS_SDK_VERSION_MAJOR <= 1 && AWS_SDK_VERSION_MINOR <= 7 && AWS_SDK_VERSION_PATCH <= 115)
     void Flush() override {}
-#endif
+#  endif
 };
 
 /* Retrieve the credentials from the list of AWS default providers, with the addition of the STS creds provider. This
@@ -108,9 +108,7 @@ static void initAWS()
 
         if (verbosity >= lvlDebug) {
             options.loggingOptions.logLevel =
-                verbosity == lvlDebug
-                ? Aws::Utils::Logging::LogLevel::Debug
-                : Aws::Utils::Logging::LogLevel::Trace;
+                verbosity == lvlDebug ? Aws::Utils::Logging::LogLevel::Debug : Aws::Utils::Logging::LogLevel::Trace;
             options.loggingOptions.logger_create_fn = [options]() {
                 return std::make_shared<AwsLogger>(options.loggingOptions.logLevel);
             };
@@ -121,32 +119,31 @@ static void initAWS()
 }
 
 S3Helper::S3Helper(
-    const std::string & profile,
-    const std::string & region,
-    const std::string & scheme,
-    const std::string & endpoint)
+    const std::string & profile, const std::string & region, const std::string & scheme, const std::string & endpoint)
     : config(makeConfig(region, scheme, endpoint))
-    , client(make_ref<Aws::S3::S3Client>(
-            std::make_shared<CustomAwsCredentialsProviderChain>(profile),
-            *config,
-#if AWS_SDK_VERSION_MAJOR == 1 && AWS_SDK_VERSION_MINOR < 3
-            false,
-#else
-            Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::Never,
-#endif
-            endpoint.empty()))
+    , client(
+          make_ref<Aws::S3::S3Client>(
+              std::make_shared<CustomAwsCredentialsProviderChain>(profile),
+              *config,
+#  if AWS_SDK_VERSION_MAJOR == 1 && AWS_SDK_VERSION_MINOR < 3
+              false,
+#  else
+              Aws::Client::AWSAuthV4Signer::PayloadSigningPolicy::Never,
+#  endif
+              endpoint.empty()))
 {
 }
 
 /* Log AWS retries. */
 class RetryStrategy : public Aws::Client::DefaultRetryStrategy
 {
-    bool ShouldRetry(const Aws::Client::AWSError<Aws::Client::CoreErrors>& error, long attemptedRetries) const override
+    bool ShouldRetry(const Aws::Client::AWSError<Aws::Client::CoreErrors> & error, long attemptedRetries) const override
     {
         checkInterrupt();
         auto retry = Aws::Client::DefaultRetryStrategy::ShouldRetry(error, attemptedRetries);
         if (retry)
-            printError("AWS error '%s' (%s; request id: %s), will retry in %d ms",
+            printError(
+                "AWS error '%s' (%s; request id: %s), will retry in %d ms",
                 error.GetExceptionName(),
                 error.GetMessage(),
                 error.GetRequestId(),
@@ -155,10 +152,8 @@ class RetryStrategy : public Aws::Client::DefaultRetryStrategy
     }
 };
 
-ref<Aws::Client::ClientConfiguration> S3Helper::makeConfig(
-    const std::string & region,
-    const std::string & scheme,
-    const std::string & endpoint)
+ref<Aws::Client::ClientConfiguration>
+S3Helper::makeConfig(const std::string & region, const std::string & scheme, const std::string & endpoint)
 {
     initAWS();
     auto res = make_ref<Aws::Client::ClientConfiguration>();
@@ -177,38 +172,30 @@ ref<Aws::Client::ClientConfiguration> S3Helper::makeConfig(
     return res;
 }
 
-S3Helper::FileTransferResult S3Helper::getObject(
-    const std::string & bucketName, const std::string & key)
+S3Helper::FileTransferResult S3Helper::getObject(const std::string & bucketName, const std::string & key)
 {
     std::string uri = "s3://" + bucketName + "/" + key;
-    Activity act(*logger, lvlTalkative, actFileTransfer,
-        fmt("downloading '%s'", uri),
-        Logger::Fields{uri}, getCurActivity());
+    Activity act(
+        *logger, lvlTalkative, actFileTransfer, fmt("downloading '%s'", uri), Logger::Fields{uri}, getCurActivity());
 
-    auto request =
-        Aws::S3::Model::GetObjectRequest()
-        .WithBucket(bucketName)
-        .WithKey(key);
+    auto request = Aws::S3::Model::GetObjectRequest().WithBucket(bucketName).WithKey(key);
 
-    request.SetResponseStreamFactory([&]() {
-        return Aws::New<std::stringstream>("STRINGSTREAM");
-    });
+    request.SetResponseStreamFactory([&]() { return Aws::New<std::stringstream>("STRINGSTREAM"); });
 
     size_t bytesDone = 0;
     size_t bytesExpected = 0;
-    request.SetDataReceivedEventHandler([&](const Aws::Http::HttpRequest * req, Aws::Http::HttpResponse * resp, long long l) {
-        if (!bytesExpected && resp->HasHeader("Content-Length")) {
-            if (auto length = string2Int<size_t>(resp->GetHeader("Content-Length"))) {
-                bytesExpected = *length;
+    request.SetDataReceivedEventHandler(
+        [&](const Aws::Http::HttpRequest * req, Aws::Http::HttpResponse * resp, long long l) {
+            if (!bytesExpected && resp->HasHeader("Content-Length")) {
+                if (auto length = string2Int<size_t>(resp->GetHeader("Content-Length"))) {
+                    bytesExpected = *length;
+                }
             }
-        }
-        bytesDone += l;
-        act.progress(bytesDone, bytesExpected);
-    });
+            bytesDone += l;
+            act.progress(bytesDone, bytesExpected);
+        });
 
-    request.SetContinueRequestHandler([](const Aws::Http::HttpRequest*) {
-        return !isInterrupted();
-    });
+    request.SetContinueRequestHandler([](const Aws::Http::HttpRequest *) { return !isInterrupted(); });
 
     FileTransferResult res;
 
@@ -216,17 +203,20 @@ S3Helper::FileTransferResult S3Helper::getObject(
 
     try {
 
-        auto result = checkAws(fmt("AWS error fetching '%s'", key),
-            client->GetObject(request));
+        auto result = checkAws(fmt("AWS error fetching '%s'", key), client->GetObject(request));
 
         act.progress(result.GetContentLength(), result.GetContentLength());
 
-        res.data = decompress(result.GetContentEncoding(),
-            dynamic_cast<std::stringstream &>(result.GetBody()).str());
+        res.data = decompress(result.GetContentEncoding(), dynamic_cast<std::stringstream &>(result.GetBody()).str());
 
     } catch (S3Error & e) {
-        if ((e.err != Aws::S3::S3Errors::NO_SUCH_KEY) &&
-            (e.err != Aws::S3::S3Errors::ACCESS_DENIED)) throw;
+        if ((e.err != Aws::S3::S3Errors::NO_SUCH_KEY) && (e.err != Aws::S3::S3Errors::ACCESS_DENIED) &&
+            // Expired tokens are not really an error, more of a caching problem. Should be treated same as 403.
+            //
+            // AWS unwilling to provide a specific error type for the situation
+            // (https://github.com/aws/aws-sdk-cpp/issues/1843) so use this hack
+            (e.exceptionName != "ExpiredToken"))
+            throw;
     }
 
     auto now2 = std::chrono::steady_clock::now();
@@ -236,11 +226,8 @@ S3Helper::FileTransferResult S3Helper::getObject(
     return res;
 }
 
-
 S3BinaryCacheStoreConfig::S3BinaryCacheStoreConfig(
-    std::string_view uriScheme,
-    std::string_view bucketName,
-    const Params & params)
+    std::string_view uriScheme, std::string_view bucketName, const Params & params)
     : StoreConfig(params)
     , BinaryCacheStoreConfig(params)
     , bucketName(bucketName)
@@ -254,19 +241,29 @@ S3BinaryCacheStoreConfig::S3BinaryCacheStoreConfig(
         throw UsageError("`%s` store requires a bucket name in its Store URI", uriScheme);
 }
 
-
 S3BinaryCacheStore::S3BinaryCacheStore(ref<Config> config)
     : BinaryCacheStore(*config)
     , config{config}
-{ }
+{
+}
 
 std::string S3BinaryCacheStoreConfig::doc()
 {
     return
-      #include "s3-binary-cache-store.md"
-      ;
+#  include "s3-binary-cache-store.md"
+        ;
 }
 
+StoreReference S3BinaryCacheStoreConfig::getReference() const
+{
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = *uriSchemes().begin(),
+                .authority = bucketName,
+            },
+    };
+}
 
 struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
 {
@@ -281,24 +278,19 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
         , s3Helper(config->profile, config->region, config->scheme, config->endpoint)
     {
         diskCache = getNarInfoDiskCache();
-
-        init();
-    }
-
-    std::string getUri() override
-    {
-        return "s3://" + config->bucketName;
     }
 
     void init() override
     {
-        if (auto cacheInfo = diskCache->upToDateCacheExists(getUri())) {
+        /* FIXME: The URI (when used as a cache key) must have several parameters rendered (e.g. the endpoint).
+           This must be represented as a separate opaque string (probably a URI) that has the right query parameters. */
+        auto cacheUri = config->getReference().render(/*withParams=*/false);
+        if (auto cacheInfo = diskCache->upToDateCacheExists(cacheUri)) {
             config->wantMassQuery.setDefault(cacheInfo->wantMassQuery);
             config->priority.setDefault(cacheInfo->priority);
         } else {
             BinaryCacheStore::init();
-            diskCache->createCache(
-                getUri(), config->storeDir, config->wantMassQuery, config->priority);
+            diskCache->createCache(cacheUri, config->storeDir, config->wantMassQuery, config->priority);
         }
     }
 
@@ -326,14 +318,16 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
         stats.head++;
 
         auto res = s3Helper.client->HeadObject(
-            Aws::S3::Model::HeadObjectRequest()
-            .WithBucket(config->bucketName)
-            .WithKey(path));
+            Aws::S3::Model::HeadObjectRequest().WithBucket(config->bucketName).WithKey(path));
 
         if (!res.IsSuccess()) {
             auto & error = res.GetError();
             if (error.GetErrorType() == Aws::S3::S3Errors::RESOURCE_NOT_FOUND
                 || error.GetErrorType() == Aws::S3::S3Errors::NO_SUCH_KEY
+                // Expired tokens are not really an error, more of a caching problem. Should be treated same as 403.
+                // AWS unwilling to provide a specific error type for the situation
+                // (https://github.com/aws/aws-sdk-cpp/issues/1843) so use this hack
+                || (error.GetErrorType() == Aws::S3::S3Errors::UNKNOWN && error.GetExceptionName() == "ExpiredToken")
                 // If bucket listing is disabled, 404s turn into 403s
                 || error.GetErrorType() == Aws::S3::S3Errors::ACCESS_DENIED)
                 return false;
@@ -363,29 +357,31 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
             cv.wait(lk);
         }
 
-        AsyncContext(const Activity & act) : act(act) {}
+        AsyncContext(const Activity & act)
+            : act(act)
+        {
+        }
     };
 
-    void uploadFile(const std::string & path,
+    void uploadFile(
+        const std::string & path,
         std::shared_ptr<std::basic_iostream<char>> istream,
         const std::string & mimeType,
         const std::string & contentEncoding)
     {
         std::string uri = "s3://" + config->bucketName + "/" + path;
-        Activity act(*logger, lvlTalkative, actFileTransfer,
-            fmt("uploading '%s'", uri),
-            Logger::Fields{uri}, getCurActivity());
+        Activity act(
+            *logger, lvlTalkative, actFileTransfer, fmt("uploading '%s'", uri), Logger::Fields{uri}, getCurActivity());
         istream->seekg(0, istream->end);
         auto size = istream->tellg();
         istream->seekg(0, istream->beg);
 
         auto maxThreads = std::thread::hardware_concurrency();
 
-        static std::shared_ptr<Aws::Utils::Threading::PooledThreadExecutor>
-            executor = std::make_shared<Aws::Utils::Threading::PooledThreadExecutor>(maxThreads);
+        static std::shared_ptr<Aws::Utils::Threading::PooledThreadExecutor> executor =
+            std::make_shared<Aws::Utils::Threading::PooledThreadExecutor>(maxThreads);
 
-        std::call_once(transferManagerCreated, [&]()
-        {
+        std::call_once(transferManagerCreated, [&]() {
             if (config->multipartUpload) {
                 TransferManagerConfiguration transferConfig(executor.get());
 
@@ -394,8 +390,7 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
 
                 transferConfig.uploadProgressCallback =
                     [](const TransferManager * transferManager,
-                        const std::shared_ptr<const TransferHandle> & transferHandle)
-                    {
+                       const std::shared_ptr<const TransferHandle> & transferHandle) {
                         auto context = std::dynamic_pointer_cast<const AsyncContext>(transferHandle->GetContext());
                         size_t bytesDone = transferHandle->GetBytesTransferred();
                         size_t bytesTotal = transferHandle->GetBytesTotalSize();
@@ -408,8 +403,7 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
                     };
                 transferConfig.transferStatusUpdatedCallback =
                     [](const TransferManager * transferManager,
-                        const std::shared_ptr<const TransferHandle> & transferHandle)
-                    {
+                       const std::shared_ptr<const TransferHandle> & transferHandle) {
                         auto context = std::dynamic_pointer_cast<const AsyncContext>(transferHandle->GetContext());
                         context->notify();
                     };
@@ -428,11 +422,13 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
                 throw Error("setting a content encoding is not supported with S3 multi-part uploads");
 
             auto context = std::make_shared<AsyncContext>(act);
-            std::shared_ptr<TransferHandle> transferHandle =
-                transferManager->UploadFile(
-                    istream, bucketName, path, mimeType,
-                    Aws::Map<Aws::String, Aws::String>(),
-                    context /*, contentEncoding */);
+            std::shared_ptr<TransferHandle> transferHandle = transferManager->UploadFile(
+                istream,
+                bucketName,
+                path,
+                mimeType,
+                Aws::Map<Aws::String, Aws::String>(),
+                context /*, contentEncoding */);
 
             TransferStatus status = transferHandle->GetStatus();
             while (status == TransferStatus::IN_PROGRESS || status == TransferStatus::NOT_STARTED) {
@@ -447,20 +443,19 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
             act.progress(transferHandle->GetBytesTransferred(), transferHandle->GetBytesTotalSize());
 
             if (status == TransferStatus::FAILED)
-                throw Error("AWS error: failed to upload 's3://%s/%s': %s",
-                    bucketName, path, transferHandle->GetLastError().GetMessage());
+                throw Error(
+                    "AWS error: failed to upload 's3://%s/%s': %s",
+                    bucketName,
+                    path,
+                    transferHandle->GetLastError().GetMessage());
 
             if (status != TransferStatus::COMPLETED)
-                throw Error("AWS error: transfer status of 's3://%s/%s' in unexpected state",
-                    bucketName, path);
+                throw Error("AWS error: transfer status of 's3://%s/%s' in unexpected state", bucketName, path);
 
         } else {
             act.progress(0, size);
 
-            auto request =
-                Aws::S3::Model::PutObjectRequest()
-                .WithBucket(bucketName)
-                .WithKey(path);
+            auto request = Aws::S3::Model::PutObjectRequest().WithBucket(bucketName).WithKey(path);
 
             size_t bytesSent = 0;
             request.SetDataSentEventHandler([&](const Aws::Http::HttpRequest * req, long long l) {
@@ -468,9 +463,7 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
                 act.progress(bytesSent, size);
             });
 
-            request.SetContinueRequestHandler([](const Aws::Http::HttpRequest*) {
-                return !isInterrupted();
-            });
+            request.SetContinueRequestHandler([](const Aws::Http::HttpRequest *) { return !isInterrupted(); });
 
             request.SetContentType(mimeType);
 
@@ -479,32 +472,28 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
 
             request.SetBody(istream);
 
-            auto result = checkAws(fmt("AWS error uploading '%s'", path),
-                s3Helper.client->PutObject(request));
+            auto result = checkAws(fmt("AWS error uploading '%s'", path), s3Helper.client->PutObject(request));
 
             act.progress(size, size);
         }
 
         auto now2 = std::chrono::steady_clock::now();
 
-        auto duration =
-            std::chrono::duration_cast<std::chrono::milliseconds>(now2 - now1)
-                .count();
+        auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(now2 - now1).count();
 
-        printInfo("uploaded 's3://%s/%s' (%d bytes) in %d ms",
-            bucketName, path, size, duration);
+        printInfo("uploaded 's3://%s/%s' (%d bytes) in %d ms", bucketName, path, size, duration);
 
         stats.putTimeMs += duration;
         stats.putBytes += std::max(size, (decltype(size)) 0);
         stats.put++;
     }
 
-    void upsertFile(const std::string & path,
+    void upsertFile(
+        const std::string & path,
         std::shared_ptr<std::basic_iostream<char>> istream,
         const std::string & mimeType) override
     {
-        auto compress = [&](std::string compression)
-        {
+        auto compress = [&](std::string compression) {
             auto compressed = nix::compress(compression, StreamToSourceAdapter(istream).drain());
             return std::make_shared<std::stringstream>(std::move(compressed));
         };
@@ -530,12 +519,17 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
         stats.getTimeMs += res.durationMs;
 
         if (res.data) {
-            printTalkative("downloaded 's3://%s/%s' (%d bytes) in %d ms",
-                config->bucketName, path, res.data->size(), res.durationMs);
+            printTalkative(
+                "downloaded 's3://%s/%s' (%d bytes) in %d ms",
+                config->bucketName,
+                path,
+                res.data->size(),
+                res.durationMs);
 
             sink(*res.data);
         } else
-            throw NoSuchBinaryCacheFile("file '%s' does not exist in binary cache '%s'", path, getUri());
+            throw NoSuchBinaryCacheFile(
+                "file '%s' does not exist in binary cache '%s'", path, config->getHumanReadableURI());
     }
 
     StorePathSet queryAllValidPaths() override
@@ -548,21 +542,19 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
         do {
             debug("listing bucket 's3://%s' from key '%s'...", bucketName, marker);
 
-            auto res = checkAws(fmt("AWS error listing bucket '%s'", bucketName),
+            auto res = checkAws(
+                fmt("AWS error listing bucket '%s'", bucketName),
                 s3Helper.client->ListObjects(
-                    Aws::S3::Model::ListObjectsRequest()
-                    .WithBucket(bucketName)
-                    .WithDelimiter("/")
-                    .WithMarker(marker)));
+                    Aws::S3::Model::ListObjectsRequest().WithBucket(bucketName).WithDelimiter("/").WithMarker(marker)));
 
             auto & contents = res.GetContents();
 
-            debug("got %d keys, next marker '%s'",
-                contents.size(), res.GetNextMarker());
+            debug("got %d keys, next marker '%s'", contents.size(), res.GetNextMarker());
 
             for (const auto & object : contents) {
                 auto & key = object.GetKey();
-                if (key.size() != 40 || !hasSuffix(key, ".narinfo")) continue;
+                if (key.size() != 40 || !hasSuffix(key, ".narinfo"))
+                    continue;
                 paths.insert(parseStorePath(storeDir + "/" + key.substr(0, key.size() - 8) + "-" + MissingName));
             }
 
@@ -585,14 +577,15 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStore
 
 ref<Store> S3BinaryCacheStoreImpl::Config::openStore() const
 {
-    return make_ref<S3BinaryCacheStoreImpl>(ref{
-        // FIXME we shouldn't actually need a mutable config
-        std::const_pointer_cast<S3BinaryCacheStore::Config>(shared_from_this())
-    });
+    auto store =
+        make_ref<S3BinaryCacheStoreImpl>(ref{// FIXME we shouldn't actually need a mutable config
+                                             std::const_pointer_cast<S3BinaryCacheStore::Config>(shared_from_this())});
+    store->init();
+    return store;
 }
 
 static RegisterStoreImplementation<S3BinaryCacheStoreImpl::Config> regS3BinaryCacheStore;
 
-}
+} // namespace nix
 
 #endif
diff --git a/src/libstore/s3.cc b/src/libstore/s3.cc
new file mode 100644
index 000000000..5396f43b9
--- /dev/null
+++ b/src/libstore/s3.cc
@@ -0,0 +1,121 @@
+#include "nix/store/s3.hh"
+#include "nix/util/split.hh"
+#include "nix/util/url.hh"
+#include "nix/util/util.hh"
+#include "nix/util/canon-path.hh"
+#include "nix/util/strings-inline.hh"
+
+#include <ranges>
+
+namespace nix {
+
+using namespace std::string_view_literals;
+
+#if NIX_WITH_S3_SUPPORT
+
+ParsedS3URL ParsedS3URL::parse(const ParsedURL & parsed)
+try {
+    if (parsed.scheme != "s3"sv)
+        throw BadURL("URI scheme '%s' is not 's3'", parsed.scheme);
+
+    /* Yeah, S3 URLs in Nix have the bucket name as authority. Luckily registered name type
+       authority has the same restrictions (mostly) as S3 bucket names.
+       TODO: Validate against:
+       https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html#general-purpose-bucket-names
+       */
+    if (!parsed.authority || parsed.authority->host.empty()
+        || parsed.authority->hostType != ParsedURL::Authority::HostType::Name)
+        throw BadURL("URI has a missing or invalid bucket name");
+
+    /* TODO: Validate the key against:
+     * https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-guidelines
+     */
+
+    auto getOptionalParam = [&](std::string_view key) -> std::optional<std::string> {
+        const auto & query = parsed.query;
+        auto it = query.find(key);
+        if (it == query.end())
+            return std::nullopt;
+        return it->second;
+    };
+
+    auto endpoint = getOptionalParam("endpoint");
+    if (parsed.path.size() <= 1 || !parsed.path.front().empty())
+        throw BadURL("URI has a missing or invalid key");
+
+    auto path = std::views::drop(parsed.path, 1) | std::ranges::to<std::vector<std::string>>();
+
+    return ParsedS3URL{
+        .bucket = parsed.authority->host,
+        .key = std::move(path),
+        .profile = getOptionalParam("profile"),
+        .region = getOptionalParam("region"),
+        .scheme = getOptionalParam("scheme"),
+        .endpoint = [&]() -> decltype(ParsedS3URL::endpoint) {
+            if (!endpoint)
+                return std::monostate();
+
+            /* Try to parse the endpoint as a full-fledged URL with a scheme. */
+            try {
+                return parseURL(*endpoint);
+            } catch (BadURL &) {
+            }
+
+            return ParsedURL::Authority::parse(*endpoint);
+        }(),
+    };
+} catch (BadURL & e) {
+    e.addTrace({}, "while parsing S3 URI: '%s'", parsed.to_string());
+    throw;
+}
+
+ParsedURL ParsedS3URL::toHttpsUrl() const
+{
+    auto toView = [](const auto & x) { return std::string_view{x}; };
+
+    auto regionStr = region.transform(toView).value_or("us-east-1");
+    auto schemeStr = scheme.transform(toView).value_or("https");
+
+    // Handle endpoint configuration using std::visit
+    return std::visit(
+        overloaded{
+            [&](const std::monostate &) {
+                // No custom endpoint, use standard AWS S3 endpoint
+                std::vector<std::string> path{""};
+                path.push_back(bucket);
+                path.insert(path.end(), key.begin(), key.end());
+                return ParsedURL{
+                    .scheme = std::string{schemeStr},
+                    .authority = ParsedURL::Authority{.host = "s3." + regionStr + ".amazonaws.com"},
+                    .path = std::move(path),
+                };
+            },
+            [&](const ParsedURL::Authority & auth) {
+                // Endpoint is just an authority (hostname/port)
+                std::vector<std::string> path{""};
+                path.push_back(bucket);
+                path.insert(path.end(), key.begin(), key.end());
+                return ParsedURL{
+                    .scheme = std::string{schemeStr},
+                    .authority = auth,
+                    .path = std::move(path),
+                };
+            },
+            [&](const ParsedURL & endpointUrl) {
+                // Endpoint is already a ParsedURL (e.g., http://server:9000)
+                auto path = endpointUrl.path;
+                path.push_back(bucket);
+                path.insert(path.end(), key.begin(), key.end());
+                return ParsedURL{
+                    .scheme = endpointUrl.scheme,
+                    .authority = endpointUrl.authority,
+                    .path = std::move(path),
+                };
+            },
+        },
+        endpoint);
+}
+
+#endif
+
+} // namespace nix
diff --git a/src/libstore/serve-protocol-connection.cc b/src/libstore/serve-protocol-connection.cc
index 276086f6f..a90b104a6 100644
--- a/src/libstore/serve-protocol-connection.cc
+++ b/src/libstore/serve-protocol-connection.cc
@@ -15,7 +15,7 @@ ServeProto::Version ServeProto::BasicClientConnection::handshake(
     if (magic != SERVE_MAGIC_2)
         throw Error("'nix-store --serve' protocol mismatch from '%s'", host);
     auto remoteVersion = readInt(from);
-    if (GET_PROTOCOL_MAJOR(remoteVersion) != 0x200)
+    if (GET_PROTOCOL_MAJOR(remoteVersion) != 0x200 || GET_PROTOCOL_MINOR(remoteVersion) < 5)
         throw Error("unsupported 'nix-store --serve' protocol version on '%s'", host);
     return std::min(remoteVersion, localVersion);
 }
@@ -93,14 +93,4 @@ void ServeProto::BasicClientConnection::narFromPath(
     fun(from);
 }
 
-void ServeProto::BasicClientConnection::importPaths(const StoreDirConfig & store, std::function<void(Sink &)> fun)
-{
-    to << ServeProto::Command::ImportPaths;
-    fun(to);
-    to.flush();
-
-    if (readInt(from) != 1)
-        throw Error("remote machine failed to import closure");
-}
-
-}
+} // namespace nix
diff --git a/src/libstore/serve-protocol.cc b/src/libstore/serve-protocol.cc
index 520c37951..7cf5e6997 100644
--- a/src/libstore/serve-protocol.cc
+++ b/src/libstore/serve-protocol.cc
@@ -20,33 +20,22 @@ BuildResult ServeProto::Serialise<BuildResult>::read(const StoreDirConfig & stor
     conn.from >> status.errorMsg;
 
     if (GET_PROTOCOL_MINOR(conn.version) >= 3)
-        conn.from
-            >> status.timesBuilt
-            >> status.isNonDeterministic
-            >> status.startTime
-            >> status.stopTime;
+        conn.from >> status.timesBuilt >> status.isNonDeterministic >> status.startTime >> status.stopTime;
     if (GET_PROTOCOL_MINOR(conn.version) >= 6) {
         auto builtOutputs = ServeProto::Serialise<DrvOutputs>::read(store, conn);
         for (auto && [output, realisation] : builtOutputs)
-            status.builtOutputs.insert_or_assign(
-                std::move(output.outputName),
-                std::move(realisation));
+            status.builtOutputs.insert_or_assign(std::move(output.outputName), std::move(realisation));
     }
     return status;
 }
 
-void ServeProto::Serialise<BuildResult>::write(const StoreDirConfig & store, ServeProto::WriteConn conn, const BuildResult & status)
+void ServeProto::Serialise<BuildResult>::write(
+    const StoreDirConfig & store, ServeProto::WriteConn conn, const BuildResult & status)
 {
-    conn.to
-        << status.status
-        << status.errorMsg;
+    conn.to << status.status << status.errorMsg;
 
     if (GET_PROTOCOL_MINOR(conn.version) >= 3)
-        conn.to
-            << status.timesBuilt
-            << status.isNonDeterministic
-            << status.startTime
-            << status.stopTime;
+        conn.to << status.timesBuilt << status.isNonDeterministic << status.startTime << status.stopTime;
     if (GET_PROTOCOL_MINOR(conn.version) >= 6) {
         DrvOutputs builtOutputs;
         for (auto & [output, realisation] : status.builtOutputs)
@@ -55,12 +44,11 @@ void ServeProto::Serialise<BuildResult>::write(const StoreDirConfig & store, Ser
     }
 }
 
-
 UnkeyedValidPathInfo ServeProto::Serialise<UnkeyedValidPathInfo>::read(const StoreDirConfig & store, ReadConn conn)
 {
     /* Hash should be set below unless very old `nix-store --serve`.
        Caller should assert that it did set it. */
-    UnkeyedValidPathInfo info { Hash::dummy };
+    UnkeyedValidPathInfo info{Hash::dummy};
 
     auto deriver = readString(conn.from);
     if (deriver != "")
@@ -81,25 +69,21 @@ UnkeyedValidPathInfo ServeProto::Serialise<UnkeyedValidPathInfo>::read(const Sto
     return info;
 }
 
-void ServeProto::Serialise<UnkeyedValidPathInfo>::write(const StoreDirConfig & store, WriteConn conn, const UnkeyedValidPathInfo & info)
+void ServeProto::Serialise<UnkeyedValidPathInfo>::write(
+    const StoreDirConfig & store, WriteConn conn, const UnkeyedValidPathInfo & info)
 {
-    conn.to
-        << (info.deriver ? store.printStorePath(*info.deriver) : "");
+    conn.to << (info.deriver ? store.printStorePath(*info.deriver) : "");
 
     ServeProto::write(store, conn, info.references);
     // !!! Maybe we want compression?
-    conn.to
-        << info.narSize // downloadSize, lie a little
-        << info.narSize;
+    conn.to << info.narSize // downloadSize, lie a little
+            << info.narSize;
     if (GET_PROTOCOL_MINOR(conn.version) >= 4)
-        conn.to
-            << info.narHash.to_string(HashFormat::Nix32, true)
-            << renderContentAddress(info.ca)
-            << info.sigs;
+        conn.to << info.narHash.to_string(HashFormat::Nix32, true) << renderContentAddress(info.ca) << info.sigs;
 }
 
-
-ServeProto::BuildOptions ServeProto::Serialise<ServeProto::BuildOptions>::read(const StoreDirConfig & store, ReadConn conn)
+ServeProto::BuildOptions
+ServeProto::Serialise<ServeProto::BuildOptions>::read(const StoreDirConfig & store, ReadConn conn)
 {
     BuildOptions options;
     options.maxSilentTime = readInt(conn.from);
@@ -116,22 +100,18 @@ ServeProto::BuildOptions ServeProto::Serialise<ServeProto::BuildOptions>::read(c
     return options;
 }
 
-void ServeProto::Serialise<ServeProto::BuildOptions>::write(const StoreDirConfig & store, WriteConn conn, const ServeProto::BuildOptions & options)
+void ServeProto::Serialise<ServeProto::BuildOptions>::write(
+    const StoreDirConfig & store, WriteConn conn, const ServeProto::BuildOptions & options)
 {
-    conn.to
-        << options.maxSilentTime
-        << options.buildTimeout;
+    conn.to << options.maxSilentTime << options.buildTimeout;
     if (GET_PROTOCOL_MINOR(conn.version) >= 2)
-        conn.to
-            << options.maxLogSize;
+        conn.to << options.maxLogSize;
     if (GET_PROTOCOL_MINOR(conn.version) >= 3)
-        conn.to
-            << options.nrRepeats
-            << options.enforceDeterminism;
+        conn.to << options.nrRepeats << options.enforceDeterminism;
 
     if (GET_PROTOCOL_MINOR(conn.version) >= 7) {
         conn.to << ((int) options.keepFailed);
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/sqlite.cc b/src/libstore/sqlite.cc
index 55b967ed6..5f0b3ce51 100644
--- a/src/libstore/sqlite.cc
+++ b/src/libstore/sqlite.cc
@@ -4,6 +4,10 @@
 #include "nix/util/url.hh"
 #include "nix/util/signals.hh"
 
+#ifdef __linux__
+#  include <sys/vfs.h>
+#endif
+
 #include <sqlite3.h>
 
 #include <atomic>
@@ -11,11 +15,18 @@
 
 namespace nix {
 
-SQLiteError::SQLiteError(const char *path, const char *errMsg, int errNo, int extendedErrNo, int offset, HintFmt && hf)
-  : Error(""), path(path), errMsg(errMsg), errNo(errNo), extendedErrNo(extendedErrNo), offset(offset)
+SQLiteError::SQLiteError(
+    const char * path, const char * errMsg, int errNo, int extendedErrNo, int offset, HintFmt && hf)
+    : Error("")
+    , path(path)
+    , errMsg(errMsg)
+    , errNo(errNo)
+    , extendedErrNo(extendedErrNo)
+    , offset(offset)
 {
     auto offsetStr = (offset == -1) ? "" : "at offset " + std::to_string(offset) + ": ";
-    err.msg = HintFmt("%s: %s%s, %s (in '%s')",
+    err.msg = HintFmt(
+        "%s: %s%s, %s (in '%s')",
         Uncolored(hf.str()),
         offsetStr,
         sqlite3_errstr(extendedErrNo),
@@ -35,9 +46,7 @@ SQLiteError::SQLiteError(const char *path, const char *errMsg, int errNo, int ex
     if (err == SQLITE_BUSY || err == SQLITE_PROTOCOL) {
         auto exp = SQLiteBusy(path, errMsg, err, exterr, offset, std::move(hf));
         exp.err.msg = HintFmt(
-            err == SQLITE_PROTOCOL
-                ? "SQLite database '%s' is busy (SQLITE_PROTOCOL)"
-                : "SQLite database '%s' is busy",
+            err == SQLITE_PROTOCOL ? "SQLite database '%s' is busy (SQLITE_PROTOCOL)" : "SQLite database '%s' is busy",
             path ? path : "(in-memory)");
         throw exp;
     } else
@@ -53,16 +62,39 @@ static void traceSQL(void * x, const char * sql)
     notice("SQL<[%1%]>", sql);
 };
 
-SQLite::SQLite(const Path & path, SQLiteOpenMode mode)
+SQLite::SQLite(const std::filesystem::path & path, SQLiteOpenMode mode)
 {
+    // Work around a ZFS issue where SQLite's truncate() call on
+    // db.sqlite-shm can randomly take up to a few seconds. See
+    // https://github.com/openzfs/zfs/issues/14290#issuecomment-3074672917.
+    // Remove this workaround when a fix is widely installed, perhaps 2027? Candidate:
+    // https://github.com/search?q=repo%3Aopenzfs%2Fzfs+%22Linux%3A+zfs_putpage%3A+complete+async+page+writeback+immediately%22&type=commits
+#ifdef __linux__
+    try {
+        auto shmFile = path;
+        shmFile += "-shm";
+        AutoCloseFD fd = open(shmFile.string().c_str(), O_RDWR | O_CLOEXEC);
+        if (fd) {
+            struct statfs fs;
+            if (fstatfs(fd.get(), &fs))
+                throw SysError("statfs() on '%s'", shmFile);
+            if (fs.f_type == /* ZFS_SUPER_MAGIC */ 801189825 && fdatasync(fd.get()) != 0)
+                throw SysError("fsync() on '%s'", shmFile);
+        }
+    } catch (...) {
+        throw;
+    }
+#endif
+
     // useSQLiteWAL also indicates what virtual file system we need.  Using
     // `unix-dotfile` is needed on NFS file systems and on Windows' Subsystem
     // for Linux (WSL) where useSQLiteWAL should be false by default.
-    const char *vfs = settings.useSQLiteWAL ? 0 : "unix-dotfile";
+    const char * vfs = settings.useSQLiteWAL ? 0 : "unix-dotfile";
     bool immutable = mode == SQLiteOpenMode::Immutable;
     int flags = immutable ? SQLITE_OPEN_READONLY : SQLITE_OPEN_READWRITE;
-    if (mode == SQLiteOpenMode::Normal) flags |= SQLITE_OPEN_CREATE;
-    auto uri = "file:" + percentEncode(path) + "?immutable=" + (immutable ? "1" : "0");
+    if (mode == SQLiteOpenMode::Normal)
+        flags |= SQLITE_OPEN_CREATE;
+    auto uri = "file:" + percentEncode(path.string()) + "?immutable=" + (immutable ? "1" : "0");
     int ret = sqlite3_open_v2(uri.c_str(), &db, SQLITE_OPEN_URI | flags, vfs);
     if (ret != SQLITE_OK) {
         const char * err = sqlite3_errstr(ret);
@@ -93,7 +125,7 @@ SQLite::~SQLite()
 void SQLite::isCache()
 {
     exec("pragma synchronous = off");
-    exec("pragma main.journal_mode = truncate");
+    exec("pragma main.journal_mode = wal");
 }
 
 void SQLite::exec(const std::string & stmt)
@@ -143,7 +175,7 @@ SQLiteStmt::Use::~Use()
     sqlite3_reset(stmt);
 }
 
-SQLiteStmt::Use & SQLiteStmt::Use::operator () (std::string_view value, bool notNull)
+SQLiteStmt::Use & SQLiteStmt::Use::operator()(std::string_view value, bool notNull)
 {
     if (notNull) {
         if (sqlite3_bind_text(stmt, curArg++, value.data(), -1, SQLITE_TRANSIENT) != SQLITE_OK)
@@ -153,7 +185,7 @@ SQLiteStmt::Use & SQLiteStmt::Use::operator () (std::string_view value, bool not
     return *this;
 }
 
-SQLiteStmt::Use & SQLiteStmt::Use::operator () (const unsigned char * data, size_t len, bool notNull)
+SQLiteStmt::Use & SQLiteStmt::Use::operator()(const unsigned char * data, size_t len, bool notNull)
 {
     if (notNull) {
         if (sqlite3_bind_blob(stmt, curArg++, data, len, SQLITE_TRANSIENT) != SQLITE_OK)
@@ -163,7 +195,7 @@ SQLiteStmt::Use & SQLiteStmt::Use::operator () (const unsigned char * data, size
     return *this;
 }
 
-SQLiteStmt::Use & SQLiteStmt::Use::operator () (int64_t value, bool notNull)
+SQLiteStmt::Use & SQLiteStmt::Use::operator()(int64_t value, bool notNull)
 {
     if (notNull) {
         if (sqlite3_bind_int64(stmt, curArg++, value) != SQLITE_OK)
@@ -249,16 +281,14 @@ void handleSQLiteBusy(const SQLiteBusy & e, time_t & nextWarning)
     time_t now = time(0);
     if (now > nextWarning) {
         nextWarning = now + 10;
-        logWarning({
-            .msg = HintFmt(e.what())
-        });
+        logWarning({.msg = e.info().msg});
     }
 
     /* Sleep for a while since retrying the transaction right away
        is likely to fail again. */
     checkInterrupt();
     /* <= 0.1s */
-    std::this_thread::sleep_for(std::chrono::milliseconds { rand() % 100 });
+    std::this_thread::sleep_for(std::chrono::milliseconds{rand() % 100});
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/ssh-store.cc b/src/libstore/ssh-store.cc
index 6992ae774..dafe14fea 100644
--- a/src/libstore/ssh-store.cc
+++ b/src/libstore/ssh-store.cc
@@ -11,24 +11,31 @@
 
 namespace nix {
 
-SSHStoreConfig::SSHStoreConfig(
-    std::string_view scheme,
-    std::string_view authority,
-    const Params & params)
+SSHStoreConfig::SSHStoreConfig(std::string_view scheme, std::string_view authority, const Params & params)
     : Store::Config{params}
     , RemoteStore::Config{params}
     , CommonSSHStoreConfig{scheme, authority, params}
 {
 }
 
-
 std::string SSHStoreConfig::doc()
 {
     return
-      #include "ssh-store.md"
-      ;
+#include "ssh-store.md"
+        ;
 }
 
+StoreReference SSHStoreConfig::getReference() const
+{
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = *uriSchemes().begin(),
+                .authority = authority.to_string(),
+            },
+        .params = getQueryParams(),
+    };
+}
 
 struct SSHStore : virtual RemoteStore
 {
@@ -41,19 +48,16 @@ struct SSHStore : virtual RemoteStore
         , RemoteStore{*config}
         , config{config}
         , master(config->createSSHMaster(
-            // Use SSH master only if using more than 1 connection.
-            connections->capacity() > 1))
+              // Use SSH master only if using more than 1 connection.
+              connections->capacity() > 1))
     {
     }
 
-    std::string getUri() override
-    {
-        return *Config::uriSchemes().begin() + "://" + host;
-    }
-
     // FIXME extend daemon protocol, move implementation to RemoteStore
     std::optional<std::string> getBuildLogExact(const StorePath & path) override
-    { unsupported("getBuildLogExact"); }
+    {
+        unsupported("getBuildLogExact");
+    }
 
 protected:
 
@@ -69,14 +73,11 @@ protected:
 
     ref<RemoteStore::Connection> openConnection() override;
 
-    std::string host;
-
     std::vector<std::string> extraRemoteProgramArgs;
 
     SSHMaster master;
 
-    void setOptions(RemoteStore::Connection & conn) override
-    {
+    void setOptions(RemoteStore::Connection & conn) override {
         /* TODO Add a way to explicitly ask for some options to be
            forwarded. One option: A way to query the daemon for its
            settings, and then a series of params to SSHStore like
@@ -86,7 +87,6 @@ protected:
     };
 };
 
-
 MountedSSHStoreConfig::MountedSSHStoreConfig(StringMap params)
     : StoreConfig(params)
     , RemoteStoreConfig(params)
@@ -108,11 +108,10 @@ MountedSSHStoreConfig::MountedSSHStoreConfig(std::string_view scheme, std::strin
 std::string MountedSSHStoreConfig::doc()
 {
     return
-      #include "mounted-ssh-store.md"
-      ;
+#include "mounted-ssh-store.md"
+        ;
 }
 
-
 /**
  * The mounted ssh store assumes that filesystems on the remote host are
  * shared with the local host. This means that the remote nix store is
@@ -183,18 +182,16 @@ struct MountedSSHStore : virtual SSHStore, virtual LocalFSStore
     }
 };
 
-
-ref<Store> SSHStore::Config::openStore() const {
+ref<Store> SSHStore::Config::openStore() const
+{
     return make_ref<SSHStore>(ref{shared_from_this()});
 }
 
-ref<Store> MountedSSHStore::Config::openStore() const {
-    return make_ref<MountedSSHStore>(ref{
-        std::dynamic_pointer_cast<const MountedSSHStore::Config>(shared_from_this())
-    });
+ref<Store> MountedSSHStore::Config::openStore() const
+{
+    return make_ref<MountedSSHStore>(ref{std::dynamic_pointer_cast<const MountedSSHStore::Config>(shared_from_this())});
 }
 
-
 ref<RemoteStore::Connection> SSHStore::openConnection()
 {
     auto conn = make_ref<Connection>();
@@ -204,8 +201,7 @@ ref<RemoteStore::Connection> SSHStore::openConnection()
         command.push_back("--store");
         command.push_back(config->remoteStore.get());
     }
-    command.insert(command.end(),
-        extraRemoteProgramArgs.begin(), extraRemoteProgramArgs.end());
+    command.insert(command.end(), extraRemoteProgramArgs.begin(), extraRemoteProgramArgs.end());
     conn->sshConn = master.startCommand(std::move(command));
     conn->to = FdSink(conn->sshConn->in.get());
     conn->from = FdSource(conn->sshConn->out.get());
@@ -215,4 +211,4 @@ ref<RemoteStore::Connection> SSHStore::openConnection()
 static RegisterStoreImplementation<SSHStore::Config> regSSHStore;
 static RegisterStoreImplementation<MountedSSHStore::Config> regMountedSSHStore;
 
-}
+} // namespace nix
diff --git a/src/libstore/ssh-store.md b/src/libstore/ssh-store.md
index 881537e71..26e0d6e39 100644
--- a/src/libstore/ssh-store.md
+++ b/src/libstore/ssh-store.md
@@ -1,6 +1,6 @@
 R"(
 
-**Store URL format**: `ssh-ng://[username@]hostname`
+**Store URL format**: `ssh-ng://[username@]hostname[:port]`
 
 Experimental store type that allows full access to a Nix store on a
 remote machine.
diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index c8fec5244..0f1dba1e9 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -4,66 +4,109 @@
 #include "nix/util/environment-variables.hh"
 #include "nix/util/util.hh"
 #include "nix/util/exec.hh"
+#include "nix/util/base-n.hh"
 
 namespace nix {
 
 static std::string parsePublicHostKey(std::string_view host, std::string_view sshPublicHostKey)
 {
     try {
-        return base64Decode(sshPublicHostKey);
+        return base64::decode(sshPublicHostKey);
     } catch (Error & e) {
         e.addTrace({}, "while decoding ssh public host key for host '%s'", host);
         throw;
     }
 }
 
-SSHMaster::SSHMaster(
-    std::string_view host,
-    std::string_view keyFile,
-    std::string_view sshPublicHostKey,
-    bool useMaster, bool compress, Descriptor logFD)
-    : host(host)
-    , fakeSSH(host == "localhost")
-    , keyFile(keyFile)
-    , sshPublicHostKey(parsePublicHostKey(host, sshPublicHostKey))
-    , useMaster(useMaster && !fakeSSH)
-    , compress(compress)
-    , logFD(logFD)
+class InvalidSSHAuthority : public Error
 {
-    if (host == "" || hasPrefix(host, "-"))
-        throw Error("invalid SSH host name '%s'", host);
+public:
+    InvalidSSHAuthority(const ParsedURL::Authority & authority, std::string_view reason)
+        : Error("invalid SSH authority: '%s': %s", authority.to_string(), reason)
+    {
+    }
+};
 
-    auto state(state_.lock());
-    state->tmpDir = std::make_unique<AutoDelete>(createTempDir("", "nix", 0700));
+/**
+ * Checks if the hostname/username are valid for use with ssh.
+ *
+ * @todo Enforce this better. Probably this needs to reimplement the same logic as in
+ * https://github.com/openssh/openssh-portable/blob/6ebd472c391a73574abe02771712d407c48e130d/ssh.c#L648-L681
+ */
+static void checkValidAuthority(const ParsedURL::Authority & authority)
+{
+    if (const auto & user = authority.user) {
+        if (user->empty())
+            throw InvalidSSHAuthority(authority, "user name must not be empty");
+        if (user->starts_with("-"))
+            throw InvalidSSHAuthority(authority, fmt("user name '%s' must not start with '-'", *user));
+    }
+
+    {
+        std::string_view host = authority.host;
+        if (host.empty())
+            throw InvalidSSHAuthority(authority, "host name must not be empty");
+        if (host.starts_with("-"))
+            throw InvalidSSHAuthority(authority, fmt("host name '%s' must not start with '-'", host));
+    }
 }
 
-void SSHMaster::addCommonSSHOpts(Strings & args)
+Strings getNixSshOpts()
 {
-    auto state(state_.lock());
-
     std::string sshOpts = getEnv("NIX_SSHOPTS").value_or("");
 
     try {
-        std::list<std::string> opts = shellSplitString(sshOpts);
-        for (auto & i : opts)
-            args.push_back(i);
+        return shellSplitString(sshOpts);
     } catch (Error & e) {
         e.addTrace({}, "while splitting NIX_SSHOPTS '%s'", sshOpts);
         throw;
     }
+}
+
+SSHMaster::SSHMaster(
+    const ParsedURL::Authority & authority,
+    std::string_view keyFile,
+    std::string_view sshPublicHostKey,
+    bool useMaster,
+    bool compress,
+    Descriptor logFD)
+    : authority(authority)
+    , hostnameAndUser([authority]() {
+        std::ostringstream oss;
+        if (authority.user)
+            oss << *authority.user << "@";
+        oss << authority.host;
+        return std::move(oss).str();
+    }())
+    , fakeSSH(authority.host == "localhost")
+    , keyFile(keyFile)
+    , sshPublicHostKey(parsePublicHostKey(authority.host, sshPublicHostKey))
+    , useMaster(useMaster && !fakeSSH)
+    , compress(compress)
+    , logFD(logFD)
+    , tmpDir(make_ref<AutoDelete>(createTempDir("", "nix", 0700)))
+{
+    checkValidAuthority(authority);
+}
+
+void SSHMaster::addCommonSSHOpts(Strings & args)
+{
+    auto sshArgs = getNixSshOpts();
+    args.insert(args.end(), sshArgs.begin(), sshArgs.end());
 
     if (!keyFile.empty())
         args.insert(args.end(), {"-i", keyFile});
     if (!sshPublicHostKey.empty()) {
-        std::filesystem::path fileName = state->tmpDir->path() / "host-key";
-        auto p = host.rfind("@");
-        std::string thost = p != std::string::npos ? std::string(host, p + 1) : host;
-        writeFile(fileName.string(), thost + " " + sshPublicHostKey + "\n");
+        std::filesystem::path fileName = tmpDir->path() / "host-key";
+        writeFile(fileName.string(), authority.host + " " + sshPublicHostKey + "\n");
         args.insert(args.end(), {"-oUserKnownHostsFile=" + fileName.string()});
     }
     if (compress)
         args.push_back("-C");
 
+    if (authority.port)
+        args.push_back(fmt("-p%d", *authority.port));
+
     // We use this to make ssh signal back to us that the connection is established.
     // It really does run locally; see createSSHEnv which sets up SHELL to make
     // it launch more reliably. The local command runs synchronously, so presumably
@@ -72,11 +115,12 @@ void SSHMaster::addCommonSSHOpts(Strings & args)
     args.push_back("-oLocalCommand=echo started");
 }
 
-bool SSHMaster::isMasterRunning() {
-    Strings args = {"-O", "check", host};
+bool SSHMaster::isMasterRunning()
+{
+    Strings args = {"-O", "check", hostnameAndUser};
     addCommonSSHOpts(args);
 
-    auto res = runProgram(RunOptions {.program = "ssh", .args = args, .mergeStderrToStdout = true});
+    auto res = runProgram(RunOptions{.program = "ssh", .args = args, .mergeStderrToStdout = true});
     return res.first == 0;
 }
 
@@ -101,8 +145,7 @@ Strings createSSHEnv()
     return r;
 }
 
-std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
-    Strings && command, Strings && extraSshArgs)
+std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(Strings && command, Strings && extraSshArgs)
 {
 #ifdef _WIN32 // TODO re-enable on Windows, once we can start processes.
     throw UnimplementedError("cannot yet SSH on windows because spawning processes is not yet implemented");
@@ -122,40 +165,41 @@ std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
         loggerSuspension = std::make_unique<Logger::Suspension>(logger->suspend());
     }
 
-    conn->sshPid = startProcess([&]() {
-        restoreProcessContext();
+    conn->sshPid = startProcess(
+        [&]() {
+            restoreProcessContext();
 
-        close(in.writeSide.get());
-        close(out.readSide.get());
+            close(in.writeSide.get());
+            close(out.readSide.get());
 
-        if (dup2(in.readSide.get(), STDIN_FILENO) == -1)
-            throw SysError("duping over stdin");
-        if (dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
-            throw SysError("duping over stdout");
-        if (logFD != -1 && dup2(logFD, STDERR_FILENO) == -1)
-            throw SysError("duping over stderr");
+            if (dup2(in.readSide.get(), STDIN_FILENO) == -1)
+                throw SysError("duping over stdin");
+            if (dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
+                throw SysError("duping over stdout");
+            if (logFD != -1 && dup2(logFD, STDERR_FILENO) == -1)
+                throw SysError("duping over stderr");
 
-        Strings args;
+            Strings args;
 
-        if (!fakeSSH) {
-            args = { "ssh", host.c_str(), "-x" };
-            addCommonSSHOpts(args);
-            if (socketPath != "")
-                args.insert(args.end(), {"-S", socketPath});
-            if (verbosity >= lvlChatty)
-                args.push_back("-v");
-            args.splice(args.end(), std::move(extraSshArgs));
-            args.push_back("--");
-        }
+            if (!fakeSSH) {
+                args = {"ssh", hostnameAndUser.c_str(), "-x"};
+                addCommonSSHOpts(args);
+                if (socketPath != "")
+                    args.insert(args.end(), {"-S", socketPath});
+                if (verbosity >= lvlChatty)
+                    args.push_back("-v");
+                args.splice(args.end(), std::move(extraSshArgs));
+                args.push_back("--");
+            }
 
-        args.splice(args.end(), std::move(command));
-        auto env = createSSHEnv();
-        nix::execvpe(args.begin()->c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(env).data());
-
-        // could not exec ssh/bash
-        throw SysError("unable to execute '%s'", args.front());
-    }, options);
+            args.splice(args.end(), std::move(command));
+            auto env = createSSHEnv();
+            nix::execvpe(args.begin()->c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(env).data());
 
+            // could not exec ssh/bash
+            throw SysError("unable to execute '%s'", args.front());
+        },
+        options);
 
     in.readSide = INVALID_DESCRIPTOR;
     out.writeSide = INVALID_DESCRIPTOR;
@@ -166,11 +210,12 @@ std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
         std::string reply;
         try {
             reply = readLine(out.readSide.get());
-        } catch (EndOfFile & e) { }
+        } catch (EndOfFile & e) {
+        }
 
         if (reply != "started") {
             printTalkative("SSH stdout first line: %s", reply);
-            throw Error("failed to start SSH connection to '%s'", host);
+            throw Error("failed to start SSH connection to '%s'", authority.host);
         }
     }
 
@@ -185,13 +230,15 @@ std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
 
 Path SSHMaster::startMaster()
 {
-    if (!useMaster) return "";
+    if (!useMaster)
+        return "";
 
     auto state(state_.lock());
 
-    if (state->sshMaster != INVALID_DESCRIPTOR) return state->socketPath;
+    if (state->sshMaster != INVALID_DESCRIPTOR)
+        return state->socketPath;
 
-    state->socketPath = (Path) *state->tmpDir + "/ssh.sock";
+    state->socketPath = (Path) *tmpDir + "/ssh.sock";
 
     Pipe out;
     out.create();
@@ -204,34 +251,37 @@ Path SSHMaster::startMaster()
     if (isMasterRunning())
         return state->socketPath;
 
-    state->sshMaster = startProcess([&]() {
-        restoreProcessContext();
+    state->sshMaster = startProcess(
+        [&]() {
+            restoreProcessContext();
 
-        close(out.readSide.get());
+            close(out.readSide.get());
 
-        if (dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
-            throw SysError("duping over stdout");
+            if (dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
+                throw SysError("duping over stdout");
 
-        Strings args = { "ssh", host.c_str(), "-M", "-N", "-S", state->socketPath };
-        if (verbosity >= lvlChatty)
-            args.push_back("-v");
-        addCommonSSHOpts(args);
-        auto env = createSSHEnv();
-        nix::execvpe(args.begin()->c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(env).data());
+            Strings args = {"ssh", hostnameAndUser.c_str(), "-M", "-N", "-S", state->socketPath};
+            if (verbosity >= lvlChatty)
+                args.push_back("-v");
+            addCommonSSHOpts(args);
+            auto env = createSSHEnv();
+            nix::execvpe(args.begin()->c_str(), stringsToCharPtrs(args).data(), stringsToCharPtrs(env).data());
 
-        throw SysError("unable to execute '%s'", args.front());
-    }, options);
+            throw SysError("unable to execute '%s'", args.front());
+        },
+        options);
 
     out.writeSide = INVALID_DESCRIPTOR;
 
     std::string reply;
     try {
         reply = readLine(out.readSide.get());
-    } catch (EndOfFile & e) { }
+    } catch (EndOfFile & e) {
+    }
 
     if (reply != "started") {
         printTalkative("SSH master stdout first line: %s", reply);
-        throw Error("failed to start SSH master connection to '%s'", host);
+        throw Error("failed to start SSH master connection to '%s'", authority.host);
     }
 
     return state->socketPath;
@@ -254,4 +304,4 @@ void SSHMaster::Connection::trySetBufferSize(size_t size)
 #endif
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 9aeab1d1f..17748ec53 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -1,3 +1,4 @@
+#include "nix/util/logging.hh"
 #include "nix/util/signature/local-keys.hh"
 #include "nix/util/source-accessor.hh"
 #include "nix/store/globals.hh"
@@ -9,7 +10,6 @@
 #include "nix/util/util.hh"
 #include "nix/store/nar-info-disk-cache.hh"
 #include "nix/util/thread-pool.hh"
-#include "nix/util/references.hh"
 #include "nix/util/archive.hh"
 #include "nix/util/callback.hh"
 #include "nix/util/git.hh"
@@ -18,7 +18,6 @@
 // `addMultipleToStore`.
 #include "nix/store/worker-protocol.hh"
 #include "nix/util/signals.hh"
-#include "nix/util/users.hh"
 
 #include <filesystem>
 #include <nlohmann/json.hpp>
@@ -29,14 +28,23 @@ using json = nlohmann::json;
 
 namespace nix {
 
+Path StoreConfigBase::getDefaultNixStoreDir()
+{
+    return settings.nixStore;
+}
 
-bool MixStoreDirMethods::isInStore(PathView path) const
+StoreConfig::StoreConfig(const Params & params)
+    : StoreConfigBase(params)
+    , StoreDirConfig{storeDir_}
+{
+}
+
+bool StoreDirConfig::isInStore(PathView path) const
 {
     return isInDir(path, storeDir);
 }
 
-
-std::pair<StorePath, Path> MixStoreDirMethods::toStorePath(PathView path) const
+std::pair<StorePath, Path> StoreDirConfig::toStorePath(PathView path) const
 {
     if (!isInStore(path))
         throw Error("path '%1%' is not in the Nix store", path);
@@ -47,12 +55,12 @@ std::pair<StorePath, Path> MixStoreDirMethods::toStorePath(PathView path) const
         return {parseStorePath(path.substr(0, slash)), (Path) path.substr(slash)};
 }
 
-
 Path Store::followLinksToStore(std::string_view _path) const
 {
     Path path = absPath(std::string(_path));
     while (!isInStore(path)) {
-        if (!std::filesystem::is_symlink(path)) break;
+        if (!std::filesystem::is_symlink(path))
+            break;
         auto target = readLink(path);
         path = absPath(target, dirOf(path));
     }
@@ -61,134 +69,11 @@ Path Store::followLinksToStore(std::string_view _path) const
     return path;
 }
 
-
 StorePath Store::followLinksToStorePath(std::string_view path) const
 {
     return toStorePath(followLinksToStore(path)).first;
 }
 
-
-/*
-The exact specification of store paths is in `protocols/store-path.md`
-in the Nix manual. These few functions implement that specification.
-
-If changes to these functions go beyond mere implementation changes i.e.
-also update the user-visible behavior, please update the specification
-to match.
-*/
-
-
-StorePath MixStoreDirMethods::makeStorePath(std::string_view type,
-    std::string_view hash, std::string_view name) const
-{
-    /* e.g., "source:sha256:1abc...:/nix/store:foo.tar.gz" */
-    auto s = std::string(type) + ":" + std::string(hash)
-        + ":" + storeDir + ":" + std::string(name);
-    auto h = compressHash(hashString(HashAlgorithm::SHA256, s), 20);
-    return StorePath(h, name);
-}
-
-
-StorePath MixStoreDirMethods::makeStorePath(std::string_view type,
-    const Hash & hash, std::string_view name) const
-{
-    return makeStorePath(type, hash.to_string(HashFormat::Base16, true), name);
-}
-
-
-StorePath MixStoreDirMethods::makeOutputPath(std::string_view id,
-    const Hash & hash, std::string_view name) const
-{
-    return makeStorePath("output:" + std::string { id }, hash, outputPathName(name, id));
-}
-
-
-/* Stuff the references (if any) into the type.  This is a bit
-   hacky, but we can't put them in, say, <s2> (per the grammar above)
-   since that would be ambiguous. */
-static std::string makeType(
-    const MixStoreDirMethods & store,
-    std::string && type,
-    const StoreReferences & references)
-{
-    for (auto & i : references.others) {
-        type += ":";
-        type += store.printStorePath(i);
-    }
-    if (references.self) type += ":self";
-    return std::move(type);
-}
-
-
-StorePath MixStoreDirMethods::makeFixedOutputPath(std::string_view name, const FixedOutputInfo & info) const
-{
-    if (info.method == FileIngestionMethod::Git && info.hash.algo != HashAlgorithm::SHA1)
-        throw Error("Git file ingestion must use SHA-1 hash");
-
-    if (info.hash.algo == HashAlgorithm::SHA256 && info.method == FileIngestionMethod::NixArchive) {
-        return makeStorePath(makeType(*this, "source", info.references), info.hash, name);
-    } else {
-        if (!info.references.empty()) {
-            throw Error("fixed output derivation '%s' is not allowed to refer to other store paths.\nYou may need to use the 'unsafeDiscardReferences' derivation attribute, see the manual for more details.",
-                name);
-        }
-        // make a unique digest based on the parameters for creating this store object
-        auto payload = "fixed:out:"
-                + makeFileIngestionPrefix(info.method)
-                + info.hash.to_string(HashFormat::Base16, true) + ":";
-        auto digest = hashString(HashAlgorithm::SHA256, payload);
-        return makeStorePath("output:out", digest, name);
-    }
-}
-
-
-StorePath MixStoreDirMethods::makeFixedOutputPathFromCA(std::string_view name, const ContentAddressWithReferences & ca) const
-{
-    // New template
-    return std::visit(overloaded {
-        [&](const TextInfo & ti) {
-            assert(ti.hash.algo == HashAlgorithm::SHA256);
-            return makeStorePath(
-                makeType(*this, "text", StoreReferences {
-                    .others = ti.references,
-                    .self = false,
-                }),
-                ti.hash,
-                name);
-        },
-        [&](const FixedOutputInfo & foi) {
-            return makeFixedOutputPath(name, foi);
-        }
-    }, ca.raw);
-}
-
-
-std::pair<StorePath, Hash> MixStoreDirMethods::computeStorePath(
-    std::string_view name,
-    const SourcePath & path,
-    ContentAddressMethod method,
-    HashAlgorithm hashAlgo,
-    const StorePathSet & references,
-    PathFilter & filter) const
-{
-    auto [h, size] = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
-    if (settings.warnLargePathThreshold && size && *size >= settings.warnLargePathThreshold)
-        warn("hashed large path '%s' (%s)", path, renderSize(*size));
-    return {
-        makeFixedOutputPathFromCA(
-            name,
-            ContentAddressWithReferences::fromParts(
-                method,
-                h,
-                {
-                    .others = references,
-                    .self = false,
-                })),
-        h,
-    };
-}
-
-
 StorePath Store::addToStore(
     std::string_view name,
     const SourcePath & path,
@@ -223,11 +108,7 @@ StorePath Store::addToStore(
     return storePath.value();
 }
 
-void Store::addMultipleToStore(
-    PathsSource && pathsToCopy,
-    Activity & act,
-    RepairFlag repair,
-    CheckSigsFlag checkSigs)
+void Store::addMultipleToStore(PathsSource && pathsToCopy, Activity & act, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     std::atomic<size_t> nrDone{0};
     std::atomic<size_t> nrFailed{0};
@@ -247,15 +128,12 @@ void Store::addMultipleToStore(
 
     act.setExpected(actCopyPath, bytesExpected);
 
-    auto showProgress = [&, nrTotal = pathsToCopy.size()]() {
-        act.progress(nrDone, nrTotal, nrRunning, nrFailed);
-    };
+    auto showProgress = [&, nrTotal = pathsToCopy.size()]() { act.progress(nrDone, nrTotal, nrRunning, nrFailed); };
 
     processGraph<StorePath>(
         storePathsToAdd,
 
         [&](const StorePath & path) {
-
             auto & [info, _] = *infosMap.at(path);
 
             if (isValidPath(info.path)) {
@@ -301,17 +179,15 @@ void Store::addMultipleToStore(
         });
 }
 
-void Store::addMultipleToStore(
-    Source & source,
-    RepairFlag repair,
-    CheckSigsFlag checkSigs)
+void Store::addMultipleToStore(Source & source, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     auto expected = readNum<uint64_t>(source);
     for (uint64_t i = 0; i < expected; ++i) {
         // FIXME we should not be using the worker protocol here, let
         // alone the worker protocol with a hard-coded version!
-        auto info = WorkerProto::Serialise<ValidPathInfo>::read(*this,
-            WorkerProto::ReadConn {
+        auto info = WorkerProto::Serialise<ValidPathInfo>::read(
+            *this,
+            WorkerProto::ReadConn{
                 .from = source,
                 .version = 16,
             });
@@ -320,7 +196,6 @@ void Store::addMultipleToStore(
     }
 }
 
-
 /*
 The aim of this function is to compute in one pass the correct ValidPathInfo for
 the files that we are trying to add to the store. To accomplish that in one
@@ -347,38 +222,37 @@ digraph graphname {
 ValidPathInfo Store::addToStoreSlow(
     std::string_view name,
     const SourcePath & srcPath,
-    ContentAddressMethod method, HashAlgorithm hashAlgo,
+    ContentAddressMethod method,
+    HashAlgorithm hashAlgo,
     const StorePathSet & references,
     std::optional<Hash> expectedCAHash)
 {
-    HashSink narHashSink { HashAlgorithm::SHA256 };
-    HashSink caHashSink { hashAlgo };
+    HashSink narHashSink{HashAlgorithm::SHA256};
+    HashSink caHashSink{hashAlgo};
 
     /* Note that fileSink and unusualHashTee must be mutually exclusive, since
        they both write to caHashSink. Note that that requisite is currently true
        because the former is only used in the flat case. */
-    RegularFileSink fileSink { caHashSink };
-    TeeSink unusualHashTee { narHashSink, caHashSink };
+    RegularFileSink fileSink{caHashSink};
+    TeeSink unusualHashTee{narHashSink, caHashSink};
 
     auto & narSink = method == ContentAddressMethod::Raw::NixArchive && hashAlgo != HashAlgorithm::SHA256
-        ? static_cast<Sink &>(unusualHashTee)
-        : narHashSink;
+                         ? static_cast<Sink &>(unusualHashTee)
+                         : narHashSink;
 
     /* Functionally, this means that fileSource will yield the content of
        srcPath. The fact that we use scratchpadSink as a temporary buffer here
        is an implementation detail. */
-    auto fileSource = sinkToSource([&](Sink & scratchpadSink) {
-        srcPath.dumpPath(scratchpadSink);
-    });
+    auto fileSource = sinkToSource([&](Sink & scratchpadSink) { srcPath.dumpPath(scratchpadSink); });
 
     /* tapped provides the same data as fileSource, but we also write all the
        information to narSink. */
-    TeeSource tapped { *fileSource, narSink };
+    TeeSource tapped{*fileSource, narSink};
 
     NullFileSystemObjectSink blank;
     auto & parseSink = method.getFileIngestionMethod() == FileIngestionMethod::Flat
-        ? (FileSystemObjectSink &) fileSink
-        : (FileSystemObjectSink &) blank; // for recursive or git we do recursive
+                           ? (FileSystemObjectSink &) fileSink
+                           : (FileSystemObjectSink &) blank; // for recursive or git we do recursive
 
     /* The information that flows from tapped (besides being replicated in
        narSink), is now put in parseSink. */
@@ -388,16 +262,14 @@ ValidPathInfo Store::addToStoreSlow(
        finish. */
     auto [narHash, narSize] = narHashSink.finish();
 
-    auto hash = method == ContentAddressMethod::Raw::NixArchive && hashAlgo == HashAlgorithm::SHA256
-        ? narHash
-        : method == ContentAddressMethod::Raw::Git
-        ? git::dumpHash(hashAlgo, srcPath).hash
-        : caHashSink.finish().first;
+    auto hash = method == ContentAddressMethod::Raw::NixArchive && hashAlgo == HashAlgorithm::SHA256 ? narHash
+                : method == ContentAddressMethod::Raw::Git ? git::dumpHash(hashAlgo, srcPath).hash
+                                                           : caHashSink.finish().hash;
 
     if (expectedCAHash && expectedCAHash != hash)
         throw Error("hash mismatch for '%s'", srcPath);
 
-    ValidPathInfo info {
+    auto info = ValidPathInfo::makeFromCA(
         *this,
         name,
         ContentAddressWithReferences::fromParts(
@@ -407,14 +279,11 @@ ValidPathInfo Store::addToStoreSlow(
                 .others = references,
                 .self = false,
             }),
-        narHash,
-    };
+        narHash);
     info.narSize = narSize;
 
     if (!isValidPath(info.path)) {
-        auto source = sinkToSource([&](Sink & scratchpadSink) {
-            srcPath.dumpPath(scratchpadSink);
-        });
+        auto source = sinkToSource([&](Sink & scratchpadSink) { srcPath.dumpPath(scratchpadSink); });
         addToStore(info, *source);
     }
 
@@ -435,28 +304,31 @@ StringSet Store::Config::getDefaultSystemFeatures()
 }
 
 Store::Store(const Store::Config & config)
-    : MixStoreDirMethods{config}
+    : StoreDirConfig{config}
     , config{config}
-    , state({(size_t) config.pathInfoCacheSize})
+    , pathInfoCache(make_ref<decltype(pathInfoCache)::element_type>((size_t) config.pathInfoCacheSize))
 {
     assertLibStoreInitialized();
 }
 
-
-std::string Store::getUri()
+StoreReference StoreConfig::getReference() const
 {
-    return "";
+    return {.variant = StoreReference::Auto{}};
 }
 
 bool Store::PathInfoCacheValue::isKnownNow()
 {
-    std::chrono::duration ttl = didExist()
-        ? std::chrono::seconds(settings.ttlPositiveNarInfoCache)
-        : std::chrono::seconds(settings.ttlNegativeNarInfoCache);
+    std::chrono::duration ttl = didExist() ? std::chrono::seconds(settings.ttlPositiveNarInfoCache)
+                                           : std::chrono::seconds(settings.ttlNegativeNarInfoCache);
 
     return std::chrono::steady_clock::now() < time_point + ttl;
 }
 
+void Store::invalidatePathInfoCacheFor(const StorePath & path)
+{
+    pathInfoCache->lock()->erase(path.to_string());
+}
+
 std::map<std::string, std::optional<StorePath>> Store::queryStaticPartialDerivationOutputMap(const StorePath & path)
 {
     std::map<std::string, std::optional<StorePath>> outputs;
@@ -467,9 +339,8 @@ std::map<std::string, std::optional<StorePath>> Store::queryStaticPartialDerivat
     return outputs;
 }
 
-std::map<std::string, std::optional<StorePath>> Store::queryPartialDerivationOutputMap(
-    const StorePath & path,
-    Store * evalStore_)
+std::map<std::string, std::optional<StorePath>>
+Store::queryPartialDerivationOutputMap(const StorePath & path, Store * evalStore_)
 {
     auto & evalStore = evalStore_ ? *evalStore_ : *this;
 
@@ -495,7 +366,8 @@ std::map<std::string, std::optional<StorePath>> Store::queryPartialDerivationOut
     return outputs;
 }
 
-OutputPathMap Store::queryDerivationOutputMap(const StorePath & path, Store * evalStore) {
+OutputPathMap Store::queryDerivationOutputMap(const StorePath & path, Store * evalStore)
+{
     auto resp = queryPartialDerivationOutputMap(path, evalStore);
     OutputPathMap result;
     for (auto & [outName, optOutPath] : resp) {
@@ -510,81 +382,93 @@ StorePathSet Store::queryDerivationOutputs(const StorePath & path)
 {
     auto outputMap = this->queryDerivationOutputMap(path);
     StorePathSet outputPaths;
-    for (auto & i: outputMap) {
+    for (auto & i : outputMap) {
         outputPaths.emplace(std::move(i.second));
     }
     return outputPaths;
 }
 
-
 void Store::querySubstitutablePathInfos(const StorePathCAMap & paths, SubstitutablePathInfos & infos)
 {
-    if (!settings.useSubstitutes) return;
-    for (auto & sub : getDefaultSubstituters()) {
-        for (auto & path : paths) {
-            if (infos.count(path.first))
-                // Choose first succeeding substituter.
-                continue;
+    if (!settings.useSubstitutes)
+        return;
+
+    for (auto & path : paths) {
+        std::optional<Error> lastStoresException = std::nullopt;
+        for (auto & sub : getDefaultSubstituters()) {
+            if (lastStoresException.has_value()) {
+                logError(lastStoresException->info());
+                lastStoresException.reset();
+            }
 
             auto subPath(path.first);
 
             // Recompute store path so that we can use a different store root.
             if (path.second) {
                 subPath = makeFixedOutputPathFromCA(
-                    path.first.name(),
-                    ContentAddressWithReferences::withoutRefs(*path.second));
+                    path.first.name(), ContentAddressWithReferences::withoutRefs(*path.second));
                 if (sub->storeDir == storeDir)
                     assert(subPath == path.first);
                 if (subPath != path.first)
-                    debug("replaced path '%s' with '%s' for substituter '%s'", printStorePath(path.first), sub->printStorePath(subPath), sub->getUri());
-            } else if (sub->storeDir != storeDir) continue;
+                    debug(
+                        "replaced path '%s' with '%s' for substituter '%s'",
+                        printStorePath(path.first),
+                        sub->printStorePath(subPath),
+                        sub->config.getHumanReadableURI());
+            } else if (sub->storeDir != storeDir)
+                continue;
 
-            debug("checking substituter '%s' for path '%s'", sub->getUri(), sub->printStorePath(subPath));
+            debug(
+                "checking substituter '%s' for path '%s'",
+                sub->config.getHumanReadableURI(),
+                sub->printStorePath(subPath));
             try {
                 auto info = sub->queryPathInfo(subPath);
 
                 if (sub->storeDir != storeDir && !(info->isContentAddressed(*sub) && info->references.empty()))
                     continue;
 
-                auto narInfo = std::dynamic_pointer_cast<const NarInfo>(
-                    std::shared_ptr<const ValidPathInfo>(info));
-                infos.insert_or_assign(path.first, SubstitutablePathInfo{
-                    .deriver = info->deriver,
-                    .references = info->references,
-                    .downloadSize = narInfo ? narInfo->fileSize : 0,
-                    .narSize = info->narSize,
-                });
+                auto narInfo = std::dynamic_pointer_cast<const NarInfo>(std::shared_ptr<const ValidPathInfo>(info));
+                infos.insert_or_assign(
+                    path.first,
+                    SubstitutablePathInfo{
+                        .deriver = info->deriver,
+                        .references = info->references,
+                        .downloadSize = narInfo ? narInfo->fileSize : 0,
+                        .narSize = info->narSize,
+                    });
             } catch (InvalidPath &) {
             } catch (SubstituterDisabled &) {
             } catch (Error & e) {
-                if (settings.tryFallback)
-                    logError(e.info());
-                else
-                    throw;
+                lastStoresException = std::make_optional(std::move(e));
             }
         }
+        if (lastStoresException.has_value()) {
+            if (!settings.tryFallback) {
+                throw *lastStoresException;
+            } else
+                logError(lastStoresException->info());
+        }
     }
 }
 
-
 bool Store::isValidPath(const StorePath & storePath)
 {
-    {
-        auto state_(state.lock());
-        auto res = state_->pathInfoCache.get(storePath.to_string());
-        if (res && res->isKnownNow()) {
-            stats.narInfoReadAverted++;
-            return res->didExist();
-        }
+    auto res = pathInfoCache->lock()->get(storePath.to_string());
+    if (res && res->isKnownNow()) {
+        stats.narInfoReadAverted++;
+        return res->didExist();
     }
 
     if (diskCache) {
-        auto res = diskCache->lookupNarInfo(getUri(), std::string(storePath.hashPart()));
+        auto res = diskCache->lookupNarInfo(
+            config.getReference().render(/*FIXME withParams=*/false), std::string(storePath.hashPart()));
         if (res.first != NarInfoDiskCache::oUnknown) {
             stats.narInfoReadAverted++;
-            auto state_(state.lock());
-            state_->pathInfoCache.upsert(storePath.to_string(),
-                res.first == NarInfoDiskCache::oInvalid ? PathInfoCacheValue{} : PathInfoCacheValue { .value = res.second });
+            pathInfoCache->lock()->upsert(
+                storePath.to_string(),
+                res.first == NarInfoDiskCache::oInvalid ? PathInfoCacheValue{}
+                                                        : PathInfoCacheValue{.value = res.second});
             return res.first == NarInfoDiskCache::oValid;
         }
     }
@@ -593,12 +477,12 @@ bool Store::isValidPath(const StorePath & storePath)
 
     if (diskCache && !valid)
         // FIXME: handle valid = true case.
-        diskCache->upsertNarInfo(getUri(), std::string(storePath.hashPart()), 0);
+        diskCache->upsertNarInfo(
+            config.getReference().render(/*FIXME withParams=*/false), std::string(storePath.hashPart()), 0);
 
     return valid;
 }
 
-
 /* Default implementation for stores that only implement
    queryPathInfoUncached(). */
 bool Store::isValidPathUncached(const StorePath & path)
@@ -611,59 +495,50 @@ bool Store::isValidPathUncached(const StorePath & path)
     }
 }
 
-
 ref<const ValidPathInfo> Store::queryPathInfo(const StorePath & storePath)
 {
     std::promise<ref<const ValidPathInfo>> promise;
 
-    queryPathInfo(storePath,
-        {[&](std::future<ref<const ValidPathInfo>> result) {
-            try {
-                promise.set_value(result.get());
-            } catch (...) {
-                promise.set_exception(std::current_exception());
-            }
-        }});
+    queryPathInfo(storePath, {[&](std::future<ref<const ValidPathInfo>> result) {
+                      try {
+                          promise.set_value(result.get());
+                      } catch (...) {
+                          promise.set_exception(std::current_exception());
+                      }
+                  }});
 
     return promise.get_future().get();
 }
 
-
 static bool goodStorePath(const StorePath & expected, const StorePath & actual)
 {
-    return
-        expected.hashPart() == actual.hashPart()
-        && (expected.name() == Store::MissingName || expected.name() == actual.name());
+    return expected.hashPart() == actual.hashPart()
+           && (expected.name() == Store::MissingName || expected.name() == actual.name());
 }
 
-
 std::optional<std::shared_ptr<const ValidPathInfo>> Store::queryPathInfoFromClientCache(const StorePath & storePath)
 {
     auto hashPart = std::string(storePath.hashPart());
 
-    {
-        auto res = state.lock()->pathInfoCache.get(storePath.to_string());
-        if (res && res->isKnownNow()) {
-            stats.narInfoReadAverted++;
-            if (res->didExist())
-                return std::make_optional(res->value);
-            else
-                return std::make_optional(nullptr);
-        }
+    auto res = pathInfoCache->lock()->get(storePath.to_string());
+    if (res && res->isKnownNow()) {
+        stats.narInfoReadAverted++;
+        if (res->didExist())
+            return std::make_optional(res->value);
+        else
+            return std::make_optional(nullptr);
     }
 
     if (diskCache) {
-        auto res = diskCache->lookupNarInfo(getUri(), hashPart);
+        auto res = diskCache->lookupNarInfo(config.getReference().render(/*FIXME withParams=*/false), hashPart);
         if (res.first != NarInfoDiskCache::oUnknown) {
             stats.narInfoReadAverted++;
-            {
-                auto state_(state.lock());
-                state_->pathInfoCache.upsert(storePath.to_string(),
-                    res.first == NarInfoDiskCache::oInvalid ? PathInfoCacheValue{} : PathInfoCacheValue{ .value = res.second });
-                if (res.first == NarInfoDiskCache::oInvalid ||
-                    !goodStorePath(storePath, res.second->path))
-                    return std::make_optional(nullptr);
-            }
+            pathInfoCache->lock()->upsert(
+                storePath.to_string(),
+                res.first == NarInfoDiskCache::oInvalid ? PathInfoCacheValue{}
+                                                        : PathInfoCacheValue{.value = res.second});
+            if (res.first == NarInfoDiskCache::oInvalid || !goodStorePath(storePath, res.second->path))
+                return std::make_optional(nullptr);
             assert(res.second);
             return std::make_optional(res.second);
         }
@@ -672,9 +547,7 @@ std::optional<std::shared_ptr<const ValidPathInfo>> Store::queryPathInfoFromClie
     return std::nullopt;
 }
 
-
-void Store::queryPathInfo(const StorePath & storePath,
-    Callback<ref<const ValidPathInfo>> callback) noexcept
+void Store::queryPathInfo(const StorePath & storePath, Callback<ref<const ValidPathInfo>> callback) noexcept
 {
     auto hashPart = std::string(storePath.hashPart());
 
@@ -687,23 +560,21 @@ void Store::queryPathInfo(const StorePath & storePath,
             else
                 throw InvalidPath("path '%s' is not valid", printStorePath(storePath));
         }
-    } catch (...) { return callback.rethrow(); }
+    } catch (...) {
+        return callback.rethrow();
+    }
 
     auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback));
 
-    queryPathInfoUncached(storePath,
-        {[this, storePath, hashPart, callbackPtr](std::future<std::shared_ptr<const ValidPathInfo>> fut) {
-
+    queryPathInfoUncached(
+        storePath, {[this, storePath, hashPart, callbackPtr](std::future<std::shared_ptr<const ValidPathInfo>> fut) {
             try {
                 auto info = fut.get();
 
                 if (diskCache)
-                    diskCache->upsertNarInfo(getUri(), hashPart, info);
+                    diskCache->upsertNarInfo(config.getReference().render(/*FIXME withParams=*/false), hashPart, info);
 
-                {
-                    auto state_(state.lock());
-                    state_->pathInfoCache.upsert(storePath.to_string(), PathInfoCacheValue { .value = info });
-                }
+                pathInfoCache->lock()->upsert(storePath.to_string(), PathInfoCacheValue{.value = info});
 
                 if (!info || !goodStorePath(storePath, info->path)) {
                     stats.narInfoMissing++;
@@ -711,27 +582,26 @@ void Store::queryPathInfo(const StorePath & storePath,
                 }
 
                 (*callbackPtr)(ref<const ValidPathInfo>(info));
-            } catch (...) { callbackPtr->rethrow(); }
+            } catch (...) {
+                callbackPtr->rethrow();
+            }
         }});
 }
 
-void Store::queryRealisation(const DrvOutput & id,
-        Callback<std::shared_ptr<const Realisation>> callback) noexcept
+void Store::queryRealisation(const DrvOutput & id, Callback<std::shared_ptr<const Realisation>> callback) noexcept
 {
 
     try {
         if (diskCache) {
-            auto [cacheOutcome, maybeCachedRealisation]
-                = diskCache->lookupRealisation(getUri(), id);
+            auto [cacheOutcome, maybeCachedRealisation] =
+                diskCache->lookupRealisation(config.getReference().render(/*FIXME: withParams=*/false), id);
             switch (cacheOutcome) {
             case NarInfoDiskCache::oValid:
                 debug("Returning a cached realisation for %s", id.to_string());
                 callback(maybeCachedRealisation);
                 return;
             case NarInfoDiskCache::oInvalid:
-                debug(
-                    "Returning a cached missing realisation for %s",
-                    id.to_string());
+                debug("Returning a cached missing realisation for %s", id.to_string());
                 callback(nullptr);
                 return;
             case NarInfoDiskCache::oUnknown:
@@ -742,29 +612,27 @@ void Store::queryRealisation(const DrvOutput & id,
         return callback.rethrow();
     }
 
-    auto callbackPtr
-        = std::make_shared<decltype(callback)>(std::move(callback));
+    auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback));
 
-    queryRealisationUncached(
-        id,
-        { [this, id, callbackPtr](
-              std::future<std::shared_ptr<const Realisation>> fut) {
-            try {
-                auto info = fut.get();
+    queryRealisationUncached(id, {[this, id, callbackPtr](std::future<std::shared_ptr<const Realisation>> fut) {
+                                 try {
+                                     auto info = fut.get();
 
-                if (diskCache) {
-                    if (info)
-                        diskCache->upsertRealisation(getUri(), *info);
-                    else
-                        diskCache->upsertAbsentRealisation(getUri(), id);
-                }
+                                     if (diskCache) {
+                                         if (info)
+                                             diskCache->upsertRealisation(
+                                                 config.getReference().render(/*FIXME withParams=*/false), *info);
+                                         else
+                                             diskCache->upsertAbsentRealisation(
+                                                 config.getReference().render(/*FIXME withParams=*/false), id);
+                                     }
 
-                (*callbackPtr)(std::shared_ptr<const Realisation>(info));
+                                     (*callbackPtr)(std::shared_ptr<const Realisation>(info));
 
-            } catch (...) {
-                callbackPtr->rethrow();
-            }
-        } });
+                                 } catch (...) {
+                                     callbackPtr->rethrow();
+                                 }
+                             }});
 }
 
 std::shared_ptr<const Realisation> Store::queryRealisation(const DrvOutput & id)
@@ -772,14 +640,13 @@ std::shared_ptr<const Realisation> Store::queryRealisation(const DrvOutput & id)
     using RealPtr = std::shared_ptr<const Realisation>;
     std::promise<RealPtr> promise;
 
-    queryRealisation(id,
-        {[&](std::future<RealPtr> result) {
-            try {
-                promise.set_value(result.get());
-            } catch (...) {
-                promise.set_exception(std::current_exception());
-            }
-        }});
+    queryRealisation(id, {[&](std::future<RealPtr> result) {
+                         try {
+                             promise.set_value(result.get());
+                         } catch (...) {
+                             promise.set_exception(std::current_exception());
+                         }
+                     }});
 
     return promise.get_future().get();
 }
@@ -795,14 +662,14 @@ void Store::substitutePaths(const StorePathSet & paths)
     if (!missing.willSubstitute.empty())
         try {
             std::vector<DerivedPath> subs;
-            for (auto & p : missing.willSubstitute) subs.emplace_back(DerivedPath::Opaque{p});
+            for (auto & p : missing.willSubstitute)
+                subs.emplace_back(DerivedPath::Opaque{p});
             buildPaths(subs);
         } catch (Error & e) {
             logWarning(e.info());
         }
 }
 
-
 StorePathSet Store::queryValidPaths(const StorePathSet & paths, SubstituteFlag maybeSubstitute)
 {
     struct State
@@ -820,29 +687,29 @@ StorePathSet Store::queryValidPaths(const StorePathSet & paths, SubstituteFlag m
     auto doQuery = [&](const StorePath & path) {
         checkInterrupt();
         queryPathInfo(path, {[path, &state_, &wakeup](std::future<ref<const ValidPathInfo>> fut) {
-            bool exists = false;
-            std::exception_ptr newExc{};
+                          bool exists = false;
+                          std::exception_ptr newExc{};
 
-            try {
-                auto info = fut.get();
-                exists = true;
-            } catch (InvalidPath &) {
-            } catch (...) {
-                newExc = std::current_exception();
-            }
+                          try {
+                              auto info = fut.get();
+                              exists = true;
+                          } catch (InvalidPath &) {
+                          } catch (...) {
+                              newExc = std::current_exception();
+                          }
 
-            auto state(state_.lock());
+                          auto state(state_.lock());
 
-            if (exists)
-                state->valid.insert(path);
+                          if (exists)
+                              state->valid.insert(path);
 
-            if (newExc)
-                state->exc = newExc;
+                          if (newExc)
+                              state->exc = newExc;
 
-            assert(state->left);
-            if (!--state->left)
-                wakeup.notify_one();
-        }});
+                          assert(state->left);
+                          if (!--state->left)
+                              wakeup.notify_one();
+                      }});
     };
 
     for (auto & path : paths)
@@ -853,19 +720,18 @@ StorePathSet Store::queryValidPaths(const StorePathSet & paths, SubstituteFlag m
     while (true) {
         auto state(state_.lock());
         if (!state->left) {
-            if (state->exc) std::rethrow_exception(state->exc);
+            if (state->exc)
+                std::rethrow_exception(state->exc);
             return std::move(state->valid);
         }
         state.wait(wakeup);
     }
 }
 
-
 /* Return a string accepted by decodeValidPathInfo() that
    registers the specified paths as valid.  Note: it's the
    responsibility of the caller to provide a closure. */
-std::string Store::makeValidityRegistration(const StorePathSet & paths,
-    bool showDerivers, bool showHash)
+std::string Store::makeValidityRegistration(const StorePathSet & paths, bool showDerivers, bool showHash)
 {
     std::string s = "";
 
@@ -891,14 +757,16 @@ std::string Store::makeValidityRegistration(const StorePathSet & paths,
     return s;
 }
 
-
 StorePathSet Store::exportReferences(const StorePathSet & storePaths, const StorePathSet & inputPaths)
 {
     StorePathSet paths;
 
     for (auto & storePath : storePaths) {
         if (!inputPaths.count(storePath))
-            throw BuildError("cannot export references of path '%s' because it is not in the input closure of the derivation", printStorePath(storePath));
+            throw BuildError(
+                BuildResult::InputRejected,
+                "cannot export references of path '%s' because it is not in the input closure of the derivation",
+                printStorePath(storePath));
 
         computeFSClosure({storePath}, paths);
     }
@@ -927,48 +795,58 @@ StorePathSet Store::exportReferences(const StorePathSet & storePaths, const Stor
     return paths;
 }
 
-
 const Store::Stats & Store::getStats()
 {
-    {
-        auto state_(state.readLock());
-        stats.pathInfoCacheSize = state_->pathInfoCache.size();
-    }
+    stats.pathInfoCacheSize = pathInfoCache->readLock()->size();
     return stats;
 }
 
-
-static std::string makeCopyPathMessage(
-    std::string_view srcUri,
-    std::string_view dstUri,
-    std::string_view storePath)
+static std::string
+makeCopyPathMessage(const StoreConfig & srcCfg, const StoreConfig & dstCfg, std::string_view storePath)
 {
-    return srcUri == "local" || srcUri == "daemon"
-        ? fmt("copying path '%s' to '%s'", storePath, dstUri)
-        : dstUri == "local" || dstUri == "daemon"
-        ? fmt("copying path '%s' from '%s'", storePath, srcUri)
-        : fmt("copying path '%s' from '%s' to '%s'", storePath, srcUri, dstUri);
+    auto src = srcCfg.getReference();
+    auto dst = dstCfg.getReference();
+
+    auto isShorthand = [](const StoreReference & ref) {
+        /* At this point StoreReference **must** be resolved. */
+        const auto & specified = std::visit(
+            overloaded{
+                [](const StoreReference::Auto &) -> const StoreReference::Specified & { unreachable(); },
+                [](const StoreReference::Specified & specified) -> const StoreReference::Specified & {
+                    return specified;
+                }},
+            ref.variant);
+        const auto & scheme = specified.scheme;
+        return (scheme == "local" || scheme == "unix") && specified.authority.empty();
+    };
+
+    if (isShorthand(src))
+        return fmt("copying path '%s' to '%s'", storePath, dstCfg.getHumanReadableURI());
+
+    if (isShorthand(dst))
+        return fmt("copying path '%s' from '%s'", storePath, srcCfg.getHumanReadableURI());
+
+    return fmt(
+        "copying path '%s' from '%s' to '%s'", storePath, srcCfg.getHumanReadableURI(), dstCfg.getHumanReadableURI());
 }
 
-
 void copyStorePath(
-    Store & srcStore,
-    Store & dstStore,
-    const StorePath & storePath,
-    RepairFlag repair,
-    CheckSigsFlag checkSigs)
+    Store & srcStore, Store & dstStore, const StorePath & storePath, RepairFlag repair, CheckSigsFlag checkSigs)
 {
     /* Bail out early (before starting a download from srcStore) if
        dstStore already has this path. */
     if (!repair && dstStore.isValidPath(storePath))
         return;
 
-    auto srcUri = srcStore.getUri();
-    auto dstUri = dstStore.getUri();
+    const auto & srcCfg = srcStore.config;
+    const auto & dstCfg = dstStore.config;
     auto storePathS = srcStore.printStorePath(storePath);
-    Activity act(*logger, lvlInfo, actCopyPath,
-        makeCopyPathMessage(srcUri, dstUri, storePathS),
-        {storePathS, srcUri, dstUri});
+    Activity act(
+        *logger,
+        lvlInfo,
+        actCopyPath,
+        makeCopyPathMessage(srcCfg, dstCfg, storePathS),
+        {storePathS, srcCfg.getHumanReadableURI(), dstCfg.getHumanReadableURI()});
     PushActivity pact(act.id);
 
     auto info = srcStore.queryPathInfo(storePath);
@@ -978,9 +856,8 @@ void copyStorePath(
     // recompute store path on the chance dstStore does it differently
     if (info->ca && info->references.empty()) {
         auto info2 = make_ref<ValidPathInfo>(*info);
-        info2->path = dstStore.makeFixedOutputPathFromCA(
-            info->path.name(),
-            info->contentAddressWithReferences().value());
+        info2->path =
+            dstStore.makeFixedOutputPathFromCA(info->path.name(), info->contentAddressWithReferences().value());
         if (dstStore.storeDir == srcStore.storeDir)
             assert(info->path == info2->path);
         info = info2;
@@ -992,21 +869,25 @@ void copyStorePath(
         info = info2;
     }
 
-    auto source = sinkToSource([&](Sink & sink) {
-        LambdaSink progressSink([&](std::string_view data) {
-            total += data.size();
-            act.progress(total, info->narSize);
+    auto source = sinkToSource(
+        [&](Sink & sink) {
+            LambdaSink progressSink([&](std::string_view data) {
+                total += data.size();
+                act.progress(total, info->narSize);
+            });
+            TeeSink tee{sink, progressSink};
+            srcStore.narFromPath(storePath, tee);
+        },
+        [&]() {
+            throw EndOfFile(
+                "NAR for '%s' fetched from '%s' is incomplete",
+                srcStore.printStorePath(storePath),
+                srcStore.config.getHumanReadableURI());
         });
-        TeeSink tee { sink, progressSink };
-        srcStore.narFromPath(storePath, tee);
-    }, [&]() {
-           throw EndOfFile("NAR for '%s' fetched from '%s' is incomplete", srcStore.printStorePath(storePath), srcStore.getUri());
-    });
 
     dstStore.addToStore(*info, *source, repair, checkSigs);
 }
 
-
 std::map<StorePath, StorePath> copyPaths(
     Store & srcStore,
     Store & dstStore,
@@ -1038,14 +919,13 @@ std::map<StorePath, StorePath> copyPaths(
                         throw Error(
                             "incomplete realisation closure: '%s' is a "
                             "dependency of '%s' but isn't registered",
-                            drvOutput.to_string(), current.id.to_string());
+                            drvOutput.to_string(),
+                            current.id.to_string());
                     children.insert(*currentChild);
                 }
                 return children;
             },
-            [&](const Realisation& current) -> void {
-                dstStore.registerDrvOutput(current, checkSigs);
-            });
+            [&](const Realisation & current) -> void { dstStore.registerDrvOutput(current, checkSigs); });
     } catch (MissingExperimentalFeature & e) {
         // Don't fail if the remote doesn't support CA derivations is it might
         // not be within our control to change that, and we might still want
@@ -1071,7 +951,8 @@ std::map<StorePath, StorePath> copyPaths(
 
     StorePathSet missing;
     for (auto & path : storePaths)
-        if (!valid.count(path)) missing.insert(path);
+        if (!valid.count(path))
+            missing.insert(path);
 
     Activity act(*logger, lvlInfo, actCopyPaths, fmt("copying %d paths", missing.size()));
 
@@ -1091,15 +972,15 @@ std::map<StorePath, StorePath> copyPaths(
         auto storePathForDst = storePathForSrc;
         if (currentPathInfo.ca && currentPathInfo.references.empty()) {
             storePathForDst = dstStore.makeFixedOutputPathFromCA(
-                currentPathInfo.path.name(),
-                currentPathInfo.contentAddressWithReferences().value());
+                currentPathInfo.path.name(), currentPathInfo.contentAddressWithReferences().value());
             if (dstStore.storeDir == srcStore.storeDir)
                 assert(storePathForDst == storePathForSrc);
             if (storePathForDst != storePathForSrc)
-                debug("replaced path '%s' to '%s' for substituter '%s'",
-                        srcStore.printStorePath(storePathForSrc),
-                        dstStore.printStorePath(storePathForDst),
-                        dstStore.getUri());
+                debug(
+                    "replaced path '%s' to '%s' for substituter '%s'",
+                    srcStore.printStorePath(storePathForSrc),
+                    dstStore.printStorePath(storePathForDst),
+                    dstStore.config.getHumanReadableURI());
         }
         return storePathForDst;
     };
@@ -1117,19 +998,22 @@ std::map<StorePath, StorePath> copyPaths(
             // We can reasonably assume that the copy will happen whenever we
             // read the path, so log something about that at that point
             uint64_t total = 0;
-            auto srcUri = srcStore.getUri();
-            auto dstUri = dstStore.getUri();
+            const auto & srcCfg = srcStore.config;
+            const auto & dstCfg = dstStore.config;
             auto storePathS = srcStore.printStorePath(missingPath);
-            Activity act(*logger, lvlInfo, actCopyPath,
-                makeCopyPathMessage(srcUri, dstUri, storePathS),
-                {storePathS, srcUri, dstUri});
+            Activity act(
+                *logger,
+                lvlInfo,
+                actCopyPath,
+                makeCopyPathMessage(srcCfg, dstCfg, storePathS),
+                {storePathS, srcCfg.getHumanReadableURI(), dstCfg.getHumanReadableURI()});
             PushActivity pact(act.id);
 
             LambdaSink progressSink([&](std::string_view data) {
                 total += data.size();
                 act.progress(total, narSize);
             });
-            TeeSink tee { sink, progressSink };
+            TeeSink tee{sink, progressSink};
 
             srcStore.narFromPath(missingPath, tee);
         });
@@ -1149,7 +1033,8 @@ void copyClosure(
     CheckSigsFlag checkSigs,
     SubstituteFlag substitute)
 {
-    if (&srcStore == &dstStore) return;
+    if (&srcStore == &dstStore)
+        return;
 
     RealisedPath::Set closure;
     RealisedPath::closure(srcStore, paths, closure);
@@ -1165,62 +1050,68 @@ void copyClosure(
     CheckSigsFlag checkSigs,
     SubstituteFlag substitute)
 {
-    if (&srcStore == &dstStore) return;
+    if (&srcStore == &dstStore)
+        return;
 
     StorePathSet closure;
     srcStore.computeFSClosure(storePaths, closure);
     copyPaths(srcStore, dstStore, closure, repair, checkSigs, substitute);
 }
 
-std::optional<ValidPathInfo> decodeValidPathInfo(const Store & store, std::istream & str, std::optional<HashResult> hashGiven)
+std::optional<ValidPathInfo>
+decodeValidPathInfo(const Store & store, std::istream & str, std::optional<HashResult> hashGiven)
 {
     std::string path;
     getline(str, path);
-    if (str.eof()) { return {}; }
+    if (str.eof()) {
+        return {};
+    }
     if (!hashGiven) {
         std::string s;
         getline(str, s);
         auto narHash = Hash::parseAny(s, HashAlgorithm::SHA256);
         getline(str, s);
         auto narSize = string2Int<uint64_t>(s);
-        if (!narSize) throw Error("number expected");
-        hashGiven = { narHash, *narSize };
+        if (!narSize)
+            throw Error("number expected");
+        hashGiven = {narHash, *narSize};
     }
-    ValidPathInfo info(store.parseStorePath(path), hashGiven->first);
-    info.narSize = hashGiven->second;
+    ValidPathInfo info(store.parseStorePath(path), hashGiven->hash);
+    info.narSize = hashGiven->numBytesDigested;
     std::string deriver;
     getline(str, deriver);
-    if (deriver != "") info.deriver = store.parseStorePath(deriver);
+    if (deriver != "")
+        info.deriver = store.parseStorePath(deriver);
     std::string s;
     getline(str, s);
     auto n = string2Int<int>(s);
-    if (!n) throw Error("number expected");
+    if (!n)
+        throw Error("number expected");
     while ((*n)--) {
         getline(str, s);
         info.references.insert(store.parseStorePath(s));
     }
-    if (!str || str.eof()) throw Error("missing input");
+    if (!str || str.eof())
+        throw Error("missing input");
     return std::optional<ValidPathInfo>(std::move(info));
 }
 
-
-std::string MixStoreDirMethods::showPaths(const StorePathSet & paths) const
+std::string StoreDirConfig::showPaths(const StorePathSet & paths) const
 {
     std::string s;
     for (auto & i : paths) {
-        if (s.size() != 0) s += ", ";
+        if (s.size() != 0)
+            s += ", ";
         s += "'" + printStorePath(i) + "'";
     }
     return s;
 }
 
-
 std::string showPaths(const PathSet & paths)
 {
     return concatStringsSep(", ", quoteStrings(paths));
 }
 
-
 Derivation Store::derivationFromPath(const StorePath & drvPath)
 {
     ensurePath(drvPath);
@@ -1231,9 +1122,8 @@ static Derivation readDerivationCommon(Store & store, const StorePath & drvPath,
 {
     auto accessor = store.getFSAccessor(requireValidPath);
     try {
-        return parseDerivation(store,
-            accessor->readFile(CanonPath(drvPath.to_string())),
-            Derivation::nameFromPath(drvPath));
+        return parseDerivation(
+            store, accessor->readFile(CanonPath(drvPath.to_string())), Derivation::nameFromPath(drvPath));
     } catch (FormatError & e) {
         throw Error("error parsing derivation '%s': %s", store.printStorePath(drvPath), e.msg());
     }
@@ -1245,7 +1135,8 @@ std::optional<StorePath> Store::getBuildDerivationPath(const StorePath & path)
     if (!path.isDerivation()) {
         try {
             auto info = queryPathInfo(path);
-            if (!info->deriver) return std::nullopt;
+            if (!info->deriver)
+                return std::nullopt;
             return *info->deriver;
         } catch (InvalidPath &) {
             return std::nullopt;
@@ -1268,11 +1159,14 @@ std::optional<StorePath> Store::getBuildDerivationPath(const StorePath & path)
 }
 
 Derivation Store::readDerivation(const StorePath & drvPath)
-{ return readDerivationCommon(*this, drvPath, true); }
+{
+    return readDerivationCommon(*this, drvPath, true);
+}
 
 Derivation Store::readInvalidDerivation(const StorePath & drvPath)
-{ return readDerivationCommon(*this, drvPath, false); }
-
+{
+    return readDerivationCommon(*this, drvPath, false);
+}
 
 void Store::signPathInfo(ValidPathInfo & info)
 {
@@ -1287,7 +1181,6 @@ void Store::signPathInfo(ValidPathInfo & info)
     }
 }
 
-
 void Store::signRealisation(Realisation & realisation)
 {
     // FIXME: keep secret keys in memory.
@@ -1301,4 +1194,4 @@ void Store::signRealisation(Realisation & realisation)
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/store-dir-config.cc b/src/libstore/store-dir-config.cc
index ec65013ef..8c756ff58 100644
--- a/src/libstore/store-dir-config.cc
+++ b/src/libstore/store-dir-config.cc
@@ -1,13 +1,176 @@
-#include "nix/store/store-dir-config.hh"
+#include "nix/util/source-path.hh"
 #include "nix/util/util.hh"
+#include "nix/store/store-dir-config.hh"
+#include "nix/store/derivations.hh"
 #include "nix/store/globals.hh"
 
 namespace nix {
 
-StoreDirConfig::StoreDirConfig(const Params & params)
-    : StoreDirConfigBase(params)
-    , MixStoreDirMethods{storeDir_}
+StorePath StoreDirConfig::parseStorePath(std::string_view path) const
 {
+    // On Windows, `/nix/store` is not a canonical path. More broadly it
+    // is unclear whether this function should be using the native
+    // notion of a canonical path at all. For example, it makes to
+    // support remote stores whose store dir is a non-native path (e.g.
+    // Windows <-> Unix ssh-ing).
+    auto p =
+#ifdef _WIN32
+        path
+#else
+        canonPath(std::string(path))
+#endif
+        ;
+    if (dirOf(p) != storeDir)
+        throw BadStorePath("path '%s' is not in the Nix store", p);
+    return StorePath(baseNameOf(p));
 }
 
+std::optional<StorePath> StoreDirConfig::maybeParseStorePath(std::string_view path) const
+{
+    try {
+        return parseStorePath(path);
+    } catch (Error &) {
+        return {};
+    }
 }
+
+bool StoreDirConfig::isStorePath(std::string_view path) const
+{
+    return (bool) maybeParseStorePath(path);
+}
+
+StorePathSet StoreDirConfig::parseStorePathSet(const PathSet & paths) const
+{
+    StorePathSet res;
+    for (auto & i : paths)
+        res.insert(parseStorePath(i));
+    return res;
+}
+
+std::string StoreDirConfig::printStorePath(const StorePath & path) const
+{
+    return (storeDir + "/").append(path.to_string());
+}
+
+PathSet StoreDirConfig::printStorePathSet(const StorePathSet & paths) const
+{
+    PathSet res;
+    for (auto & i : paths)
+        res.insert(printStorePath(i));
+    return res;
+}
+
+/*
+The exact specification of store paths is in `protocols/store-path.md`
+in the Nix manual. These few functions implement that specification.
+
+If changes to these functions go beyond mere implementation changes i.e.
+also update the user-visible behavior, please update the specification
+to match.
+*/
+
+StorePath StoreDirConfig::makeStorePath(std::string_view type, std::string_view hash, std::string_view name) const
+{
+    /* e.g., "source:sha256:1abc...:/nix/store:foo.tar.gz" */
+    auto s = std::string(type) + ":" + std::string(hash) + ":" + storeDir + ":" + std::string(name);
+    auto h = compressHash(hashString(HashAlgorithm::SHA256, s), 20);
+    return StorePath(h, name);
+}
+
+StorePath StoreDirConfig::makeStorePath(std::string_view type, const Hash & hash, std::string_view name) const
+{
+    return makeStorePath(type, hash.to_string(HashFormat::Base16, true), name);
+}
+
+StorePath StoreDirConfig::makeOutputPath(std::string_view id, const Hash & hash, std::string_view name) const
+{
+    return makeStorePath("output:" + std::string{id}, hash, outputPathName(name, id));
+}
+
+/* Stuff the references (if any) into the type.  This is a bit
+   hacky, but we can't put them in, say, <s2> (per the grammar above)
+   since that would be ambiguous. */
+static std::string makeType(const StoreDirConfig & store, std::string && type, const StoreReferences & references)
+{
+    for (auto & i : references.others) {
+        type += ":";
+        type += store.printStorePath(i);
+    }
+    if (references.self)
+        type += ":self";
+    return std::move(type);
+}
+
+StorePath StoreDirConfig::makeFixedOutputPath(std::string_view name, const FixedOutputInfo & info) const
+{
+    if (info.method == FileIngestionMethod::Git
+        && !(info.hash.algo == HashAlgorithm::SHA1 || info.hash.algo == HashAlgorithm::SHA256)) {
+        throw Error(
+            "Git file ingestion must use SHA-1 or SHA-256 hash, but instead using: %s", printHashAlgo(info.hash.algo));
+    }
+
+    if (info.hash.algo == HashAlgorithm::SHA256 && info.method == FileIngestionMethod::NixArchive) {
+        return makeStorePath(makeType(*this, "source", info.references), info.hash, name);
+    } else {
+        if (!info.references.empty()) {
+            throw Error(
+                "fixed output derivation '%s' is not allowed to refer to other store paths.\nYou may need to use the 'unsafeDiscardReferences' derivation attribute, see the manual for more details.",
+                name);
+        }
+        // make a unique digest based on the parameters for creating this store object
+        auto payload =
+            "fixed:out:" + makeFileIngestionPrefix(info.method) + info.hash.to_string(HashFormat::Base16, true) + ":";
+        auto digest = hashString(HashAlgorithm::SHA256, payload);
+        return makeStorePath("output:out", digest, name);
+    }
+}
+
+StorePath
+StoreDirConfig::makeFixedOutputPathFromCA(std::string_view name, const ContentAddressWithReferences & ca) const
+{
+    // New template
+    return std::visit(
+        overloaded{
+            [&](const TextInfo & ti) {
+                assert(ti.hash.algo == HashAlgorithm::SHA256);
+                return makeStorePath(
+                    makeType(
+                        *this,
+                        "text",
+                        StoreReferences{
+                            .others = ti.references,
+                            .self = false,
+                        }),
+                    ti.hash,
+                    name);
+            },
+            [&](const FixedOutputInfo & foi) { return makeFixedOutputPath(name, foi); }},
+        ca.raw);
+}
+
+std::pair<StorePath, Hash> StoreDirConfig::computeStorePath(
+    std::string_view name,
+    const SourcePath & path,
+    ContentAddressMethod method,
+    HashAlgorithm hashAlgo,
+    const StorePathSet & references,
+    PathFilter & filter) const
+{
+    auto [h, size] = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
+    if (settings.warnLargePathThreshold && size && *size >= settings.warnLargePathThreshold)
+        warn("hashed large path '%s' (%s)", path, renderSize(*size));
+    return {
+        makeFixedOutputPathFromCA(
+            name,
+            ContentAddressWithReferences::fromParts(
+                method,
+                h,
+                {
+                    .others = references,
+                    .self = false,
+                })),
+        h,
+    };
+}
+
+} // namespace nix
diff --git a/src/libstore/store-reference.cc b/src/libstore/store-reference.cc
index cb4e2cfb8..96ee829d0 100644
--- a/src/libstore/store-reference.cc
+++ b/src/libstore/store-reference.cc
@@ -1,11 +1,12 @@
-#include <regex>
-
 #include "nix/util/error.hh"
+#include "nix/util/split.hh"
 #include "nix/util/url.hh"
 #include "nix/store/store-reference.hh"
 #include "nix/util/file-system.hh"
 #include "nix/util/util.hh"
 
+#include <boost/url/ipv6_address.hpp>
+
 namespace nix {
 
 static bool isNonUriPath(const std::string & spec)
@@ -18,13 +19,15 @@ static bool isNonUriPath(const std::string & spec)
         && spec.find("/") != std::string::npos;
 }
 
-std::string StoreReference::render() const
+std::string StoreReference::render(bool withParams) const
 {
     std::string res;
 
     std::visit(
         overloaded{
             [&](const StoreReference::Auto &) { res = "auto"; },
+            [&](const StoreReference::Daemon &) { res = "daemon"; },
+            [&](const StoreReference::Local &) { res = "local"; },
             [&](const StoreReference::Specified & g) {
                 res = g.scheme;
                 res += "://";
@@ -33,7 +36,7 @@ std::string StoreReference::render() const
         },
         variant);
 
-    if (!params.empty()) {
+    if (withParams && !params.empty()) {
         res += "?";
         res += encodeQuery(params);
     }
@@ -41,20 +44,41 @@ std::string StoreReference::render() const
     return res;
 }
 
+namespace {
+
+struct SchemeAndAuthorityWithPath
+{
+    std::string_view scheme;
+    std::string_view authority;
+};
+
+} // namespace
+
+/**
+ * Return the 'scheme' and remove the '://' or ':' separator.
+ */
+static std::optional<SchemeAndAuthorityWithPath> splitSchemePrefixTo(std::string_view string)
+{
+    auto scheme = splitPrefixTo(string, ':');
+    if (!scheme)
+        return std::nullopt;
+
+    splitPrefix(string, "//");
+    return SchemeAndAuthorityWithPath{.scheme = *scheme, .authority = string};
+}
+
 StoreReference StoreReference::parse(const std::string & uri, const StoreReference::Params & extraParams)
 {
     auto params = extraParams;
     try {
-        auto parsedUri = parseURL(uri);
+        auto parsedUri = parseURL(uri, /*lenient=*/true);
         params.insert(parsedUri.query.begin(), parsedUri.query.end());
 
-        auto baseURI = parsedUri.authority.value_or("") + parsedUri.path;
-
         return {
             .variant =
                 Specified{
                     .scheme = std::move(parsedUri.scheme),
-                    .authority = std::move(baseURI),
+                    .authority = parsedUri.renderAuthorityAndPath(),
                 },
             .params = std::move(params),
         };
@@ -68,21 +92,17 @@ StoreReference StoreReference::parse(const std::string & uri, const StoreReferen
                 .params = std::move(params),
             };
         } else if (baseURI == "daemon") {
+            if (params.empty())
+                return {.variant = Daemon{}};
             return {
-                .variant =
-                    Specified{
-                        .scheme = "unix",
-                        .authority = "",
-                    },
+                .variant = Specified{.scheme = "unix", .authority = ""},
                 .params = std::move(params),
             };
         } else if (baseURI == "local") {
+            if (params.empty())
+                return {.variant = Local{}};
             return {
-                .variant =
-                    Specified{
-                        .scheme = "local",
-                        .authority = "",
-                    },
+                .variant = Specified{.scheme = "local", .authority = ""},
                 .params = std::move(params),
             };
         } else if (isNonUriPath(baseURI)) {
@@ -94,6 +114,32 @@ StoreReference StoreReference::parse(const std::string & uri, const StoreReferen
                     },
                 .params = std::move(params),
             };
+        } else if (auto schemeAndAuthority = splitSchemePrefixTo(baseURI)) {
+            /* Back-compatibility shim to accept unbracketed IPv6 addresses after the scheme.
+             * Old versions of nix allowed that. Note that this is ambiguous and does not allow
+             * specifying the port number. For that the address must be bracketed, otherwise it's
+             * greedily assumed to be the part of the host address. */
+            auto authorityString = schemeAndAuthority->authority;
+            auto userinfo = splitPrefixTo(authorityString, '@');
+            auto maybeIpv6 = boost::urls::parse_ipv6_address(authorityString);
+            if (maybeIpv6) {
+                std::string fixedAuthority;
+                if (userinfo) {
+                    fixedAuthority += *userinfo;
+                    fixedAuthority += '@';
+                }
+                fixedAuthority += '[';
+                fixedAuthority += authorityString;
+                fixedAuthority += ']';
+                return {
+                    .variant =
+                        Specified{
+                            .scheme = std::string(schemeAndAuthority->scheme),
+                            .authority = fixedAuthority,
+                        },
+                    .params = std::move(params),
+                };
+            }
         }
     }
 
@@ -107,10 +153,10 @@ std::pair<std::string, StoreReference::Params> splitUriAndParams(const std::stri
     StoreReference::Params params;
     auto q = uri.find('?');
     if (q != std::string::npos) {
-        params = decodeQuery(uri.substr(q + 1));
+        params = decodeQuery(uri.substr(q + 1), /*lenient=*/true);
         uri = uri_.substr(0, q);
     }
     return {uri, params};
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/store-registration.cc b/src/libstore/store-registration.cc
index 6362ac036..cfaf86b1e 100644
--- a/src/libstore/store-registration.cc
+++ b/src/libstore/store-registration.cc
@@ -2,9 +2,15 @@
 #include "nix/store/store-open.hh"
 #include "nix/store/local-store.hh"
 #include "nix/store/uds-remote-store.hh"
+#include "nix/store/globals.hh"
 
 namespace nix {
 
+ref<Store> openStore()
+{
+    return openStore(settings.storeUri.get());
+}
+
 ref<Store> openStore(const std::string & uri, const Store::Config::Params & extraParams)
 {
     return openStore(StoreReference::parse(uri, extraParams));
@@ -102,4 +108,4 @@ Implementations::Map & Implementations::registered()
     return registered;
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/uds-remote-store.cc b/src/libstore/uds-remote-store.cc
index c979b5e47..9725fe8a0 100644
--- a/src/libstore/uds-remote-store.cc
+++ b/src/libstore/uds-remote-store.cc
@@ -2,6 +2,7 @@
 #include "nix/util/unix-domain-socket.hh"
 #include "nix/store/worker-protocol.hh"
 #include "nix/store/store-registration.hh"
+#include "nix/store/globals.hh"
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -9,19 +10,17 @@
 #include <unistd.h>
 
 #ifdef _WIN32
-# include <winsock2.h>
-# include <afunix.h>
+#  include <winsock2.h>
+#  include <afunix.h>
 #else
-# include <sys/socket.h>
-# include <sys/un.h>
+#  include <sys/socket.h>
+#  include <sys/un.h>
 #endif
 
 namespace nix {
 
 UDSRemoteStoreConfig::UDSRemoteStoreConfig(
-    std::string_view scheme,
-    std::string_view authority,
-    const StoreReference::Params & params)
+    std::string_view scheme, std::string_view authority, const StoreReference::Params & params)
     : Store::Config{params}
     , LocalFSStore::Config{params}
     , RemoteStore::Config{params}
@@ -32,15 +31,13 @@ UDSRemoteStoreConfig::UDSRemoteStoreConfig(
     }
 }
 
-
 std::string UDSRemoteStoreConfig::doc()
 {
     return
-        #include "uds-remote-store.md"
+#include "uds-remote-store.md"
         ;
 }
 
-
 // A bit gross that we now pass empty string but this is knowing that
 // empty string will later default to the same nixDaemonSocketFile. Why
 // don't we just wire it all through? I believe there are cases where it
@@ -50,7 +47,6 @@ UDSRemoteStoreConfig::UDSRemoteStoreConfig(const Params & params)
 {
 }
 
-
 UDSRemoteStore::UDSRemoteStore(ref<const Config> config)
     : Store{*config}
     , LocalFSStore{*config}
@@ -59,25 +55,27 @@ UDSRemoteStore::UDSRemoteStore(ref<const Config> config)
 {
 }
 
-
-std::string UDSRemoteStore::getUri()
+StoreReference UDSRemoteStoreConfig::getReference() const
 {
-    return config->path == settings.nixDaemonSocketFile
-        ? // FIXME: Not clear why we return daemon here and not default
-          // to settings.nixDaemonSocketFile
-          //
-          // unix:// with no path also works. Change what we return?
-          "daemon"
-        : std::string(*Config::uriSchemes().begin()) + "://" + config->path;
+    /* We specifically return "daemon" here instead of "unix://" or "unix://${path}"
+     * to be more compatible with older versions of nix. Some tooling out there
+     * tries hard to parse store references and it might not be able to handle "unix://". */
+    if (path == settings.nixDaemonSocketFile)
+        return {.variant = StoreReference::Daemon{}};
+    return {
+        .variant =
+            StoreReference::Specified{
+                .scheme = *uriSchemes().begin(),
+                .authority = path,
+            },
+    };
 }
 
-
 void UDSRemoteStore::Connection::closeWrite()
 {
     shutdown(toSocket(fd.get()), SHUT_WR);
 }
 
-
 ref<RemoteStore::Connection> UDSRemoteStore::openConnection()
 {
     auto conn = make_ref<Connection>();
@@ -93,7 +91,6 @@ ref<RemoteStore::Connection> UDSRemoteStore::openConnection()
     return conn;
 }
 
-
 void UDSRemoteStore::addIndirectRoot(const Path & path)
 {
     auto conn(getConnection());
@@ -102,12 +99,11 @@ void UDSRemoteStore::addIndirectRoot(const Path & path)
     readInt(conn->from);
 }
 
-
-ref<Store> UDSRemoteStore::Config::openStore() const {
+ref<Store> UDSRemoteStore::Config::openStore() const
+{
     return make_ref<UDSRemoteStore>(ref{shared_from_this()});
 }
 
-
 static RegisterStoreImplementation<UDSRemoteStore::Config> regUDSRemoteStore;
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/build/child.cc b/src/libstore/unix/build/child.cc
index a21fddf51..3a704e6ed 100644
--- a/src/libstore/unix/build/child.cc
+++ b/src/libstore/unix/build/child.cc
@@ -34,4 +34,4 @@ void commonChildInit()
     close(fdDevNull);
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/build/chroot-derivation-builder.cc b/src/libstore/unix/build/chroot-derivation-builder.cc
new file mode 100644
index 000000000..8c9359533
--- /dev/null
+++ b/src/libstore/unix/build/chroot-derivation-builder.cc
@@ -0,0 +1,203 @@
+#ifdef __linux__
+
+namespace nix {
+
+struct ChrootDerivationBuilder : virtual DerivationBuilderImpl
+{
+    ChrootDerivationBuilder(
+        LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
+        : DerivationBuilderImpl{store, std::move(miscMethods), std::move(params)}
+    {
+    }
+
+    /**
+     * The root of the chroot environment.
+     */
+    Path chrootRootDir;
+
+    /**
+     * RAII object to delete the chroot directory.
+     */
+    std::shared_ptr<AutoDelete> autoDelChroot;
+
+    PathsInChroot pathsInChroot;
+
+    bool needsHashRewrite() override
+    {
+        return false;
+    }
+
+    void setBuildTmpDir() override
+    {
+        /* If sandboxing is enabled, put the actual TMPDIR underneath
+           an inaccessible root-owned directory, to prevent outside
+           access.
+
+           On macOS, we don't use an actual chroot, so this isn't
+           possible. Any mitigation along these lines would have to be
+           done directly in the sandbox profile. */
+        tmpDir = topTmpDir + "/build";
+        createDir(tmpDir, 0700);
+    }
+
+    Path tmpDirInSandbox() override
+    {
+        /* In a sandbox, for determinism, always use the same temporary
+           directory. */
+        return settings.sandboxBuildDir;
+    }
+
+    virtual gid_t sandboxGid()
+    {
+        return buildUser->getGID();
+    }
+
+    void prepareSandbox() override
+    {
+        /* Create a temporary directory in which we set up the chroot
+           environment using bind-mounts.  We put it in the Nix store
+           so that the build outputs can be moved efficiently from the
+           chroot to their final location. */
+        auto chrootParentDir = store.Store::toRealPath(drvPath) + ".chroot";
+        deletePath(chrootParentDir);
+
+        /* Clean up the chroot directory automatically. */
+        autoDelChroot = std::make_shared<AutoDelete>(chrootParentDir);
+
+        printMsg(lvlChatty, "setting up chroot environment in '%1%'", chrootParentDir);
+
+        if (mkdir(chrootParentDir.c_str(), 0700) == -1)
+            throw SysError("cannot create '%s'", chrootRootDir);
+
+        chrootRootDir = chrootParentDir + "/root";
+
+        if (mkdir(chrootRootDir.c_str(), buildUser && buildUser->getUIDCount() != 1 ? 0755 : 0750) == -1)
+            throw SysError("cannot create '%1%'", chrootRootDir);
+
+        if (buildUser
+            && chown(
+                   chrootRootDir.c_str(), buildUser->getUIDCount() != 1 ? buildUser->getUID() : 0, buildUser->getGID())
+                   == -1)
+            throw SysError("cannot change ownership of '%1%'", chrootRootDir);
+
+        /* Create a writable /tmp in the chroot.  Many builders need
+           this.  (Of course they should really respect $TMPDIR
+           instead.) */
+        Path chrootTmpDir = chrootRootDir + "/tmp";
+        createDirs(chrootTmpDir);
+        chmod_(chrootTmpDir, 01777);
+
+        /* Create a /etc/passwd with entries for the build user and the
+           nobody account.  The latter is kind of a hack to support
+           Samba-in-QEMU. */
+        createDirs(chrootRootDir + "/etc");
+        if (drvOptions.useUidRange(drv))
+            chownToBuilder(chrootRootDir + "/etc");
+
+        if (drvOptions.useUidRange(drv) && (!buildUser || buildUser->getUIDCount() < 65536))
+            throw Error("feature 'uid-range' requires the setting '%s' to be enabled", settings.autoAllocateUids.name);
+
+        /* Declare the build user's group so that programs get a consistent
+           view of the system (e.g., "id -gn"). */
+        writeFile(
+            chrootRootDir + "/etc/group",
+            fmt("root:x:0:\n"
+                "nixbld:!:%1%:\n"
+                "nogroup:x:65534:\n",
+                sandboxGid()));
+
+        /* Create /etc/hosts with localhost entry. */
+        if (derivationType.isSandboxed())
+            writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
+
+        /* Make the closure of the inputs available in the chroot,
+           rather than the whole Nix store.  This prevents any access
+           to undeclared dependencies.  Directories are bind-mounted,
+           while other inputs are hard-linked (since only directories
+           can be bind-mounted).  !!! As an extra security
+           precaution, make the fake Nix store only writable by the
+           build user. */
+        Path chrootStoreDir = chrootRootDir + store.storeDir;
+        createDirs(chrootStoreDir);
+        chmod_(chrootStoreDir, 01775);
+
+        if (buildUser && chown(chrootStoreDir.c_str(), 0, buildUser->getGID()) == -1)
+            throw SysError("cannot change ownership of '%1%'", chrootStoreDir);
+
+        pathsInChroot = getPathsInSandbox();
+
+        for (auto & i : inputPaths) {
+            auto p = store.printStorePath(i);
+            pathsInChroot.insert_or_assign(p, ChrootPath{.source = store.toRealPath(p)});
+        }
+
+        /* If we're repairing, checking or rebuilding part of a
+           multiple-outputs derivation, it's possible that we're
+           rebuilding a path that is in settings.sandbox-paths
+           (typically the dependencies of /bin/sh).  Throw them
+           out. */
+        for (auto & i : drv.outputsAndOptPaths(store)) {
+            /* If the name isn't known a priori (i.e. floating
+               content-addressing derivation), the temporary location we use
+               should be fresh.  Freshness means it is impossible that the path
+               is already in the sandbox, so we don't need to worry about
+               removing it.  */
+            if (i.second.second)
+                pathsInChroot.erase(store.printStorePath(*i.second.second));
+        }
+    }
+
+    Strings getPreBuildHookArgs() override
+    {
+        assert(!chrootRootDir.empty());
+        return Strings({store.printStorePath(drvPath), chrootRootDir});
+    }
+
+    Path realPathInSandbox(const Path & p) override
+    {
+        // FIXME: why the needsHashRewrite() conditional?
+        return !needsHashRewrite() ? chrootRootDir + p : store.toRealPath(p);
+    }
+
+    void cleanupBuild(bool force) override
+    {
+        DerivationBuilderImpl::cleanupBuild(force);
+
+        /* Move paths out of the chroot for easier debugging of
+           build failures. */
+        if (!force && buildMode == bmNormal)
+            for (auto & [_, status] : initialOutputs) {
+                if (!status.known)
+                    continue;
+                if (buildMode != bmCheck && status.known->isValid())
+                    continue;
+                auto p = store.Store::toRealPath(status.known->path);
+                if (pathExists(chrootRootDir + p))
+                    std::filesystem::rename((chrootRootDir + p), p);
+            }
+
+        autoDelChroot.reset(); /* this runs the destructor */
+    }
+
+    std::pair<Path, Path> addDependencyPrep(const StorePath & path)
+    {
+        DerivationBuilderImpl::addDependency(path);
+
+        debug("materialising '%s' in the sandbox", store.printStorePath(path));
+
+        Path source = store.Store::toRealPath(path);
+        Path target = chrootRootDir + store.printStorePath(path);
+
+        if (pathExists(target)) {
+            // There is a similar debug message in doBind, so only run it in this block to not have double messages.
+            debug("bind-mounting %s -> %s", target, source);
+            throw Error("store path '%s' already exists in the sandbox", store.printStorePath(path));
+        }
+
+        return {source, target};
+    }
+};
+
+} // namespace nix
+
+#endif
diff --git a/src/libstore/unix/build/darwin-derivation-builder.cc b/src/libstore/unix/build/darwin-derivation-builder.cc
index 5e06dbe55..21b3c6cb9 100644
--- a/src/libstore/unix/build/darwin-derivation-builder.cc
+++ b/src/libstore/unix/build/darwin-derivation-builder.cc
@@ -21,7 +21,7 @@ struct DarwinDerivationBuilder : DerivationBuilderImpl
     bool useSandbox;
 
     DarwinDerivationBuilder(
-        Store & store,
+        LocalStore & store,
         std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
         DerivationBuilderParams params,
         bool useSandbox)
@@ -69,7 +69,7 @@ struct DarwinDerivationBuilder : DerivationBuilderImpl
             /* Add all our input paths to the chroot */
             for (auto & i : inputPaths) {
                 auto p = store.printStorePath(i);
-                pathsInChroot.insert_or_assign(p, p);
+                pathsInChroot.insert_or_assign(p, ChrootPath{.source = p});
             }
 
             /* Violations will go to the syslog if you set this. Unfortunately the destination does not appear to be
@@ -160,6 +160,8 @@ struct DarwinDerivationBuilder : DerivationBuilderImpl
 
         if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
             Strings sandboxArgs;
+            sandboxArgs.push_back("_NIX_BUILD_TOP");
+            sandboxArgs.push_back(tmpDir);
             sandboxArgs.push_back("_GLOBAL_TMP_DIR");
             sandboxArgs.push_back(globalTmpDir);
             if (drvOptions.allowLocalNetworking) {
@@ -204,6 +206,6 @@ struct DarwinDerivationBuilder : DerivationBuilderImpl
     }
 };
 
-}
+} // namespace nix
 
 #endif
diff --git a/src/libstore/unix/build/derivation-builder.cc b/src/libstore/unix/build/derivation-builder.cc
index fd62aa664..770bdad4d 100644
--- a/src/libstore/unix/build/derivation-builder.cc
+++ b/src/libstore/unix/build/derivation-builder.cc
@@ -15,6 +15,9 @@
 #include "nix/store/posix-fs-canonicalise.hh"
 #include "nix/util/posix-source-accessor.hh"
 #include "nix/store/restricted-store.hh"
+#include "nix/store/user-lock.hh"
+#include "nix/store/globals.hh"
+#include "nix/store/build/derivation-env-desugar.hh"
 
 #include <queue>
 
@@ -29,7 +32,7 @@
 #include "store-config-private.hh"
 
 #if HAVE_STATVFS
-# include <sys/statvfs.h>
+#  include <sys/statvfs.h>
 #endif
 
 #include <pwd.h>
@@ -40,10 +43,17 @@
 #include "nix/util/signals.hh"
 
 #include "store-config-private.hh"
+#include "build/derivation-check.hh"
 
 namespace nix {
 
-MakeError(NotDeterministic, BuildError);
+struct NotDeterministic : BuildError
+{
+    NotDeterministic(auto &&... args)
+        : BuildError(BuildResult::NotDeterministic, args...)
+    {
+    }
+};
 
 /**
  * This class represents the state for building locally.
@@ -61,21 +71,46 @@ class DerivationBuilderImpl : public DerivationBuilder, public DerivationBuilder
 {
 protected:
 
-    Store & store;
+    /**
+     * The process ID of the builder.
+     */
+    Pid pid;
+
+    LocalStore & store;
 
     std::unique_ptr<DerivationBuilderCallbacks> miscMethods;
 
 public:
 
     DerivationBuilderImpl(
-        Store & store,
-        std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
-        DerivationBuilderParams params)
+        LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
         : DerivationBuilderParams{std::move(params)}
         , store{store}
         , miscMethods{std::move(miscMethods)}
         , derivationType{drv.type()}
-      { }
+    {
+    }
+
+    ~DerivationBuilderImpl()
+    {
+        /* Careful: we should never ever throw an exception from a
+           destructor. */
+        try {
+            killChild();
+        } catch (...) {
+            ignoreExceptionInDestructor();
+        }
+        try {
+            stopDaemon();
+        } catch (...) {
+            ignoreExceptionInDestructor();
+        }
+        try {
+            cleanupBuild(false);
+        } catch (...) {
+            ignoreExceptionInDestructor();
+        }
+    }
 
 protected:
 
@@ -107,18 +142,6 @@ protected:
      */
     const DerivationType derivationType;
 
-    /**
-     * Stuff we need to pass to initChild().
-     */
-    struct ChrootPath {
-        Path source;
-        bool optional;
-        ChrootPath(Path source = "", bool optional = false)
-            : source(source), optional(optional)
-        { }
-    };
-    typedef std::map<Path, ChrootPath> PathsInChroot; // maps target path to source path
-
     typedef StringMap Environment;
     Environment env;
 
@@ -171,6 +194,7 @@ protected:
     {
         return inputPaths.count(path) || addedPaths.count(path);
     }
+
     bool isAllowed(const DrvOutput & id) override
     {
         return addedDrvOutputs.count(id);
@@ -190,11 +214,9 @@ protected:
 
 public:
 
-    bool prepareBuild() override;
+    std::optional<Descriptor> startBuild() override;
 
-    void startBuilder() override;
-
-    std::variant<std::pair<BuildResult::Status, Error>, SingleDrvOutputs> unprepareBuild() override;
+    SingleDrvOutputs unprepareBuild() override;
 
 protected:
 
@@ -283,26 +305,21 @@ protected:
 
 private:
 
-    /**
-     * Write a JSON file containing the derivation attributes.
-     */
-    void writeStructuredAttrs();
-
     /**
      * Start an in-process nix daemon thread for recursive-nix.
      */
     void startDaemon();
 
-public:
-
-    void stopDaemon() override;
-
-private:
-
-    void addDependency(const StorePath & path) override;
+    /**
+     * Stop the in-process nix daemon thread.
+     * @see startDaemon
+     */
+    void stopDaemon();
 
 protected:
 
+    void addDependency(const StorePath & path) override;
+
     /**
      * Make a file owned by the builder.
      *
@@ -319,9 +336,7 @@ protected:
     /**
      * Create a file in `tmpDir` owned by the builder.
      */
-    void writeBuilderFile(
-        const std::string & name,
-        std::string_view contents);
+    void writeBuilderFile(const std::string & name, std::string_view contents);
 
     /**
      * Run the builder's process.
@@ -332,9 +347,7 @@ protected:
      * Move the current process into the chroot, if any. Called early
      * by runChild().
      */
-    virtual void enterChroot()
-    {
-    }
+    virtual void enterChroot() {}
 
     /**
      * Change the current process's uid/gid to the build user, if
@@ -356,22 +369,25 @@ private:
      */
     SingleDrvOutputs registerOutputs();
 
+protected:
+
     /**
-     * Check that an output meets the requirements specified by the
-     * 'outputChecks' attribute (or the legacy
-     * '{allowed,disallowed}{References,Requisites}' attributes).
+     * Delete the temporary directory, if we have one.
+     *
+     * @param force We know the build suceeded, so don't attempt to
+     * preseve anything for debugging.
      */
-    void checkOutputs(const std::map<std::string, ValidPathInfo> & outputs);
+    virtual void cleanupBuild(bool force);
+
+    /**
+     * Kill any processes running under the build user UID or in the
+     * cgroup of the build.
+     */
+    virtual void killSandbox(bool getStats);
 
 public:
 
-    void deleteTmpDir(bool force) override;
-
-    void killSandbox(bool getStats) override;
-
-protected:
-
-    virtual void cleanupBuild();
+    bool killChild() override;
 
 private:
 
@@ -395,27 +411,22 @@ private:
 };
 
 void handleDiffHook(
-    uid_t uid, uid_t gid,
-    const Path & tryA, const Path & tryB,
-    const Path & drvPath, const Path & tmpDir)
+    uid_t uid, uid_t gid, const Path & tryA, const Path & tryB, const Path & drvPath, const Path & tmpDir)
 {
     auto & diffHookOpt = settings.diffHook.get();
     if (diffHookOpt && settings.runDiffHook) {
         auto & diffHook = *diffHookOpt;
         try {
-            auto diffRes = runProgram(RunOptions {
-                .program = diffHook,
-                .lookupPath = true,
-                .args = {tryA, tryB, drvPath, tmpDir},
-                .uid = uid,
-                .gid = gid,
-                .chdir = "/"
-            });
+            auto diffRes = runProgram(
+                RunOptions{
+                    .program = diffHook,
+                    .lookupPath = true,
+                    .args = {tryA, tryB, drvPath, tmpDir},
+                    .uid = uid,
+                    .gid = gid,
+                    .chdir = "/"});
             if (!statusOk(diffRes.first))
-                throw ExecError(diffRes.first,
-                    "diff-hook program '%1%' %2%",
-                    diffHook,
-                    statusToString(diffRes.first));
+                throw ExecError(diffRes.first, "diff-hook program '%1%' %2%", diffHook, statusToString(diffRes.first));
 
             if (diffRes.second != "")
                 printError(chomp(diffRes.second));
@@ -430,15 +441,6 @@ void handleDiffHook(
 
 const Path DerivationBuilderImpl::homeDir = "/homeless-shelter";
 
-
-static LocalStore & getLocalStore(Store & store)
-{
-    auto p = dynamic_cast<LocalStore *>(&store);
-    assert(p);
-    return *p;
-}
-
-
 void DerivationBuilderImpl::killSandbox(bool getStats)
 {
     if (buildUser) {
@@ -448,31 +450,26 @@ void DerivationBuilderImpl::killSandbox(bool getStats)
     }
 }
 
-
-bool DerivationBuilderImpl::prepareBuild()
+bool DerivationBuilderImpl::killChild()
 {
-    if (useBuildUsers()) {
-        if (!buildUser)
-            buildUser = getBuildUser();
+    bool ret = pid != -1;
+    if (ret) {
+        /* If we're using a build user, then there is a tricky race
+           condition: if we kill the build user before the child has
+           done its setuid() to the build user uid, then it won't be
+           killed, and we'll potentially lock up in pid.wait().  So
+           also send a conventional kill to the child. */
+        ::kill(-pid, SIGKILL); /* ignore the result */
 
-        if (!buildUser)
-            return false;
+        killSandbox(true);
+
+        pid.wait();
     }
-
-    return true;
+    return ret;
 }
 
-
-std::variant<std::pair<BuildResult::Status, Error>, SingleDrvOutputs> DerivationBuilderImpl::unprepareBuild()
+SingleDrvOutputs DerivationBuilderImpl::unprepareBuild()
 {
-    // FIXME: get rid of this, rely on RAII.
-    Finally releaseBuildUser([&](){
-        /* Release the build user at the end of this function. We don't do
-           it right away because we don't want another build grabbing this
-           uid and then messing around with our output. */
-        buildUser.reset();
-    });
-
     /* Since we got an EOF on the logger pipe, the builder is presumed
        to have terminated.  In fact, the builder could also have
        simply have closed its end of the pipe, so just to be sure,
@@ -504,76 +501,36 @@ std::variant<std::pair<BuildResult::Status, Error>, SingleDrvOutputs> Derivation
     stopDaemon();
 
     if (buildResult.cpuUser && buildResult.cpuSystem) {
-        debug("builder for '%s' terminated with status %d, user CPU %.3fs, system CPU %.3fs",
+        debug(
+            "builder for '%s' terminated with status %d, user CPU %.3fs, system CPU %.3fs",
             store.printStorePath(drvPath),
             status,
             ((double) buildResult.cpuUser->count()) / 1000000,
             ((double) buildResult.cpuSystem->count()) / 1000000);
     }
 
-    bool diskFull = false;
+    /* Check the exit status. */
+    if (!statusOk(status)) {
 
-    try {
+        /* Check *before* cleaning up. */
+        bool diskFull = decideWhetherDiskFull();
 
-        /* Check the exit status. */
-        if (!statusOk(status)) {
+        cleanupBuild(false);
 
-            diskFull |= decideWhetherDiskFull();
-
-            cleanupBuild();
-
-            auto msg = fmt(
-                "Cannot build '%s'.\n"
-                "Reason: " ANSI_RED "builder %s" ANSI_NORMAL ".",
-                Magenta(store.printStorePath(drvPath)),
-                statusToString(status));
-
-            msg += showKnownOutputs(store, drv);
-
-            miscMethods->appendLogTailErrorMsg(msg);
-
-            if (diskFull)
-                msg += "\nnote: build failure may have been caused by lack of free disk space";
-
-            throw BuildError(msg);
-        }
-
-        /* Compute the FS closure of the outputs and register them as
-           being valid. */
-        auto builtOutputs = registerOutputs();
-
-        StorePathSet outputPaths;
-        for (auto & [_, output] : builtOutputs)
-            outputPaths.insert(output.outPath);
-        runPostBuildHook(
-            store,
-            *logger,
-            drvPath,
-            outputPaths
-        );
-
-        /* Delete unused redirected outputs (when doing hash rewriting). */
-        for (auto & i : redirectedOutputs)
-            deletePath(store.Store::toRealPath(i.second));
-
-        deleteTmpDir(true);
-
-        return std::move(builtOutputs);
-
-    } catch (BuildError & e) {
-        BuildResult::Status st =
-            dynamic_cast<NotDeterministic*>(&e) ? BuildResult::NotDeterministic :
-            statusOk(status) ? BuildResult::OutputRejected :
-            !derivationType.isSandboxed() || diskFull ? BuildResult::TransientFailure :
-            BuildResult::PermanentFailure;
-
-        return std::pair{std::move(st), std::move(e)};
+        throw BuilderFailureError{
+            !derivationType.isSandboxed() || diskFull ? BuildResult::TransientFailure : BuildResult::PermanentFailure,
+            status,
+            diskFull ? "\nnote: build failure may have been caused by lack of free disk space" : "",
+        };
     }
-}
 
-void DerivationBuilderImpl::cleanupBuild()
-{
-    deleteTmpDir(false);
+    /* Compute the FS closure of the outputs and register them as
+       being valid. */
+    auto builtOutputs = registerOutputs();
+
+    cleanupBuild(true);
+
+    return builtOutputs;
 }
 
 static void chmod_(const Path & path, mode_t mode)
@@ -582,7 +539,6 @@ static void chmod_(const Path & path, mode_t mode)
         throw SysError("setting permissions on '%s'", path);
 }
 
-
 /* Move/rename path 'src' to 'dst'. Temporarily make 'src' writable if
    it's a directory and we're not root (to be able to update the
    directory's parent link ".."). */
@@ -601,7 +557,6 @@ static void movePath(const Path & src, const Path & dst)
         chmod_(dst, st.st_mode);
 }
 
-
 static void replaceValidPath(const Path & storePath, const Path & tmpPath)
 {
     /* We can't atomically replace storePath (the original) with
@@ -648,14 +603,12 @@ bool DerivationBuilderImpl::decideWhetherDiskFull()
        so, we don't mark this build as a permanent failure. */
 #if HAVE_STATVFS
     {
-        auto & localStore = getLocalStore(store);
         uint64_t required = 8ULL * 1024 * 1024; // FIXME: make configurable
         struct statvfs st;
-        if (statvfs(localStore.config->realStoreDir.get().c_str(), &st) == 0 &&
-            (uint64_t) st.f_bavail * st.f_bsize < required)
+        if (statvfs(store.config->realStoreDir.get().c_str(), &st) == 0
+            && (uint64_t) st.f_bavail * st.f_bsize < required)
             diskFull = true;
-        if (statvfs(tmpDir.c_str(), &st) == 0 &&
-            (uint64_t) st.f_bavail * st.f_bsize < required)
+        if (statvfs(tmpDir.c_str(), &st) == 0 && (uint64_t) st.f_bavail * st.f_bsize < required)
             diskFull = true;
     }
 #endif
@@ -704,14 +657,23 @@ static bool checkNotWorldWritable(std::filesystem::path path)
         auto st = lstat(path);
         if (st.st_mode & S_IWOTH)
             return false;
-        if (path == path.parent_path()) break;
+        if (path == path.parent_path())
+            break;
         path = path.parent_path();
     }
     return true;
 }
 
-void DerivationBuilderImpl::startBuilder()
+std::optional<Descriptor> DerivationBuilderImpl::startBuild()
 {
+    if (useBuildUsers()) {
+        if (!buildUser)
+            buildUser = getBuildUser();
+
+        if (!buildUser)
+            return std::nullopt;
+    }
+
     /* Make sure that no other processes are executing under the
        sandbox uids. This must be done before any chownToBuilder()
        calls. */
@@ -719,34 +681,39 @@ void DerivationBuilderImpl::startBuilder()
 
     /* Right platform? */
     if (!drvOptions.canBuildLocally(store, drv)) {
-        auto msg = fmt(
-            "Cannot build '%s'.\n"
-            "Reason: " ANSI_RED "required system or feature not available" ANSI_NORMAL "\n"
-            "Required system: '%s' with features {%s}\n"
-            "Current system: '%s' with features {%s}",
-            Magenta(store.printStorePath(drvPath)),
-            Magenta(drv.platform),
-            concatStringsSep(", ", drvOptions.getRequiredSystemFeatures(drv)),
-            Magenta(settings.thisSystem),
-            concatStringsSep<StringSet>(", ", store.config.systemFeatures));
+        auto msg =
+            fmt("Cannot build '%s'.\n"
+                "Reason: " ANSI_RED "required system or feature not available" ANSI_NORMAL
+                "\n"
+                "Required system: '%s' with features {%s}\n"
+                "Current system: '%s' with features {%s}",
+                Magenta(store.printStorePath(drvPath)),
+                Magenta(drv.platform),
+                concatStringsSep(", ", drvOptions.getRequiredSystemFeatures(drv)),
+                Magenta(settings.thisSystem),
+                concatStringsSep<StringSet>(", ", store.Store::config.systemFeatures));
 
-        // since aarch64-darwin has Rosetta 2, this user can actually run x86_64-darwin on their hardware - we should tell them to run the command to install Darwin 2
+        // since aarch64-darwin has Rosetta 2, this user can actually run x86_64-darwin on their hardware - we should
+        // tell them to run the command to install Darwin 2
         if (drv.platform == "x86_64-darwin" && settings.thisSystem == "aarch64-darwin")
-          msg += fmt("\nNote: run `%s` to run programs for x86_64-darwin", Magenta("/usr/sbin/softwareupdate --install-rosetta && launchctl stop org.nixos.nix-daemon"));
+            msg +=
+                fmt("\nNote: run `%s` to run programs for x86_64-darwin",
+                    Magenta("/usr/sbin/softwareupdate --install-rosetta && launchctl stop org.nixos.nix-daemon"));
 
-        throw BuildError(msg);
+        throw BuildError(BuildResult::InputRejected, msg);
     }
 
-    auto buildDir = getLocalStore(store).config->getBuildDir();
+    auto buildDir = store.config->getBuildDir();
 
     createDirs(buildDir);
 
     if (buildUser && !checkNotWorldWritable(buildDir))
-        throw Error("Path %s or a parent directory is world-writable or a symlink. That's not allowed for security.", buildDir);
+        throw Error(
+            "Path %s or a parent directory is world-writable or a symlink. That's not allowed for security.", buildDir);
 
     /* Create a temporary directory where the build will take
        place. */
-    topTmpDir = createTempDir(buildDir, "nix-build-" + std::string(drvPath.name()), 0700);
+    topTmpDir = createTempDir(buildDir, "nix", 0700);
     setBuildTmpDir();
     assert(!tmpDir.empty());
 
@@ -770,22 +737,20 @@ void DerivationBuilderImpl::startBuilder()
            corresponding to the valid outputs, and rewrite the
            contents of the new outputs to replace the dummy strings
            with the actual hashes. */
-        auto scratchPath =
-            !status.known
-                ? makeFallbackPath(outputName)
-            : !needsHashRewrite()
-                /* Can always use original path in sandbox */
-                ? status.known->path
-            : !status.known->isPresent()
-                /* If path doesn't yet exist can just use it */
-                ? status.known->path
-            : buildMode != bmRepair && !status.known->isValid()
-                /* If we aren't repairing we'll delete a corrupted path, so we
-                   can use original path */
-                ? status.known->path
-            :   /* If we are repairing or the path is totally valid, we'll need
-                   to use a temporary path */
-                makeFallbackPath(status.known->path);
+        auto scratchPath = !status.known ? makeFallbackPath(outputName)
+                           : !needsHashRewrite()
+                               /* Can always use original path in sandbox */
+                               ? status.known->path
+                               : !status.known->isPresent()
+                                     /* If path doesn't yet exist can just use it */
+                                     ? status.known->path
+                                     : buildMode != bmRepair && !status.known->isValid()
+                                           /* If we aren't repairing we'll delete a corrupted path, so we
+                                              can use original path */
+                                           ? status.known->path
+                                           : /* If we are repairing or the path is totally valid, we'll need
+                                                to use a temporary path */
+                                           makeFallbackPath(status.known->path);
         scratchOutputs.insert_or_assign(outputName, scratchPath);
 
         /* Substitute output placeholders with the scratch output paths.
@@ -793,20 +758,22 @@ void DerivationBuilderImpl::startBuilder()
         inputRewrites[hashPlaceholder(outputName)] = store.printStorePath(scratchPath);
 
         /* Additional tasks if we know the final path a priori. */
-        if (!status.known) continue;
+        if (!status.known)
+            continue;
         auto fixedFinalPath = status.known->path;
 
         /* Additional tasks if the final and scratch are both known and
            differ. */
-        if (fixedFinalPath == scratchPath) continue;
+        if (fixedFinalPath == scratchPath)
+            continue;
 
         /* Ensure scratch path is ours to use. */
         deletePath(store.printStorePath(scratchPath));
 
         /* Rewrite and unrewrite paths */
         {
-            std::string h1 { fixedFinalPath.hashPart() };
-            std::string h2 { scratchPath.hashPart() };
+            std::string h1{fixedFinalPath.hashPart()};
+            std::string h2{scratchPath.hashPart()};
             inputRewrites[h1] = h2;
         }
 
@@ -816,28 +783,11 @@ void DerivationBuilderImpl::startBuilder()
     /* Construct the environment passed to the builder. */
     initEnv();
 
-    writeStructuredAttrs();
-
-    /* Handle exportReferencesGraph(), if set. */
-    if (!parsedDrv) {
-        for (auto & [fileName, ss] : drvOptions.exportReferencesGraph) {
-            StorePathSet storePathSet;
-            for (auto & storePathS : ss) {
-                if (!store.isInStore(storePathS))
-                    throw BuildError("'exportReferencesGraph' contains a non-store path '%1%'", storePathS);
-                storePathSet.insert(store.toStorePath(storePathS).first);
-            }
-            /* Write closure info to <fileName>. */
-            writeFile(tmpDir + "/" + fileName,
-                store.makeValidityRegistration(
-                    store.exportReferences(storePathSet, inputPaths), false, false));
-        }
-    }
-
     prepareSandbox();
 
     if (needsHashRewrite() && pathExists(homeDir))
-        throw Error("home directory '%1%' exists; please remove it to assure purity of builds without sandboxing", homeDir);
+        throw Error(
+            "home directory '%1%' exists; please remove it to assure purity of builds without sandboxing", homeDir);
 
     /* Fire up a Nix daemon to process recursive Nix calls from the
        builder. */
@@ -884,51 +834,22 @@ void DerivationBuilderImpl::startBuilder()
     startChild();
 
     pid.setSeparatePG(true);
-    miscMethods->childStarted(builderOut.get());
 
     processSandboxSetupMessages();
+
+    return builderOut.get();
 }
 
-DerivationBuilderImpl::PathsInChroot DerivationBuilderImpl::getPathsInSandbox()
+PathsInChroot DerivationBuilderImpl::getPathsInSandbox()
 {
-    PathsInChroot pathsInChroot;
-
     /* Allow a user-configurable set of directories from the
        host file system. */
-    for (auto i : settings.sandboxPaths.get()) {
-        if (i.empty()) continue;
-        bool optional = false;
-        if (i[i.size() - 1] == '?') {
-            optional = true;
-            i.pop_back();
-        }
-        size_t p = i.find('=');
-        if (p == std::string::npos)
-            pathsInChroot[i] = {i, optional};
-        else
-            pathsInChroot[i.substr(0, p)] = {i.substr(p + 1), optional};
-    }
-    if (hasPrefix(store.storeDir, tmpDirInSandbox()))
-    {
+    PathsInChroot pathsInChroot = defaultPathsInChroot;
+
+    if (hasPrefix(store.storeDir, tmpDirInSandbox())) {
         throw Error("`sandbox-build-dir` must not contain the storeDir");
     }
-    pathsInChroot[tmpDirInSandbox()] = tmpDir;
-
-    /* Add the closure of store paths to the chroot. */
-    StorePathSet closure;
-    for (auto & i : pathsInChroot)
-        try {
-            if (store.isInStore(i.second.source))
-                store.computeFSClosure(store.toStorePath(i.second.source).first, closure);
-        } catch (InvalidPath & e) {
-        } catch (Error & e) {
-            e.addTrace({}, "while processing sandbox path '%s'", i.second.source);
-            throw;
-        }
-    for (auto & i : closure) {
-        auto p = store.printStorePath(i);
-        pathsInChroot.insert_or_assign(p, p);
-    }
+    pathsInChroot[tmpDirInSandbox()] = {.source = tmpDir};
 
     PathSet allowedPaths = settings.allowedImpureHostPrefixes;
 
@@ -950,8 +871,10 @@ DerivationBuilderImpl::PathsInChroot DerivationBuilderImpl::getPathsInSandbox()
             }
         }
         if (!found)
-            throw Error("derivation '%s' requested impure path '%s', but it was not in allowed-impure-host-deps",
-                store.printStorePath(drvPath), i);
+            throw Error(
+                "derivation '%s' requested impure path '%s', but it was not in allowed-impure-host-deps",
+                store.printStorePath(drvPath),
+                i);
 
         /* Allow files in drvOptions.impureHostDeps to be missing; e.g.
            macOS 11+ has no /usr/lib/libSystem*.dylib */
@@ -960,16 +883,13 @@ DerivationBuilderImpl::PathsInChroot DerivationBuilderImpl::getPathsInSandbox()
 
     if (settings.preBuildHook != "") {
         printMsg(lvlChatty, "executing pre-build hook '%1%'", settings.preBuildHook);
-        enum BuildHookState {
-            stBegin,
-            stExtraChrootDirs
-        };
+
+        enum BuildHookState { stBegin, stExtraChrootDirs };
+
         auto state = stBegin;
         auto lines = runProgram(settings.preBuildHook, false, getPreBuildHookArgs());
         auto lastPos = std::string::size_type{0};
-        for (auto nlPos = lines.find('\n'); nlPos != std::string::npos;
-                nlPos = lines.find('\n', lastPos))
-        {
+        for (auto nlPos = lines.find('\n'); nlPos != std::string::npos; nlPos = lines.find('\n', lastPos)) {
             auto line = lines.substr(lastPos, nlPos - lastPos);
             lastPos = nlPos + 1;
             if (state == stBegin) {
@@ -984,9 +904,9 @@ DerivationBuilderImpl::PathsInChroot DerivationBuilderImpl::getPathsInSandbox()
                 } else {
                     auto p = line.find('=');
                     if (p == std::string::npos)
-                        pathsInChroot[line] = line;
+                        pathsInChroot[line] = {.source = line};
                     else
-                        pathsInChroot[line.substr(0, p)] = line.substr(p + 1);
+                        pathsInChroot[line.substr(0, p)] = {.source = line.substr(p + 1)};
                 }
             }
         }
@@ -1040,14 +960,17 @@ void DerivationBuilderImpl::processSandboxSetupMessages()
                 return readLine(builderOut.get());
             } catch (Error & e) {
                 auto status = pid.wait();
-                e.addTrace({}, "while waiting for the build environment for '%s' to initialize (%s, previous messages: %s)",
+                e.addTrace(
+                    {},
+                    "while waiting for the build environment for '%s' to initialize (%s, previous messages: %s)",
                     store.printStorePath(drvPath),
                     statusToString(status),
                     concatStringsSep("|", msgs));
                 throw;
             }
         }();
-        if (msg.substr(0, 1) == "\2") break;
+        if (msg.substr(0, 1) == "\2")
+            break;
         if (msg.substr(0, 1) == "\1") {
             FdSource source(builderOut.get());
             auto ex = readError(source);
@@ -1083,22 +1006,18 @@ void DerivationBuilderImpl::initEnv()
     env["NIX_STORE"] = store.storeDir;
 
     /* The maximum number of cores to utilize for parallel building. */
-    env["NIX_BUILD_CORES"] = fmt("%d", settings.buildCores);
+    env["NIX_BUILD_CORES"] = fmt("%d", settings.buildCores ? settings.buildCores : settings.getDefaultCores());
 
-    /* In non-structured mode, set all bindings either directory in the
-       environment or via a file, as specified by
-       `DerivationOptions::passAsFile`. */
-    if (!parsedDrv) {
-        for (auto & i : drv.env) {
-            if (drvOptions.passAsFile.find(i.first) == drvOptions.passAsFile.end()) {
-                env[i.first] = i.second;
-            } else {
-                auto hash = hashString(HashAlgorithm::SHA256, i.first);
-                std::string fn = ".attr-" + hash.to_string(HashFormat::Nix32, false);
-                writeBuilderFile(fn, rewriteStrings(i.second, inputRewrites));
-                env[i.first + "Path"] = tmpDirInSandbox() + "/" + fn;
-            }
-        }
+    /* Write the final environment. Note that this is intentionally
+       *not* `drv.env`, because we've desugared things like like
+       "passAFile", "expandReferencesGraph", structured attrs, etc. */
+    for (const auto & [name, info] : desugaredEnv.variables) {
+        env[name] = info.prependBuildDirectory ? tmpDirInSandbox() + "/" + info.value : info.value;
+    }
+
+    /* Add extra files, similar to `finalEnv` */
+    for (const auto & [fileName, value] : desugaredEnv.extraFiles) {
+        writeBuilderFile(fileName, rewriteStrings(value, inputRewrites));
     }
 
     /* For convenience, set an environment pointing to the top build
@@ -1118,7 +1037,8 @@ void DerivationBuilderImpl::initEnv()
        derivation, tell the builder, so that for instance `fetchurl'
        can skip checking the output.  On older Nixes, this environment
        variable won't be set, so `fetchurl' will do the check. */
-    if (derivationType.isFixed()) env["NIX_OUTPUT_CHECKED"] = "1";
+    if (derivationType.isFixed())
+        env["NIX_OUTPUT_CHECKED"] = "1";
 
     /* *Only* if this is a fixed-output derivation, propagate the
        values of the environment variables specified in the
@@ -1134,7 +1054,7 @@ void DerivationBuilderImpl::initEnv()
         if (!impureEnv.empty())
             experimentalFeatureSettings.require(Xp::ConfigurableImpureEnv);
 
-        for (auto & i : drvOptions.impureEnvVars){
+        for (auto & i : drvOptions.impureEnvVars) {
             auto envVar = impureEnv.find(i);
             if (envVar != impureEnv.end()) {
                 env[i] = envVar->second;
@@ -1153,41 +1073,13 @@ void DerivationBuilderImpl::initEnv()
     env["TERM"] = "xterm-256color";
 }
 
-
-void DerivationBuilderImpl::writeStructuredAttrs()
-{
-    if (parsedDrv) {
-        auto json = parsedDrv->prepareStructuredAttrs(
-            store,
-            drvOptions,
-            inputPaths,
-            drv.outputs);
-        nlohmann::json rewritten;
-        for (auto & [i, v] : json["outputs"].get<nlohmann::json::object_t>()) {
-            /* The placeholder must have a rewrite, so we use it to cover both the
-               cases where we know or don't know the output path ahead of time. */
-            rewritten[i] = rewriteStrings((std::string) v, inputRewrites);
-        }
-
-        json["outputs"] = rewritten;
-
-        auto jsonSh = StructuredAttrs::writeShell(json);
-
-        writeBuilderFile(".attrs.sh", rewriteStrings(jsonSh, inputRewrites));
-        env["NIX_ATTRS_SH_FILE"] = tmpDirInSandbox() + "/.attrs.sh";
-        writeBuilderFile(".attrs.json", rewriteStrings(json.dump(), inputRewrites));
-        env["NIX_ATTRS_JSON_FILE"] = tmpDirInSandbox() + "/.attrs.json";
-    }
-}
-
-
 void DerivationBuilderImpl::startDaemon()
 {
     experimentalFeatureSettings.require(Xp::RecursiveNix);
 
     auto store = makeRestrictedStore(
-        [&]{
-            auto config = make_ref<LocalStore::Config>(*getLocalStore(this->store).config);
+        [&] {
+            auto config = make_ref<LocalStore::Config>(*this->store.config);
             config->pathInfoCacheSize = 0;
             config->stateDir = "/no-such-path";
             config->logDir = "/no-such-path";
@@ -1207,18 +1099,18 @@ void DerivationBuilderImpl::startDaemon()
     chownToBuilder(socketPath);
 
     daemonThread = std::thread([this, store]() {
-
         while (true) {
 
             /* Accept a connection. */
             struct sockaddr_un remoteAddr;
             socklen_t remoteAddrLen = sizeof(remoteAddr);
 
-            AutoCloseFD remote = accept(daemonSocket.get(),
-                (struct sockaddr *) &remoteAddr, &remoteAddrLen);
+            AutoCloseFD remote = accept(daemonSocket.get(), (struct sockaddr *) &remoteAddr, &remoteAddrLen);
             if (!remote) {
-                if (errno == EINTR || errno == EAGAIN) continue;
-                if (errno == EINVAL || errno == ECONNABORTED) break;
+                if (errno == EINTR || errno == EAGAIN)
+                    continue;
+                if (errno == EINVAL || errno == ECONNABORTED)
+                    break;
                 throw SysError("accepting connection");
             }
 
@@ -1229,10 +1121,7 @@ void DerivationBuilderImpl::startDaemon()
             auto workerThread = std::thread([store, remote{std::move(remote)}]() {
                 try {
                     daemon::processConnection(
-                        store,
-                        FdSource(remote.get()),
-                        FdSink(remote.get()),
-                        NotTrusted, daemon::Recursive);
+                        store, FdSource(remote.get()), FdSink(remote.get()), NotTrusted, daemon::Recursive);
                     debug("terminated daemon connection");
                 } catch (const Interrupted &) {
                     debug("interrupted daemon connection");
@@ -1248,7 +1137,6 @@ void DerivationBuilderImpl::startDaemon()
     });
 }
 
-
 void DerivationBuilderImpl::stopDaemon()
 {
     if (daemonSocket && shutdown(daemonSocket.get(), SHUT_RDWR) == -1) {
@@ -1281,34 +1169,35 @@ void DerivationBuilderImpl::stopDaemon()
     daemonSocket.close();
 }
 
-
 void DerivationBuilderImpl::addDependency(const StorePath & path)
 {
-    if (isAllowed(path)) return;
+    if (isAllowed(path))
+        return;
 
     addedPaths.insert(path);
 }
 
 void DerivationBuilderImpl::chownToBuilder(const Path & path)
 {
-    if (!buildUser) return;
+    if (!buildUser)
+        return;
     if (chown(path.c_str(), buildUser->getUID(), buildUser->getGID()) == -1)
         throw SysError("cannot change ownership of '%1%'", path);
 }
 
 void DerivationBuilderImpl::chownToBuilder(int fd, const Path & path)
 {
-    if (!buildUser) return;
+    if (!buildUser)
+        return;
     if (fchown(fd, buildUser->getUID(), buildUser->getGID()) == -1)
         throw SysError("cannot change ownership of file '%1%'", path);
 }
 
-void DerivationBuilderImpl::writeBuilderFile(
-    const std::string & name,
-    std::string_view contents)
+void DerivationBuilderImpl::writeBuilderFile(const std::string & name, std::string_view contents)
 {
     auto path = std::filesystem::path(tmpDir) / name;
-    AutoCloseFD fd{openat(tmpDirFd.get(), name.c_str(), O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC | O_EXCL | O_NOFOLLOW, 0666)};
+    AutoCloseFD fd{
+        openat(tmpDirFd.get(), name.c_str(), O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC | O_EXCL | O_NOFOLLOW, 0666)};
     if (!fd)
         throw SysError("creating file %s", path);
     writeFile(fd, path, contents);
@@ -1335,13 +1224,15 @@ void DerivationBuilderImpl::runChild()
         };
 
         if (drv.isBuiltin() && drv.builder == "builtin:fetchurl") {
-           try {
-               ctx.netrcData = readFile(settings.netrcFile);
-           } catch (SystemError &) { }
+            try {
+                ctx.netrcData = readFile(settings.netrcFile);
+            } catch (SystemError &) {
+            }
 
-           try {
-               ctx.caFileData = readFile(settings.caFile);
-           } catch (SystemError &) { }
+            try {
+                ctx.caFileData = readFile(settings.caFile);
+            } catch (SystemError &) {
+            }
         }
 
         enterChroot();
@@ -1353,7 +1244,7 @@ void DerivationBuilderImpl::runChild()
         unix::closeExtraFDs();
 
         /* Disable core dumps by default. */
-        struct rlimit limit = { 0, RLIM_INFINITY };
+        struct rlimit limit = {0, RLIM_INFINITY};
         setrlimit(RLIMIT_CORE, &limit);
 
         // FIXME: set other limits to deterministic values?
@@ -1371,8 +1262,7 @@ void DerivationBuilderImpl::runChild()
                 logger = makeJSONLogger(getStandardError());
 
                 for (auto & e : drv.outputs)
-                    ctx.outputs.insert_or_assign(e.first,
-                        store.printStorePath(scratchOutputs.at(e.first)));
+                    ctx.outputs.insert_or_assign(e.first, store.printStorePath(scratchOutputs.at(e.first)));
 
                 std::string builtinName = drv.builder.substr(8);
                 assert(RegisterBuiltinBuilder::builtinBuilders);
@@ -1424,14 +1314,10 @@ void DerivationBuilderImpl::setUser()
         if (setgroups(gids.size(), gids.data()) == -1)
             throw SysError("cannot set supplementary groups of build user");
 
-        if (setgid(buildUser->getGID()) == -1 ||
-            getgid() != buildUser->getGID() ||
-            getegid() != buildUser->getGID())
+        if (setgid(buildUser->getGID()) == -1 || getgid() != buildUser->getGID() || getegid() != buildUser->getGID())
             throw SysError("setgid failed");
 
-        if (setuid(buildUser->getUID()) == -1 ||
-            getuid() != buildUser->getUID() ||
-            geteuid() != buildUser->getUID())
+        if (setuid(buildUser->getUID()) == -1 || getuid() != buildUser->getUID() || geteuid() != buildUser->getUID())
             throw SysError("setuid failed");
     }
 }
@@ -1450,17 +1336,16 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
        outputs to allow hard links between outputs. */
     InodesSeen inodesSeen;
 
-    Path checkSuffix = ".check";
-
-    std::exception_ptr delayedException;
-
     /* The paths that can be referenced are the input closures, the
        output paths, and any paths that have been built via recursive
        Nix calls. */
     StorePathSet referenceablePaths;
-    for (auto & p : inputPaths) referenceablePaths.insert(p);
-    for (auto & i : scratchOutputs) referenceablePaths.insert(i.second);
-    for (auto & p : addedPaths) referenceablePaths.insert(p);
+    for (auto & p : inputPaths)
+        referenceablePaths.insert(p);
+    for (auto & i : scratchOutputs)
+        referenceablePaths.insert(i.second);
+    for (auto & p : addedPaths)
+        referenceablePaths.insert(p);
 
     /* Check whether the output paths were created, and make all
        output paths read-only.  Then get the references of each output (that we
@@ -1468,43 +1353,47 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
        that are most definitely already installed, we just store their final
        name so we can also use it in rewrites. */
     StringSet outputsToSort;
-    struct AlreadyRegistered { StorePath path; };
-    struct PerhapsNeedToRegister { StorePathSet refs; };
+
+    struct AlreadyRegistered
+    {
+        StorePath path;
+    };
+
+    struct PerhapsNeedToRegister
+    {
+        StorePathSet refs;
+    };
+
     std::map<std::string, std::variant<AlreadyRegistered, PerhapsNeedToRegister>> outputReferencesIfUnregistered;
     std::map<std::string, struct stat> outputStats;
     for (auto & [outputName, _] : drv.outputs) {
         auto scratchOutput = get(scratchOutputs, outputName);
-        if (!scratchOutput)
-            throw BuildError(
-                "builder for '%s' has no scratch output for '%s'",
-                store.printStorePath(drvPath), outputName);
+        assert(scratchOutput);
         auto actualPath = realPathInSandbox(store.printStorePath(*scratchOutput));
 
         outputsToSort.insert(outputName);
 
         /* Updated wanted info to remove the outputs we definitely don't need to register */
         auto initialOutput = get(initialOutputs, outputName);
-        if (!initialOutput)
-            throw BuildError(
-                "builder for '%s' has no initial output for '%s'",
-                store.printStorePath(drvPath), outputName);
+        assert(initialOutput);
         auto & initialInfo = *initialOutput;
 
         /* Don't register if already valid, and not checking */
-        initialInfo.wanted = buildMode == bmCheck
-            || !(initialInfo.known && initialInfo.known->isValid());
-        if (!initialInfo.wanted) {
+        bool wanted = buildMode == bmCheck || !(initialInfo.known && initialInfo.known->isValid());
+        if (!wanted) {
             outputReferencesIfUnregistered.insert_or_assign(
-                outputName,
-                AlreadyRegistered { .path = initialInfo.known->path });
+                outputName, AlreadyRegistered{.path = initialInfo.known->path});
             continue;
         }
 
         auto optSt = maybeLstat(actualPath.c_str());
         if (!optSt)
             throw BuildError(
+                BuildResult::OutputRejected,
                 "builder for '%s' failed to produce output path for output '%s' at '%s'",
-                store.printStorePath(drvPath), outputName, actualPath);
+                store.printStorePath(drvPath),
+                outputName,
+                actualPath);
         struct stat & st = *optSt;
 
 #ifndef __CYGWIN__
@@ -1512,20 +1401,20 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
            that means that someone else can have interfered with the
            build.  Also, the output should be owned by the build
            user. */
-        if ((!S_ISLNK(st.st_mode) && (st.st_mode & (S_IWGRP | S_IWOTH))) ||
-            (buildUser && st.st_uid != buildUser->getUID()))
+        if ((!S_ISLNK(st.st_mode) && (st.st_mode & (S_IWGRP | S_IWOTH)))
+            || (buildUser && st.st_uid != buildUser->getUID()))
             throw BuildError(
-                    "suspicious ownership or permission on '%s' for output '%s'; rejecting this build output",
-                    actualPath, outputName);
+                BuildResult::OutputRejected,
+                "suspicious ownership or permission on '%s' for output '%s'; rejecting this build output",
+                actualPath,
+                outputName);
 #endif
 
         /* Canonicalise first.  This ensures that the path we're
            rewriting doesn't contain a hard link to /etc/shadow or
            something like that. */
         canonicalisePathMetaData(
-            actualPath,
-            buildUser ? std::optional(buildUser->getUIDRange()) : std::nullopt,
-            inodesSeen);
+            actualPath, buildUser ? std::optional(buildUser->getUIDRange()) : std::nullopt, inodesSeen);
 
         bool discardReferences = false;
         if (auto udr = get(drvOptions.unsafeDiscardReferences, outputName)) {
@@ -1543,40 +1432,46 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
             references = scanForReferences(blank, actualPath, referenceablePaths);
         }
 
-        outputReferencesIfUnregistered.insert_or_assign(
-            outputName,
-            PerhapsNeedToRegister { .refs = references });
+        outputReferencesIfUnregistered.insert_or_assign(outputName, PerhapsNeedToRegister{.refs = references});
         outputStats.insert_or_assign(outputName, std::move(st));
     }
 
-    auto sortedOutputNames = topoSort(outputsToSort,
+    auto sortedOutputNames = topoSort(
+        outputsToSort,
         {[&](const std::string & name) {
             auto orifu = get(outputReferencesIfUnregistered, name);
             if (!orifu)
                 throw BuildError(
+                    BuildResult::OutputRejected,
                     "no output reference for '%s' in build of '%s'",
-                    name, store.printStorePath(drvPath));
-            return std::visit(overloaded {
-                /* Since we'll use the already installed versions of these, we
-                   can treat them as leaves and ignore any references they
-                   have. */
-                [&](const AlreadyRegistered &) { return StringSet {}; },
-                [&](const PerhapsNeedToRegister & refs) {
-                    StringSet referencedOutputs;
-                    /* FIXME build inverted map up front so no quadratic waste here */
-                    for (auto & r : refs.refs)
-                        for (auto & [o, p] : scratchOutputs)
-                            if (r == p)
-                                referencedOutputs.insert(o);
-                    return referencedOutputs;
+                    name,
+                    store.printStorePath(drvPath));
+            return std::visit(
+                overloaded{
+                    /* Since we'll use the already installed versions of these, we
+                       can treat them as leaves and ignore any references they
+                       have. */
+                    [&](const AlreadyRegistered &) { return StringSet{}; },
+                    [&](const PerhapsNeedToRegister & refs) {
+                        StringSet referencedOutputs;
+                        /* FIXME build inverted map up front so no quadratic waste here */
+                        for (auto & r : refs.refs)
+                            for (auto & [o, p] : scratchOutputs)
+                                if (r == p)
+                                    referencedOutputs.insert(o);
+                        return referencedOutputs;
+                    },
                 },
-            }, *orifu);
+                *orifu);
         }},
         {[&](const std::string & path, const std::string & parent) {
             // TODO with more -vvvv also show the temporary paths for manual inspection.
             return BuildError(
+                BuildResult::OutputRejected,
                 "cycle detected in build of '%s' in the references of output '%s' from output '%s'",
-                store.printStorePath(drvPath), path, parent);
+                store.printStorePath(drvPath),
+                path,
+                parent);
         }});
 
     std::reverse(sortedOutputNames.begin(), sortedOutputNames.end());
@@ -1596,21 +1491,21 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
                use. This is why the topological sort is essential to do first
                before this for loop. */
             if (*scratchPath != finalStorePath)
-                outputRewrites[std::string { scratchPath->hashPart() }] = std::string { finalStorePath.hashPart() };
+                outputRewrites[std::string{scratchPath->hashPart()}] = std::string{finalStorePath.hashPart()};
         };
 
         auto orifu = get(outputReferencesIfUnregistered, outputName);
         assert(orifu);
 
-        std::optional<StorePathSet> referencesOpt = std::visit(overloaded {
-            [&](const AlreadyRegistered & skippedFinalPath) -> std::optional<StorePathSet> {
-                finish(skippedFinalPath.path);
-                return std::nullopt;
+        std::optional<StorePathSet> referencesOpt = std::visit(
+            overloaded{
+                [&](const AlreadyRegistered & skippedFinalPath) -> std::optional<StorePathSet> {
+                    finish(skippedFinalPath.path);
+                    return std::nullopt;
+                },
+                [&](const PerhapsNeedToRegister & r) -> std::optional<StorePathSet> { return r.refs; },
             },
-            [&](const PerhapsNeedToRegister & r) -> std::optional<StorePathSet> {
-                return r.refs;
-            },
-        }, *orifu);
+            *orifu);
 
         if (!referencesOpt)
             continue;
@@ -1643,19 +1538,19 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
                final path, therefore we look for a *non-rewritten
                self-reference, and use a bool rather try to solve the
                computationally intractable fixed point. */
-            StoreReferences res {
+            StoreReferences res{
                 .self = false,
             };
             for (auto & r : references) {
                 auto name = r.name();
-                auto origHash = std::string { r.hashPart() };
+                auto origHash = std::string{r.hashPart()};
                 if (r == *scratchPath) {
                     res.self = true;
                 } else if (auto outputRewrite = get(outputRewrites, origHash)) {
                     std::string newRef = *outputRewrite;
                     newRef += '-';
                     newRef += name;
-                    res.others.insert(StorePath { newRef });
+                    res.others.insert(StorePath{newRef});
                 } else {
                     res.others.insert(r);
                 }
@@ -1666,160 +1561,123 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
         auto newInfoFromCA = [&](const DerivationOutput::CAFloating outputHash) -> ValidPathInfo {
             auto st = get(outputStats, outputName);
             if (!st)
-                throw BuildError(
-                    "output path %1% without valid stats info",
-                    actualPath);
-            if (outputHash.method.getFileIngestionMethod() == FileIngestionMethod::Flat)
-            {
+                throw BuildError(BuildResult::OutputRejected, "output path %1% without valid stats info", actualPath);
+            if (outputHash.method.getFileIngestionMethod() == FileIngestionMethod::Flat) {
                 /* The output path should be a regular file without execute permission. */
                 if (!S_ISREG(st->st_mode) || (st->st_mode & S_IXUSR) != 0)
                     throw BuildError(
+                        BuildResult::OutputRejected,
                         "output path '%1%' should be a non-executable regular file "
                         "since recursive hashing is not enabled (one of outputHashMode={flat,text} is true)",
                         actualPath);
             }
             rewriteOutput(outputRewrites);
             /* FIXME optimize and deduplicate with addToStore */
-            std::string oldHashPart { scratchPath->hashPart() };
-            auto got = [&]{
+            std::string oldHashPart{scratchPath->hashPart()};
+            auto got = [&] {
                 auto fim = outputHash.method.getFileIngestionMethod();
                 switch (fim) {
                 case FileIngestionMethod::Flat:
-                case FileIngestionMethod::NixArchive:
-                {
-                    HashModuloSink caSink { outputHash.hashAlgo, oldHashPart };
+                case FileIngestionMethod::NixArchive: {
+                    HashModuloSink caSink{outputHash.hashAlgo, oldHashPart};
                     auto fim = outputHash.method.getFileIngestionMethod();
-                    dumpPath(
-                        {getFSSourceAccessor(), CanonPath(actualPath)},
-                        caSink,
-                        (FileSerialisationMethod) fim);
-                    return caSink.finish().first;
+                    dumpPath({getFSSourceAccessor(), CanonPath(actualPath)}, caSink, (FileSerialisationMethod) fim);
+                    return caSink.finish().hash;
                 }
                 case FileIngestionMethod::Git: {
-                    return git::dumpHash(
-                        outputHash.hashAlgo,
-                        {getFSSourceAccessor(), CanonPath(actualPath)}).hash;
+                    return git::dumpHash(outputHash.hashAlgo, {getFSSourceAccessor(), CanonPath(actualPath)}).hash;
                 }
                 }
                 assert(false);
             }();
 
-            ValidPathInfo newInfo0 {
+            auto newInfo0 = ValidPathInfo::makeFromCA(
                 store,
                 outputPathName(drv.name, outputName),
-                ContentAddressWithReferences::fromParts(
-                    outputHash.method,
-                    std::move(got),
-                    rewriteRefs()),
-                Hash::dummy,
-            };
+                ContentAddressWithReferences::fromParts(outputHash.method, std::move(got), rewriteRefs()),
+                Hash::dummy);
             if (*scratchPath != newInfo0.path) {
                 // If the path has some self-references, we need to rewrite
                 // them.
                 // (note that this doesn't invalidate the ca hash we calculated
                 // above because it's computed *modulo the self-references*, so
                 // it already takes this rewrite into account).
-                rewriteOutput(
-                    StringMap{{oldHashPart,
-                               std::string(newInfo0.path.hashPart())}});
+                rewriteOutput(StringMap{{oldHashPart, std::string(newInfo0.path.hashPart())}});
             }
 
             {
                 HashResult narHashAndSize = hashPath(
                     {getFSSourceAccessor(), CanonPath(actualPath)},
-                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256);
-                newInfo0.narHash = narHashAndSize.first;
-                newInfo0.narSize = narHashAndSize.second;
+                    FileSerialisationMethod::NixArchive,
+                    HashAlgorithm::SHA256);
+                newInfo0.narHash = narHashAndSize.hash;
+                newInfo0.narSize = narHashAndSize.numBytesDigested;
             }
 
             assert(newInfo0.ca);
             return newInfo0;
         };
 
-        ValidPathInfo newInfo = std::visit(overloaded {
+        ValidPathInfo newInfo = std::visit(
+            overloaded{
+
+                [&](const DerivationOutput::InputAddressed & output) {
+                    /* input-addressed case */
+                    auto requiredFinalPath = output.path;
+                    /* Preemptively add rewrite rule for final hash, as that is
+                       what the NAR hash will use rather than normalized-self references */
+                    if (*scratchPath != requiredFinalPath)
+                        outputRewrites.insert_or_assign(
+                            std::string{scratchPath->hashPart()}, std::string{requiredFinalPath.hashPart()});
+                    rewriteOutput(outputRewrites);
+                    HashResult narHashAndSize = hashPath(
+                        {getFSSourceAccessor(), CanonPath(actualPath)},
+                        FileSerialisationMethod::NixArchive,
+                        HashAlgorithm::SHA256);
+                    ValidPathInfo newInfo0{requiredFinalPath, narHashAndSize.hash};
+                    newInfo0.narSize = narHashAndSize.numBytesDigested;
+                    auto refs = rewriteRefs();
+                    newInfo0.references = std::move(refs.others);
+                    if (refs.self)
+                        newInfo0.references.insert(newInfo0.path);
+                    return newInfo0;
+                },
+
+                [&](const DerivationOutput::CAFixed & dof) {
+                    auto & wanted = dof.ca.hash;
+
+                    // Replace the output by a fresh copy of itself to make sure
+                    // that there's no stale file descriptor pointing to it
+                    Path tmpOutput = actualPath + ".tmp";
+                    copyFile(std::filesystem::path(actualPath), std::filesystem::path(tmpOutput), true);
+
+                    std::filesystem::rename(tmpOutput, actualPath);
+
+                    return newInfoFromCA(
+                        DerivationOutput::CAFloating{
+                            .method = dof.ca.method,
+                            .hashAlgo = wanted.algo,
+                        });
+                },
+
+                [&](const DerivationOutput::CAFloating & dof) { return newInfoFromCA(dof); },
+
+                [&](const DerivationOutput::Deferred &) -> ValidPathInfo {
+                    // No derivation should reach that point without having been
+                    // rewritten first
+                    assert(false);
+                },
+
+                [&](const DerivationOutput::Impure & doi) {
+                    return newInfoFromCA(
+                        DerivationOutput::CAFloating{
+                            .method = doi.method,
+                            .hashAlgo = doi.hashAlgo,
+                        });
+                },
 
-            [&](const DerivationOutput::InputAddressed & output) {
-                /* input-addressed case */
-                auto requiredFinalPath = output.path;
-                /* Preemptively add rewrite rule for final hash, as that is
-                   what the NAR hash will use rather than normalized-self references */
-                if (*scratchPath != requiredFinalPath)
-                    outputRewrites.insert_or_assign(
-                        std::string { scratchPath->hashPart() },
-                        std::string { requiredFinalPath.hashPart() });
-                rewriteOutput(outputRewrites);
-                HashResult narHashAndSize = hashPath(
-                    {getFSSourceAccessor(), CanonPath(actualPath)},
-                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256);
-                ValidPathInfo newInfo0 { requiredFinalPath, narHashAndSize.first };
-                newInfo0.narSize = narHashAndSize.second;
-                auto refs = rewriteRefs();
-                newInfo0.references = std::move(refs.others);
-                if (refs.self)
-                    newInfo0.references.insert(newInfo0.path);
-                return newInfo0;
             },
-
-            [&](const DerivationOutput::CAFixed & dof) {
-                auto & wanted = dof.ca.hash;
-
-                // Replace the output by a fresh copy of itself to make sure
-                // that there's no stale file descriptor pointing to it
-                Path tmpOutput = actualPath + ".tmp";
-                copyFile(
-                    std::filesystem::path(actualPath),
-                    std::filesystem::path(tmpOutput), true);
-
-                std::filesystem::rename(tmpOutput, actualPath);
-
-                auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
-                    .method = dof.ca.method,
-                    .hashAlgo = wanted.algo,
-                });
-
-                /* Check wanted hash */
-                assert(newInfo0.ca);
-                auto & got = newInfo0.ca->hash;
-                if (wanted != got) {
-                    /* Throw an error after registering the path as
-                       valid. */
-                    miscMethods->noteHashMismatch();
-                    delayedException = std::make_exception_ptr(
-                        BuildError("hash mismatch in fixed-output derivation '%s':\n  specified: %s\n     got:    %s",
-                            store.printStorePath(drvPath),
-                            wanted.to_string(HashFormat::SRI, true),
-                            got.to_string(HashFormat::SRI, true)));
-                }
-                if (!newInfo0.references.empty()) {
-                    auto numViolations = newInfo.references.size();
-                    delayedException = std::make_exception_ptr(
-                        BuildError("fixed-output derivations must not reference store paths: '%s' references %d distinct paths, e.g. '%s'",
-                            store.printStorePath(drvPath),
-                            numViolations,
-                            store.printStorePath(*newInfo.references.begin())));
-                }
-
-                return newInfo0;
-            },
-
-            [&](const DerivationOutput::CAFloating & dof) {
-                return newInfoFromCA(dof);
-            },
-
-            [&](const DerivationOutput::Deferred &) -> ValidPathInfo {
-                // No derivation should reach that point without having been
-                // rewritten first
-                assert(false);
-            },
-
-            [&](const DerivationOutput::Impure & doi) {
-                return newInfoFromCA(DerivationOutput::CAFloating {
-                    .method = doi.method,
-                    .hashAlgo = doi.hashAlgo,
-                });
-            },
-
-        }, output->raw);
+            output->raw);
 
         /* FIXME: set proper permissions in restorePath() so
             we don't have to do another traversal. */
@@ -1836,9 +1694,7 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
         PathLocks dynamicOutputLock;
         dynamicOutputLock.setDeletion(true);
         auto optFixedPath = output->path(store, drv.name, outputName);
-        if (!optFixedPath ||
-            store.printStorePath(*optFixedPath) != finalDestPath)
-        {
+        if (!optFixedPath || store.printStorePath(*optFixedPath) != finalDestPath) {
             assert(newInfo.ca);
             dynamicOutputLock.lockPaths({store.toRealPath(finalDestPath)});
         }
@@ -1864,117 +1720,114 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
             }
         }
 
-        auto & localStore = getLocalStore(store);
-
         if (buildMode == bmCheck) {
+            /* Check against already registered outputs */
 
-            if (!store.isValidPath(newInfo.path)) continue;
-            ValidPathInfo oldInfo(*store.queryPathInfo(newInfo.path));
-            if (newInfo.narHash != oldInfo.narHash) {
-                miscMethods->noteCheckMismatch();
-                if (settings.runDiffHook || settings.keepFailed) {
-                    auto dst = store.toRealPath(finalDestPath + checkSuffix);
-                    deletePath(dst);
-                    movePath(actualPath, dst);
+            if (store.isValidPath(newInfo.path)) {
+                ValidPathInfo oldInfo(*store.queryPathInfo(newInfo.path));
+                if (newInfo.narHash != oldInfo.narHash) {
+                    if (settings.runDiffHook || settings.keepFailed) {
+                        auto dst = store.toRealPath(finalDestPath + ".check");
+                        deletePath(dst);
+                        movePath(actualPath, dst);
 
-                    handleDiffHook(
-                        buildUser ? buildUser->getUID() : getuid(),
-                        buildUser ? buildUser->getGID() : getgid(),
-                        finalDestPath, dst, store.printStorePath(drvPath), tmpDir);
+                        handleDiffHook(
+                            buildUser ? buildUser->getUID() : getuid(),
+                            buildUser ? buildUser->getGID() : getgid(),
+                            finalDestPath,
+                            dst,
+                            store.printStorePath(drvPath),
+                            tmpDir);
 
-                    throw NotDeterministic("derivation '%s' may not be deterministic: output '%s' differs from '%s'",
-                        store.printStorePath(drvPath), store.toRealPath(finalDestPath), dst);
-                } else
-                    throw NotDeterministic("derivation '%s' may not be deterministic: output '%s' differs",
-                        store.printStorePath(drvPath), store.toRealPath(finalDestPath));
+                        throw NotDeterministic(
+                            "derivation '%s' may not be deterministic: output '%s' differs from '%s'",
+                            store.printStorePath(drvPath),
+                            store.toRealPath(finalDestPath),
+                            dst);
+                    } else
+                        throw NotDeterministic(
+                            "derivation '%s' may not be deterministic: output '%s' differs",
+                            store.printStorePath(drvPath),
+                            store.toRealPath(finalDestPath));
+                }
+
+                /* Since we verified the build, it's now ultimately trusted. */
+                if (!oldInfo.ultimate) {
+                    oldInfo.ultimate = true;
+                    store.signPathInfo(oldInfo);
+                    store.registerValidPaths({{oldInfo.path, oldInfo}});
+                }
+            }
+        } else {
+            /* do tasks relating to registering these outputs */
+
+            /* For debugging, print out the referenced and unreferenced paths. */
+            for (auto & i : inputPaths) {
+                if (references.count(i))
+                    debug("referenced input: '%1%'", store.printStorePath(i));
+                else
+                    debug("unreferenced input: '%1%'", store.printStorePath(i));
             }
 
-            /* Since we verified the build, it's now ultimately trusted. */
-            if (!oldInfo.ultimate) {
-                oldInfo.ultimate = true;
-                localStore.signPathInfo(oldInfo);
-                localStore.registerValidPaths({{oldInfo.path, oldInfo}});
-            }
+            store.optimisePath(actualPath, NoRepair); // FIXME: combine with scanForReferences()
 
-            continue;
+            newInfo.deriver = drvPath;
+            newInfo.ultimate = true;
+            store.signPathInfo(newInfo);
+
+            finish(newInfo.path);
+
+            /* If it's a CA path, register it right away. This is necessary if it
+               isn't statically known so that we can safely unlock the path before
+               the next iteration
+
+               This is also good so that if a fixed-output produces the
+               wrong path, we still store the result (just don't consider
+               the derivation sucessful, so if someone fixes the problem by
+               just changing the wanted hash, the redownload (or whateer
+               possibly quite slow thing it was) doesn't have to be done
+               again. */
+            if (newInfo.ca)
+                store.registerValidPaths({{newInfo.path, newInfo}});
         }
 
-        /* For debugging, print out the referenced and unreferenced paths. */
-        for (auto & i : inputPaths) {
-            if (references.count(i))
-                debug("referenced input: '%1%'", store.printStorePath(i));
-            else
-                debug("unreferenced input: '%1%'", store.printStorePath(i));
-        }
-
-        localStore.optimisePath(actualPath, NoRepair); // FIXME: combine with scanForReferences()
-        miscMethods->markContentsGood(newInfo.path);
-
-        newInfo.deriver = drvPath;
-        newInfo.ultimate = true;
-        localStore.signPathInfo(newInfo);
-
-        finish(newInfo.path);
-
-        /* If it's a CA path, register it right away. This is necessary if it
-           isn't statically known so that we can safely unlock the path before
-           the next iteration */
-        if (newInfo.ca)
-            localStore.registerValidPaths({{newInfo.path, newInfo}});
-
+        /* Do this in both the check and non-check cases, because we
+           want `checkOutputs` below to work, which needs these path
+           infos. */
         infos.emplace(outputName, std::move(newInfo));
     }
 
+    /* Apply output checks. This includes checking of the wanted vs got
+       hash of fixed-outputs. */
+    checkOutputs(store, drvPath, drv.outputs, drvOptions.outputChecks, infos);
+
     if (buildMode == bmCheck) {
-        /* In case of fixed-output derivations, if there are
-           mismatches on `--check` an error must be thrown as this is
-           also a source for non-determinism. */
-        if (delayedException)
-            std::rethrow_exception(delayedException);
         return {};
     }
 
-    /* Apply output checks. */
-    checkOutputs(infos);
-
     /* Register each output path as valid, and register the sets of
        paths referenced by each of them.  If there are cycles in the
        outputs, this will fail. */
     {
-        auto & localStore = getLocalStore(store);
-
         ValidPathInfos infos2;
         for (auto & [outputName, newInfo] : infos) {
             infos2.insert_or_assign(newInfo.path, newInfo);
         }
-        localStore.registerValidPaths(infos2);
+        store.registerValidPaths(infos2);
     }
 
-    /* In case of a fixed-output derivation hash mismatch, throw an
-       exception now that we have registered the output as valid. */
-    if (delayedException)
-        std::rethrow_exception(delayedException);
-
-    /* If we made it this far, we are sure the output matches the derivation
-       (since the delayedException would be a fixed output CA mismatch). That
-       means it's safe to link the derivation to the output hash. We must do
-       that for floating CA derivations, which otherwise couldn't be cached,
-       but it's fine to do in all cases. */
+    /* If we made it this far, we are sure the output matches the
+       derivation That means it's safe to link the derivation to the
+       output hash. We must do that for floating CA derivations, which
+       otherwise couldn't be cached, but it's fine to do in all cases.
+       */
     SingleDrvOutputs builtOutputs;
 
     for (auto & [outputName, newInfo] : infos) {
         auto oldinfo = get(initialOutputs, outputName);
         assert(oldinfo);
-        auto thisRealisation = Realisation {
-            .id = DrvOutput {
-                oldinfo->outputHash,
-                outputName
-            },
-            .outPath = newInfo.path
-        };
-        if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)
-            && !drv.type().isImpure())
-        {
+        auto thisRealisation = Realisation{.id = DrvOutput{oldinfo->outputHash, outputName}, .outPath = newInfo.path};
+        if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations) && !drv.type().isImpure()) {
             store.signRealisation(thisRealisation);
             store.registerDrvOutput(thisRealisation);
         }
@@ -1984,144 +1837,14 @@ SingleDrvOutputs DerivationBuilderImpl::registerOutputs()
     return builtOutputs;
 }
 
-
-void DerivationBuilderImpl::checkOutputs(const std::map<std::string, ValidPathInfo> & outputs)
+void DerivationBuilderImpl::cleanupBuild(bool force)
 {
-    std::map<Path, const ValidPathInfo &> outputsByPath;
-    for (auto & output : outputs)
-        outputsByPath.emplace(store.printStorePath(output.second.path), output.second);
-
-    for (auto & output : outputs) {
-        auto & outputName = output.first;
-        auto & info = output.second;
-
-        /* Compute the closure and closure size of some output. This
-           is slightly tricky because some of its references (namely
-           other outputs) may not be valid yet. */
-        auto getClosure = [&](const StorePath & path)
-        {
-            uint64_t closureSize = 0;
-            StorePathSet pathsDone;
-            std::queue<StorePath> pathsLeft;
-            pathsLeft.push(path);
-
-            while (!pathsLeft.empty()) {
-                auto path = pathsLeft.front();
-                pathsLeft.pop();
-                if (!pathsDone.insert(path).second) continue;
-
-                auto i = outputsByPath.find(store.printStorePath(path));
-                if (i != outputsByPath.end()) {
-                    closureSize += i->second.narSize;
-                    for (auto & ref : i->second.references)
-                        pathsLeft.push(ref);
-                } else {
-                    auto info = store.queryPathInfo(path);
-                    closureSize += info->narSize;
-                    for (auto & ref : info->references)
-                        pathsLeft.push(ref);
-                }
-            }
-
-            return std::make_pair(std::move(pathsDone), closureSize);
-        };
-
-        auto applyChecks = [&](const DerivationOptions::OutputChecks & checks)
-        {
-            if (checks.maxSize && info.narSize > *checks.maxSize)
-                throw BuildError("path '%s' is too large at %d bytes; limit is %d bytes",
-                    store.printStorePath(info.path), info.narSize, *checks.maxSize);
-
-            if (checks.maxClosureSize) {
-                uint64_t closureSize = getClosure(info.path).second;
-                if (closureSize > *checks.maxClosureSize)
-                    throw BuildError("closure of path '%s' is too large at %d bytes; limit is %d bytes",
-                        store.printStorePath(info.path), closureSize, *checks.maxClosureSize);
-            }
-
-            auto checkRefs = [&](const StringSet & value, bool allowed, bool recursive)
-            {
-                /* Parse a list of reference specifiers.  Each element must
-                   either be a store path, or the symbolic name of the output
-                   of the derivation (such as `out'). */
-                StorePathSet spec;
-                for (auto & i : value) {
-                    if (store.isStorePath(i))
-                        spec.insert(store.parseStorePath(i));
-                    else if (auto output = get(outputs, i))
-                        spec.insert(output->path);
-                    else {
-                        std::string outputsListing = concatMapStringsSep(", ", outputs, [](auto & o) { return o.first; });
-                        throw BuildError("derivation '%s' output check for '%s' contains an illegal reference specifier '%s',"
-                            " expected store path or output name (one of [%s])",
-                            store.printStorePath(drvPath), outputName, i, outputsListing);
-                    }
-                }
-
-                auto used = recursive
-                    ? getClosure(info.path).first
-                    : info.references;
-
-                if (recursive && checks.ignoreSelfRefs)
-                    used.erase(info.path);
-
-                StorePathSet badPaths;
-
-                for (auto & i : used)
-                    if (allowed) {
-                        if (!spec.count(i))
-                            badPaths.insert(i);
-                    } else {
-                        if (spec.count(i))
-                            badPaths.insert(i);
-                    }
-
-                if (!badPaths.empty()) {
-                    std::string badPathsStr;
-                    for (auto & i : badPaths) {
-                        badPathsStr += "\n  ";
-                        badPathsStr += store.printStorePath(i);
-                    }
-                    throw BuildError("output '%s' is not allowed to refer to the following paths:%s",
-                        store.printStorePath(info.path), badPathsStr);
-                }
-            };
-
-            /* Mandatory check: absent whitelist, and present but empty
-               whitelist mean very different things. */
-            if (auto & refs = checks.allowedReferences) {
-                checkRefs(*refs, true, false);
-            }
-            if (auto & refs = checks.allowedRequisites) {
-                checkRefs(*refs, true, true);
-            }
-
-            /* Optimization: don't need to do anything when
-               disallowed and empty set. */
-            if (!checks.disallowedReferences.empty()) {
-                checkRefs(checks.disallowedReferences, false, false);
-            }
-            if (!checks.disallowedRequisites.empty()) {
-                checkRefs(checks.disallowedRequisites, false, true);
-            }
-        };
-
-        std::visit(overloaded{
-            [&](const DerivationOptions::OutputChecks & checks) {
-                applyChecks(checks);
-            },
-            [&](const std::map<std::string, DerivationOptions::OutputChecks> & checksPerOutput) {
-                if (auto outputChecks = get(checksPerOutput, outputName))
-
-                    applyChecks(*outputChecks);
-            },
-        }, drvOptions.outputChecks);
+    if (force) {
+        /* Delete unused redirected outputs (when doing hash rewriting). */
+        for (auto & i : redirectedOutputs)
+            deletePath(store.Store::toRealPath(i.second));
     }
-}
 
-
-void DerivationBuilderImpl::deleteTmpDir(bool force)
-{
     if (topTmpDir != "") {
         /* As an extra precaution, even in the event of `deletePath` failing to
          * clean up, the `tmpDir` will be chowned as if we were to move
@@ -2138,28 +1861,27 @@ void DerivationBuilderImpl::deleteTmpDir(bool force)
             printError("note: keeping build directory '%s'", tmpDir);
             chmod(topTmpDir.c_str(), 0755);
             chmod(tmpDir.c_str(), 0755);
-        }
-        else
+        } else
             deletePath(topTmpDir);
         topTmpDir = "";
         tmpDir = "";
     }
 }
 
-
 StorePath DerivationBuilderImpl::makeFallbackPath(OutputNameView outputName)
 {
     // This is a bogus path type, constructed this way to ensure that it doesn't collide with any other store path
     // See doc/manual/source/protocols/store-path.md for details
-    // TODO: We may want to separate the responsibilities of constructing the path fingerprint and of actually doing the hashing
+    // TODO: We may want to separate the responsibilities of constructing the path fingerprint and of actually doing the
+    // hashing
     auto pathType = "rewrite:" + std::string(drvPath.to_string()) + ":name:" + std::string(outputName);
     return store.makeStorePath(
         pathType,
         // pass an all-zeroes hash
-        Hash(HashAlgorithm::SHA256), outputPathName(drv.name, outputName));
+        Hash(HashAlgorithm::SHA256),
+        outputPathName(drv.name, outputName));
 }
 
-
 StorePath DerivationBuilderImpl::makeFallbackPath(const StorePath & path)
 {
     // This is a bogus path type, constructed this way to ensure that it doesn't collide with any other store path
@@ -2168,21 +1890,21 @@ StorePath DerivationBuilderImpl::makeFallbackPath(const StorePath & path)
     return store.makeStorePath(
         pathType,
         // pass an all-zeroes hash
-        Hash(HashAlgorithm::SHA256), path.name());
+        Hash(HashAlgorithm::SHA256),
+        path.name());
 }
 
-}
+} // namespace nix
 
 // FIXME: do this properly
+#include "chroot-derivation-builder.cc"
 #include "linux-derivation-builder.cc"
 #include "darwin-derivation-builder.cc"
 
 namespace nix {
 
 std::unique_ptr<DerivationBuilder> makeDerivationBuilder(
-    Store & store,
-    std::unique_ptr<DerivationBuilderCallbacks> miscMethods,
-    DerivationBuilderParams params)
+    LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
 {
     bool useSandbox = false;
 
@@ -2190,69 +1912,60 @@ std::unique_ptr<DerivationBuilder> makeDerivationBuilder(
     {
         if (settings.sandboxMode == smEnabled) {
             if (params.drvOptions.noChroot)
-                throw Error("derivation '%s' has '__noChroot' set, "
-                    "but that's not allowed when 'sandbox' is 'true'", store.printStorePath(params.drvPath));
+                throw Error(
+                    "derivation '%s' has '__noChroot' set, "
+                    "but that's not allowed when 'sandbox' is 'true'",
+                    store.printStorePath(params.drvPath));
 #ifdef __APPLE__
             if (params.drvOptions.additionalSandboxProfile != "")
-                throw Error("derivation '%s' specifies a sandbox profile, "
-                    "but this is only allowed when 'sandbox' is 'relaxed'", store.printStorePath(params.drvPath));
+                throw Error(
+                    "derivation '%s' specifies a sandbox profile, "
+                    "but this is only allowed when 'sandbox' is 'relaxed'",
+                    store.printStorePath(params.drvPath));
 #endif
             useSandbox = true;
-        }
-        else if (settings.sandboxMode == smDisabled)
+        } else if (settings.sandboxMode == smDisabled)
             useSandbox = false;
         else if (settings.sandboxMode == smRelaxed)
             // FIXME: cache derivationType
             useSandbox = params.drv.type().isSandboxed() && !params.drvOptions.noChroot;
     }
 
-    auto & localStore = getLocalStore(store);
-    if (localStore.storeDir != localStore.config->realStoreDir.get()) {
-        #ifdef __linux__
-            useSandbox = true;
-        #else
-            throw Error("building using a diverted store is not supported on this platform");
-        #endif
+    if (store.storeDir != store.config->realStoreDir.get()) {
+#ifdef __linux__
+        useSandbox = true;
+#else
+        throw Error("building using a diverted store is not supported on this platform");
+#endif
     }
 
-    #ifdef __linux__
+#ifdef __linux__
     if (useSandbox && !mountAndPidNamespacesSupported()) {
         if (!settings.sandboxFallback)
-            throw Error("this system does not support the kernel namespaces that are required for sandboxing; use '--no-sandbox' to disable sandboxing");
+            throw Error(
+                "this system does not support the kernel namespaces that are required for sandboxing; use '--no-sandbox' to disable sandboxing");
         debug("auto-disabling sandboxing because the prerequisite namespaces are not available");
         useSandbox = false;
     }
 
-    if (useSandbox)
-        return std::make_unique<ChrootLinuxDerivationBuilder>(
-            store,
-            std::move(miscMethods),
-            std::move(params));
-    #endif
+#endif
 
     if (!useSandbox && params.drvOptions.useUidRange(params.drv))
         throw Error("feature 'uid-range' is only supported in sandboxed builds");
 
-    #ifdef __APPLE__
-    return std::make_unique<DarwinDerivationBuilder>(
-        store,
-        std::move(miscMethods),
-        std::move(params),
-        useSandbox);
-    #elif defined(__linux__)
-    return std::make_unique<LinuxDerivationBuilder>(
-        store,
-        std::move(miscMethods),
-        std::move(params));
-    #else
+#ifdef __APPLE__
+    return std::make_unique<DarwinDerivationBuilder>(store, std::move(miscMethods), std::move(params), useSandbox);
+#elif defined(__linux__)
+    if (useSandbox)
+        return std::make_unique<ChrootLinuxDerivationBuilder>(store, std::move(miscMethods), std::move(params));
+
+    return std::make_unique<LinuxDerivationBuilder>(store, std::move(miscMethods), std::move(params));
+#else
     if (useSandbox)
         throw Error("sandboxing builds is not supported on this platform");
 
-    return std::make_unique<DerivationBuilderImpl>(
-        store,
-        std::move(miscMethods),
-        std::move(params));
-    #endif
+    return std::make_unique<DerivationBuilderImpl>(store, std::move(miscMethods), std::move(params));
+#endif
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/build/hook-instance.cc b/src/libstore/unix/build/hook-instance.cc
index 3713f7c86..83824b51f 100644
--- a/src/libstore/unix/build/hook-instance.cc
+++ b/src/libstore/unix/build/hook-instance.cc
@@ -46,13 +46,13 @@ HookInstance::HookInstance()
 
     /* Fork the hook. */
     pid = startProcess([&]() {
-
         if (dup2(fromHook.writeSide.get(), STDERR_FILENO) == -1)
             throw SysError("cannot pipe standard error into log file");
 
         commonChildInit();
 
-        if (chdir("/") == -1) throw SysError("changing into /");
+        if (chdir("/") == -1)
+            throw SysError("changing into /");
 
         /* Dup the communication pipes. */
         if (dup2(toHook.readSide.get(), STDIN_FILENO) == -1)
@@ -84,15 +84,15 @@ HookInstance::HookInstance()
     sink << 0;
 }
 
-
 HookInstance::~HookInstance()
 {
     try {
         toHook.writeSide = -1;
-        if (pid != -1) pid.kill();
+        if (pid != -1)
+            pid.kill();
     } catch (...) {
         ignoreExceptionInDestructor();
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/build/linux-derivation-builder.cc b/src/libstore/unix/build/linux-derivation-builder.cc
index b23c8003f..35730644b 100644
--- a/src/libstore/unix/build/linux-derivation-builder.cc
+++ b/src/libstore/unix/build/linux-derivation-builder.cc
@@ -153,7 +153,7 @@ static void doBind(const Path & source, const Path & target, bool optional = fal
     }
 }
 
-struct LinuxDerivationBuilder : DerivationBuilderImpl
+struct LinuxDerivationBuilder : virtual DerivationBuilderImpl
 {
     using DerivationBuilderImpl::DerivationBuilderImpl;
 
@@ -165,7 +165,7 @@ struct LinuxDerivationBuilder : DerivationBuilderImpl
     }
 };
 
-struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
+struct ChrootLinuxDerivationBuilder : ChrootDerivationBuilder, LinuxDerivationBuilder
 {
     /**
      * Pipe for synchronising updates to the builder namespaces.
@@ -185,30 +185,17 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
      */
     bool usingUserNamespace = true;
 
-    /**
-     * The root of the chroot environment.
-     */
-    Path chrootRootDir;
-
-    /**
-     * RAII object to delete the chroot directory.
-     */
-    std::shared_ptr<AutoDelete> autoDelChroot;
-
-    PathsInChroot pathsInChroot;
-
     /**
      * The cgroup of the builder, if any.
      */
     std::optional<Path> cgroup;
 
-    using LinuxDerivationBuilder::LinuxDerivationBuilder;
-
-    void deleteTmpDir(bool force) override
+    ChrootLinuxDerivationBuilder(
+        LocalStore & store, std::unique_ptr<DerivationBuilderCallbacks> miscMethods, DerivationBuilderParams params)
+        : DerivationBuilderImpl{store, std::move(miscMethods), std::move(params)}
+        , ChrootDerivationBuilder{store, std::move(miscMethods), std::move(params)}
+        , LinuxDerivationBuilder{store, std::move(miscMethods), std::move(params)}
     {
-        autoDelChroot.reset(); /* this runs the destructor */
-
-        DerivationBuilderImpl::deleteTmpDir(force);
     }
 
     uid_t sandboxUid()
@@ -216,14 +203,10 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
         return usingUserNamespace ? (!buildUser || buildUser->getUIDCount() == 1 ? 1000 : 0) : buildUser->getUID();
     }
 
-    gid_t sandboxGid()
+    gid_t sandboxGid() override
     {
-        return usingUserNamespace ? (!buildUser || buildUser->getUIDCount() == 1 ? 100 : 0) : buildUser->getGID();
-    }
-
-    bool needsHashRewrite() override
-    {
-        return false;
+        return usingUserNamespace ? (!buildUser || buildUser->getUIDCount() == 1 ? 100 : 0)
+                                  : ChrootDerivationBuilder::sandboxGid();
     }
 
     std::unique_ptr<UserLock> getBuildUser() override
@@ -231,26 +214,6 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
         return acquireUserLock(drvOptions.useUidRange(drv) ? 65536 : 1, true);
     }
 
-    void setBuildTmpDir() override
-    {
-        /* If sandboxing is enabled, put the actual TMPDIR underneath
-           an inaccessible root-owned directory, to prevent outside
-           access.
-
-           On macOS, we don't use an actual chroot, so this isn't
-           possible. Any mitigation along these lines would have to be
-           done directly in the sandbox profile. */
-        tmpDir = topTmpDir + "/build";
-        createDir(tmpDir, 0700);
-    }
-
-    Path tmpDirInSandbox() override
-    {
-        /* In a sandbox, for determinism, always use the same temporary
-           directory. */
-        return settings.sandboxBuildDir;
-    }
-
     void prepareUser() override
     {
         if ((buildUser && buildUser->getUIDCount() != 1) || settings.useCgroups) {
@@ -298,97 +261,7 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
 
     void prepareSandbox() override
     {
-        /* Create a temporary directory in which we set up the chroot
-           environment using bind-mounts.  We put it in the Nix store
-           so that the build outputs can be moved efficiently from the
-           chroot to their final location. */
-        auto chrootParentDir = store.Store::toRealPath(drvPath) + ".chroot";
-        deletePath(chrootParentDir);
-
-        /* Clean up the chroot directory automatically. */
-        autoDelChroot = std::make_shared<AutoDelete>(chrootParentDir);
-
-        printMsg(lvlChatty, "setting up chroot environment in '%1%'", chrootParentDir);
-
-        if (mkdir(chrootParentDir.c_str(), 0700) == -1)
-            throw SysError("cannot create '%s'", chrootRootDir);
-
-        chrootRootDir = chrootParentDir + "/root";
-
-        if (mkdir(chrootRootDir.c_str(), buildUser && buildUser->getUIDCount() != 1 ? 0755 : 0750) == -1)
-            throw SysError("cannot create '%1%'", chrootRootDir);
-
-        if (buildUser
-            && chown(
-                   chrootRootDir.c_str(), buildUser->getUIDCount() != 1 ? buildUser->getUID() : 0, buildUser->getGID())
-                   == -1)
-            throw SysError("cannot change ownership of '%1%'", chrootRootDir);
-
-        /* Create a writable /tmp in the chroot.  Many builders need
-           this.  (Of course they should really respect $TMPDIR
-           instead.) */
-        Path chrootTmpDir = chrootRootDir + "/tmp";
-        createDirs(chrootTmpDir);
-        chmod_(chrootTmpDir, 01777);
-
-        /* Create a /etc/passwd with entries for the build user and the
-           nobody account.  The latter is kind of a hack to support
-           Samba-in-QEMU. */
-        createDirs(chrootRootDir + "/etc");
-        if (drvOptions.useUidRange(drv))
-            chownToBuilder(chrootRootDir + "/etc");
-
-        if (drvOptions.useUidRange(drv) && (!buildUser || buildUser->getUIDCount() < 65536))
-            throw Error("feature 'uid-range' requires the setting '%s' to be enabled", settings.autoAllocateUids.name);
-
-        /* Declare the build user's group so that programs get a consistent
-           view of the system (e.g., "id -gn"). */
-        writeFile(
-            chrootRootDir + "/etc/group",
-            fmt("root:x:0:\n"
-                "nixbld:!:%1%:\n"
-                "nogroup:x:65534:\n",
-                sandboxGid()));
-
-        /* Create /etc/hosts with localhost entry. */
-        if (derivationType.isSandboxed())
-            writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
-
-        /* Make the closure of the inputs available in the chroot,
-           rather than the whole Nix store.  This prevents any access
-           to undeclared dependencies.  Directories are bind-mounted,
-           while other inputs are hard-linked (since only directories
-           can be bind-mounted).  !!! As an extra security
-           precaution, make the fake Nix store only writable by the
-           build user. */
-        Path chrootStoreDir = chrootRootDir + store.storeDir;
-        createDirs(chrootStoreDir);
-        chmod_(chrootStoreDir, 01775);
-
-        if (buildUser && chown(chrootStoreDir.c_str(), 0, buildUser->getGID()) == -1)
-            throw SysError("cannot change ownership of '%1%'", chrootStoreDir);
-
-        pathsInChroot = getPathsInSandbox();
-
-        for (auto & i : inputPaths) {
-            auto p = store.printStorePath(i);
-            pathsInChroot.insert_or_assign(p, store.toRealPath(p));
-        }
-
-        /* If we're repairing, checking or rebuilding part of a
-           multiple-outputs derivation, it's possible that we're
-           rebuilding a path that is in settings.sandbox-paths
-           (typically the dependencies of /bin/sh).  Throw them
-           out. */
-        for (auto & i : drv.outputsAndOptPaths(store)) {
-            /* If the name isn't known a priori (i.e. floating
-               content-addressing derivation), the temporary location we use
-               should be fresh.  Freshness means it is impossible that the path
-               is already in the sandbox, so we don't need to worry about
-               removing it.  */
-            if (i.second.second)
-                pathsInChroot.erase(store.printStorePath(*i.second.second));
-        }
+        ChrootDerivationBuilder::prepareSandbox();
 
         if (cgroup) {
             if (mkdir(cgroup->c_str(), 0755) != 0)
@@ -400,18 +273,6 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
         }
     }
 
-    Strings getPreBuildHookArgs() override
-    {
-        assert(!chrootRootDir.empty());
-        return Strings({store.printStorePath(drvPath), chrootRootDir});
-    }
-
-    Path realPathInSandbox(const Path & p) override
-    {
-        // FIXME: why the needsHashRewrite() conditional?
-        return !needsHashRewrite() ? chrootRootDir + p : store.toRealPath(p);
-    }
-
     void startChild() override
     {
         /* Set up private namespaces for the build:
@@ -501,9 +362,21 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
 
         userNamespaceSync.readSide = -1;
 
-        /* Close the write side to prevent runChild() from hanging
-           reading from this. */
-        Finally cleanup([&]() { userNamespaceSync.writeSide = -1; });
+        /* Make sure that we write *something* to the child in case of
+           an exception. Note that merely closing
+           `userNamespaceSync.writeSide` doesn't work in
+           multi-threaded Nix, since several child processes may have
+           inherited `writeSide` (and O_CLOEXEC doesn't help because
+           the children may not do an execve). */
+        bool userNamespaceSyncDone = false;
+        Finally cleanup([&]() {
+            try {
+                if (!userNamespaceSyncDone)
+                    writeFull(userNamespaceSync.writeSide.get(), "0\n");
+            } catch (...) {
+            }
+            userNamespaceSync.writeSide = -1;
+        });
 
         auto ss = tokenizeString<std::vector<std::string>>(readLine(sendPid.readSide.get()));
         assert(ss.size() == 1);
@@ -558,14 +431,15 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
             writeFile(*cgroup + "/cgroup.procs", fmt("%d", (pid_t) pid));
 
         /* Signal the builder that we've updated its user namespace. */
-        writeFull(userNamespaceSync.writeSide.get(), "1");
+        writeFull(userNamespaceSync.writeSide.get(), "1\n");
+        userNamespaceSyncDone = true;
     }
 
     void enterChroot() override
     {
         userNamespaceSync.writeSide = -1;
 
-        if (drainFD(userNamespaceSync.readSide.get()) != "1")
+        if (readLine(userNamespaceSync.readSide.get()) != "1")
             throw Error("user namespace initialisation failed");
 
         userNamespaceSync.readSide = -1;
@@ -631,7 +505,7 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
             createDirs(chrootRootDir + "/dev/shm");
             createDirs(chrootRootDir + "/dev/pts");
             ss.push_back("/dev/full");
-            if (store.config.systemFeatures.get().count("kvm") && pathExists("/dev/kvm"))
+            if (systemFeatures.count("kvm") && pathExists("/dev/kvm"))
                 ss.push_back("/dev/kvm");
             ss.push_back("/dev/null");
             ss.push_back("/dev/random");
@@ -798,7 +672,7 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
             throw SysError("setuid failed");
     }
 
-    std::variant<std::pair<BuildResult::Status, Error>, SingleDrvOutputs> unprepareBuild() override
+    SingleDrvOutputs unprepareBuild() override
     {
         sandboxMountNamespace = -1;
         sandboxUserNamespace = -1;
@@ -820,41 +694,9 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
         DerivationBuilderImpl::killSandbox(getStats);
     }
 
-    void cleanupBuild() override
-    {
-        DerivationBuilderImpl::cleanupBuild();
-
-        /* Move paths out of the chroot for easier debugging of
-           build failures. */
-        if (buildMode == bmNormal)
-            for (auto & [_, status] : initialOutputs) {
-                if (!status.known)
-                    continue;
-                if (buildMode != bmCheck && status.known->isValid())
-                    continue;
-                auto p = store.toRealPath(status.known->path);
-                if (pathExists(chrootRootDir + p))
-                    std::filesystem::rename((chrootRootDir + p), p);
-            }
-    }
-
     void addDependency(const StorePath & path) override
     {
-        if (isAllowed(path))
-            return;
-
-        addedPaths.insert(path);
-
-        debug("materialising '%s' in the sandbox", store.printStorePath(path));
-
-        Path source = store.Store::toRealPath(path);
-        Path target = chrootRootDir + store.printStorePath(path);
-
-        if (pathExists(target)) {
-            // There is a similar debug message in doBind, so only run it in this block to not have double messages.
-            debug("bind-mounting %s -> %s", target, source);
-            throw Error("store path '%s' already exists in the sandbox", store.printStorePath(path));
-        }
+        auto [source, target] = ChrootDerivationBuilder::addDependencyPrep(path);
 
         /* Bind-mount the path into the sandbox. This requires
            entering its mount namespace, which is not possible
@@ -878,6 +720,6 @@ struct ChrootLinuxDerivationBuilder : LinuxDerivationBuilder
     }
 };
 
-}
+} // namespace nix
 
 #endif
diff --git a/src/libstore/unix/build/sandbox-defaults.sb b/src/libstore/unix/build/sandbox-defaults.sb
index 15cd6daf5..dd6a064c1 100644
--- a/src/libstore/unix/build/sandbox-defaults.sb
+++ b/src/libstore/unix/build/sandbox-defaults.sb
@@ -29,12 +29,14 @@ R""(
 ; Allow getpwuid.
 (allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo"))
 
-; Access to /tmp.
+; Access to /tmp and the build directory.
 ; The network-outbound/network-inbound ones are for unix domain sockets, which
 ; we allow access to in TMPDIR (but if we allow them more broadly, you could in
 ; theory escape the sandbox)
 (allow file* process-exec network-outbound network-inbound
-       (literal "/tmp") (subpath TMPDIR))
+       (literal "/tmp")
+       (subpath TMPDIR)
+       (subpath (param "_NIX_BUILD_TOP")))
 
 ; Some packages like to read the system version.
 (allow file-read*
diff --git a/src/libstore/unix/include/nix/store/build/child.hh b/src/libstore/unix/include/nix/store/build/child.hh
index 3dfc552b9..9216316cc 100644
--- a/src/libstore/unix/include/nix/store/build/child.hh
+++ b/src/libstore/unix/include/nix/store/build/child.hh
@@ -1,4 +1,5 @@
 #pragma once
+
 ///@file
 
 namespace nix {
@@ -8,4 +9,4 @@ namespace nix {
  */
 void commonChildInit();
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/include/nix/store/build/hook-instance.hh b/src/libstore/unix/include/nix/store/build/hook-instance.hh
index ff205ff76..7657d5dbd 100644
--- a/src/libstore/unix/include/nix/store/build/hook-instance.hh
+++ b/src/libstore/unix/include/nix/store/build/hook-instance.hh
@@ -7,6 +7,14 @@
 
 namespace nix {
 
+/**
+ * @note Sometimes this is owned by the `Worker`, and sometimes it is
+ * owned by a `Goal`. This is for efficiency: rather than starting the
+ * hook every time we want to ask whether we can run a remote build
+ * (which can be very often), we reuse a hook process for answering
+ * those queries until it accepts a build.  So if there are N
+ * derivations to be built, at most N hooks will be started.
+ */
 struct HookInstance
 {
     /**
@@ -29,6 +37,15 @@ struct HookInstance
      */
     Pid pid;
 
+    /**
+     * The remote machine on which we're building.
+     *
+     * @Invariant When the hook instance is owned by the `Worker`, this
+     * is the empty string. When it is owned by a `Goal`, this should be
+     * set.
+     */
+    std::string machineName;
+
     FdSink sink;
 
     std::map<ActivityId, Activity> activities;
@@ -38,4 +55,4 @@ struct HookInstance
     ~HookInstance();
 };
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/include/nix/store/meson.build b/src/libstore/unix/include/nix/store/meson.build
index 7cf973223..bdc4b2f20 100644
--- a/src/libstore/unix/include/nix/store/meson.build
+++ b/src/libstore/unix/include/nix/store/meson.build
@@ -2,7 +2,6 @@ include_dirs += include_directories('../..')
 
 headers += files(
   'build/child.hh',
-  'build/derivation-builder.hh',
   'build/hook-instance.hh',
   'user-lock.hh',
 )
diff --git a/src/libstore/unix/include/nix/store/user-lock.hh b/src/libstore/unix/include/nix/store/user-lock.hh
index a7caf8518..828980d6f 100644
--- a/src/libstore/unix/include/nix/store/user-lock.hh
+++ b/src/libstore/unix/include/nix/store/user-lock.hh
@@ -9,7 +9,7 @@ namespace nix {
 
 struct UserLock
 {
-    virtual ~UserLock() { }
+    virtual ~UserLock() {}
 
     /**
      * Get the first and last UID.
@@ -40,4 +40,4 @@ std::unique_ptr<UserLock> acquireUserLock(uid_t nrIds, bool useUserNamespace);
 
 bool useBuildUsers();
 
-}
+} // namespace nix
diff --git a/src/libstore/unix/pathlocks.cc b/src/libstore/unix/pathlocks.cc
index 58d047f4e..e3f411a5d 100644
--- a/src/libstore/unix/pathlocks.cc
+++ b/src/libstore/unix/pathlocks.cc
@@ -11,7 +11,6 @@
 #include <sys/stat.h>
 #include <sys/file.h>
 
-
 namespace nix {
 
 AutoCloseFD openLockFile(const Path & path, bool create)
@@ -25,7 +24,6 @@ AutoCloseFD openLockFile(const Path & path, bool create)
     return fd;
 }
 
-
 void deleteLockFile(const Path & path, Descriptor desc)
 {
     /* Get rid of the lock file.  Have to be careful not to introduce
@@ -38,14 +36,17 @@ void deleteLockFile(const Path & path, Descriptor desc)
        file is an optimisation, not a necessity. */
 }
 
-
 bool lockFile(Descriptor desc, LockType lockType, bool wait)
 {
     int type;
-    if (lockType == ltRead) type = LOCK_SH;
-    else if (lockType == ltWrite) type = LOCK_EX;
-    else if (lockType == ltNone) type = LOCK_UN;
-    else unreachable();
+    if (lockType == ltRead)
+        type = LOCK_SH;
+    else if (lockType == ltWrite)
+        type = LOCK_EX;
+    else if (lockType == ltNone)
+        type = LOCK_UN;
+    else
+        unreachable();
 
     if (wait) {
         while (flock(desc, type) != 0) {
@@ -58,7 +59,8 @@ bool lockFile(Descriptor desc, LockType lockType, bool wait)
     } else {
         while (flock(desc, type | LOCK_NB) != 0) {
             checkInterrupt();
-            if (errno == EWOULDBLOCK) return false;
+            if (errno == EWOULDBLOCK)
+                return false;
             if (errno != EINTR)
                 throw SysError("acquiring/releasing lock");
         }
@@ -67,9 +69,7 @@ bool lockFile(Descriptor desc, LockType lockType, bool wait)
     return true;
 }
 
-
-bool PathLocks::lockPaths(const PathSet & paths,
-    const std::string & waitMsg, bool wait)
+bool PathLocks::lockPaths(const PathSet & paths, const std::string & waitMsg, bool wait)
 {
     assert(fds.empty());
 
@@ -95,7 +95,8 @@ bool PathLocks::lockPaths(const PathSet & paths,
             /* Acquire an exclusive lock. */
             if (!lockFile(fd.get(), ltWrite, false)) {
                 if (wait) {
-                    if (waitMsg != "") printError(waitMsg);
+                    if (waitMsg != "")
+                        printError(waitMsg);
                     lockFile(fd.get(), ltWrite, true);
                 } else {
                     /* Failed to lock this path; release all other
@@ -129,16 +130,14 @@ bool PathLocks::lockPaths(const PathSet & paths,
     return true;
 }
 
-
 void PathLocks::unlock()
 {
     for (auto & i : fds) {
-        if (deletePaths) deleteLockFile(i.second, i.first);
+        if (deletePaths)
+            deleteLockFile(i.second, i.first);
 
         if (close(i.first) == -1)
-            printError(
-                "error (ignored): cannot close lock file on '%1%'",
-                i.second);
+            printError("error (ignored): cannot close lock file on '%1%'", i.second);
 
         debug("lock released on '%1%'", i.second);
     }
@@ -146,7 +145,6 @@ void PathLocks::unlock()
     fds.clear();
 }
 
-
 FdLock::FdLock(Descriptor desc, LockType lockType, bool wait, std::string_view waitMsg)
     : desc(desc)
 {
@@ -159,5 +157,4 @@ FdLock::FdLock(Descriptor desc, LockType lockType, bool wait, std::string_view w
         acquired = lockFile(desc, lockType, false);
 }
 
-
-}
+} // namespace nix
diff --git a/src/libstore/unix/user-lock.cc b/src/libstore/unix/user-lock.cc
index 6a07cb7cc..c5e6455e8 100644
--- a/src/libstore/unix/user-lock.cc
+++ b/src/libstore/unix/user-lock.cc
@@ -13,12 +13,12 @@ namespace nix {
 
 #ifdef __linux__
 
-static std::vector<gid_t> get_group_list(const char *username, gid_t group_id)
+static std::vector<gid_t> get_group_list(const char * username, gid_t group_id)
 {
     std::vector<gid_t> gids;
     gids.resize(32); // Initial guess
 
-    auto getgroupl_failed {[&] {
+    auto getgroupl_failed{[&] {
         int ngroups = gids.size();
         int err = getgrouplist(username, group_id, gids.data(), &ngroups);
         gids.resize(ngroups);
@@ -35,7 +35,6 @@ static std::vector<gid_t> get_group_list(const char *username, gid_t group_id)
 }
 #endif
 
-
 struct SimpleUserLock : UserLock
 {
     AutoCloseFD fdUserLock;
@@ -43,11 +42,27 @@ struct SimpleUserLock : UserLock
     gid_t gid;
     std::vector<gid_t> supplementaryGIDs;
 
-    uid_t getUID() override { assert(uid); return uid; }
-    uid_t getUIDCount() override { return 1; }
-    gid_t getGID() override { assert(gid); return gid; }
+    uid_t getUID() override
+    {
+        assert(uid);
+        return uid;
+    }
 
-    std::vector<gid_t> getSupplementaryGIDs() override { return supplementaryGIDs; }
+    uid_t getUIDCount() override
+    {
+        return 1;
+    }
+
+    gid_t getGID() override
+    {
+        assert(gid);
+        return gid;
+    }
+
+    std::vector<gid_t> getSupplementaryGIDs() override
+    {
+        return supplementaryGIDs;
+    }
 
     static std::unique_ptr<UserLock> acquire()
     {
@@ -61,7 +76,7 @@ struct SimpleUserLock : UserLock
 
         /* Copy the result of getgrnam. */
         Strings users;
-        for (char * * p = gr->gr_mem; *p; ++p) {
+        for (char ** p = gr->gr_mem; *p; ++p) {
             debug("found build user '%s'", *p);
             users.push_back(*p);
         }
@@ -78,7 +93,7 @@ struct SimpleUserLock : UserLock
             if (!pw)
                 throw Error("the user '%s' in the group '%s' does not exist", i, settings.buildUsersGroup);
 
-            auto fnUserLock = fmt("%s/userpool/%s", settings.nixStateDir,pw->pw_uid);
+            auto fnUserLock = fmt("%s/userpool/%s", settings.nixStateDir, pw->pw_uid);
 
             AutoCloseFD fd = open(fnUserLock.c_str(), O_RDWR | O_CREAT | O_CLOEXEC, 0600);
             if (!fd)
@@ -95,7 +110,7 @@ struct SimpleUserLock : UserLock
                 if (lock->uid == getuid() || lock->uid == geteuid())
                     throw Error("the Nix user should not be a member of '%s'", settings.buildUsersGroup);
 
-                #ifdef __linux__
+#ifdef __linux__
                 /* Get the list of supplementary groups of this user. This is
                  * usually either empty or contains a group such as "kvm". */
 
@@ -104,7 +119,7 @@ struct SimpleUserLock : UserLock
                     if (gid != lock->gid)
                         lock->supplementaryGIDs.push_back(gid);
                 }
-                #endif
+#endif
 
                 return lock;
             }
@@ -121,19 +136,33 @@ struct AutoUserLock : UserLock
     gid_t firstGid = 0;
     uid_t nrIds = 1;
 
-    uid_t getUID() override { assert(firstUid); return firstUid; }
+    uid_t getUID() override
+    {
+        assert(firstUid);
+        return firstUid;
+    }
 
-    gid_t getUIDCount() override { return nrIds; }
+    gid_t getUIDCount() override
+    {
+        return nrIds;
+    }
 
-    gid_t getGID() override { assert(firstGid); return firstGid; }
+    gid_t getGID() override
+    {
+        assert(firstGid);
+        return firstGid;
+    }
 
-    std::vector<gid_t> getSupplementaryGIDs() override { return {}; }
+    std::vector<gid_t> getSupplementaryGIDs() override
+    {
+        return {};
+    }
 
     static std::unique_ptr<UserLock> acquire(uid_t nrIds, bool useUserNamespace)
     {
-        #if !defined(__linux__)
+#if !defined(__linux__)
         useUserNamespace = false;
-        #endif
+#endif
 
         experimentalFeatureSettings.require(Xp::AutoAllocateUids);
         assert(settings.startId > 0);
@@ -172,7 +201,8 @@ struct AutoUserLock : UserLock
                 else {
                     struct group * gr = getgrnam(settings.buildUsersGroup.get().c_str());
                     if (!gr)
-                        throw Error("the group '%s' specified in 'build-users-group' does not exist", settings.buildUsersGroup);
+                        throw Error(
+                            "the group '%s' specified in 'build-users-group' does not exist", settings.buildUsersGroup);
                     lock->firstGid = gr->gr_gid;
                 }
                 lock->nrIds = nrIds;
@@ -194,15 +224,15 @@ std::unique_ptr<UserLock> acquireUserLock(uid_t nrIds, bool useUserNamespace)
 
 bool useBuildUsers()
 {
-    #ifdef __linux__
+#ifdef __linux__
     static bool b = (settings.buildUsersGroup != "" || settings.autoAllocateUids) && isRootUser();
     return b;
-    #elif defined(__APPLE__) && defined(__FreeBSD__)
+#elif defined(__APPLE__) || defined(__FreeBSD__)
     static bool b = settings.buildUsersGroup != "" && isRootUser();
     return b;
-    #else
+#else
     return false;
-    #endif
+#endif
 }
 
-}
+} // namespace nix
diff --git a/src/libstore/windows/meson.build b/src/libstore/windows/meson.build
index b81c5b2af..1cc30602a 100644
--- a/src/libstore/windows/meson.build
+++ b/src/libstore/windows/meson.build
@@ -7,5 +7,4 @@ include_dirs += include_directories(
   #'build',
 )
 
-headers += files(
-)
+headers += files()
diff --git a/src/libstore/windows/pathlocks.cc b/src/libstore/windows/pathlocks.cc
index 92a7cbcf9..c4e3a3d39 100644
--- a/src/libstore/windows/pathlocks.cc
+++ b/src/libstore/windows/pathlocks.cc
@@ -155,5 +155,5 @@ FdLock::FdLock(Descriptor desc, LockType lockType, bool wait, std::string_view w
         acquired = lockFile(desc, lockType, false);
 }
 
-}
+} // namespace nix
 #endif
diff --git a/src/libstore/worker-protocol-connection.cc b/src/libstore/worker-protocol-connection.cc
index d07dc8163..8a3766290 100644
--- a/src/libstore/worker-protocol-connection.cc
+++ b/src/libstore/worker-protocol-connection.cc
@@ -244,7 +244,7 @@ void WorkerProto::BasicServerConnection::postHandshake(const StoreDirConfig & st
     WorkerProto::write(store, *this, info);
 }
 
-UnkeyedValidPathInfo WorkerProto::BasicClientConnection::queryPathInfo(
+std::optional<UnkeyedValidPathInfo> WorkerProto::BasicClientConnection::queryPathInfo(
     const StoreDirConfig & store, bool * daemonException, const StorePath & path)
 {
     to << WorkerProto::Op::QueryPathInfo << store.printStorePath(path);
@@ -253,14 +253,14 @@ UnkeyedValidPathInfo WorkerProto::BasicClientConnection::queryPathInfo(
     } catch (Error & e) {
         // Ugly backwards compatibility hack.
         if (e.msg().find("is not valid") != std::string::npos)
-            throw InvalidPath(std::move(e.info()));
+            return std::nullopt;
         throw;
     }
     if (GET_PROTOCOL_MINOR(protoVersion) >= 17) {
         bool valid;
         from >> valid;
         if (!valid)
-            throw InvalidPath("path '%s' is not valid", store.printStorePath(path));
+            return std::nullopt;
     }
     return WorkerProto::Serialise<UnkeyedValidPathInfo>::read(store, *this);
 }
@@ -313,12 +313,4 @@ void WorkerProto::BasicClientConnection::narFromPath(
     fun(from);
 }
 
-void WorkerProto::BasicClientConnection::importPaths(
-    const StoreDirConfig & store, bool * daemonException, Source & source)
-{
-    to << WorkerProto::Op::ImportPaths;
-    processStderr(daemonException, 0, &source);
-    auto importedPaths = WorkerProto::Serialise<StorePathSet>::read(store, *this);
-    assert(importedPaths.size() <= importedPaths.size());
-}
-}
+} // namespace nix
diff --git a/src/libstore/worker-protocol.cc b/src/libstore/worker-protocol.cc
index 21b21a347..1bbff64a2 100644
--- a/src/libstore/worker-protocol.cc
+++ b/src/libstore/worker-protocol.cc
@@ -18,14 +18,19 @@ BuildMode WorkerProto::Serialise<BuildMode>::read(const StoreDirConfig & store,
 {
     auto temp = readNum<uint8_t>(conn.from);
     switch (temp) {
-    case 0: return bmNormal;
-    case 1: return bmRepair;
-    case 2: return bmCheck;
-    default: throw Error("Invalid build mode");
+    case 0:
+        return bmNormal;
+    case 1:
+        return bmRepair;
+    case 2:
+        return bmCheck;
+    default:
+        throw Error("Invalid build mode");
     }
 }
 
-void WorkerProto::Serialise<BuildMode>::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const BuildMode & buildMode)
+void WorkerProto::Serialise<BuildMode>::write(
+    const StoreDirConfig & store, WorkerProto::WriteConn conn, const BuildMode & buildMode)
 {
     switch (buildMode) {
     case bmNormal:
@@ -42,22 +47,24 @@ void WorkerProto::Serialise<BuildMode>::write(const StoreDirConfig & store, Work
     };
 }
 
-std::optional<TrustedFlag> WorkerProto::Serialise<std::optional<TrustedFlag>>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
+std::optional<TrustedFlag>
+WorkerProto::Serialise<std::optional<TrustedFlag>>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
 {
     auto temp = readNum<uint8_t>(conn.from);
     switch (temp) {
-        case 0:
-            return std::nullopt;
-        case 1:
-            return { Trusted };
-        case 2:
-            return { NotTrusted };
-        default:
-            throw Error("Invalid trusted status from remote");
+    case 0:
+        return std::nullopt;
+    case 1:
+        return {Trusted};
+    case 2:
+        return {NotTrusted};
+    default:
+        throw Error("Invalid trusted status from remote");
     }
 }
 
-void WorkerProto::Serialise<std::optional<TrustedFlag>>::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const std::optional<TrustedFlag> & optTrusted)
+void WorkerProto::Serialise<std::optional<TrustedFlag>>::write(
+    const StoreDirConfig & store, WorkerProto::WriteConn conn, const std::optional<TrustedFlag> & optTrusted)
 {
     if (!optTrusted)
         conn.to << uint8_t{0};
@@ -75,32 +82,32 @@ void WorkerProto::Serialise<std::optional<TrustedFlag>>::write(const StoreDirCon
     }
 }
 
-
-std::optional<std::chrono::microseconds> WorkerProto::Serialise<std::optional<std::chrono::microseconds>>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
+std::optional<std::chrono::microseconds> WorkerProto::Serialise<std::optional<std::chrono::microseconds>>::read(
+    const StoreDirConfig & store, WorkerProto::ReadConn conn)
 {
     auto tag = readNum<uint8_t>(conn.from);
     switch (tag) {
-        case 0:
-            return std::nullopt;
-        case 1:
-            return std::optional<std::chrono::microseconds>{std::chrono::microseconds(readNum<int64_t>(conn.from))};
-        default:
-            throw Error("Invalid optional tag from remote");
+    case 0:
+        return std::nullopt;
+    case 1:
+        return std::optional<std::chrono::microseconds>{std::chrono::microseconds(readNum<int64_t>(conn.from))};
+    default:
+        throw Error("Invalid optional tag from remote");
     }
 }
 
-void WorkerProto::Serialise<std::optional<std::chrono::microseconds>>::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const std::optional<std::chrono::microseconds> & optDuration)
+void WorkerProto::Serialise<std::optional<std::chrono::microseconds>>::write(
+    const StoreDirConfig & store,
+    WorkerProto::WriteConn conn,
+    const std::optional<std::chrono::microseconds> & optDuration)
 {
     if (!optDuration.has_value()) {
         conn.to << uint8_t{0};
     } else {
-        conn.to
-            << uint8_t{1}
-            << optDuration.value().count();
+        conn.to << uint8_t{1} << optDuration.value().count();
     }
 }
 
-
 DerivedPath WorkerProto::Serialise<DerivedPath>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
 {
     auto s = readString(conn.from);
@@ -111,58 +118,57 @@ DerivedPath WorkerProto::Serialise<DerivedPath>::read(const StoreDirConfig & sto
     }
 }
 
-void WorkerProto::Serialise<DerivedPath>::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const DerivedPath & req)
+void WorkerProto::Serialise<DerivedPath>::write(
+    const StoreDirConfig & store, WorkerProto::WriteConn conn, const DerivedPath & req)
 {
     if (GET_PROTOCOL_MINOR(conn.version) >= 30) {
         conn.to << req.to_string_legacy(store);
     } else {
         auto sOrDrvPath = StorePathWithOutputs::tryFromDerivedPath(req);
-        std::visit(overloaded {
-            [&](const StorePathWithOutputs & s) {
-                conn.to << s.to_string(store);
+        std::visit(
+            overloaded{
+                [&](const StorePathWithOutputs & s) { conn.to << s.to_string(store); },
+                [&](const StorePath & drvPath) {
+                    throw Error(
+                        "trying to request '%s', but daemon protocol %d.%d is too old (< 1.29) to request a derivation file",
+                        store.printStorePath(drvPath),
+                        GET_PROTOCOL_MAJOR(conn.version),
+                        GET_PROTOCOL_MINOR(conn.version));
+                },
+                [&](std::monostate) {
+                    throw Error(
+                        "wanted to build a derivation that is itself a build product, but protocols do not support that. Try upgrading the Nix on the other end of this connection");
+                },
             },
-            [&](const StorePath & drvPath) {
-                throw Error("trying to request '%s', but daemon protocol %d.%d is too old (< 1.29) to request a derivation file",
-                    store.printStorePath(drvPath),
-                    GET_PROTOCOL_MAJOR(conn.version),
-                    GET_PROTOCOL_MINOR(conn.version));
-            },
-            [&](std::monostate) {
-                throw Error("wanted to build a derivation that is itself a build product, but protocols do not support that. Try upgrading the Nix on the other end of this connection");
-            },
-        }, sOrDrvPath);
+            sOrDrvPath);
     }
 }
 
-
-KeyedBuildResult WorkerProto::Serialise<KeyedBuildResult>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
+KeyedBuildResult
+WorkerProto::Serialise<KeyedBuildResult>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
 {
     auto path = WorkerProto::Serialise<DerivedPath>::read(store, conn);
     auto br = WorkerProto::Serialise<BuildResult>::read(store, conn);
-    return KeyedBuildResult {
+    return KeyedBuildResult{
         std::move(br),
         /* .path = */ std::move(path),
     };
 }
 
-void WorkerProto::Serialise<KeyedBuildResult>::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const KeyedBuildResult & res)
+void WorkerProto::Serialise<KeyedBuildResult>::write(
+    const StoreDirConfig & store, WorkerProto::WriteConn conn, const KeyedBuildResult & res)
 {
     WorkerProto::write(store, conn, res.path);
     WorkerProto::write(store, conn, static_cast<const BuildResult &>(res));
 }
 
-
 BuildResult WorkerProto::Serialise<BuildResult>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
 {
     BuildResult res;
     res.status = static_cast<BuildResult::Status>(readInt(conn.from));
     conn.from >> res.errorMsg;
     if (GET_PROTOCOL_MINOR(conn.version) >= 29) {
-        conn.from
-            >> res.timesBuilt
-            >> res.isNonDeterministic
-            >> res.startTime
-            >> res.stopTime;
+        conn.from >> res.timesBuilt >> res.isNonDeterministic >> res.startTime >> res.stopTime;
     }
     if (GET_PROTOCOL_MINOR(conn.version) >= 37) {
         res.cpuUser = WorkerProto::Serialise<std::optional<std::chrono::microseconds>>::read(store, conn);
@@ -171,24 +177,17 @@ BuildResult WorkerProto::Serialise<BuildResult>::read(const StoreDirConfig & sto
     if (GET_PROTOCOL_MINOR(conn.version) >= 28) {
         auto builtOutputs = WorkerProto::Serialise<DrvOutputs>::read(store, conn);
         for (auto && [output, realisation] : builtOutputs)
-            res.builtOutputs.insert_or_assign(
-                std::move(output.outputName),
-                std::move(realisation));
+            res.builtOutputs.insert_or_assign(std::move(output.outputName), std::move(realisation));
     }
     return res;
 }
 
-void WorkerProto::Serialise<BuildResult>::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const BuildResult & res)
+void WorkerProto::Serialise<BuildResult>::write(
+    const StoreDirConfig & store, WorkerProto::WriteConn conn, const BuildResult & res)
 {
-    conn.to
-        << res.status
-        << res.errorMsg;
+    conn.to << res.status << res.errorMsg;
     if (GET_PROTOCOL_MINOR(conn.version) >= 29) {
-        conn.to
-            << res.timesBuilt
-            << res.isNonDeterministic
-            << res.startTime
-            << res.stopTime;
+        conn.to << res.timesBuilt << res.isNonDeterministic << res.startTime << res.stopTime;
     }
     if (GET_PROTOCOL_MINOR(conn.version) >= 37) {
         WorkerProto::write(store, conn, res.cpuUser);
@@ -202,29 +201,29 @@ void WorkerProto::Serialise<BuildResult>::write(const StoreDirConfig & store, Wo
     }
 }
 
-
 ValidPathInfo WorkerProto::Serialise<ValidPathInfo>::read(const StoreDirConfig & store, ReadConn conn)
 {
     auto path = WorkerProto::Serialise<StorePath>::read(store, conn);
-    return ValidPathInfo {
+    return ValidPathInfo{
         std::move(path),
         WorkerProto::Serialise<UnkeyedValidPathInfo>::read(store, conn),
     };
 }
 
-void WorkerProto::Serialise<ValidPathInfo>::write(const StoreDirConfig & store, WriteConn conn, const ValidPathInfo & pathInfo)
+void WorkerProto::Serialise<ValidPathInfo>::write(
+    const StoreDirConfig & store, WriteConn conn, const ValidPathInfo & pathInfo)
 {
     WorkerProto::write(store, conn, pathInfo.path);
     WorkerProto::write(store, conn, static_cast<const UnkeyedValidPathInfo &>(pathInfo));
 }
 
-
 UnkeyedValidPathInfo WorkerProto::Serialise<UnkeyedValidPathInfo>::read(const StoreDirConfig & store, ReadConn conn)
 {
     auto deriver = readString(conn.from);
     auto narHash = Hash::parseAny(readString(conn.from), HashAlgorithm::SHA256);
     UnkeyedValidPathInfo info(narHash);
-    if (deriver != "") info.deriver = store.parseStorePath(deriver);
+    if (deriver != "")
+        info.deriver = store.parseStorePath(deriver);
     info.references = WorkerProto::Serialise<StorePathSet>::read(store, conn);
     conn.from >> info.registrationTime >> info.narSize;
     if (GET_PROTOCOL_MINOR(conn.version) >= 16) {
@@ -235,23 +234,20 @@ UnkeyedValidPathInfo WorkerProto::Serialise<UnkeyedValidPathInfo>::read(const St
     return info;
 }
 
-void WorkerProto::Serialise<UnkeyedValidPathInfo>::write(const StoreDirConfig & store, WriteConn conn, const UnkeyedValidPathInfo & pathInfo)
+void WorkerProto::Serialise<UnkeyedValidPathInfo>::write(
+    const StoreDirConfig & store, WriteConn conn, const UnkeyedValidPathInfo & pathInfo)
 {
-    conn.to
-        << (pathInfo.deriver ? store.printStorePath(*pathInfo.deriver) : "")
-        << pathInfo.narHash.to_string(HashFormat::Base16, false);
+    conn.to << (pathInfo.deriver ? store.printStorePath(*pathInfo.deriver) : "")
+            << pathInfo.narHash.to_string(HashFormat::Base16, false);
     WorkerProto::write(store, conn, pathInfo.references);
     conn.to << pathInfo.registrationTime << pathInfo.narSize;
     if (GET_PROTOCOL_MINOR(conn.version) >= 16) {
-        conn.to
-            << pathInfo.ultimate
-            << pathInfo.sigs
-            << renderContentAddress(pathInfo.ca);
+        conn.to << pathInfo.ultimate << pathInfo.sigs << renderContentAddress(pathInfo.ca);
     }
 }
 
-
-WorkerProto::ClientHandshakeInfo WorkerProto::Serialise<WorkerProto::ClientHandshakeInfo>::read(const StoreDirConfig & store, ReadConn conn)
+WorkerProto::ClientHandshakeInfo
+WorkerProto::Serialise<WorkerProto::ClientHandshakeInfo>::read(const StoreDirConfig & store, ReadConn conn)
 {
     WorkerProto::ClientHandshakeInfo res;
 
@@ -260,7 +256,7 @@ WorkerProto::ClientHandshakeInfo WorkerProto::Serialise<WorkerProto::ClientHands
     }
 
     if (GET_PROTOCOL_MINOR(conn.version) >= 35) {
-        res.remoteTrustsUs = WorkerProto::Serialise<std::optional<    TrustedFlag>>::read(store, conn);
+        res.remoteTrustsUs = WorkerProto::Serialise<std::optional<TrustedFlag>>::read(store, conn);
     } else {
         // We don't know the answer; protocol to old.
         res.remoteTrustsUs = std::nullopt;
@@ -269,7 +265,8 @@ WorkerProto::ClientHandshakeInfo WorkerProto::Serialise<WorkerProto::ClientHands
     return res;
 }
 
-void WorkerProto::Serialise<WorkerProto::ClientHandshakeInfo>::write(const StoreDirConfig & store, WriteConn conn, const WorkerProto::ClientHandshakeInfo & info)
+void WorkerProto::Serialise<WorkerProto::ClientHandshakeInfo>::write(
+    const StoreDirConfig & store, WriteConn conn, const WorkerProto::ClientHandshakeInfo & info)
 {
     if (GET_PROTOCOL_MINOR(conn.version) >= 33) {
         assert(info.daemonNixVersion);
@@ -281,4 +278,4 @@ void WorkerProto::Serialise<WorkerProto::ClientHandshakeInfo>::write(const Store
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 3414a6d31..8131c517c 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -1,7 +1,9 @@
-project('nix-util-c', 'cpp',
+project(
+  'nix-util-c',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -19,8 +21,7 @@ configdata = configuration_data()
 deps_private_maybe_subproject = [
   dependency('nix-util'),
 ]
-deps_public_maybe_subproject = [
-]
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
@@ -36,7 +37,7 @@ sources = files(
   'nix_api_util.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 headers = files(
   'nix_api_util.h',
@@ -54,7 +55,7 @@ this_library = library(
   config_priv_h,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libutil-c/nix_api_util.cc b/src/libutil-c/nix_api_util.cc
index 2254f18fa..a43e7103b 100644
--- a/src/libutil-c/nix_api_util.cc
+++ b/src/libutil-c/nix_api_util.cc
@@ -9,6 +9,8 @@
 
 #include "nix_api_util_config.h"
 
+extern "C" {
+
 nix_c_context * nix_c_context_create()
 {
     return new nix_c_context();
@@ -156,3 +158,5 @@ nix_err call_nix_get_string_callback(const std::string str, nix_get_string_callb
     callback(str.c_str(), str.size(), user_data);
     return NIX_OK;
 }
+
+} // extern "C"
diff --git a/src/libutil-c/nix_api_util_internal.h b/src/libutil-c/nix_api_util_internal.h
index 8fbf3d91a..92bb9c1d2 100644
--- a/src/libutil-c/nix_api_util_internal.h
+++ b/src/libutil-c/nix_api_util_internal.h
@@ -7,6 +7,8 @@
 #include "nix/util/error.hh"
 #include "nix_api_util.h"
 
+extern "C" {
+
 struct nix_c_context
 {
     nix_err last_err_code = NIX_OK;
@@ -32,19 +34,21 @@ nix_err nix_context_error(nix_c_context * context);
  */
 nix_err call_nix_get_string_callback(const std::string str, nix_get_string_callback callback, void * user_data);
 
-#define NIXC_CATCH_ERRS \
-    catch (...) \
-    { \
+#define NIXC_CATCH_ERRS                    \
+    catch (...)                            \
+    {                                      \
         return nix_context_error(context); \
-    } \
+    }                                      \
     return NIX_OK;
 
-#define NIXC_CATCH_ERRS_RES(def) \
-    catch (...) \
-    { \
+#define NIXC_CATCH_ERRS_RES(def)    \
+    catch (...)                     \
+    {                               \
         nix_context_error(context); \
-        return def; \
+        return def;                 \
     }
 #define NIXC_CATCH_ERRS_NULL NIXC_CATCH_ERRS_RES(nullptr)
 
+} // extern "C"
+
 #endif // NIX_API_UTIL_INTERNAL_H
diff --git a/src/libutil-test-support/hash.cc b/src/libutil-test-support/hash.cc
index d047f4073..853da8e90 100644
--- a/src/libutil-test-support/hash.cc
+++ b/src/libutil-test-support/hash.cc
@@ -1,5 +1,6 @@
 #include <regex>
 
+#include <exception> // Needed by rapidcheck on Darwin
 #include <rapidcheck.h>
 
 #include "nix/util/hash.hh"
@@ -12,16 +13,14 @@ using namespace nix;
 Gen<Hash> Arbitrary<Hash>::arbitrary()
 {
     Hash prototype(HashAlgorithm::SHA1);
-    return
-        gen::apply(
-            [](const std::vector<uint8_t> & v) {
-                Hash hash(HashAlgorithm::SHA1);
-                assert(v.size() == hash.hashSize);
-                std::copy(v.begin(), v.end(), hash.hash);
-                return hash;
-            },
-            gen::container<std::vector<uint8_t>>(prototype.hashSize, gen::arbitrary<uint8_t>())
-        );
+    return gen::apply(
+        [](const std::vector<uint8_t> & v) {
+            Hash hash(HashAlgorithm::SHA1);
+            assert(v.size() == hash.hashSize);
+            std::copy(v.begin(), v.end(), hash.hash);
+            return hash;
+        },
+        gen::container<std::vector<uint8_t>>(prototype.hashSize, gen::arbitrary<uint8_t>()));
 }
 
-}
+} // namespace rc
diff --git a/src/libutil-test-support/include/nix/util/tests/characterization.hh b/src/libutil-test-support/include/nix/util/tests/characterization.hh
index 3e8effe8b..0434590f7 100644
--- a/src/libutil-test-support/include/nix/util/tests/characterization.hh
+++ b/src/libutil-test-support/include/nix/util/tests/characterization.hh
@@ -13,7 +13,8 @@ namespace nix {
  * The path to the unit test data directory. See the contributing guide
  * in the manual for further details.
  */
-static inline std::filesystem::path getUnitTestData() {
+static inline std::filesystem::path getUnitTestData()
+{
     return getEnv("_NIX_TEST_UNIT_DATA").value();
 }
 
@@ -22,7 +23,8 @@ static inline std::filesystem::path getUnitTestData() {
  * against them. See the contributing guide in the manual for further
  * details.
  */
-static inline bool testAccept() {
+static inline bool testAccept()
+{
     return getEnv("_NIX_TEST_ACCEPT") == "1";
 }
 
@@ -49,15 +51,9 @@ public:
     {
         auto file = goldenMaster(testStem);
 
-        if (testAccept())
-        {
-            GTEST_SKIP()
-                << "Cannot read golden master "
-                << file
-                << "because another test is also updating it";
-        }
-        else
-        {
+        if (testAccept()) {
+            GTEST_SKIP() << "Cannot read golden master " << file << "because another test is also updating it";
+        } else {
             test(readFile(file));
         }
     }
@@ -68,23 +64,17 @@ public:
      * @param test hook that produces contents of the file and does the
      * actual work
      */
-    void writeTest(
-        PathView testStem, auto && test, auto && readFile2, auto && writeFile2)
+    void writeTest(PathView testStem, auto && test, auto && readFile2, auto && writeFile2)
     {
         auto file = goldenMaster(testStem);
 
         auto got = test();
 
-        if (testAccept())
-        {
+        if (testAccept()) {
             std::filesystem::create_directories(file.parent_path());
             writeFile2(file, got);
-            GTEST_SKIP()
-                << "Updating golden master "
-                << file;
-        }
-        else
-        {
+            GTEST_SKIP() << "Updating golden master " << file;
+        } else {
             decltype(got) expected = readFile2(file);
             ASSERT_EQ(got, expected);
         }
@@ -96,14 +86,11 @@ public:
     void writeTest(PathView testStem, auto && test)
     {
         writeTest(
-            testStem, test,
-            [](const std::filesystem::path & f) -> std::string {
-                return readFile(f);
-            },
-            [](const std::filesystem::path & f, const std::string & c) {
-                return writeFile(f, c);
-            });
+            testStem,
+            test,
+            [](const std::filesystem::path & f) -> std::string { return readFile(f); },
+            [](const std::filesystem::path & f, const std::string & c) { return writeFile(f, c); });
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil-test-support/include/nix/util/tests/gmock-matchers.hh b/src/libutil-test-support/include/nix/util/tests/gmock-matchers.hh
new file mode 100644
index 000000000..27d765e9e
--- /dev/null
+++ b/src/libutil-test-support/include/nix/util/tests/gmock-matchers.hh
@@ -0,0 +1,56 @@
+#pragma once
+///@file
+
+#include "nix/util/terminal.hh"
+#include <gmock/gmock.h>
+
+namespace nix::testing {
+
+namespace internal {
+
+/**
+ * GMock matcher that matches substring while stripping off all ANSI escapes.
+ * Useful for checking exceptions messages in unit tests.
+ */
+class HasSubstrIgnoreANSIMatcher
+{
+public:
+    explicit HasSubstrIgnoreANSIMatcher(std::string substring)
+        : substring(std::move(substring))
+    {
+    }
+
+    bool MatchAndExplain(const char * s, ::testing::MatchResultListener * listener) const
+    {
+        return s != nullptr && MatchAndExplain(std::string(s), listener);
+    }
+
+    template<typename MatcheeStringType>
+    bool MatchAndExplain(const MatcheeStringType & s, [[maybe_unused]] ::testing::MatchResultListener * listener) const
+    {
+        return filterANSIEscapes(s, /*filterAll=*/true).find(substring) != substring.npos;
+    }
+
+    void DescribeTo(::std::ostream * os) const
+    {
+        *os << "has substring " << substring;
+    }
+
+    void DescribeNegationTo(::std::ostream * os) const
+    {
+        *os << "has no substring " << substring;
+    }
+
+private:
+    std::string substring;
+};
+
+} // namespace internal
+
+inline ::testing::PolymorphicMatcher<internal::HasSubstrIgnoreANSIMatcher>
+HasSubstrIgnoreANSIMatcher(const std::string & substring)
+{
+    return ::testing::MakePolymorphicMatcher(internal::HasSubstrIgnoreANSIMatcher(substring));
+}
+
+} // namespace nix::testing
diff --git a/src/libutil-test-support/include/nix/util/tests/gtest-with-params.hh b/src/libutil-test-support/include/nix/util/tests/gtest-with-params.hh
index a6e23ad89..a086bbeea 100644
--- a/src/libutil-test-support/include/nix/util/tests/gtest-with-params.hh
+++ b/src/libutil-test-support/include/nix/util/tests/gtest-with-params.hh
@@ -43,7 +43,7 @@ void checkGTestWith(Testable && testable, MakeTestParams makeTestParams)
         throw std::runtime_error(ss.str());
     }
 }
-}
+} // namespace rc::detail
 
 #define RC_GTEST_PROP_WITH_PARAMS(TestCase, Name, MakeParams, ArgList)                      \
     void rapidCheck_propImpl_##TestCase##_##Name ArgList;                                   \
diff --git a/src/libutil-test-support/include/nix/util/tests/hash.hh b/src/libutil-test-support/include/nix/util/tests/hash.hh
index de832c12f..633f7bbf7 100644
--- a/src/libutil-test-support/include/nix/util/tests/hash.hh
+++ b/src/libutil-test-support/include/nix/util/tests/hash.hh
@@ -9,8 +9,9 @@ namespace rc {
 using namespace nix;
 
 template<>
-struct Arbitrary<Hash> {
+struct Arbitrary<Hash>
+{
     static Gen<Hash> arbitrary();
 };
 
-}
+} // namespace rc
diff --git a/src/libutil-test-support/include/nix/util/tests/meson.build b/src/libutil-test-support/include/nix/util/tests/meson.build
index f77dedff7..ab143757c 100644
--- a/src/libutil-test-support/include/nix/util/tests/meson.build
+++ b/src/libutil-test-support/include/nix/util/tests/meson.build
@@ -1,9 +1,10 @@
 # Public headers directory
 
-include_dirs = [include_directories('../../..')]
+include_dirs = [ include_directories('../../..') ]
 
 headers = files(
   'characterization.hh',
+  'gmock-matchers.hh',
   'gtest-with-params.hh',
   'hash.hh',
   'nix_api_util.hh',
diff --git a/src/libutil-test-support/include/nix/util/tests/nix_api_util.hh b/src/libutil-test-support/include/nix/util/tests/nix_api_util.hh
index 382c7b292..cc1d244f5 100644
--- a/src/libutil-test-support/include/nix/util/tests/nix_api_util.hh
+++ b/src/libutil-test-support/include/nix/util/tests/nix_api_util.hh
@@ -40,6 +40,7 @@ protected:
         std::string msg(p, n);
         throw std::runtime_error(loc(file, line) + ": nix_err_code(ctx) != NIX_OK, message: " + msg);
     }
+
 #define assert_ctx_ok() assert_ctx_ok(__FILE__, __LINE__)
 
     inline void assert_ctx_err(const char * file, int line)
@@ -49,7 +50,16 @@ protected:
         }
         throw std::runtime_error(loc(file, line) + ": Got NIX_OK, but expected an error!");
     }
+
 #define assert_ctx_err() assert_ctx_err(__FILE__, __LINE__)
 };
 
+static inline auto createOwnedNixContext()
+{
+    return std::unique_ptr<nix_c_context, decltype([](nix_c_context * ctx) {
+                               if (ctx)
+                                   nix_c_context_free(ctx);
+                           })>(nix_c_context_create(), {});
 }
+
+} // namespace nixC
diff --git a/src/libutil-test-support/include/nix/util/tests/string_callback.hh b/src/libutil-test-support/include/nix/util/tests/string_callback.hh
index 9a7e8d85d..c7eb9d013 100644
--- a/src/libutil-test-support/include/nix/util/tests/string_callback.hh
+++ b/src/libutil-test-support/include/nix/util/tests/string_callback.hh
@@ -12,4 +12,4 @@ inline void * observe_string_cb_data(std::string & out)
 
 #define OBSERVE_STRING(str) nix::testing::observe_string_cb, nix::testing::observe_string_cb_data(str)
 
-}
+} // namespace nix::testing
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index ec6bc15d9..910f1d881 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -1,7 +1,9 @@
-project('nix-util-test-support', 'cpp',
+project(
+  'nix-util-test-support',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -14,8 +16,7 @@ cxx = meson.get_compiler('cpp')
 
 subdir('nix-meson-build-support/deps-lists')
 
-deps_private_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
 deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-c'),
@@ -44,7 +45,7 @@ this_library = library(
   include_directories : include_dirs,
   # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
   #       is available. See also ../libutil/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   prelink : true, # For C++ static initializers
   install : true,
 )
diff --git a/src/libutil-test-support/string_callback.cc b/src/libutil-test-support/string_callback.cc
index 4f6a9cf40..b64389e4a 100644
--- a/src/libutil-test-support/string_callback.cc
+++ b/src/libutil-test-support/string_callback.cc
@@ -8,4 +8,4 @@ void observe_string_cb(const char * start, unsigned int n, void * user_data)
     *user_data_casted = std::string(start);
 }
 
-}
+} // namespace nix::testing
diff --git a/src/libutil-tests/args.cc b/src/libutil-tests/args.cc
index f5ad43a55..7aa996233 100644
--- a/src/libutil-tests/args.cc
+++ b/src/libutil-tests/args.cc
@@ -7,97 +7,110 @@
 
 namespace nix {
 
-    TEST(parseShebangContent, basic) {
-        std::list<std::string> r = parseShebangContent("hi there");
-        ASSERT_EQ(r.size(), 2u);
-        auto i = r.begin();
-        ASSERT_EQ(*i++, "hi");
-        ASSERT_EQ(*i++, "there");
-    }
+TEST(parseShebangContent, basic)
+{
+    std::list<std::string> r = parseShebangContent("hi there");
+    ASSERT_EQ(r.size(), 2u);
+    auto i = r.begin();
+    ASSERT_EQ(*i++, "hi");
+    ASSERT_EQ(*i++, "there");
+}
 
-    TEST(parseShebangContent, empty) {
-        std::list<std::string> r = parseShebangContent("");
-        ASSERT_EQ(r.size(), 0u);
-    }
+TEST(parseShebangContent, empty)
+{
+    std::list<std::string> r = parseShebangContent("");
+    ASSERT_EQ(r.size(), 0u);
+}
 
-    TEST(parseShebangContent, doubleBacktick) {
-        std::list<std::string> r = parseShebangContent("``\"ain't that nice\"``");
-        ASSERT_EQ(r.size(), 1u);
-        auto i = r.begin();
-        ASSERT_EQ(*i++, "\"ain't that nice\"");
-    }
+TEST(parseShebangContent, doubleBacktick)
+{
+    std::list<std::string> r = parseShebangContent("``\"ain't that nice\"``");
+    ASSERT_EQ(r.size(), 1u);
+    auto i = r.begin();
+    ASSERT_EQ(*i++, "\"ain't that nice\"");
+}
 
-    TEST(parseShebangContent, doubleBacktickEmpty) {
-        std::list<std::string> r = parseShebangContent("````");
-        ASSERT_EQ(r.size(), 1u);
-        auto i = r.begin();
-        ASSERT_EQ(*i++, "");
-    }
+TEST(parseShebangContent, doubleBacktickEmpty)
+{
+    std::list<std::string> r = parseShebangContent("````");
+    ASSERT_EQ(r.size(), 1u);
+    auto i = r.begin();
+    ASSERT_EQ(*i++, "");
+}
 
-    TEST(parseShebangContent, doubleBacktickMarkdownInlineCode) {
-        std::list<std::string> r = parseShebangContent("``# I'm markdown section about `coolFunction` ``");
-        ASSERT_EQ(r.size(), 1u);
-        auto i = r.begin();
-        ASSERT_EQ(*i++, "# I'm markdown section about `coolFunction`");
-    }
+TEST(parseShebangContent, doubleBacktickMarkdownInlineCode)
+{
+    std::list<std::string> r = parseShebangContent("``# I'm markdown section about `coolFunction` ``");
+    ASSERT_EQ(r.size(), 1u);
+    auto i = r.begin();
+    ASSERT_EQ(*i++, "# I'm markdown section about `coolFunction`");
+}
 
-    TEST(parseShebangContent, doubleBacktickMarkdownCodeBlockNaive) {
-        std::list<std::string> r = parseShebangContent("``Example 1\n```nix\na: a\n``` ``");
-        auto i = r.begin();
-        ASSERT_EQ(r.size(), 1u);
-        ASSERT_EQ(*i++, "Example 1\n``nix\na: a\n``");
-    }
+TEST(parseShebangContent, doubleBacktickMarkdownCodeBlockNaive)
+{
+    std::list<std::string> r = parseShebangContent("``Example 1\n```nix\na: a\n``` ``");
+    auto i = r.begin();
+    ASSERT_EQ(r.size(), 1u);
+    ASSERT_EQ(*i++, "Example 1\n``nix\na: a\n``");
+}
 
-    TEST(parseShebangContent, doubleBacktickMarkdownCodeBlockCorrect) {
-        std::list<std::string> r = parseShebangContent("``Example 1\n````nix\na: a\n```` ``");
-        auto i = r.begin();
-        ASSERT_EQ(r.size(), 1u);
-        ASSERT_EQ(*i++, "Example 1\n```nix\na: a\n```");
-    }
+TEST(parseShebangContent, doubleBacktickMarkdownCodeBlockCorrect)
+{
+    std::list<std::string> r = parseShebangContent("``Example 1\n````nix\na: a\n```` ``");
+    auto i = r.begin();
+    ASSERT_EQ(r.size(), 1u);
+    ASSERT_EQ(*i++, "Example 1\n```nix\na: a\n```");
+}
 
-    TEST(parseShebangContent, doubleBacktickMarkdownCodeBlock2) {
-        std::list<std::string> r = parseShebangContent("``Example 1\n````nix\na: a\n````\nExample 2\n````nix\na: a\n```` ``");
-        auto i = r.begin();
-        ASSERT_EQ(r.size(), 1u);
-        ASSERT_EQ(*i++, "Example 1\n```nix\na: a\n```\nExample 2\n```nix\na: a\n```");
-    }
+TEST(parseShebangContent, doubleBacktickMarkdownCodeBlock2)
+{
+    std::list<std::string> r =
+        parseShebangContent("``Example 1\n````nix\na: a\n````\nExample 2\n````nix\na: a\n```` ``");
+    auto i = r.begin();
+    ASSERT_EQ(r.size(), 1u);
+    ASSERT_EQ(*i++, "Example 1\n```nix\na: a\n```\nExample 2\n```nix\na: a\n```");
+}
 
-    TEST(parseShebangContent, singleBacktickInDoubleBacktickQuotes) {
-        std::list<std::string> r = parseShebangContent("``` ``");
-        auto i = r.begin();
-        ASSERT_EQ(r.size(), 1u);
-        ASSERT_EQ(*i++, "`");
-    }
+TEST(parseShebangContent, singleBacktickInDoubleBacktickQuotes)
+{
+    std::list<std::string> r = parseShebangContent("``` ``");
+    auto i = r.begin();
+    ASSERT_EQ(r.size(), 1u);
+    ASSERT_EQ(*i++, "`");
+}
 
-    TEST(parseShebangContent, singleBacktickAndSpaceInDoubleBacktickQuotes) {
-        std::list<std::string> r = parseShebangContent("```  ``");
-        auto i = r.begin();
-        ASSERT_EQ(r.size(), 1u);
-        ASSERT_EQ(*i++, "` ");
-    }
+TEST(parseShebangContent, singleBacktickAndSpaceInDoubleBacktickQuotes)
+{
+    std::list<std::string> r = parseShebangContent("```  ``");
+    auto i = r.begin();
+    ASSERT_EQ(r.size(), 1u);
+    ASSERT_EQ(*i++, "` ");
+}
 
-    TEST(parseShebangContent, doubleBacktickInDoubleBacktickQuotes) {
-        std::list<std::string> r = parseShebangContent("````` ``");
-        auto i = r.begin();
-        ASSERT_EQ(r.size(), 1u);
-        ASSERT_EQ(*i++, "``");
-    }
-
-    TEST(parseShebangContent, increasingQuotes) {
-        std::list<std::string> r = parseShebangContent("```` ``` `` ````` `` `````` ``");
-        auto i = r.begin();
-        ASSERT_EQ(r.size(), 4u);
-        ASSERT_EQ(*i++, "");
-        ASSERT_EQ(*i++, "`");
-        ASSERT_EQ(*i++, "``");
-        ASSERT_EQ(*i++, "```");
-    }
+TEST(parseShebangContent, doubleBacktickInDoubleBacktickQuotes)
+{
+    std::list<std::string> r = parseShebangContent("````` ``");
+    auto i = r.begin();
+    ASSERT_EQ(r.size(), 1u);
+    ASSERT_EQ(*i++, "``");
+}
 
+TEST(parseShebangContent, increasingQuotes)
+{
+    std::list<std::string> r = parseShebangContent("```` ``` `` ````` `` `````` ``");
+    auto i = r.begin();
+    ASSERT_EQ(r.size(), 4u);
+    ASSERT_EQ(*i++, "");
+    ASSERT_EQ(*i++, "`");
+    ASSERT_EQ(*i++, "``");
+    ASSERT_EQ(*i++, "```");
+}
 
 #ifndef COVERAGE
 
 // quick and dirty
-static inline std::string escape(std::string_view s_) {
+static inline std::string escape(std::string_view s_)
+{
 
     std::string_view s = s_;
     std::string r = "``";
@@ -125,11 +138,7 @@ static inline std::string escape(std::string_view s_) {
         }
     }
 
-    if (!r.empty()
-        && (
-            r[r.size() - 1] == '`'
-            || r[r.size() - 1] == ' '
-        )) {
+    if (!r.empty() && (r[r.size() - 1] == '`' || r[r.size() - 1] == ' ')) {
         r += " ";
     }
 
@@ -138,10 +147,7 @@ static inline std::string escape(std::string_view s_) {
     return r;
 };
 
-RC_GTEST_PROP(
-    parseShebangContent,
-    prop_round_trip_single,
-    (const std::string & orig))
+RC_GTEST_PROP(parseShebangContent, prop_round_trip_single, (const std::string & orig))
 {
     auto escaped = escape(orig);
     // RC_LOG() << "escaped: <[[" << escaped << "]]>" << std::endl;
@@ -150,10 +156,7 @@ RC_GTEST_PROP(
     RC_ASSERT(*ss.begin() == orig);
 }
 
-RC_GTEST_PROP(
-    parseShebangContent,
-    prop_round_trip_two,
-    (const std::string & one, const std::string & two))
+RC_GTEST_PROP(parseShebangContent, prop_round_trip_two, (const std::string & one, const std::string & two))
 {
     auto ss = parseShebangContent(escape(one) + " " + escape(two));
     RC_ASSERT(ss.size() == 2u);
@@ -162,7 +165,6 @@ RC_GTEST_PROP(
     RC_ASSERT(*i++ == two);
 }
 
-
 #endif
 
-}
+} // namespace nix
diff --git a/src/libutil-tests/base-n.cc b/src/libutil-tests/base-n.cc
new file mode 100644
index 000000000..b3a845365
--- /dev/null
+++ b/src/libutil-tests/base-n.cc
@@ -0,0 +1,110 @@
+#include <gtest/gtest.h>
+#include <numeric>
+
+#include "nix/util/base-n.hh"
+#include "nix/util/error.hh"
+
+namespace nix {
+
+static const std::span<const std::byte> stringToByteSpan(const std::string_view s)
+{
+    return {(const std::byte *) s.data(), s.size()};
+}
+
+/* ----------------------------------------------------------------------------
+ * base64::encode
+ * --------------------------------------------------------------------------*/
+
+TEST(base64Encode, emptyString)
+{
+    ASSERT_EQ(base64::encode(stringToByteSpan("")), "");
+}
+
+TEST(base64Encode, encodesAString)
+{
+    ASSERT_EQ(base64::encode(stringToByteSpan("quod erat demonstrandum")), "cXVvZCBlcmF0IGRlbW9uc3RyYW5kdW0=");
+}
+
+TEST(base64Encode, encodeAndDecode)
+{
+    auto s = "quod erat demonstrandum";
+    auto encoded = base64::encode(stringToByteSpan(s));
+    auto decoded = base64::decode(encoded);
+
+    ASSERT_EQ(decoded, s);
+}
+
+TEST(base64Encode, encodeAndDecodeNonPrintable)
+{
+    char s[256];
+    std::iota(std::rbegin(s), std::rend(s), 0);
+
+    auto encoded = base64::encode(std::as_bytes(std::span<const char>{std::string_view{s}}));
+    auto decoded = base64::decode(encoded);
+
+    EXPECT_EQ(decoded.length(), 255u);
+    ASSERT_EQ(decoded, s);
+}
+
+/* ----------------------------------------------------------------------------
+ * base64::decode
+ * --------------------------------------------------------------------------*/
+
+TEST(base64Decode, emptyString)
+{
+    ASSERT_EQ(base64::decode(""), "");
+}
+
+TEST(base64Decode, decodeAString)
+{
+    ASSERT_EQ(base64::decode("cXVvZCBlcmF0IGRlbW9uc3RyYW5kdW0="), "quod erat demonstrandum");
+}
+
+TEST(base64Decode, decodeThrowsOnInvalidChar)
+{
+    ASSERT_THROW(base64::decode("cXVvZCBlcm_0IGRlbW9uc3RyYW5kdW0="), Error);
+}
+
+// A SHA-512 hash. Hex encoded to be clearer / distinct from the Base64 test case.
+const std::string expectedDecoded = base16::decode(
+    "ee0f754c1bd8a18428ad14eaa3ead80ff8b96275af5012e7a8384f1f10490da056eec9ae3cc791a7a13a24e16e54df5bccdd109c7d53a14534bbd7360a300b11");
+
+struct Base64TrailingParseCase
+{
+    std::string sri;
+};
+
+class Base64TrailParseTest : public ::testing::TestWithParam<Base64TrailingParseCase>
+{};
+
+TEST_P(Base64TrailParseTest, AcceptsVariousSha512Paddings)
+{
+    auto sri = GetParam().sri;
+    auto decoded = base64::decode(sri);
+
+    EXPECT_EQ(decoded, expectedDecoded);
+}
+
+/* Nix's Base64 implementation has historically accepted trailing
+   garbage. We may want to warn about this in the future, but we cannot
+   take it away suddenly.
+
+   Test case taken from Snix:
+   https://git.snix.dev/snix/snix/src/commit/2a29b90c7f3f3c52b5bdae50260fb0bd903c6b38/snix/nix-compat/src/nixhash/mod.rs#L431
+ */
+INSTANTIATE_TEST_SUITE_P(
+    Sha512Paddings,
+    Base64TrailParseTest,
+    ::testing::Values(
+        Base64TrailingParseCase{
+            "7g91TBvYoYQorRTqo+rYD/i5YnWvUBLnqDhPHxBJDaBW7smuPMeRp6E6JOFuVN9bzN0QnH1ToUU0u9c2CjALEQ"},
+        Base64TrailingParseCase{
+            "7g91TBvYoYQorRTqo+rYD/i5YnWvUBLnqDhPHxBJDaBW7smuPMeRp6E6JOFuVN9bzN0QnH1ToUU0u9c2CjALEQ="},
+        Base64TrailingParseCase{
+            "7g91TBvYoYQorRTqo+rYD/i5YnWvUBLnqDhPHxBJDaBW7smuPMeRp6E6JOFuVN9bzN0QnH1ToUU0u9c2CjALEQ=="},
+        Base64TrailingParseCase{
+            "7g91TBvYoYQorRTqo+rYD/i5YnWvUBLnqDhPHxBJDaBW7smuPMeRp6E6JOFuVN9bzN0QnH1ToUU0u9c2CjALEQ==="},
+        Base64TrailingParseCase{
+            "7g91TBvYoYQorRTqo+rYD/i5YnWvUBLnqDhPHxBJDaBW7smuPMeRp6E6JOFuVN9bzN0QnH1ToUU0u9c2CjALEQ== cheesecake"}));
+
+} // namespace nix
diff --git a/src/libutil-tests/canon-path.cc b/src/libutil-tests/canon-path.cc
index c6808bf66..971a9cc96 100644
--- a/src/libutil-tests/canon-path.cc
+++ b/src/libutil-tests/canon-path.cc
@@ -4,177 +4,189 @@
 
 namespace nix {
 
-    TEST(CanonPath, basic) {
-        {
-            CanonPath p("/");
-            ASSERT_EQ(p.abs(), "/");
-            ASSERT_EQ(p.rel(), "");
-            ASSERT_EQ(p.baseName(), std::nullopt);
-            ASSERT_EQ(p.dirOf(), std::nullopt);
-            ASSERT_FALSE(p.parent());
-        }
-
-        {
-            CanonPath p("/foo//");
-            ASSERT_EQ(p.abs(), "/foo");
-            ASSERT_EQ(p.rel(), "foo");
-            ASSERT_EQ(*p.baseName(), "foo");
-            ASSERT_EQ(*p.dirOf(), ""); // FIXME: do we want this?
-            ASSERT_EQ(p.parent()->abs(), "/");
-        }
-
-        {
-            CanonPath p("foo/bar");
-            ASSERT_EQ(p.abs(), "/foo/bar");
-            ASSERT_EQ(p.rel(), "foo/bar");
-            ASSERT_EQ(*p.baseName(), "bar");
-            ASSERT_EQ(*p.dirOf(), "/foo");
-            ASSERT_EQ(p.parent()->abs(), "/foo");
-        }
-
-        {
-            CanonPath p("foo//bar/");
-            ASSERT_EQ(p.abs(), "/foo/bar");
-            ASSERT_EQ(p.rel(), "foo/bar");
-            ASSERT_EQ(*p.baseName(), "bar");
-            ASSERT_EQ(*p.dirOf(), "/foo");
-        }
-    }
-
-    TEST(CanonPath, from_existing) {
-        CanonPath p0("foo//bar/");
-        {
-            CanonPath p("/baz//quux/", p0);
-            ASSERT_EQ(p.abs(), "/baz/quux");
-            ASSERT_EQ(p.rel(), "baz/quux");
-            ASSERT_EQ(*p.baseName(), "quux");
-            ASSERT_EQ(*p.dirOf(), "/baz");
-        }
-        {
-            CanonPath p("baz//quux/", p0);
-            ASSERT_EQ(p.abs(), "/foo/bar/baz/quux");
-            ASSERT_EQ(p.rel(), "foo/bar/baz/quux");
-            ASSERT_EQ(*p.baseName(), "quux");
-            ASSERT_EQ(*p.dirOf(), "/foo/bar/baz");
-        }
-    }
-
-    TEST(CanonPath, pop) {
-        CanonPath p("foo/bar/x");
-        ASSERT_EQ(p.abs(), "/foo/bar/x");
-        p.pop();
-        ASSERT_EQ(p.abs(), "/foo/bar");
-        p.pop();
-        ASSERT_EQ(p.abs(), "/foo");
-        p.pop();
+TEST(CanonPath, basic)
+{
+    {
+        CanonPath p("/");
         ASSERT_EQ(p.abs(), "/");
+        ASSERT_EQ(p.rel(), "");
+        ASSERT_EQ(p.baseName(), std::nullopt);
+        ASSERT_EQ(p.dirOf(), std::nullopt);
+        ASSERT_FALSE(p.parent());
     }
 
-    TEST(CanonPath, removePrefix) {
-        CanonPath p1("foo/bar");
-        CanonPath p2("foo/bar/a/b/c");
-        ASSERT_EQ(p2.removePrefix(p1).abs(), "/a/b/c");
-        ASSERT_EQ(p1.removePrefix(p1).abs(), "/");
-        ASSERT_EQ(p1.removePrefix(CanonPath("/")).abs(), "/foo/bar");
+    {
+        CanonPath p("/foo//");
+        ASSERT_EQ(p.abs(), "/foo");
+        ASSERT_EQ(p.rel(), "foo");
+        ASSERT_EQ(*p.baseName(), "foo");
+        ASSERT_EQ(*p.dirOf(), ""); // FIXME: do we want this?
+        ASSERT_EQ(p.parent()->abs(), "/");
     }
 
-    TEST(CanonPath, iter) {
-        {
-            CanonPath p("a//foo/bar//");
-            std::vector<std::string_view> ss;
-            for (auto & c : p) ss.push_back(c);
-            ASSERT_EQ(ss, std::vector<std::string_view>({"a", "foo", "bar"}));
-        }
-
-        {
-            CanonPath p("/");
-            std::vector<std::string_view> ss;
-            for (auto & c : p) ss.push_back(c);
-            ASSERT_EQ(ss, std::vector<std::string_view>());
-        }
+    {
+        CanonPath p("foo/bar");
+        ASSERT_EQ(p.abs(), "/foo/bar");
+        ASSERT_EQ(p.rel(), "foo/bar");
+        ASSERT_EQ(*p.baseName(), "bar");
+        ASSERT_EQ(*p.dirOf(), "/foo");
+        ASSERT_EQ(p.parent()->abs(), "/foo");
     }
 
-    TEST(CanonPath, concat) {
-        {
-            CanonPath p1("a//foo/bar//");
-            CanonPath p2("xyzzy/bla");
-            ASSERT_EQ((p1 / p2).abs(), "/a/foo/bar/xyzzy/bla");
-        }
-
-        {
-            CanonPath p1("/");
-            CanonPath p2("/a/b");
-            ASSERT_EQ((p1 / p2).abs(), "/a/b");
-        }
-
-        {
-            CanonPath p1("/a/b");
-            CanonPath p2("/");
-            ASSERT_EQ((p1 / p2).abs(), "/a/b");
-        }
-
-        {
-            CanonPath p("/foo/bar");
-            ASSERT_EQ((p / "x").abs(), "/foo/bar/x");
-        }
-
-        {
-            CanonPath p("/");
-            ASSERT_EQ((p / "foo" / "bar").abs(), "/foo/bar");
-        }
-    }
-
-    TEST(CanonPath, within) {
-        ASSERT_TRUE(CanonPath("foo").isWithin(CanonPath("foo")));
-        ASSERT_FALSE(CanonPath("foo").isWithin(CanonPath("bar")));
-        ASSERT_FALSE(CanonPath("foo").isWithin(CanonPath("fo")));
-        ASSERT_TRUE(CanonPath("foo/bar").isWithin(CanonPath("foo")));
-        ASSERT_FALSE(CanonPath("foo").isWithin(CanonPath("foo/bar")));
-        ASSERT_TRUE(CanonPath("/foo/bar/default.nix").isWithin(CanonPath("/")));
-        ASSERT_TRUE(CanonPath("/").isWithin(CanonPath("/")));
-    }
-
-    TEST(CanonPath, sort) {
-        ASSERT_FALSE(CanonPath("foo") < CanonPath("foo"));
-        ASSERT_TRUE (CanonPath("foo") < CanonPath("foo/bar"));
-        ASSERT_TRUE (CanonPath("foo/bar") < CanonPath("foo!"));
-        ASSERT_FALSE(CanonPath("foo!") < CanonPath("foo"));
-        ASSERT_TRUE (CanonPath("foo") < CanonPath("foo!"));
-    }
-
-    TEST(CanonPath, allowed) {
-        std::set<CanonPath> allowed {
-            CanonPath("foo/bar"),
-            CanonPath("foo!"),
-            CanonPath("xyzzy"),
-            CanonPath("a/b/c"),
-        };
-
-        ASSERT_TRUE (CanonPath("foo/bar").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("foo/bar/bla").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("foo").isAllowed(allowed));
-        ASSERT_FALSE(CanonPath("bar").isAllowed(allowed));
-        ASSERT_FALSE(CanonPath("bar/a").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("a").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("a/b").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("a/b/c").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("a/b/c/d").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("a/b/c/d/e").isAllowed(allowed));
-        ASSERT_FALSE(CanonPath("a/b/a").isAllowed(allowed));
-        ASSERT_FALSE(CanonPath("a/b/d").isAllowed(allowed));
-        ASSERT_FALSE(CanonPath("aaa").isAllowed(allowed));
-        ASSERT_FALSE(CanonPath("zzz").isAllowed(allowed));
-        ASSERT_TRUE (CanonPath("/").isAllowed(allowed));
-    }
-
-    TEST(CanonPath, makeRelative) {
-        CanonPath d("/foo/bar");
-        ASSERT_EQ(d.makeRelative(CanonPath("/foo/bar")), ".");
-        ASSERT_EQ(d.makeRelative(CanonPath("/foo")), "..");
-        ASSERT_EQ(d.makeRelative(CanonPath("/")), "../..");
-        ASSERT_EQ(d.makeRelative(CanonPath("/foo/bar/xyzzy")), "xyzzy");
-        ASSERT_EQ(d.makeRelative(CanonPath("/foo/bar/xyzzy/bla")), "xyzzy/bla");
-        ASSERT_EQ(d.makeRelative(CanonPath("/foo/xyzzy/bla")), "../xyzzy/bla");
-        ASSERT_EQ(d.makeRelative(CanonPath("/xyzzy/bla")), "../../xyzzy/bla");
+    {
+        CanonPath p("foo//bar/");
+        ASSERT_EQ(p.abs(), "/foo/bar");
+        ASSERT_EQ(p.rel(), "foo/bar");
+        ASSERT_EQ(*p.baseName(), "bar");
+        ASSERT_EQ(*p.dirOf(), "/foo");
     }
 }
+
+TEST(CanonPath, from_existing)
+{
+    CanonPath p0("foo//bar/");
+    {
+        CanonPath p("/baz//quux/", p0);
+        ASSERT_EQ(p.abs(), "/baz/quux");
+        ASSERT_EQ(p.rel(), "baz/quux");
+        ASSERT_EQ(*p.baseName(), "quux");
+        ASSERT_EQ(*p.dirOf(), "/baz");
+    }
+    {
+        CanonPath p("baz//quux/", p0);
+        ASSERT_EQ(p.abs(), "/foo/bar/baz/quux");
+        ASSERT_EQ(p.rel(), "foo/bar/baz/quux");
+        ASSERT_EQ(*p.baseName(), "quux");
+        ASSERT_EQ(*p.dirOf(), "/foo/bar/baz");
+    }
+}
+
+TEST(CanonPath, pop)
+{
+    CanonPath p("foo/bar/x");
+    ASSERT_EQ(p.abs(), "/foo/bar/x");
+    p.pop();
+    ASSERT_EQ(p.abs(), "/foo/bar");
+    p.pop();
+    ASSERT_EQ(p.abs(), "/foo");
+    p.pop();
+    ASSERT_EQ(p.abs(), "/");
+}
+
+TEST(CanonPath, removePrefix)
+{
+    CanonPath p1("foo/bar");
+    CanonPath p2("foo/bar/a/b/c");
+    ASSERT_EQ(p2.removePrefix(p1).abs(), "/a/b/c");
+    ASSERT_EQ(p1.removePrefix(p1).abs(), "/");
+    ASSERT_EQ(p1.removePrefix(CanonPath("/")).abs(), "/foo/bar");
+}
+
+TEST(CanonPath, iter)
+{
+    {
+        CanonPath p("a//foo/bar//");
+        std::vector<std::string_view> ss;
+        for (auto & c : p)
+            ss.push_back(c);
+        ASSERT_EQ(ss, std::vector<std::string_view>({"a", "foo", "bar"}));
+    }
+
+    {
+        CanonPath p("/");
+        std::vector<std::string_view> ss;
+        for (auto & c : p)
+            ss.push_back(c);
+        ASSERT_EQ(ss, std::vector<std::string_view>());
+    }
+}
+
+TEST(CanonPath, concat)
+{
+    {
+        CanonPath p1("a//foo/bar//");
+        CanonPath p2("xyzzy/bla");
+        ASSERT_EQ((p1 / p2).abs(), "/a/foo/bar/xyzzy/bla");
+    }
+
+    {
+        CanonPath p1("/");
+        CanonPath p2("/a/b");
+        ASSERT_EQ((p1 / p2).abs(), "/a/b");
+    }
+
+    {
+        CanonPath p1("/a/b");
+        CanonPath p2("/");
+        ASSERT_EQ((p1 / p2).abs(), "/a/b");
+    }
+
+    {
+        CanonPath p("/foo/bar");
+        ASSERT_EQ((p / "x").abs(), "/foo/bar/x");
+    }
+
+    {
+        CanonPath p("/");
+        ASSERT_EQ((p / "foo" / "bar").abs(), "/foo/bar");
+    }
+}
+
+TEST(CanonPath, within)
+{
+    ASSERT_TRUE(CanonPath("foo").isWithin(CanonPath("foo")));
+    ASSERT_FALSE(CanonPath("foo").isWithin(CanonPath("bar")));
+    ASSERT_FALSE(CanonPath("foo").isWithin(CanonPath("fo")));
+    ASSERT_TRUE(CanonPath("foo/bar").isWithin(CanonPath("foo")));
+    ASSERT_FALSE(CanonPath("foo").isWithin(CanonPath("foo/bar")));
+    ASSERT_TRUE(CanonPath("/foo/bar/default.nix").isWithin(CanonPath("/")));
+    ASSERT_TRUE(CanonPath("/").isWithin(CanonPath("/")));
+}
+
+TEST(CanonPath, sort)
+{
+    ASSERT_FALSE(CanonPath("foo") < CanonPath("foo"));
+    ASSERT_TRUE(CanonPath("foo") < CanonPath("foo/bar"));
+    ASSERT_TRUE(CanonPath("foo/bar") < CanonPath("foo!"));
+    ASSERT_FALSE(CanonPath("foo!") < CanonPath("foo"));
+    ASSERT_TRUE(CanonPath("foo") < CanonPath("foo!"));
+}
+
+TEST(CanonPath, allowed)
+{
+    std::set<CanonPath> allowed{
+        CanonPath("foo/bar"),
+        CanonPath("foo!"),
+        CanonPath("xyzzy"),
+        CanonPath("a/b/c"),
+    };
+
+    ASSERT_TRUE(CanonPath("foo/bar").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("foo/bar/bla").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("foo").isAllowed(allowed));
+    ASSERT_FALSE(CanonPath("bar").isAllowed(allowed));
+    ASSERT_FALSE(CanonPath("bar/a").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("a").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("a/b").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("a/b/c").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("a/b/c/d").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("a/b/c/d/e").isAllowed(allowed));
+    ASSERT_FALSE(CanonPath("a/b/a").isAllowed(allowed));
+    ASSERT_FALSE(CanonPath("a/b/d").isAllowed(allowed));
+    ASSERT_FALSE(CanonPath("aaa").isAllowed(allowed));
+    ASSERT_FALSE(CanonPath("zzz").isAllowed(allowed));
+    ASSERT_TRUE(CanonPath("/").isAllowed(allowed));
+}
+
+TEST(CanonPath, makeRelative)
+{
+    CanonPath d("/foo/bar");
+    ASSERT_EQ(d.makeRelative(CanonPath("/foo/bar")), ".");
+    ASSERT_EQ(d.makeRelative(CanonPath("/foo")), "..");
+    ASSERT_EQ(d.makeRelative(CanonPath("/")), "../..");
+    ASSERT_EQ(d.makeRelative(CanonPath("/foo/bar/xyzzy")), "xyzzy");
+    ASSERT_EQ(d.makeRelative(CanonPath("/foo/bar/xyzzy/bla")), "xyzzy/bla");
+    ASSERT_EQ(d.makeRelative(CanonPath("/foo/xyzzy/bla")), "../xyzzy/bla");
+    ASSERT_EQ(d.makeRelative(CanonPath("/xyzzy/bla")), "../../xyzzy/bla");
+}
+} // namespace nix
diff --git a/src/libutil-tests/checked-arithmetic.cc b/src/libutil-tests/checked-arithmetic.cc
index 8056a430a..2b5970fb6 100644
--- a/src/libutil-tests/checked-arithmetic.cc
+++ b/src/libutil-tests/checked-arithmetic.cc
@@ -21,7 +21,7 @@ struct Arbitrary<nix::checked::Checked<T>>
     }
 };
 
-}
+} // namespace rc
 
 namespace nix::checked {
 
@@ -155,4 +155,4 @@ TEST(Checked, div_signed_special_cases)
     checkDivision<int16_t, int64_t>(0, 0);
 }
 
-}
+} // namespace nix::checked
diff --git a/src/libutil-tests/chunked-vector.cc b/src/libutil-tests/chunked-vector.cc
index c4f1d3858..52f87a0d5 100644
--- a/src/libutil-tests/chunked-vector.cc
+++ b/src/libutil-tests/chunked-vector.cc
@@ -3,52 +3,54 @@
 #include <gtest/gtest.h>
 
 namespace nix {
-    TEST(ChunkedVector, InitEmpty) {
-        auto v = ChunkedVector<int, 2>(100);
-        ASSERT_EQ(v.size(), 0u);
-    }
-
-    TEST(ChunkedVector, GrowsCorrectly) {
-        auto v = ChunkedVector<int, 2>(100);
-        for (uint32_t i = 1; i < 20; i++) {
-            v.add(i);
-            ASSERT_EQ(v.size(), i);
-        }
-    }
-
-    TEST(ChunkedVector, AddAndGet) {
-        auto v = ChunkedVector<int, 2>(100);
-        for (auto i = 1; i < 20; i++) {
-            auto [i2, idx] = v.add(i);
-            auto & i3 = v[idx];
-            ASSERT_EQ(i, i2);
-            ASSERT_EQ(&i2, &i3);
-        }
-    }
-
-    TEST(ChunkedVector, ForEach) {
-        auto v = ChunkedVector<int, 2>(100);
-        for (auto i = 1; i < 20; i++) {
-            v.add(i);
-        }
-        uint32_t count = 0;
-        v.forEach([&count](int elt) {
-            count++;
-        });
-        ASSERT_EQ(count, v.size());
-    }
-
-    TEST(ChunkedVector, OverflowOK) {
-        // Similar to the AddAndGet, but intentionnally use a small
-        // initial ChunkedVector to force it to overflow
-        auto v = ChunkedVector<int, 2>(2);
-        for (auto i = 1; i < 20; i++) {
-            auto [i2, idx] = v.add(i);
-            auto & i3 = v[idx];
-            ASSERT_EQ(i, i2);
-            ASSERT_EQ(&i2, &i3);
-        }
-    }
-
+TEST(ChunkedVector, InitEmpty)
+{
+    auto v = ChunkedVector<int, 2>(100);
+    ASSERT_EQ(v.size(), 0u);
 }
 
+TEST(ChunkedVector, GrowsCorrectly)
+{
+    auto v = ChunkedVector<int, 2>(100);
+    for (uint32_t i = 1; i < 20; i++) {
+        v.add(i);
+        ASSERT_EQ(v.size(), i);
+    }
+}
+
+TEST(ChunkedVector, AddAndGet)
+{
+    auto v = ChunkedVector<int, 2>(100);
+    for (auto i = 1; i < 20; i++) {
+        auto [i2, idx] = v.add(i);
+        auto & i3 = v[idx];
+        ASSERT_EQ(i, i2);
+        ASSERT_EQ(&i2, &i3);
+    }
+}
+
+TEST(ChunkedVector, ForEach)
+{
+    auto v = ChunkedVector<int, 2>(100);
+    for (auto i = 1; i < 20; i++) {
+        v.add(i);
+    }
+    uint32_t count = 0;
+    v.forEach([&count](int elt) { count++; });
+    ASSERT_EQ(count, v.size());
+}
+
+TEST(ChunkedVector, OverflowOK)
+{
+    // Similar to the AddAndGet, but intentionnally use a small
+    // initial ChunkedVector to force it to overflow
+    auto v = ChunkedVector<int, 2>(2);
+    for (auto i = 1; i < 20; i++) {
+        auto [i2, idx] = v.add(i);
+        auto & i3 = v[idx];
+        ASSERT_EQ(i, i2);
+        ASSERT_EQ(&i2, &i3);
+    }
+}
+
+} // namespace nix
diff --git a/src/libutil-tests/closure.cc b/src/libutil-tests/closure.cc
index 6bbc128c2..9973ceeb0 100644
--- a/src/libutil-tests/closure.cc
+++ b/src/libutil-tests/closure.cc
@@ -6,48 +6,48 @@ namespace nix {
 using namespace std;
 
 map<string, set<string>> testGraph = {
-    { "A", { "B", "C", "G" } },
-    { "B", { "A" } }, // Loops back to A
-    { "C", { "F" } }, // Indirect reference
-    { "D", { "A" } }, // Not reachable, but has backreferences
-    { "E", {} }, // Just not reachable
-    { "F", {} },
-    { "G", { "G" } }, // Self reference
+    {"A", {"B", "C", "G"}},
+    {"B", {"A"}}, // Loops back to A
+    {"C", {"F"}}, // Indirect reference
+    {"D", {"A"}}, // Not reachable, but has backreferences
+    {"E", {}},    // Just not reachable
+    {"F", {}},
+    {"G", {"G"}}, // Self reference
 };
 
-TEST(closure, correctClosure) {
+TEST(closure, correctClosure)
+{
     set<string> aClosure;
     set<string> expectedClosure = {"A", "B", "C", "F", "G"};
     computeClosure<string>(
-        {"A"},
-        aClosure,
-        [&](const string currentNode, function<void(promise<set<string>> &)> processEdges) {
+        {"A"}, aClosure, [&](const string currentNode, function<void(promise<set<string>> &)> processEdges) {
             promise<set<string>> promisedNodes;
             promisedNodes.set_value(testGraph[currentNode]);
             processEdges(promisedNodes);
-        }
-    );
+        });
 
     ASSERT_EQ(aClosure, expectedClosure);
 }
 
-TEST(closure, properlyHandlesDirectExceptions) {
-    struct TestExn {};
+TEST(closure, properlyHandlesDirectExceptions)
+{
+    struct TestExn
+    {};
+
     set<string> aClosure;
     EXPECT_THROW(
         computeClosure<string>(
             {"A"},
             aClosure,
-            [&](const string currentNode, function<void(promise<set<string>> &)> processEdges) {
-                throw TestExn();
-            }
-        ),
-        TestExn
-    );
+            [&](const string currentNode, function<void(promise<set<string>> &)> processEdges) { throw TestExn(); }),
+        TestExn);
 }
 
-TEST(closure, properlyHandlesExceptionsInPromise) {
-    struct TestExn {};
+TEST(closure, properlyHandlesExceptionsInPromise)
+{
+    struct TestExn
+    {};
+
     set<string> aClosure;
     EXPECT_THROW(
         computeClosure<string>(
@@ -61,10 +61,8 @@ TEST(closure, properlyHandlesExceptionsInPromise) {
                     promise.set_exception(std::current_exception());
                 }
                 processEdges(promise);
-            }
-        ),
-        TestExn
-    );
+            }),
+        TestExn);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil-tests/compression.cc b/src/libutil-tests/compression.cc
index de0c7cdb6..c6d570471 100644
--- a/src/libutil-tests/compression.cc
+++ b/src/libutil-tests/compression.cc
@@ -3,94 +3,104 @@
 
 namespace nix {
 
-    /* ----------------------------------------------------------------------------
-     * compress / decompress
-     * --------------------------------------------------------------------------*/
-
-    TEST(compress, compressWithUnknownMethod) {
-        ASSERT_THROW(compress("invalid-method", "something-to-compress"), UnknownCompressionMethod);
-    }
-
-    TEST(compress, noneMethodDoesNothingToTheInput) {
-        auto o = compress("none", "this-is-a-test");
-
-        ASSERT_EQ(o, "this-is-a-test");
-    }
-
-    TEST(decompress, decompressNoneCompressed) {
-        auto method = "none";
-        auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-        auto o = decompress(method, str);
-
-        ASSERT_EQ(o, str);
-    }
-
-    TEST(decompress, decompressEmptyCompressed) {
-        // Empty-method decompression used e.g. by S3 store
-        // (Content-Encoding == "").
-        auto method = "";
-        auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-        auto o = decompress(method, str);
-
-        ASSERT_EQ(o, str);
-    }
-
-    TEST(decompress, decompressXzCompressed) {
-        auto method = "xz";
-        auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-        auto o = decompress(method, compress(method, str));
-
-        ASSERT_EQ(o, str);
-    }
-
-    TEST(decompress, decompressBzip2Compressed) {
-        auto method = "bzip2";
-        auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-        auto o = decompress(method, compress(method, str));
-
-        ASSERT_EQ(o, str);
-    }
-
-    TEST(decompress, decompressBrCompressed) {
-        auto method = "br";
-        auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-        auto o = decompress(method, compress(method, str));
-
-        ASSERT_EQ(o, str);
-    }
-
-    TEST(decompress, decompressInvalidInputThrowsCompressionError) {
-        auto method = "bzip2";
-        auto str = "this is a string that does not qualify as valid bzip2 data";
-
-        ASSERT_THROW(decompress(method, str), CompressionError);
-    }
-
-    /* ----------------------------------------------------------------------------
-     * compression sinks
-     * --------------------------------------------------------------------------*/
-
-    TEST(makeCompressionSink, noneSinkDoesNothingToInput) {
-        StringSink strSink;
-        auto inputString = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-        auto sink = makeCompressionSink("none", strSink);
-        (*sink)(inputString);
-        sink->finish();
-
-        ASSERT_STREQ(strSink.s.c_str(), inputString);
-    }
-
-    TEST(makeCompressionSink, compressAndDecompress) {
-        StringSink strSink;
-        auto inputString = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
-        auto decompressionSink = makeDecompressionSink("bzip2", strSink);
-        auto sink = makeCompressionSink("bzip2", *decompressionSink);
-
-        (*sink)(inputString);
-        sink->finish();
-        decompressionSink->finish();
-
-        ASSERT_STREQ(strSink.s.c_str(), inputString);
-    }
+/* ----------------------------------------------------------------------------
+ * compress / decompress
+ * --------------------------------------------------------------------------*/
 
+TEST(compress, compressWithUnknownMethod)
+{
+    ASSERT_THROW(compress("invalid-method", "something-to-compress"), UnknownCompressionMethod);
 }
+
+TEST(compress, noneMethodDoesNothingToTheInput)
+{
+    auto o = compress("none", "this-is-a-test");
+
+    ASSERT_EQ(o, "this-is-a-test");
+}
+
+TEST(decompress, decompressNoneCompressed)
+{
+    auto method = "none";
+    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+    auto o = decompress(method, str);
+
+    ASSERT_EQ(o, str);
+}
+
+TEST(decompress, decompressEmptyCompressed)
+{
+    // Empty-method decompression used e.g. by S3 store
+    // (Content-Encoding == "").
+    auto method = "";
+    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+    auto o = decompress(method, str);
+
+    ASSERT_EQ(o, str);
+}
+
+TEST(decompress, decompressXzCompressed)
+{
+    auto method = "xz";
+    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+    auto o = decompress(method, compress(method, str));
+
+    ASSERT_EQ(o, str);
+}
+
+TEST(decompress, decompressBzip2Compressed)
+{
+    auto method = "bzip2";
+    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+    auto o = decompress(method, compress(method, str));
+
+    ASSERT_EQ(o, str);
+}
+
+TEST(decompress, decompressBrCompressed)
+{
+    auto method = "br";
+    auto str = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+    auto o = decompress(method, compress(method, str));
+
+    ASSERT_EQ(o, str);
+}
+
+TEST(decompress, decompressInvalidInputThrowsCompressionError)
+{
+    auto method = "bzip2";
+    auto str = "this is a string that does not qualify as valid bzip2 data";
+
+    ASSERT_THROW(decompress(method, str), CompressionError);
+}
+
+/* ----------------------------------------------------------------------------
+ * compression sinks
+ * --------------------------------------------------------------------------*/
+
+TEST(makeCompressionSink, noneSinkDoesNothingToInput)
+{
+    StringSink strSink;
+    auto inputString = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+    auto sink = makeCompressionSink("none", strSink);
+    (*sink)(inputString);
+    sink->finish();
+
+    ASSERT_STREQ(strSink.s.c_str(), inputString);
+}
+
+TEST(makeCompressionSink, compressAndDecompress)
+{
+    StringSink strSink;
+    auto inputString = "slfja;sljfklsa;jfklsjfkl;sdjfkl;sadjfkl;sdjf;lsdfjsadlf";
+    auto decompressionSink = makeDecompressionSink("bzip2", strSink);
+    auto sink = makeCompressionSink("bzip2", *decompressionSink);
+
+    (*sink)(inputString);
+    sink->finish();
+    decompressionSink->finish();
+
+    ASSERT_STREQ(strSink.s.c_str(), inputString);
+}
+
+} // namespace nix
diff --git a/src/libutil-tests/config.cc b/src/libutil-tests/config.cc
index bc7db251b..5fb2229b6 100644
--- a/src/libutil-tests/config.cc
+++ b/src/libutil-tests/config.cc
@@ -7,169 +7,195 @@
 
 namespace nix {
 
-    /* ----------------------------------------------------------------------------
-     * Config
-     * --------------------------------------------------------------------------*/
+/* ----------------------------------------------------------------------------
+ * Config
+ * --------------------------------------------------------------------------*/
 
-    TEST(Config, setUndefinedSetting) {
-        Config config;
-        ASSERT_EQ(config.set("undefined-key", "value"), false);
-    }
+TEST(Config, setUndefinedSetting)
+{
+    Config config;
+    ASSERT_EQ(config.set("undefined-key", "value"), false);
+}
 
-    TEST(Config, setDefinedSetting) {
-        Config config;
-        std::string value;
-        Setting<std::string> foo{&config, value, "name-of-the-setting", "description"};
-        ASSERT_EQ(config.set("name-of-the-setting", "value"), true);
-    }
+TEST(Config, setDefinedSetting)
+{
+    Config config;
+    std::string value;
+    Setting<std::string> foo{&config, value, "name-of-the-setting", "description"};
+    ASSERT_EQ(config.set("name-of-the-setting", "value"), true);
+}
 
-    TEST(Config, getDefinedSetting) {
-        Config config;
-        std::string value;
+TEST(Config, getDefinedSetting)
+{
+    Config config;
+    std::string value;
+    std::map<std::string, Config::SettingInfo> settings;
+    Setting<std::string> foo{&config, value, "name-of-the-setting", "description"};
+
+    config.getSettings(settings, /* overriddenOnly = */ false);
+    const auto iter = settings.find("name-of-the-setting");
+    ASSERT_NE(iter, settings.end());
+    ASSERT_EQ(iter->second.value, "");
+    ASSERT_EQ(iter->second.description, "description\n");
+}
+
+TEST(Config, getDefinedOverriddenSettingNotSet)
+{
+    Config config;
+    std::string value;
+    std::map<std::string, Config::SettingInfo> settings;
+    Setting<std::string> foo{&config, value, "name-of-the-setting", "description"};
+
+    config.getSettings(settings, /* overriddenOnly = */ true);
+    const auto e = settings.find("name-of-the-setting");
+    ASSERT_EQ(e, settings.end());
+}
+
+TEST(Config, getDefinedSettingSet1)
+{
+    Config config;
+    std::string value;
+    std::map<std::string, Config::SettingInfo> settings;
+    Setting<std::string> setting{&config, value, "name-of-the-setting", "description"};
+
+    setting.assign("value");
+
+    config.getSettings(settings, /* overriddenOnly = */ false);
+    const auto iter = settings.find("name-of-the-setting");
+    ASSERT_NE(iter, settings.end());
+    ASSERT_EQ(iter->second.value, "value");
+    ASSERT_EQ(iter->second.description, "description\n");
+}
+
+TEST(Config, getDefinedSettingSet2)
+{
+    Config config;
+    std::map<std::string, Config::SettingInfo> settings;
+    Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
+
+    ASSERT_TRUE(config.set("name-of-the-setting", "value"));
+
+    config.getSettings(settings, /* overriddenOnly = */ false);
+    const auto e = settings.find("name-of-the-setting");
+    ASSERT_NE(e, settings.end());
+    ASSERT_EQ(e->second.value, "value");
+    ASSERT_EQ(e->second.description, "description\n");
+}
+
+TEST(Config, addSetting)
+{
+    class TestSetting : public AbstractSetting
+    {
+    public:
+        TestSetting()
+            : AbstractSetting("test", "test", {})
+        {
+        }
+
+        void set(const std::string & value, bool append) override {}
+
+        std::string to_string() const override
+        {
+            return {};
+        }
+
+        bool isAppendable() override
+        {
+            return false;
+        }
+    };
+
+    Config config;
+    TestSetting setting;
+
+    ASSERT_FALSE(config.set("test", "value"));
+    config.addSetting(&setting);
+    ASSERT_TRUE(config.set("test", "value"));
+    ASSERT_FALSE(config.set("extra-test", "value"));
+}
+
+TEST(Config, withInitialValue)
+{
+    const StringMap initials = {
+        {"key", "value"},
+    };
+    Config config(initials);
+
+    {
         std::map<std::string, Config::SettingInfo> settings;
-        Setting<std::string> foo{&config, value, "name-of-the-setting", "description"};
-
         config.getSettings(settings, /* overriddenOnly = */ false);
-        const auto iter = settings.find("name-of-the-setting");
-        ASSERT_NE(iter, settings.end());
-        ASSERT_EQ(iter->second.value, "");
-        ASSERT_EQ(iter->second.description, "description\n");
+        ASSERT_EQ(settings.find("key"), settings.end());
     }
 
-    TEST(Config, getDefinedOverriddenSettingNotSet) {
-        Config config;
-        std::string value;
-        std::map<std::string, Config::SettingInfo> settings;
-        Setting<std::string> foo{&config, value, "name-of-the-setting", "description"};
+    Setting<std::string> setting{&config, "default-value", "key", "description"};
 
+    {
+        std::map<std::string, Config::SettingInfo> settings;
+        config.getSettings(settings, /* overriddenOnly = */ false);
+        ASSERT_EQ(settings["key"].value, "value");
+    }
+}
+
+TEST(Config, resetOverridden)
+{
+    Config config;
+    config.resetOverridden();
+}
+
+TEST(Config, resetOverriddenWithSetting)
+{
+    Config config;
+    Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
+
+    {
+        std::map<std::string, Config::SettingInfo> settings;
+
+        setting.set("foo");
+        ASSERT_EQ(setting.get(), "foo");
         config.getSettings(settings, /* overriddenOnly = */ true);
-        const auto e = settings.find("name-of-the-setting");
-        ASSERT_EQ(e, settings.end());
+        ASSERT_TRUE(settings.empty());
     }
 
-    TEST(Config, getDefinedSettingSet1) {
-        Config config;
-        std::string value;
+    {
         std::map<std::string, Config::SettingInfo> settings;
-        Setting<std::string> setting{&config, value, "name-of-the-setting", "description"};
 
-        setting.assign("value");
-
-        config.getSettings(settings, /* overriddenOnly = */ false);
-        const auto iter = settings.find("name-of-the-setting");
-        ASSERT_NE(iter, settings.end());
-        ASSERT_EQ(iter->second.value, "value");
-        ASSERT_EQ(iter->second.description, "description\n");
+        setting.override("bar");
+        ASSERT_TRUE(setting.overridden);
+        ASSERT_EQ(setting.get(), "bar");
+        config.getSettings(settings, /* overriddenOnly = */ true);
+        ASSERT_FALSE(settings.empty());
     }
 
-    TEST(Config, getDefinedSettingSet2) {
-        Config config;
+    {
         std::map<std::string, Config::SettingInfo> settings;
-        Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
 
-        ASSERT_TRUE(config.set("name-of-the-setting", "value"));
-
-        config.getSettings(settings, /* overriddenOnly = */ false);
-        const auto e = settings.find("name-of-the-setting");
-        ASSERT_NE(e, settings.end());
-        ASSERT_EQ(e->second.value, "value");
-        ASSERT_EQ(e->second.description, "description\n");
-    }
-
-    TEST(Config, addSetting) {
-        class TestSetting : public AbstractSetting {
-            public:
-            TestSetting() : AbstractSetting("test", "test", {}) {}
-            void set(const std::string & value, bool append) override {}
-            std::string to_string() const override { return {}; }
-            bool isAppendable() override { return false; }
-        };
-
-        Config config;
-        TestSetting setting;
-
-        ASSERT_FALSE(config.set("test", "value"));
-        config.addSetting(&setting);
-        ASSERT_TRUE(config.set("test", "value"));
-        ASSERT_FALSE(config.set("extra-test", "value"));
-    }
-
-    TEST(Config, withInitialValue) {
-        const StringMap initials = {
-            { "key", "value" },
-        };
-        Config config(initials);
-
-        {
-            std::map<std::string, Config::SettingInfo> settings;
-            config.getSettings(settings, /* overriddenOnly = */ false);
-            ASSERT_EQ(settings.find("key"), settings.end());
-        }
-
-        Setting<std::string> setting{&config, "default-value", "key", "description"};
-
-        {
-            std::map<std::string, Config::SettingInfo> settings;
-            config.getSettings(settings, /* overriddenOnly = */ false);
-            ASSERT_EQ(settings["key"].value, "value");
-        }
-    }
-
-    TEST(Config, resetOverridden) {
-        Config config;
         config.resetOverridden();
+        ASSERT_FALSE(setting.overridden);
+        config.getSettings(settings, /* overriddenOnly = */ true);
+        ASSERT_TRUE(settings.empty());
     }
+}
 
-    TEST(Config, resetOverriddenWithSetting) {
-        Config config;
-        Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
+TEST(Config, toJSONOnEmptyConfig)
+{
+    ASSERT_EQ(Config().toJSON().dump(), "{}");
+}
 
-        {
-            std::map<std::string, Config::SettingInfo> settings;
+TEST(Config, toJSONOnNonEmptyConfig)
+{
+    using nlohmann::literals::operator"" _json;
+    Config config;
+    Setting<std::string> setting{
+        &config,
+        "",
+        "name-of-the-setting",
+        "description",
+    };
+    setting.assign("value");
 
-            setting.set("foo");
-            ASSERT_EQ(setting.get(), "foo");
-            config.getSettings(settings, /* overriddenOnly = */ true);
-            ASSERT_TRUE(settings.empty());
-        }
-
-        {
-            std::map<std::string, Config::SettingInfo> settings;
-
-            setting.override("bar");
-            ASSERT_TRUE(setting.overridden);
-            ASSERT_EQ(setting.get(), "bar");
-            config.getSettings(settings, /* overriddenOnly = */ true);
-            ASSERT_FALSE(settings.empty());
-        }
-
-        {
-            std::map<std::string, Config::SettingInfo> settings;
-
-            config.resetOverridden();
-            ASSERT_FALSE(setting.overridden);
-            config.getSettings(settings, /* overriddenOnly = */ true);
-            ASSERT_TRUE(settings.empty());
-        }
-    }
-
-    TEST(Config, toJSONOnEmptyConfig) {
-        ASSERT_EQ(Config().toJSON().dump(), "{}");
-    }
-
-    TEST(Config, toJSONOnNonEmptyConfig) {
-        using nlohmann::literals::operator "" _json;
-        Config config;
-        Setting<std::string> setting{
-            &config,
-            "",
-            "name-of-the-setting",
-            "description",
-        };
-        setting.assign("value");
-
-        ASSERT_EQ(config.toJSON(),
-          R"#({
+    ASSERT_EQ(
+        config.toJSON(),
+        R"#({
             "name-of-the-setting": {
               "aliases": [],
               "defaultValue": "",
@@ -179,24 +205,26 @@ namespace nix {
               "experimentalFeature": null
             }
           })#"_json);
-    }
+}
 
-    TEST(Config, toJSONOnNonEmptyConfigWithExperimentalSetting) {
-        using nlohmann::literals::operator "" _json;
-        Config config;
-        Setting<std::string> setting{
-            &config,
-            "",
-            "name-of-the-setting",
-            "description",
-            {},
-            true,
-            Xp::Flakes,
-        };
-        setting.assign("value");
+TEST(Config, toJSONOnNonEmptyConfigWithExperimentalSetting)
+{
+    using nlohmann::literals::operator"" _json;
+    Config config;
+    Setting<std::string> setting{
+        &config,
+        "",
+        "name-of-the-setting",
+        "description",
+        {},
+        true,
+        Xp::Flakes,
+    };
+    setting.assign("value");
 
-        ASSERT_EQ(config.toJSON(),
-          R"#({
+    ASSERT_EQ(
+        config.toJSON(),
+        R"#({
             "name-of-the-setting": {
               "aliases": [],
               "defaultValue": "",
@@ -206,90 +234,97 @@ namespace nix {
               "experimentalFeature": "flakes"
             }
           })#"_json);
-    }
+}
 
-    TEST(Config, setSettingAlias) {
-        Config config;
-        Setting<std::string> setting{&config, "", "some-int", "best number", { "another-int" }};
-        ASSERT_TRUE(config.set("some-int", "1"));
-        ASSERT_EQ(setting.get(), "1");
-        ASSERT_TRUE(config.set("another-int", "2"));
-        ASSERT_EQ(setting.get(), "2");
-        ASSERT_TRUE(config.set("some-int", "3"));
-        ASSERT_EQ(setting.get(), "3");
-    }
+TEST(Config, setSettingAlias)
+{
+    Config config;
+    Setting<std::string> setting{&config, "", "some-int", "best number", {"another-int"}};
+    ASSERT_TRUE(config.set("some-int", "1"));
+    ASSERT_EQ(setting.get(), "1");
+    ASSERT_TRUE(config.set("another-int", "2"));
+    ASSERT_EQ(setting.get(), "2");
+    ASSERT_TRUE(config.set("some-int", "3"));
+    ASSERT_EQ(setting.get(), "3");
+}
 
-    /* FIXME: The reapplyUnknownSettings method doesn't seem to do anything
-     * useful (these days).  Whenever we add a new setting to Config the
-     * unknown settings are always considered.  In which case is this function
-     * actually useful? Is there some way to register a Setting without calling
-     * addSetting? */
-    TEST(Config, DISABLED_reapplyUnknownSettings) {
-        Config config;
-        ASSERT_FALSE(config.set("name-of-the-setting", "unknownvalue"));
-        Setting<std::string> setting{&config, "default", "name-of-the-setting", "description"};
-        ASSERT_EQ(setting.get(), "default");
-        config.reapplyUnknownSettings();
-        ASSERT_EQ(setting.get(), "unknownvalue");
-    }
+/* FIXME: The reapplyUnknownSettings method doesn't seem to do anything
+ * useful (these days).  Whenever we add a new setting to Config the
+ * unknown settings are always considered.  In which case is this function
+ * actually useful? Is there some way to register a Setting without calling
+ * addSetting? */
+TEST(Config, DISABLED_reapplyUnknownSettings)
+{
+    Config config;
+    ASSERT_FALSE(config.set("name-of-the-setting", "unknownvalue"));
+    Setting<std::string> setting{&config, "default", "name-of-the-setting", "description"};
+    ASSERT_EQ(setting.get(), "default");
+    config.reapplyUnknownSettings();
+    ASSERT_EQ(setting.get(), "unknownvalue");
+}
 
-    TEST(Config, applyConfigEmpty) {
-        Config config;
-        std::map<std::string, Config::SettingInfo> settings;
-        config.applyConfig("");
-        config.getSettings(settings);
-        ASSERT_TRUE(settings.empty());
-    }
+TEST(Config, applyConfigEmpty)
+{
+    Config config;
+    std::map<std::string, Config::SettingInfo> settings;
+    config.applyConfig("");
+    config.getSettings(settings);
+    ASSERT_TRUE(settings.empty());
+}
 
-    TEST(Config, applyConfigEmptyWithComment) {
-        Config config;
-        std::map<std::string, Config::SettingInfo> settings;
-        config.applyConfig("# just a comment");
-        config.getSettings(settings);
-        ASSERT_TRUE(settings.empty());
-    }
+TEST(Config, applyConfigEmptyWithComment)
+{
+    Config config;
+    std::map<std::string, Config::SettingInfo> settings;
+    config.applyConfig("# just a comment");
+    config.getSettings(settings);
+    ASSERT_TRUE(settings.empty());
+}
 
-    TEST(Config, applyConfigAssignment) {
-        Config config;
-        std::map<std::string, Config::SettingInfo> settings;
-        Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
+TEST(Config, applyConfigAssignment)
+{
+    Config config;
+    std::map<std::string, Config::SettingInfo> settings;
+    Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
+    config.applyConfig(
+        "name-of-the-setting = value-from-file #useful comment\n"
+        "# name-of-the-setting = foo\n");
+    config.getSettings(settings);
+    ASSERT_FALSE(settings.empty());
+    ASSERT_EQ(settings["name-of-the-setting"].value, "value-from-file");
+}
+
+TEST(Config, applyConfigWithReassignedSetting)
+{
+    Config config;
+    std::map<std::string, Config::SettingInfo> settings;
+    Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
+    config.applyConfig(
+        "name-of-the-setting = first-value\n"
+        "name-of-the-setting = second-value\n");
+    config.getSettings(settings);
+    ASSERT_FALSE(settings.empty());
+    ASSERT_EQ(settings["name-of-the-setting"].value, "second-value");
+}
+
+TEST(Config, applyConfigFailsOnMissingIncludes)
+{
+    Config config;
+    std::map<std::string, Config::SettingInfo> settings;
+    Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
+
+    ASSERT_THROW(
         config.applyConfig(
-            "name-of-the-setting = value-from-file #useful comment\n"
-            "# name-of-the-setting = foo\n"
-        );
-        config.getSettings(settings);
-        ASSERT_FALSE(settings.empty());
-        ASSERT_EQ(settings["name-of-the-setting"].value, "value-from-file");
-    }
-
-    TEST(Config, applyConfigWithReassignedSetting) {
-        Config config;
-        std::map<std::string, Config::SettingInfo> settings;
-        Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
-        config.applyConfig(
-            "name-of-the-setting = first-value\n"
-            "name-of-the-setting = second-value\n"
-        );
-        config.getSettings(settings);
-        ASSERT_FALSE(settings.empty());
-        ASSERT_EQ(settings["name-of-the-setting"].value, "second-value");
-    }
-
-    TEST(Config, applyConfigFailsOnMissingIncludes) {
-        Config config;
-        std::map<std::string, Config::SettingInfo> settings;
-        Setting<std::string> setting{&config, "", "name-of-the-setting", "description"};
-
-        ASSERT_THROW(config.applyConfig(
             "name-of-the-setting = value-from-file\n"
             "# name-of-the-setting = foo\n"
-            "include /nix/store/does/not/exist.nix"
-        ), Error);
-    }
-
-    TEST(Config, applyConfigInvalidThrows) {
-        Config config;
-        ASSERT_THROW(config.applyConfig("value == key"), UsageError);
-        ASSERT_THROW(config.applyConfig("value "), UsageError);
-    }
+            "include /nix/store/does/not/exist.nix"),
+        Error);
 }
+
+TEST(Config, applyConfigInvalidThrows)
+{
+    Config config;
+    ASSERT_THROW(config.applyConfig("value == key"), UsageError);
+    ASSERT_THROW(config.applyConfig("value "), UsageError);
+}
+} // namespace nix
diff --git a/src/libutil-tests/data/git/check-data.sh b/src/libutil-tests/data/git/check-data.sh
old mode 100644
new mode 100755
index b3f59c4f1..d3be5c41a
--- a/src/libutil-tests/data/git/check-data.sh
+++ b/src/libutil-tests/data/git/check-data.sh
@@ -2,30 +2,34 @@
 
 set -eu -o pipefail
 
-export TEST_ROOT=$(realpath ${TMPDIR:-/tmp}/nix-test)/git-hashing/check-data
-mkdir -p $TEST_ROOT
+TEST_ROOT=$(realpath "${TMPDIR:-/tmp}/nix-test")/git-hashing/check-data
+export TEST_ROOT
+mkdir -p "$TEST_ROOT"
 
-repo="$TEST_ROOT/scratch"
-git init "$repo"
+for hash in sha1 sha256; do
+  repo="$TEST_ROOT/scratch-$hash"
+  git init "$repo" --object-format="$hash"
 
-git -C "$repo" config user.email "you@example.com"
-git -C "$repo" config user.name "Your Name"
+  git -C "$repo" config user.email "you@example.com"
+  git -C "$repo" config user.name "Your Name"
 
-# `-w` to write for tree test
-freshlyAddedHash=$(git -C "$repo" hash-object -w -t blob --stdin < "./hello-world.bin")
-encodingHash=$(sha1sum -b < "./hello-world-blob.bin" | head -c 40)
+  # `-w` to write for tree test
+  freshlyAddedHash=$(git -C "$repo" hash-object -w -t blob --stdin < "./hello-world.bin")
+  encodingHash=$("${hash}sum" -b < "./hello-world-blob.bin" | sed 's/ .*//')
 
-# If the hashes match, then `hello-world-blob.bin` must be the encoding
-# of `hello-world.bin`.
-[[ "$encodingHash" == "$freshlyAddedHash" ]]
+  # If the hashes match, then `hello-world-blob.bin` must be the encoding
+  # of `hello-world.bin`.
+  [[ "$encodingHash" == "$freshlyAddedHash" ]]
 
-# Create empty directory object for tree test
-echo -n | git -C "$repo" hash-object -w -t tree --stdin
+  # Create empty directory object for tree test
+  echo -n | git -C "$repo" hash-object -w -t tree --stdin
 
-# Relies on both child hashes already existing in the git store
-freshlyAddedHash=$(git -C "$repo" mktree < "./tree.txt")
-encodingHash=$(sha1sum -b < "./tree.bin" | head -c 40)
+  # Relies on both child hashes already existing in the git store
+  tree=tree-${hash}
+  freshlyAddedHash=$(git -C "$repo" mktree < "${tree}.txt")
+  encodingHash=$("${hash}sum" -b < "${tree}.bin" | sed 's/ .*//')
 
-# If the hashes match, then `tree.bin` must be the encoding of the
-# directory denoted by `tree.txt` interpreted as git directory listing.
-[[ "$encodingHash" == "$freshlyAddedHash" ]]
+  # If the hashes match, then `tree.bin` must be the encoding of the
+  # directory denoted by `tree.txt` interpreted as git directory listing.
+  [[ "$encodingHash" == "$freshlyAddedHash" ]]
+done
diff --git a/src/libutil-tests/data/git/tree.bin b/src/libutil-tests/data/git/tree-sha1.bin
similarity index 100%
rename from src/libutil-tests/data/git/tree.bin
rename to src/libutil-tests/data/git/tree-sha1.bin
diff --git a/src/libutil-tests/data/git/tree.txt b/src/libutil-tests/data/git/tree-sha1.txt
similarity index 100%
rename from src/libutil-tests/data/git/tree.txt
rename to src/libutil-tests/data/git/tree-sha1.txt
diff --git a/src/libutil-tests/data/git/tree-sha256.bin b/src/libutil-tests/data/git/tree-sha256.bin
new file mode 100644
index 000000000..87380f412
Binary files /dev/null and b/src/libutil-tests/data/git/tree-sha256.bin differ
diff --git a/src/libutil-tests/data/git/tree-sha256.txt b/src/libutil-tests/data/git/tree-sha256.txt
new file mode 100644
index 000000000..93568a063
--- /dev/null
+++ b/src/libutil-tests/data/git/tree-sha256.txt
@@ -0,0 +1,4 @@
+100644 blob ce60f5ad78a08ac24872ef74d78b078f077be212e7a246893a1a5d957dfbc8b1	Foo
+100755 blob ce60f5ad78a08ac24872ef74d78b078f077be212e7a246893a1a5d957dfbc8b1	bAr
+040000 tree 6ef19b41225c5369f1c104d45d8d85efa9b057b53b14b4b9b939dd74decc5321	baZ
+120000 blob ce60f5ad78a08ac24872ef74d78b078f077be212e7a246893a1a5d957dfbc8b1	quuX
diff --git a/src/libutil-tests/executable-path.cc b/src/libutil-tests/executable-path.cc
index 7229b14e6..d000c1fb9 100644
--- a/src/libutil-tests/executable-path.cc
+++ b/src/libutil-tests/executable-path.cc
@@ -61,4 +61,4 @@ TEST(ExecutablePath, elementyElemNormalize)
     EXPECT_EQ(s2, OS_STR("." PATH_VAR_SEP "." PATH_VAR_SEP "." PATH_VAR_SEP "."));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil-tests/file-content-address.cc b/src/libutil-tests/file-content-address.cc
index 92c6059a4..a6b10d4f6 100644
--- a/src/libutil-tests/file-content-address.cc
+++ b/src/libutil-tests/file-content-address.cc
@@ -9,20 +9,22 @@ namespace nix {
  * parseFileSerialisationMethod, renderFileSerialisationMethod
  * --------------------------------------------------------------------------*/
 
-TEST(FileSerialisationMethod, testRoundTripPrintParse_1) {
+TEST(FileSerialisationMethod, testRoundTripPrintParse_1)
+{
     for (const FileSerialisationMethod fim : {
-        FileSerialisationMethod::Flat,
-        FileSerialisationMethod::NixArchive,
-    }) {
+             FileSerialisationMethod::Flat,
+             FileSerialisationMethod::NixArchive,
+         }) {
         EXPECT_EQ(parseFileSerialisationMethod(renderFileSerialisationMethod(fim)), fim);
     }
 }
 
-TEST(FileSerialisationMethod, testRoundTripPrintParse_2) {
+TEST(FileSerialisationMethod, testRoundTripPrintParse_2)
+{
     for (const std::string_view fimS : {
-        "flat",
-        "nar",
-    }) {
+             "flat",
+             "nar",
+         }) {
         EXPECT_EQ(renderFileSerialisationMethod(parseFileSerialisationMethod(fimS)), fimS);
     }
 }
@@ -38,22 +40,24 @@ TEST(FileSerialisationMethod, testParseFileSerialisationMethodOptException)
  * parseFileIngestionMethod, renderFileIngestionMethod
  * --------------------------------------------------------------------------*/
 
-TEST(FileIngestionMethod, testRoundTripPrintParse_1) {
+TEST(FileIngestionMethod, testRoundTripPrintParse_1)
+{
     for (const FileIngestionMethod fim : {
-        FileIngestionMethod::Flat,
-        FileIngestionMethod::NixArchive,
-        FileIngestionMethod::Git,
-    }) {
+             FileIngestionMethod::Flat,
+             FileIngestionMethod::NixArchive,
+             FileIngestionMethod::Git,
+         }) {
         EXPECT_EQ(parseFileIngestionMethod(renderFileIngestionMethod(fim)), fim);
     }
 }
 
-TEST(FileIngestionMethod, testRoundTripPrintParse_2) {
+TEST(FileIngestionMethod, testRoundTripPrintParse_2)
+{
     for (const std::string_view fimS : {
-        "flat",
-        "nar",
-        "git",
-    }) {
+             "flat",
+             "nar",
+             "git",
+         }) {
         EXPECT_EQ(renderFileIngestionMethod(parseFileIngestionMethod(fimS)), fimS);
     }
 }
@@ -65,4 +69,4 @@ TEST(FileIngestionMethod, testParseFileIngestionMethodOptException)
         testing::ThrowsMessage<UsageError>(testing::HasSubstr("narwhal")));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil-tests/file-system.cc b/src/libutil-tests/file-system.cc
index 2d1058c4f..dfdd26088 100644
--- a/src/libutil-tests/file-system.cc
+++ b/src/libutil-tests/file-system.cc
@@ -318,4 +318,4 @@ TEST(DirectoryIterator, nonexistent)
     ASSERT_THROW(DirectoryIterator("/schnitzel/darmstadt/pommes"), SysError);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil-tests/git.cc b/src/libutil-tests/git.cc
index 91432b76b..6180a4cfc 100644
--- a/src/libutil-tests/git.cc
+++ b/src/libutil-tests/git.cc
@@ -15,7 +15,8 @@ class GitTest : public CharacterizationTest
 
 public:
 
-    std::filesystem::path goldenMaster(std::string_view testStem) const override {
+    std::filesystem::path goldenMaster(std::string_view testStem) const override
+    {
         return unitTestData / std::string(testStem);
     }
 
@@ -33,39 +34,44 @@ private:
     }
 };
 
-TEST(GitMode, gitMode_directory) {
+TEST(GitMode, gitMode_directory)
+{
     Mode m = Mode::Directory;
     RawMode r = 0040000;
     ASSERT_EQ(static_cast<RawMode>(m), r);
-    ASSERT_EQ(decodeMode(r), std::optional { m });
+    ASSERT_EQ(decodeMode(r), std::optional{m});
 };
 
-TEST(GitMode, gitMode_executable) {
+TEST(GitMode, gitMode_executable)
+{
     Mode m = Mode::Executable;
     RawMode r = 0100755;
     ASSERT_EQ(static_cast<RawMode>(m), r);
-    ASSERT_EQ(decodeMode(r), std::optional { m });
+    ASSERT_EQ(decodeMode(r), std::optional{m});
 };
 
-TEST(GitMode, gitMode_regular) {
+TEST(GitMode, gitMode_regular)
+{
     Mode m = Mode::Regular;
     RawMode r = 0100644;
     ASSERT_EQ(static_cast<RawMode>(m), r);
-    ASSERT_EQ(decodeMode(r), std::optional { m });
+    ASSERT_EQ(decodeMode(r), std::optional{m});
 };
 
-TEST(GitMode, gitMode_symlink) {
+TEST(GitMode, gitMode_symlink)
+{
     Mode m = Mode::Symlink;
     RawMode r = 0120000;
     ASSERT_EQ(static_cast<RawMode>(m), r);
-    ASSERT_EQ(decodeMode(r), std::optional { m });
+    ASSERT_EQ(decodeMode(r), std::optional{m});
 };
 
-TEST_F(GitTest, blob_read) {
+TEST_F(GitTest, blob_read)
+{
     readTest("hello-world-blob.bin", [&](const auto & encoded) {
-        StringSource in { encoded };
+        StringSource in{encoded};
         StringSink out;
-        RegularFileSink out2 { out };
+        RegularFileSink out2{out};
         ASSERT_EQ(parseObjectType(in, mockXpSettings), ObjectType::Blob);
         parseBlob(out2, CanonPath::root, in, BlobMode::Regular, mockXpSettings);
 
@@ -75,7 +81,8 @@ TEST_F(GitTest, blob_read) {
     });
 }
 
-TEST_F(GitTest, blob_write) {
+TEST_F(GitTest, blob_write)
+{
     writeTest("hello-world-blob.bin", [&]() {
         auto decoded = readFile(goldenMaster("hello-world.bin"));
         StringSink s;
@@ -90,7 +97,7 @@ TEST_F(GitTest, blob_write) {
  * so that we can check our test data in a small shell script test test
  * (`src/libutil-tests/data/git/check-data.sh`).
  */
-const static Tree tree = {
+const static Tree treeSha1 = {
     {
         "Foo",
         {
@@ -126,113 +133,186 @@ const static Tree tree = {
     },
 };
 
-TEST_F(GitTest, tree_read) {
-    readTest("tree.bin", [&](const auto & encoded) {
-        StringSource in { encoded };
+/**
+ * Same conceptual object as `treeSha1`, just different hash algorithm.
+ * See that one for details.
+ */
+const static Tree treeSha256 = {
+    {
+        "Foo",
+        {
+            .mode = Mode::Regular,
+            .hash = Hash::parseAny(
+                "ce60f5ad78a08ac24872ef74d78b078f077be212e7a246893a1a5d957dfbc8b1", HashAlgorithm::SHA256),
+        },
+    },
+    {
+        "bAr",
+        {
+            .mode = Mode::Executable,
+            .hash = Hash::parseAny(
+                "ce60f5ad78a08ac24872ef74d78b078f077be212e7a246893a1a5d957dfbc8b1", HashAlgorithm::SHA256),
+        },
+    },
+    {
+        "baZ/",
+        {
+            .mode = Mode::Directory,
+            .hash = Hash::parseAny(
+                "6ef19b41225c5369f1c104d45d8d85efa9b057b53b14b4b9b939dd74decc5321", HashAlgorithm::SHA256),
+        },
+    },
+    {
+        "quuX",
+        {
+            .mode = Mode::Symlink,
+            .hash = Hash::parseAny(
+                "ce60f5ad78a08ac24872ef74d78b078f077be212e7a246893a1a5d957dfbc8b1", HashAlgorithm::SHA256),
+        },
+    },
+};
+
+static auto mkTreeReadTest(HashAlgorithm hashAlgo, Tree tree, const ExperimentalFeatureSettings & mockXpSettings)
+{
+    return [hashAlgo, tree, mockXpSettings](const auto & encoded) {
+        StringSource in{encoded};
         NullFileSystemObjectSink out;
         Tree got;
         ASSERT_EQ(parseObjectType(in, mockXpSettings), ObjectType::Tree);
-        parseTree(out, CanonPath::root, in, [&](auto & name, auto entry) {
-            auto name2 = std::string{name.rel()};
-            if (entry.mode == Mode::Directory)
-                name2 += '/';
-            got.insert_or_assign(name2, std::move(entry));
-        }, mockXpSettings);
+        parseTree(
+            out,
+            CanonPath::root,
+            in,
+            hashAlgo,
+            [&](auto & name, auto entry) {
+                auto name2 = std::string{name.rel()};
+                if (entry.mode == Mode::Directory)
+                    name2 += '/';
+                got.insert_or_assign(name2, std::move(entry));
+            },
+            mockXpSettings);
 
         ASSERT_EQ(got, tree);
-    });
+    };
 }
 
-TEST_F(GitTest, tree_write) {
-    writeTest("tree.bin", [&]() {
+TEST_F(GitTest, tree_sha1_read)
+{
+    readTest("tree-sha1.bin", mkTreeReadTest(HashAlgorithm::SHA1, treeSha1, mockXpSettings));
+}
+
+TEST_F(GitTest, tree_sha256_read)
+{
+    readTest("tree-sha256.bin", mkTreeReadTest(HashAlgorithm::SHA256, treeSha256, mockXpSettings));
+}
+
+TEST_F(GitTest, tree_sha1_write)
+{
+    writeTest("tree-sha1.bin", [&]() {
         StringSink s;
-        dumpTree(tree, s, mockXpSettings);
+        dumpTree(treeSha1, s, mockXpSettings);
         return s.s;
     });
 }
 
-TEST_F(GitTest, both_roundrip) {
+TEST_F(GitTest, tree_sha256_write)
+{
+    writeTest("tree-sha256.bin", [&]() {
+        StringSink s;
+        dumpTree(treeSha256, s, mockXpSettings);
+        return s.s;
+    });
+}
+
+TEST_F(GitTest, both_roundrip)
+{
     using File = MemorySourceAccessor::File;
 
     auto files = make_ref<MemorySourceAccessor>();
-    files->root = File::Directory {
-        .contents {
+    files->root = File::Directory{
+        .contents{
             {
                 "foo",
-                File::Regular {
+                File::Regular{
                     .contents = "hello\n\0\n\tworld!",
                 },
             },
             {
                 "bar",
-                File::Directory {
-                    .contents = {
+                File::Directory{
+                    .contents =
                         {
-                            "baz",
-                            File::Regular {
-                                .executable = true,
-                                .contents = "good day,\n\0\n\tworld!",
+                            {
+                                "baz",
+                                File::Regular{
+                                    .executable = true,
+                                    .contents = "good day,\n\0\n\tworld!",
+                                },
+                            },
+                            {
+                                "quux",
+                                File::Symlink{
+                                    .target = "/over/there",
+                                },
                             },
                         },
-                        {
-                            "quux",
-                            File::Symlink {
-                                .target = "/over/there",
-                            },
-                        },
-                    },
                 },
             },
         },
     };
 
-    std::map<Hash, std::string> cas;
+    for (const auto hashAlgo : {HashAlgorithm::SHA1, HashAlgorithm::SHA256}) {
+        std::map<Hash, std::string> cas;
 
-    std::function<DumpHook> dumpHook;
-    dumpHook = [&](const SourcePath & path) {
-        StringSink s;
-        HashSink hashSink { HashAlgorithm::SHA1 };
-        TeeSink s2 { s, hashSink };
-        auto mode = dump(
-            path, s2, dumpHook,
-            defaultPathFilter, mockXpSettings);
-        auto hash = hashSink.finish().first;
-        cas.insert_or_assign(hash, std::move(s.s));
-        return TreeEntry {
-            .mode = mode,
-            .hash = hash,
+        std::function<DumpHook> dumpHook;
+        dumpHook = [&](const SourcePath & path) {
+            StringSink s;
+            HashSink hashSink{hashAlgo};
+            TeeSink s2{s, hashSink};
+            auto mode = dump(path, s2, dumpHook, defaultPathFilter, mockXpSettings);
+            auto hash = hashSink.finish().hash;
+            cas.insert_or_assign(hash, std::move(s.s));
+            return TreeEntry{
+                .mode = mode,
+                .hash = hash,
+            };
         };
-    };
 
-    auto root = dumpHook({files});
+        auto root = dumpHook({files});
 
-    auto files2 = make_ref<MemorySourceAccessor>();
+        auto files2 = make_ref<MemorySourceAccessor>();
 
-    MemorySink sinkFiles2 { *files2 };
+        MemorySink sinkFiles2{*files2};
 
-    std::function<void(const CanonPath, const Hash &, BlobMode)> mkSinkHook;
-    mkSinkHook = [&](auto prefix, auto & hash, auto blobMode) {
-        StringSource in { cas[hash] };
-        parse(
-            sinkFiles2, prefix, in, blobMode,
-            [&](const CanonPath & name, const auto & entry) {
-                mkSinkHook(
-                    prefix / name,
-                    entry.hash,
-                    // N.B. this cast would not be acceptable in real
-                    // code, because it would make an assert reachable,
-                    // but it should harmless in this test.
-                    static_cast<BlobMode>(entry.mode));
-            },
-            mockXpSettings);
-    };
+        std::function<void(const CanonPath, const Hash &, BlobMode)> mkSinkHook;
+        mkSinkHook = [&](auto prefix, auto & hash, auto blobMode) {
+            StringSource in{cas[hash]};
+            parse(
+                sinkFiles2,
+                prefix,
+                in,
+                blobMode,
+                hashAlgo,
+                [&](const CanonPath & name, const auto & entry) {
+                    mkSinkHook(
+                        prefix / name,
+                        entry.hash,
+                        // N.B. this cast would not be acceptable in real
+                        // code, because it would make an assert reachable,
+                        // but it should harmless in this test.
+                        static_cast<BlobMode>(entry.mode));
+                },
+                mockXpSettings);
+        };
 
-    mkSinkHook(CanonPath::root, root.hash, BlobMode::Regular);
+        mkSinkHook(CanonPath::root, root.hash, BlobMode::Regular);
 
-    ASSERT_EQ(files->root, files2->root);
+        EXPECT_EQ(files->root, files2->root);
+    }
 }
 
-TEST(GitLsRemote, parseSymrefLineWithReference) {
+TEST(GitLsRemote, parseSymrefLineWithReference)
+{
     auto line = "ref: refs/head/main	HEAD";
     auto res = parseLsRemoteLine(line);
     ASSERT_TRUE(res.has_value());
@@ -241,7 +321,8 @@ TEST(GitLsRemote, parseSymrefLineWithReference) {
     ASSERT_EQ(res->reference, "HEAD");
 }
 
-TEST(GitLsRemote, parseSymrefLineWithNoReference) {
+TEST(GitLsRemote, parseSymrefLineWithNoReference)
+{
     auto line = "ref: refs/head/main";
     auto res = parseLsRemoteLine(line);
     ASSERT_TRUE(res.has_value());
@@ -250,7 +331,8 @@ TEST(GitLsRemote, parseSymrefLineWithNoReference) {
     ASSERT_EQ(res->reference, std::nullopt);
 }
 
-TEST(GitLsRemote, parseObjectRefLine) {
+TEST(GitLsRemote, parseObjectRefLine)
+{
     auto line = "abc123	refs/head/main";
     auto res = parseLsRemoteLine(line);
     ASSERT_TRUE(res.has_value());
@@ -259,4 +341,4 @@ TEST(GitLsRemote, parseObjectRefLine) {
     ASSERT_EQ(res->reference, "refs/head/main");
 }
 
-}
+} // namespace nix
diff --git a/src/libutil-tests/hash.cc b/src/libutil-tests/hash.cc
index 3c71b0486..15e639180 100644
--- a/src/libutil-tests/hash.cc
+++ b/src/libutil-tests/hash.cc
@@ -1,13 +1,17 @@
 #include <regex>
 
 #include <gtest/gtest.h>
+#include <nlohmann/json.hpp>
 
 #include "nix/util/hash.hh"
+#include "nix/util/tests/characterization.hh"
 
 namespace nix {
 
-class BLAKE3HashTest : public virtual ::testing::Test
+class HashTest : public CharacterizationTest
 {
+    std::filesystem::path unitTestData = getUnitTestData() / "hash";
+
 public:
 
     /**
@@ -16,119 +20,187 @@ public:
      */
     ExperimentalFeatureSettings mockXpSettings;
 
-private:
+    std::filesystem::path goldenMaster(std::string_view testStem) const override
+    {
+        return unitTestData / testStem;
+    }
+};
 
+class BLAKE3HashTest : public HashTest
+{
     void SetUp() override
     {
         mockXpSettings.set("experimental-features", "blake3-hashes");
     }
 };
 
-    /* ----------------------------------------------------------------------------
-     * hashString
-     * --------------------------------------------------------------------------*/
+/* ----------------------------------------------------------------------------
+ * hashString
+ * --------------------------------------------------------------------------*/
 
-    TEST_F(BLAKE3HashTest, testKnownBLAKE3Hashes1) {
-        // values taken from: https://tools.ietf.org/html/rfc4634
-        auto s = "abc";
-        auto hash = hashString(HashAlgorithm::BLAKE3, s, mockXpSettings);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),
-                "blake3:6437b3ac38465133ffb63b75273a8db548c558465d79db03fd359c6cd5bd9d85");
-    }
+TEST_F(BLAKE3HashTest, testKnownBLAKE3Hashes1)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    auto s = "abc";
+    auto hash = hashString(HashAlgorithm::BLAKE3, s, mockXpSettings);
+    ASSERT_EQ(
+        hash.to_string(HashFormat::Base16, true),
+        "blake3:6437b3ac38465133ffb63b75273a8db548c558465d79db03fd359c6cd5bd9d85");
+}
 
-    TEST_F(BLAKE3HashTest, testKnownBLAKE3Hashes2) {
-        // values taken from: https://tools.ietf.org/html/rfc4634
-        auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
-        auto hash = hashString(HashAlgorithm::BLAKE3, s, mockXpSettings);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),
-                "blake3:c19012cc2aaf0dc3d8e5c45a1b79114d2df42abb2a410bf54be09e891af06ff8");
-    }
+TEST_F(BLAKE3HashTest, testKnownBLAKE3Hashes2)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
+    auto hash = hashString(HashAlgorithm::BLAKE3, s, mockXpSettings);
+    ASSERT_EQ(
+        hash.to_string(HashFormat::Base16, true),
+        "blake3:c19012cc2aaf0dc3d8e5c45a1b79114d2df42abb2a410bf54be09e891af06ff8");
+}
 
-    TEST_F(BLAKE3HashTest, testKnownBLAKE3Hashes3) {
-        // values taken from: https://www.ietf.org/archive/id/draft-aumasson-blake3-00.txt
-        auto s = "IETF";
-        auto hash = hashString(HashAlgorithm::BLAKE3, s, mockXpSettings);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),
-                "blake3:83a2de1ee6f4e6ab686889248f4ec0cf4cc5709446a682ffd1cbb4d6165181e2");
-    }
+TEST_F(BLAKE3HashTest, testKnownBLAKE3Hashes3)
+{
+    // values taken from: https://www.ietf.org/archive/id/draft-aumasson-blake3-00.txt
+    auto s = "IETF";
+    auto hash = hashString(HashAlgorithm::BLAKE3, s, mockXpSettings);
+    ASSERT_EQ(
+        hash.to_string(HashFormat::Base16, true),
+        "blake3:83a2de1ee6f4e6ab686889248f4ec0cf4cc5709446a682ffd1cbb4d6165181e2");
+}
 
-    TEST(hashString, testKnownMD5Hashes1) {
-        // values taken from: https://tools.ietf.org/html/rfc1321
-        auto s1 = "";
-        auto hash = hashString(HashAlgorithm::MD5, s1);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true), "md5:d41d8cd98f00b204e9800998ecf8427e");
-    }
+TEST(hashString, testKnownMD5Hashes1)
+{
+    // values taken from: https://tools.ietf.org/html/rfc1321
+    auto s1 = "";
+    auto hash = hashString(HashAlgorithm::MD5, s1);
+    ASSERT_EQ(hash.to_string(HashFormat::Base16, true), "md5:d41d8cd98f00b204e9800998ecf8427e");
+}
 
-    TEST(hashString, testKnownMD5Hashes2) {
-        // values taken from: https://tools.ietf.org/html/rfc1321
-        auto s2 = "abc";
-        auto hash = hashString(HashAlgorithm::MD5, s2);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true), "md5:900150983cd24fb0d6963f7d28e17f72");
-    }
+TEST(hashString, testKnownMD5Hashes2)
+{
+    // values taken from: https://tools.ietf.org/html/rfc1321
+    auto s2 = "abc";
+    auto hash = hashString(HashAlgorithm::MD5, s2);
+    ASSERT_EQ(hash.to_string(HashFormat::Base16, true), "md5:900150983cd24fb0d6963f7d28e17f72");
+}
 
-    TEST(hashString, testKnownSHA1Hashes1) {
-        // values taken from: https://tools.ietf.org/html/rfc3174
-        auto s = "abc";
-        auto hash = hashString(HashAlgorithm::SHA1, s);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),"sha1:a9993e364706816aba3e25717850c26c9cd0d89d");
-    }
+TEST(hashString, testKnownSHA1Hashes1)
+{
+    // values taken from: https://tools.ietf.org/html/rfc3174
+    auto s = "abc";
+    auto hash = hashString(HashAlgorithm::SHA1, s);
+    ASSERT_EQ(hash.to_string(HashFormat::Base16, true), "sha1:a9993e364706816aba3e25717850c26c9cd0d89d");
+}
 
-    TEST(hashString, testKnownSHA1Hashes2) {
-        // values taken from: https://tools.ietf.org/html/rfc3174
-        auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
-        auto hash = hashString(HashAlgorithm::SHA1, s);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),"sha1:84983e441c3bd26ebaae4aa1f95129e5e54670f1");
-    }
+TEST(hashString, testKnownSHA1Hashes2)
+{
+    // values taken from: https://tools.ietf.org/html/rfc3174
+    auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
+    auto hash = hashString(HashAlgorithm::SHA1, s);
+    ASSERT_EQ(hash.to_string(HashFormat::Base16, true), "sha1:84983e441c3bd26ebaae4aa1f95129e5e54670f1");
+}
 
-    TEST(hashString, testKnownSHA256Hashes1) {
-        // values taken from: https://tools.ietf.org/html/rfc4634
-        auto s = "abc";
+TEST(hashString, testKnownSHA256Hashes1)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    auto s = "abc";
 
-        auto hash = hashString(HashAlgorithm::SHA256, s);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),
-                "sha256:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
-    }
+    auto hash = hashString(HashAlgorithm::SHA256, s);
+    ASSERT_EQ(
+        hash.to_string(HashFormat::Base16, true),
+        "sha256:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
+}
 
-    TEST(hashString, testKnownSHA256Hashes2) {
-        // values taken from: https://tools.ietf.org/html/rfc4634
-        auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
-        auto hash = hashString(HashAlgorithm::SHA256, s);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),
-                "sha256:248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1");
-    }
+TEST(hashString, testKnownSHA256Hashes2)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    auto s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
+    auto hash = hashString(HashAlgorithm::SHA256, s);
+    ASSERT_EQ(
+        hash.to_string(HashFormat::Base16, true),
+        "sha256:248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1");
+}
 
-    TEST(hashString, testKnownSHA512Hashes1) {
-        // values taken from: https://tools.ietf.org/html/rfc4634
-        auto s = "abc";
-        auto hash = hashString(HashAlgorithm::SHA512, s);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),
-                "sha512:ddaf35a193617abacc417349ae20413112e6fa4e89a9"
-                "7ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd"
-                "454d4423643ce80e2a9ac94fa54ca49f");
-    }
-    TEST(hashString, testKnownSHA512Hashes2) {
-        // values taken from: https://tools.ietf.org/html/rfc4634
-        auto s = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu";
+TEST(hashString, testKnownSHA512Hashes1)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    auto s = "abc";
+    auto hash = hashString(HashAlgorithm::SHA512, s);
+    ASSERT_EQ(
+        hash.to_string(HashFormat::Base16, true),
+        "sha512:ddaf35a193617abacc417349ae20413112e6fa4e89a9"
+        "7ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd"
+        "454d4423643ce80e2a9ac94fa54ca49f");
+}
 
-        auto hash = hashString(HashAlgorithm::SHA512, s);
-        ASSERT_EQ(hash.to_string(HashFormat::Base16, true),
-                "sha512:8e959b75dae313da8cf4f72814fc143f8f7779c6eb9f7fa1"
-                "7299aeadb6889018501d289e4900f7e4331b99dec4b5433a"
-                "c7d329eeb6dd26545e96e55b874be909");
-    }
+TEST(hashString, testKnownSHA512Hashes2)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    auto s =
+        "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu";
 
-    /* ----------------------------------------------------------------------------
-     * parseHashFormat, parseHashFormatOpt, printHashFormat
-     * --------------------------------------------------------------------------*/
+    auto hash = hashString(HashAlgorithm::SHA512, s);
+    ASSERT_EQ(
+        hash.to_string(HashFormat::Base16, true),
+        "sha512:8e959b75dae313da8cf4f72814fc143f8f7779c6eb9f7fa1"
+        "7299aeadb6889018501d289e4900f7e4331b99dec4b5433a"
+        "c7d329eeb6dd26545e96e55b874be909");
+}
 
-    TEST(hashFormat, testRoundTripPrintParse) {
-        for (const HashFormat hashFormat: { HashFormat::Base64, HashFormat::Nix32, HashFormat::Base16, HashFormat::SRI}) {
-            ASSERT_EQ(parseHashFormat(printHashFormat(hashFormat)), hashFormat);
-            ASSERT_EQ(*parseHashFormatOpt(printHashFormat(hashFormat)), hashFormat);
-        }
-    }
+/* ----------------------------------------------------------------------------
+ * parsing hashes
+ * --------------------------------------------------------------------------*/
 
-    TEST(hashFormat, testParseHashFormatOptException) {
-        ASSERT_EQ(parseHashFormatOpt("sha0042"), std::nullopt);
+TEST(hashParseExplicitFormatUnprefixed, testKnownSHA256Hashes1_correct)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    auto s = "abc";
+
+    auto hash = hashString(HashAlgorithm::SHA256, s);
+    ASSERT_EQ(
+        hash,
+        Hash::parseExplicitFormatUnprefixed(
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+            HashAlgorithm::SHA256,
+            HashFormat::Base16));
+}
+
+TEST(hashParseExplicitFormatUnprefixed, testKnownSHA256Hashes1_wrongAlgo)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    ASSERT_THROW(
+        Hash::parseExplicitFormatUnprefixed(
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+            HashAlgorithm::SHA1,
+            HashFormat::Base16),
+        BadHash);
+}
+
+TEST(hashParseExplicitFormatUnprefixed, testKnownSHA256Hashes1_wrongBase)
+{
+    // values taken from: https://tools.ietf.org/html/rfc4634
+    ASSERT_THROW(
+        Hash::parseExplicitFormatUnprefixed(
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+            HashAlgorithm::SHA256,
+            HashFormat::Nix32),
+        BadHash);
+}
+
+/* ----------------------------------------------------------------------------
+ * parseHashFormat, parseHashFormatOpt, printHashFormat
+ * --------------------------------------------------------------------------*/
+
+TEST(hashFormat, testRoundTripPrintParse)
+{
+    for (const HashFormat hashFormat : {HashFormat::Base64, HashFormat::Nix32, HashFormat::Base16, HashFormat::SRI}) {
+        ASSERT_EQ(parseHashFormat(printHashFormat(hashFormat)), hashFormat);
+        ASSERT_EQ(*parseHashFormatOpt(printHashFormat(hashFormat)), hashFormat);
     }
 }
+
+TEST(hashFormat, testParseHashFormatOptException)
+{
+    ASSERT_EQ(parseHashFormatOpt("sha0042"), std::nullopt);
+}
+} // namespace nix
diff --git a/src/libutil-tests/hilite.cc b/src/libutil-tests/hilite.cc
index 98773afcf..6436ad684 100644
--- a/src/libutil-tests/hilite.cc
+++ b/src/libutil-tests/hilite.cc
@@ -5,61 +5,57 @@
 namespace nix {
 /* ----------- tests for fmt.hh -------------------------------------------------*/
 
-    TEST(hiliteMatches, noHighlight) {
-        ASSERT_STREQ(hiliteMatches("Hello, world!", std::vector<std::smatch>(), "(", ")").c_str(), "Hello, world!");
-    }
-
-    TEST(hiliteMatches, simpleHighlight) {
-        std::string str = "Hello, world!";
-        std::regex re = std::regex("world");
-        auto matches = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
-        ASSERT_STREQ(
-                    hiliteMatches(str, matches, "(", ")").c_str(),
-                    "Hello, (world)!"
-        );
-    }
-
-    TEST(hiliteMatches, multipleMatches) {
-        std::string str = "Hello, world, world, world, world, world, world, Hello!";
-        std::regex re = std::regex("world");
-        auto matches = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
-        ASSERT_STREQ(
-                    hiliteMatches(str, matches, "(", ")").c_str(),
-                    "Hello, (world), (world), (world), (world), (world), (world), Hello!"
-        );
-    }
-
-    TEST(hiliteMatches, overlappingMatches) {
-        std::string str = "world, Hello, world, Hello, world, Hello, world, Hello, world!";
-        std::regex re = std::regex("Hello, world");
-        std::regex re2 = std::regex("world, Hello");
-        auto v = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
-        for(auto it = std::sregex_iterator(str.begin(), str.end(), re2); it != std::sregex_iterator(); ++it) {
-            v.push_back(*it);
-        }
-        ASSERT_STREQ(
-                    hiliteMatches(str, v, "(", ")").c_str(),
-                    "(world, Hello, world, Hello, world, Hello, world, Hello, world)!"
-        );
-    }
-
-    TEST(hiliteMatches, complexOverlappingMatches) {
-        std::string str = "legacyPackages.x86_64-linux.git-crypt";
-        std::vector regexes = {
-            std::regex("t-cry"),
-            std::regex("ux\\.git-cry"),
-            std::regex("git-c"),
-            std::regex("pt"),
-        };
-        std::vector<std::smatch> matches;
-        for (const auto & regex : regexes) {
-            for(auto it = std::sregex_iterator(str.begin(), str.end(), regex); it != std::sregex_iterator(); ++it) {
-                matches.push_back(*it);
-            }
-        }
-        ASSERT_STREQ(
-                    hiliteMatches(str, matches, "(", ")").c_str(),
-                    "legacyPackages.x86_64-lin(ux.git-crypt)"
-        );
-    }
+TEST(hiliteMatches, noHighlight)
+{
+    ASSERT_STREQ(hiliteMatches("Hello, world!", std::vector<std::smatch>(), "(", ")").c_str(), "Hello, world!");
 }
+
+TEST(hiliteMatches, simpleHighlight)
+{
+    std::string str = "Hello, world!";
+    std::regex re = std::regex("world");
+    auto matches = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
+    ASSERT_STREQ(hiliteMatches(str, matches, "(", ")").c_str(), "Hello, (world)!");
+}
+
+TEST(hiliteMatches, multipleMatches)
+{
+    std::string str = "Hello, world, world, world, world, world, world, Hello!";
+    std::regex re = std::regex("world");
+    auto matches = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
+    ASSERT_STREQ(
+        hiliteMatches(str, matches, "(", ")").c_str(),
+        "Hello, (world), (world), (world), (world), (world), (world), Hello!");
+}
+
+TEST(hiliteMatches, overlappingMatches)
+{
+    std::string str = "world, Hello, world, Hello, world, Hello, world, Hello, world!";
+    std::regex re = std::regex("Hello, world");
+    std::regex re2 = std::regex("world, Hello");
+    auto v = std::vector(std::sregex_iterator(str.begin(), str.end(), re), std::sregex_iterator());
+    for (auto it = std::sregex_iterator(str.begin(), str.end(), re2); it != std::sregex_iterator(); ++it) {
+        v.push_back(*it);
+    }
+    ASSERT_STREQ(
+        hiliteMatches(str, v, "(", ")").c_str(), "(world, Hello, world, Hello, world, Hello, world, Hello, world)!");
+}
+
+TEST(hiliteMatches, complexOverlappingMatches)
+{
+    std::string str = "legacyPackages.x86_64-linux.git-crypt";
+    std::vector regexes = {
+        std::regex("t-cry"),
+        std::regex("ux\\.git-cry"),
+        std::regex("git-c"),
+        std::regex("pt"),
+    };
+    std::vector<std::smatch> matches;
+    for (const auto & regex : regexes) {
+        for (auto it = std::sregex_iterator(str.begin(), str.end(), regex); it != std::sregex_iterator(); ++it) {
+            matches.push_back(*it);
+        }
+    }
+    ASSERT_STREQ(hiliteMatches(str, matches, "(", ")").c_str(), "legacyPackages.x86_64-lin(ux.git-crypt)");
+}
+} // namespace nix
diff --git a/src/libutil-tests/json-utils.cc b/src/libutil-tests/json-utils.cc
index 211f8bf1e..7d02894c6 100644
--- a/src/libutil-tests/json-utils.cc
+++ b/src/libutil-tests/json-utils.cc
@@ -12,14 +12,16 @@ namespace nix {
  * We are specifically interested in whether we can _nest_ optionals in STL
  * containers so we that we can leverage existing adl_serializer templates. */
 
-TEST(to_json, optionalInt) {
+TEST(to_json, optionalInt)
+{
     std::optional<int> val = std::make_optional(420);
     ASSERT_EQ(nlohmann::json(val), nlohmann::json(420));
     val = std::nullopt;
     ASSERT_EQ(nlohmann::json(val), nlohmann::json(nullptr));
 }
 
-TEST(to_json, vectorOfOptionalInts) {
+TEST(to_json, vectorOfOptionalInts)
+{
     std::vector<std::optional<int>> vals = {
         std::make_optional(420),
         std::nullopt,
@@ -27,17 +29,20 @@ TEST(to_json, vectorOfOptionalInts) {
     ASSERT_EQ(nlohmann::json(vals), nlohmann::json::parse("[420,null]"));
 }
 
-TEST(to_json, optionalVectorOfInts) {
-    std::optional<std::vector<int>> val = std::make_optional(std::vector<int> {
-        -420,
-        420,
-    });
+TEST(to_json, optionalVectorOfInts)
+{
+    std::optional<std::vector<int>> val = std::make_optional(
+        std::vector<int>{
+            -420,
+            420,
+        });
     ASSERT_EQ(nlohmann::json(val), nlohmann::json::parse("[-420,420]"));
     val = std::nullopt;
     ASSERT_EQ(nlohmann::json(val), nlohmann::json(nullptr));
 }
 
-TEST(from_json, optionalInt) {
+TEST(from_json, optionalInt)
+{
     nlohmann::json json = 420;
     std::optional<int> val = json;
     ASSERT_TRUE(val.has_value());
@@ -47,8 +52,9 @@ TEST(from_json, optionalInt) {
     ASSERT_FALSE(val.has_value());
 }
 
-TEST(from_json, vectorOfOptionalInts) {
-    nlohmann::json json = { 420, nullptr };
+TEST(from_json, vectorOfOptionalInts)
+{
+    nlohmann::json json = {420, nullptr};
     std::vector<std::optional<int>> vals = json;
     ASSERT_EQ(vals.size(), 2u);
     ASSERT_TRUE(vals.at(0).has_value());
@@ -56,7 +62,8 @@ TEST(from_json, vectorOfOptionalInts) {
     ASSERT_FALSE(vals.at(1).has_value());
 }
 
-TEST(valueAt, simpleObject) {
+TEST(valueAt, simpleObject)
+{
     auto simple = R"({ "hello": "world" })"_json;
 
     ASSERT_EQ(valueAt(getObject(simple), "hello"), "world");
@@ -66,7 +73,8 @@ TEST(valueAt, simpleObject) {
     ASSERT_EQ(valueAt(valueAt(getObject(nested), "hello"), "world"), "");
 }
 
-TEST(valueAt, missingKey) {
+TEST(valueAt, missingKey)
+{
     auto json = R"({ "hello": { "nested": "world" } })"_json;
 
     auto & obj = getObject(json);
@@ -74,20 +82,22 @@ TEST(valueAt, missingKey) {
     ASSERT_THROW(valueAt(obj, "foo"), Error);
 }
 
-TEST(getObject, rightAssertions) {
+TEST(getObject, rightAssertions)
+{
     auto simple = R"({ "object": {} })"_json;
 
-    ASSERT_EQ(getObject(valueAt(getObject(simple), "object")), (nlohmann::json::object_t {}));
+    ASSERT_EQ(getObject(valueAt(getObject(simple), "object")), (nlohmann::json::object_t{}));
 
     auto nested = R"({ "object": { "object": {} } })"_json;
 
     auto nestedObject = getObject(valueAt(getObject(nested), "object"));
 
     ASSERT_EQ(nestedObject, getObject(nlohmann::json::parse(R"({ "object": {} })")));
-    ASSERT_EQ(getObject(valueAt(getObject(nestedObject), "object")), (nlohmann::json::object_t {}));
+    ASSERT_EQ(getObject(valueAt(getObject(nestedObject), "object")), (nlohmann::json::object_t{}));
 }
 
-TEST(getObject, wrongAssertions) {
+TEST(getObject, wrongAssertions)
+{
     auto json = R"({ "object": {}, "array": [], "string": "", "int": 0, "boolean": false })"_json;
 
     auto & obj = getObject(json);
@@ -98,13 +108,15 @@ TEST(getObject, wrongAssertions) {
     ASSERT_THROW(getObject(valueAt(obj, "boolean")), Error);
 }
 
-TEST(getArray, rightAssertions) {
+TEST(getArray, rightAssertions)
+{
     auto simple = R"({ "array": [] })"_json;
 
-    ASSERT_EQ(getArray(valueAt(getObject(simple), "array")), (nlohmann::json::array_t {}));
+    ASSERT_EQ(getArray(valueAt(getObject(simple), "array")), (nlohmann::json::array_t{}));
 }
 
-TEST(getArray, wrongAssertions) {
+TEST(getArray, wrongAssertions)
+{
     auto json = R"({ "object": {}, "array": [], "string": "", "int": 0, "boolean": false })"_json;
 
     ASSERT_THROW(getArray(valueAt(json, "object")), Error);
@@ -113,13 +125,15 @@ TEST(getArray, wrongAssertions) {
     ASSERT_THROW(getArray(valueAt(json, "boolean")), Error);
 }
 
-TEST(getString, rightAssertions) {
+TEST(getString, rightAssertions)
+{
     auto simple = R"({ "string": "" })"_json;
 
     ASSERT_EQ(getString(valueAt(getObject(simple), "string")), "");
 }
 
-TEST(getString, wrongAssertions) {
+TEST(getString, wrongAssertions)
+{
     auto json = R"({ "object": {}, "array": [], "string": "", "int": 0, "boolean": false })"_json;
 
     ASSERT_THROW(getString(valueAt(json, "object")), Error);
@@ -128,7 +142,8 @@ TEST(getString, wrongAssertions) {
     ASSERT_THROW(getString(valueAt(json, "boolean")), Error);
 }
 
-TEST(getIntegralNumber, rightAssertions) {
+TEST(getIntegralNumber, rightAssertions)
+{
     auto simple = R"({ "int": 0, "signed": -1 })"_json;
 
     ASSERT_EQ(getUnsigned(valueAt(getObject(simple), "int")), 0u);
@@ -136,8 +151,10 @@ TEST(getIntegralNumber, rightAssertions) {
     ASSERT_EQ(getInteger<int8_t>(valueAt(getObject(simple), "signed")), -1);
 }
 
-TEST(getIntegralNumber, wrongAssertions) {
-    auto json = R"({ "object": {}, "array": [], "string": "", "int": 0, "signed": -256, "large": 128, "boolean": false })"_json;
+TEST(getIntegralNumber, wrongAssertions)
+{
+    auto json =
+        R"({ "object": {}, "array": [], "string": "", "int": 0, "signed": -256, "large": 128, "boolean": false })"_json;
 
     ASSERT_THROW(getUnsigned(valueAt(json, "object")), Error);
     ASSERT_THROW(getUnsigned(valueAt(json, "array")), Error);
@@ -153,13 +170,15 @@ TEST(getIntegralNumber, wrongAssertions) {
     ASSERT_THROW(getInteger<int8_t>(valueAt(json, "signed")), Error);
 }
 
-TEST(getBoolean, rightAssertions) {
+TEST(getBoolean, rightAssertions)
+{
     auto simple = R"({ "boolean": false })"_json;
 
     ASSERT_EQ(getBoolean(valueAt(getObject(simple), "boolean")), false);
 }
 
-TEST(getBoolean, wrongAssertions) {
+TEST(getBoolean, wrongAssertions)
+{
     auto json = R"({ "object": {}, "array": [], "string": "", "int": 0, "boolean": false })"_json;
 
     ASSERT_THROW(getBoolean(valueAt(json, "object")), Error);
@@ -168,25 +187,29 @@ TEST(getBoolean, wrongAssertions) {
     ASSERT_THROW(getBoolean(valueAt(json, "int")), Error);
 }
 
-TEST(optionalValueAt, existing) {
+TEST(optionalValueAt, existing)
+{
     auto json = R"({ "string": "ssh-rsa" })"_json;
 
-    ASSERT_EQ(optionalValueAt(json, "string"), std::optional { "ssh-rsa" });
+    ASSERT_EQ(optionalValueAt(json, "string"), std::optional{"ssh-rsa"});
 }
 
-TEST(optionalValueAt, empty) {
+TEST(optionalValueAt, empty)
+{
     auto json = R"({})"_json;
 
     ASSERT_EQ(optionalValueAt(json, "string"), std::nullopt);
 }
 
-TEST(getNullable, null) {
+TEST(getNullable, null)
+{
     auto json = R"(null)"_json;
 
     ASSERT_EQ(getNullable(json), nullptr);
 }
 
-TEST(getNullable, empty) {
+TEST(getNullable, empty)
+{
     auto json = R"({})"_json;
 
     auto * p = getNullable(json);
diff --git a/src/libutil-tests/logging.cc b/src/libutil-tests/logging.cc
index 5c9fcfe8f..e4ebccd49 100644
--- a/src/libutil-tests/logging.cc
+++ b/src/libutil-tests/logging.cc
@@ -1,10 +1,10 @@
 #if 0
 
-#include "nix/util/logging.hh"
-#include "nix/expr/nixexpr.hh"
-#include <fstream>
+#  include "nix/util/logging.hh"
+#  include "nix/expr/nixexpr.hh"
+#  include <fstream>
 
-#include <gtest/gtest.h>
+#  include <gtest/gtest.h>
 
 namespace nix {
 
diff --git a/src/libutil-tests/lru-cache.cc b/src/libutil-tests/lru-cache.cc
index a6a27cd3e..ed603cd44 100644
--- a/src/libutil-tests/lru-cache.cc
+++ b/src/libutil-tests/lru-cache.cc
@@ -3,128 +3,141 @@
 
 namespace nix {
 
-    /* ----------------------------------------------------------------------------
-     * size
-     * --------------------------------------------------------------------------*/
+/* ----------------------------------------------------------------------------
+ * size
+ * --------------------------------------------------------------------------*/
 
-    TEST(LRUCache, sizeOfEmptyCacheIsZero) {
-        LRUCache<std::string, std::string> c(10);
-        ASSERT_EQ(c.size(), 0u);
-    }
-
-    TEST(LRUCache, sizeOfSingleElementCacheIsOne) {
-        LRUCache<std::string, std::string> c(10);
-        c.upsert("foo", "bar");
-        ASSERT_EQ(c.size(), 1u);
-    }
-
-    /* ----------------------------------------------------------------------------
-     * upsert / get
-     * --------------------------------------------------------------------------*/
-
-    TEST(LRUCache, getFromEmptyCache) {
-        LRUCache<std::string, std::string> c(10);
-        auto val = c.get("x");
-        ASSERT_EQ(val.has_value(), false);
-    }
-
-    TEST(LRUCache, getExistingValue) {
-        LRUCache<std::string, std::string> c(10);
-        c.upsert("foo", "bar");
-        auto val = c.get("foo");
-        ASSERT_EQ(val, "bar");
-    }
-
-    TEST(LRUCache, getNonExistingValueFromNonEmptyCache) {
-        LRUCache<std::string, std::string> c(10);
-        c.upsert("foo", "bar");
-        auto val = c.get("another");
-        ASSERT_EQ(val.has_value(), false);
-    }
-
-    TEST(LRUCache, upsertOnZeroCapacityCache) {
-        LRUCache<std::string, std::string> c(0);
-        c.upsert("foo", "bar");
-        auto val = c.get("foo");
-        ASSERT_EQ(val.has_value(), false);
-    }
-
-    TEST(LRUCache, updateExistingValue) {
-        LRUCache<std::string, std::string> c(1);
-        c.upsert("foo", "bar");
-
-        auto val = c.get("foo");
-        ASSERT_EQ(val.value_or("error"), "bar");
-        ASSERT_EQ(c.size(), 1u);
-
-        c.upsert("foo", "changed");
-        val = c.get("foo");
-        ASSERT_EQ(val.value_or("error"), "changed");
-        ASSERT_EQ(c.size(), 1u);
-    }
-
-    TEST(LRUCache, overwriteOldestWhenCapacityIsReached) {
-        LRUCache<std::string, std::string> c(3);
-        c.upsert("one", "eins");
-        c.upsert("two", "zwei");
-        c.upsert("three", "drei");
-
-        ASSERT_EQ(c.size(), 3u);
-        ASSERT_EQ(c.get("one").value_or("error"), "eins");
-
-        // exceed capacity
-        c.upsert("another", "whatever");
-
-        ASSERT_EQ(c.size(), 3u);
-        // Retrieving "one" makes it the most recent element thus
-        // two will be the oldest one and thus replaced.
-        ASSERT_EQ(c.get("two").has_value(), false);
-        ASSERT_EQ(c.get("another").value(), "whatever");
-    }
-
-    /* ----------------------------------------------------------------------------
-     * clear
-     * --------------------------------------------------------------------------*/
-
-    TEST(LRUCache, clearEmptyCache) {
-        LRUCache<std::string, std::string> c(10);
-        c.clear();
-        ASSERT_EQ(c.size(), 0u);
-    }
-
-    TEST(LRUCache, clearNonEmptyCache) {
-        LRUCache<std::string, std::string> c(10);
-        c.upsert("one", "eins");
-        c.upsert("two", "zwei");
-        c.upsert("three", "drei");
-        ASSERT_EQ(c.size(), 3u);
-        c.clear();
-        ASSERT_EQ(c.size(), 0u);
-    }
-
-    /* ----------------------------------------------------------------------------
-     * erase
-     * --------------------------------------------------------------------------*/
-
-    TEST(LRUCache, eraseFromEmptyCache) {
-        LRUCache<std::string, std::string> c(10);
-        ASSERT_EQ(c.erase("foo"), false);
-        ASSERT_EQ(c.size(), 0u);
-    }
-
-    TEST(LRUCache, eraseMissingFromNonEmptyCache) {
-        LRUCache<std::string, std::string> c(10);
-        c.upsert("one", "eins");
-        ASSERT_EQ(c.erase("foo"), false);
-        ASSERT_EQ(c.size(), 1u);
-        ASSERT_EQ(c.get("one").value_or("error"), "eins");
-    }
-
-    TEST(LRUCache, eraseFromNonEmptyCache) {
-        LRUCache<std::string, std::string> c(10);
-        c.upsert("one", "eins");
-        ASSERT_EQ(c.erase("one"), true);
-        ASSERT_EQ(c.size(), 0u);
-        ASSERT_EQ(c.get("one").value_or("empty"), "empty");
-    }
+TEST(LRUCache, sizeOfEmptyCacheIsZero)
+{
+    LRUCache<std::string, std::string> c(10);
+    ASSERT_EQ(c.size(), 0u);
 }
+
+TEST(LRUCache, sizeOfSingleElementCacheIsOne)
+{
+    LRUCache<std::string, std::string> c(10);
+    c.upsert("foo", "bar");
+    ASSERT_EQ(c.size(), 1u);
+}
+
+/* ----------------------------------------------------------------------------
+ * upsert / get
+ * --------------------------------------------------------------------------*/
+
+TEST(LRUCache, getFromEmptyCache)
+{
+    LRUCache<std::string, std::string> c(10);
+    auto val = c.get("x");
+    ASSERT_EQ(val.has_value(), false);
+}
+
+TEST(LRUCache, getExistingValue)
+{
+    LRUCache<std::string, std::string> c(10);
+    c.upsert("foo", "bar");
+    auto val = c.get("foo");
+    ASSERT_EQ(val, "bar");
+}
+
+TEST(LRUCache, getNonExistingValueFromNonEmptyCache)
+{
+    LRUCache<std::string, std::string> c(10);
+    c.upsert("foo", "bar");
+    auto val = c.get("another");
+    ASSERT_EQ(val.has_value(), false);
+}
+
+TEST(LRUCache, upsertOnZeroCapacityCache)
+{
+    LRUCache<std::string, std::string> c(0);
+    c.upsert("foo", "bar");
+    auto val = c.get("foo");
+    ASSERT_EQ(val.has_value(), false);
+}
+
+TEST(LRUCache, updateExistingValue)
+{
+    LRUCache<std::string, std::string> c(1);
+    c.upsert("foo", "bar");
+
+    auto val = c.get("foo");
+    ASSERT_EQ(val.value_or("error"), "bar");
+    ASSERT_EQ(c.size(), 1u);
+
+    c.upsert("foo", "changed");
+    val = c.get("foo");
+    ASSERT_EQ(val.value_or("error"), "changed");
+    ASSERT_EQ(c.size(), 1u);
+}
+
+TEST(LRUCache, overwriteOldestWhenCapacityIsReached)
+{
+    LRUCache<std::string, std::string> c(3);
+    c.upsert("one", "eins");
+    c.upsert("two", "zwei");
+    c.upsert("three", "drei");
+
+    ASSERT_EQ(c.size(), 3u);
+    ASSERT_EQ(c.get("one").value_or("error"), "eins");
+
+    // exceed capacity
+    c.upsert("another", "whatever");
+
+    ASSERT_EQ(c.size(), 3u);
+    // Retrieving "one" makes it the most recent element thus
+    // two will be the oldest one and thus replaced.
+    ASSERT_EQ(c.get("two").has_value(), false);
+    ASSERT_EQ(c.get("another").value(), "whatever");
+}
+
+/* ----------------------------------------------------------------------------
+ * clear
+ * --------------------------------------------------------------------------*/
+
+TEST(LRUCache, clearEmptyCache)
+{
+    LRUCache<std::string, std::string> c(10);
+    c.clear();
+    ASSERT_EQ(c.size(), 0u);
+}
+
+TEST(LRUCache, clearNonEmptyCache)
+{
+    LRUCache<std::string, std::string> c(10);
+    c.upsert("one", "eins");
+    c.upsert("two", "zwei");
+    c.upsert("three", "drei");
+    ASSERT_EQ(c.size(), 3u);
+    c.clear();
+    ASSERT_EQ(c.size(), 0u);
+}
+
+/* ----------------------------------------------------------------------------
+ * erase
+ * --------------------------------------------------------------------------*/
+
+TEST(LRUCache, eraseFromEmptyCache)
+{
+    LRUCache<std::string, std::string> c(10);
+    ASSERT_EQ(c.erase("foo"), false);
+    ASSERT_EQ(c.size(), 0u);
+}
+
+TEST(LRUCache, eraseMissingFromNonEmptyCache)
+{
+    LRUCache<std::string, std::string> c(10);
+    c.upsert("one", "eins");
+    ASSERT_EQ(c.erase("foo"), false);
+    ASSERT_EQ(c.size(), 1u);
+    ASSERT_EQ(c.get("one").value_or("error"), "eins");
+}
+
+TEST(LRUCache, eraseFromNonEmptyCache)
+{
+    LRUCache<std::string, std::string> c(10);
+    c.upsert("one", "eins");
+    ASSERT_EQ(c.erase("one"), true);
+    ASSERT_EQ(c.size(), 0u);
+    ASSERT_EQ(c.get("one").value_or("empty"), "empty");
+}
+} // namespace nix
diff --git a/src/libutil-tests/meson.build b/src/libutil-tests/meson.build
index b3776e094..ff71d2215 100644
--- a/src/libutil-tests/meson.build
+++ b/src/libutil-tests/meson.build
@@ -1,7 +1,9 @@
-project('nix-util-tests', 'cpp',
+project(
+  'nix-util-tests',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -19,8 +21,7 @@ deps_private_maybe_subproject = [
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
 ]
-deps_public_maybe_subproject = [
-]
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 subdir('nix-meson-build-support/export-all-symbols')
@@ -44,6 +45,7 @@ subdir('nix-meson-build-support/common')
 
 sources = files(
   'args.cc',
+  'base-n.cc',
   'canon-path.cc',
   'checked-arithmetic.cc',
   'chunked-vector.cc',
@@ -61,10 +63,10 @@ sources = files(
   'lru-cache.cc',
   'monitorfdhup.cc',
   'nix_api_util.cc',
+  'nix_api_util_internal.cc',
   'pool.cc',
   'position.cc',
   'processes.cc',
-  'references.cc',
   'sort.cc',
   'spawn.cc',
   'strings.cc',
@@ -75,7 +77,7 @@ sources = files(
   'xml-writer.cc',
 )
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 
 this_exe = executable(
@@ -85,16 +87,17 @@ this_exe = executable(
   dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
   # TODO: -lrapidcheck, see ../libutil-support/build.meson
-  link_args: linker_export_flags + ['-lrapidcheck'],
+  link_args : linker_export_flags + [ '-lrapidcheck' ],
   # get main from gtest
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 test(
   meson.project_name(),
   this_exe,
   env : {
-    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+    '_NIX_TEST_UNIT_DATA' : meson.current_source_dir() / 'data',
   },
   protocol : 'gtest',
 )
diff --git a/src/libutil-tests/monitorfdhup.cc b/src/libutil-tests/monitorfdhup.cc
index 8e6fed6f0..d591b2fed 100644
--- a/src/libutil-tests/monitorfdhup.cc
+++ b/src/libutil-tests/monitorfdhup.cc
@@ -17,6 +17,6 @@ TEST(MonitorFdHup, shouldNotBlock)
         MonitorFdHup monitor(p.readSide.get());
     }
 }
-}
+} // namespace nix
 
 #endif
diff --git a/src/libutil-tests/nix_api_util.cc b/src/libutil-tests/nix_api_util.cc
index baaaa81fc..48f85c403 100644
--- a/src/libutil-tests/nix_api_util.cc
+++ b/src/libutil-tests/nix_api_util.cc
@@ -1,7 +1,6 @@
 #include "nix/util/config-global.hh"
 #include "nix/util/args.hh"
 #include "nix_api_util.h"
-#include "nix_api_util_internal.h"
 #include "nix/util/tests/nix_api_util.hh"
 #include "nix/util/tests/string_callback.hh"
 
@@ -13,41 +12,6 @@
 
 namespace nixC {
 
-TEST_F(nix_api_util_context, nix_context_error)
-{
-    std::string err_msg_ref;
-    try {
-        throw nix::Error("testing error");
-    } catch (nix::Error & e) {
-        err_msg_ref = e.what();
-        nix_context_error(ctx);
-    }
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
-    ASSERT_EQ(ctx->name, "nix::Error");
-    ASSERT_EQ(*ctx->last_err, err_msg_ref);
-    ASSERT_EQ(ctx->info->msg.str(), "testing error");
-
-    try {
-        throw std::runtime_error("testing exception");
-    } catch (std::exception & e) {
-        err_msg_ref = e.what();
-        nix_context_error(ctx);
-    }
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_UNKNOWN);
-    ASSERT_EQ(*ctx->last_err, err_msg_ref);
-
-    nix_clear_err(ctx);
-    ASSERT_EQ(ctx->last_err_code, NIX_OK);
-}
-
-TEST_F(nix_api_util_context, nix_set_err_msg)
-{
-    ASSERT_EQ(ctx->last_err_code, NIX_OK);
-    nix_set_err_msg(ctx, NIX_ERR_UNKNOWN, "unknown test error");
-    ASSERT_EQ(ctx->last_err_code, NIX_ERR_UNKNOWN);
-    ASSERT_EQ(*ctx->last_err, "unknown test error");
-}
-
 TEST(nix_api_util, nix_version_get)
 {
     ASSERT_EQ(std::string(nix_version_get()), PACKAGE_VERSION);
@@ -61,17 +25,9 @@ struct MySettings : nix::Config
 MySettings mySettings;
 static nix::GlobalConfig::Register rs(&mySettings);
 
-static auto createOwnedNixContext()
-{
-    return std::unique_ptr<nix_c_context, decltype([](nix_c_context * ctx) {
-                               if (ctx)
-                                   nix_c_context_free(ctx);
-                           })>(nix_c_context_create(), {});
-}
-
 TEST_F(nix_api_util_context, nix_setting_get)
 {
-    ASSERT_EQ(ctx->last_err_code, NIX_OK);
+    ASSERT_EQ(nix_err_code(ctx), NIX_OK);
     std::string setting_value;
     nix_err result = nix_setting_get(ctx, "invalid-key", OBSERVE_STRING(setting_value));
     ASSERT_EQ(result, NIX_ERR_KEY);
@@ -114,40 +70,6 @@ TEST_F(nix_api_util_context, nix_err_msg)
     ASSERT_EQ(sz, err_msg.size());
 }
 
-TEST_F(nix_api_util_context, nix_err_info_msg)
-{
-    std::string err_info;
-
-    // no error
-    EXPECT_THROW(nix_err_info_msg(NULL, ctx, OBSERVE_STRING(err_info)), nix::Error);
-
-    try {
-        throw nix::Error("testing error");
-    } catch (...) {
-        nix_context_error(ctx);
-    }
-    auto new_ctx = createOwnedNixContext();
-    nix_err_info_msg(new_ctx.get(), ctx, OBSERVE_STRING(err_info));
-    ASSERT_STREQ("testing error", err_info.c_str());
-}
-
-TEST_F(nix_api_util_context, nix_err_name)
-{
-    std::string err_name;
-
-    // no error
-    EXPECT_THROW(nix_err_name(NULL, ctx, OBSERVE_STRING(err_name)), nix::Error);
-
-    try {
-        throw nix::Error("testing error");
-    } catch (...) {
-        nix_context_error(ctx);
-    }
-    auto new_ctx = createOwnedNixContext();
-    nix_err_name(new_ctx.get(), ctx, OBSERVE_STRING(err_name));
-    ASSERT_EQ(std::string(err_name), "nix::Error");
-}
-
 TEST_F(nix_api_util_context, nix_err_code)
 {
     ASSERT_EQ(nix_err_code(ctx), NIX_OK);
@@ -155,4 +77,4 @@ TEST_F(nix_api_util_context, nix_err_code)
     ASSERT_EQ(nix_err_code(ctx), NIX_ERR_UNKNOWN);
 }
 
-}
+} // namespace nixC
diff --git a/src/libutil-tests/nix_api_util_internal.cc b/src/libutil-tests/nix_api_util_internal.cc
new file mode 100644
index 000000000..6fb0a623f
--- /dev/null
+++ b/src/libutil-tests/nix_api_util_internal.cc
@@ -0,0 +1,85 @@
+#include "nix/util/config-global.hh"
+#include "nix/util/args.hh"
+#include "nix_api_util.h"
+#include "nix_api_util_internal.h"
+#include "nix/util/tests/nix_api_util.hh"
+#include "nix/util/tests/string_callback.hh"
+
+#include <gtest/gtest.h>
+
+#include <memory>
+
+#include "util-tests-config.hh"
+
+namespace nixC {
+
+TEST_F(nix_api_util_context, nix_context_error)
+{
+    std::string err_msg_ref;
+    try {
+        throw nix::Error("testing error");
+    } catch (nix::Error & e) {
+        err_msg_ref = e.what();
+        nix_context_error(ctx);
+    }
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_NIX_ERROR);
+    ASSERT_EQ(ctx->name, "nix::Error");
+    ASSERT_EQ(*ctx->last_err, err_msg_ref);
+    ASSERT_EQ(ctx->info->msg.str(), "testing error");
+
+    try {
+        throw std::runtime_error("testing exception");
+    } catch (std::exception & e) {
+        err_msg_ref = e.what();
+        nix_context_error(ctx);
+    }
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_UNKNOWN);
+    ASSERT_EQ(*ctx->last_err, err_msg_ref);
+
+    nix_clear_err(ctx);
+    ASSERT_EQ(nix_err_code(ctx), NIX_OK);
+}
+
+TEST_F(nix_api_util_context, nix_set_err_msg)
+{
+    ASSERT_EQ(nix_err_code(ctx), NIX_OK);
+    nix_set_err_msg(ctx, NIX_ERR_UNKNOWN, "unknown test error");
+    ASSERT_EQ(nix_err_code(ctx), NIX_ERR_UNKNOWN);
+    ASSERT_EQ(*ctx->last_err, "unknown test error");
+}
+
+TEST_F(nix_api_util_context, nix_err_info_msg)
+{
+    std::string err_info;
+
+    // no error
+    EXPECT_THROW(nix_err_info_msg(NULL, ctx, OBSERVE_STRING(err_info)), nix::Error);
+
+    try {
+        throw nix::Error("testing error");
+    } catch (...) {
+        nix_context_error(ctx);
+    }
+    auto new_ctx = createOwnedNixContext();
+    nix_err_info_msg(new_ctx.get(), ctx, OBSERVE_STRING(err_info));
+    ASSERT_STREQ("testing error", err_info.c_str());
+}
+
+TEST_F(nix_api_util_context, nix_err_name)
+{
+    std::string err_name;
+
+    // no error
+    EXPECT_THROW(nix_err_name(NULL, ctx, OBSERVE_STRING(err_name)), nix::Error);
+
+    try {
+        throw nix::Error("testing error");
+    } catch (...) {
+        nix_context_error(ctx);
+    }
+    auto new_ctx = createOwnedNixContext();
+    nix_err_name(new_ctx.get(), ctx, OBSERVE_STRING(err_name));
+    ASSERT_EQ(std::string(err_name), "nix::Error");
+}
+
+} // namespace nixC
diff --git a/src/libutil-tests/pch/precompiled-headers.hh b/src/libutil-tests/pch/precompiled-headers.hh
new file mode 100644
index 000000000..0a078fcc4
--- /dev/null
+++ b/src/libutil-tests/pch/precompiled-headers.hh
@@ -0,0 +1,5 @@
+#include "nix/util/util.hh"
+
+#include <gtest/gtest.h>
+#include <gmock/gmock.h>
+#include <rapidcheck/gtest.h>
diff --git a/src/libutil-tests/pool.cc b/src/libutil-tests/pool.cc
index d41bab8ed..68448a1cb 100644
--- a/src/libutil-tests/pool.cc
+++ b/src/libutil-tests/pool.cc
@@ -3,125 +3,133 @@
 
 namespace nix {
 
-    struct TestResource
+struct TestResource
+{
+
+    TestResource()
     {
-
-        TestResource() {
-            static int counter = 0;
-            num = counter++;
-        }
-
-        int dummyValue = 1;
-        bool good = true;
-        int num;
-    };
-
-    /* ----------------------------------------------------------------------------
-     * Pool
-     * --------------------------------------------------------------------------*/
-
-    TEST(Pool, freshPoolHasZeroCountAndSpecifiedCapacity) {
-        auto isGood = [](const ref<TestResource> & r) { return r->good; };
-        auto createResource = []() { return make_ref<TestResource>(); };
-
-        Pool<TestResource> pool = Pool<TestResource>((size_t)1, createResource, isGood);
-
-        ASSERT_EQ(pool.count(), 0u);
-        ASSERT_EQ(pool.capacity(), 1u);
+        static int counter = 0;
+        num = counter++;
     }
 
-    TEST(Pool, freshPoolCanGetAResource) {
-        auto isGood = [](const ref<TestResource> & r) { return r->good; };
-        auto createResource = []() { return make_ref<TestResource>(); };
+    int dummyValue = 1;
+    bool good = true;
+    int num;
+};
 
-        Pool<TestResource> pool = Pool<TestResource>((size_t)1, createResource, isGood);
-        ASSERT_EQ(pool.count(), 0u);
+/* ----------------------------------------------------------------------------
+ * Pool
+ * --------------------------------------------------------------------------*/
 
-        TestResource r = *(pool.get());
+TEST(Pool, freshPoolHasZeroCountAndSpecifiedCapacity)
+{
+    auto isGood = [](const ref<TestResource> & r) { return r->good; };
+    auto createResource = []() { return make_ref<TestResource>(); };
 
+    Pool<TestResource> pool = Pool<TestResource>((size_t) 1, createResource, isGood);
+
+    ASSERT_EQ(pool.count(), 0u);
+    ASSERT_EQ(pool.capacity(), 1u);
+}
+
+TEST(Pool, freshPoolCanGetAResource)
+{
+    auto isGood = [](const ref<TestResource> & r) { return r->good; };
+    auto createResource = []() { return make_ref<TestResource>(); };
+
+    Pool<TestResource> pool = Pool<TestResource>((size_t) 1, createResource, isGood);
+    ASSERT_EQ(pool.count(), 0u);
+
+    TestResource r = *(pool.get());
+
+    ASSERT_EQ(pool.count(), 1u);
+    ASSERT_EQ(pool.capacity(), 1u);
+    ASSERT_EQ(r.dummyValue, 1);
+    ASSERT_EQ(r.good, true);
+}
+
+TEST(Pool, capacityCanBeIncremented)
+{
+    auto isGood = [](const ref<TestResource> & r) { return r->good; };
+    auto createResource = []() { return make_ref<TestResource>(); };
+
+    Pool<TestResource> pool = Pool<TestResource>((size_t) 1, createResource, isGood);
+    ASSERT_EQ(pool.capacity(), 1u);
+    pool.incCapacity();
+    ASSERT_EQ(pool.capacity(), 2u);
+}
+
+TEST(Pool, capacityCanBeDecremented)
+{
+    auto isGood = [](const ref<TestResource> & r) { return r->good; };
+    auto createResource = []() { return make_ref<TestResource>(); };
+
+    Pool<TestResource> pool = Pool<TestResource>((size_t) 1, createResource, isGood);
+    ASSERT_EQ(pool.capacity(), 1u);
+    pool.decCapacity();
+    ASSERT_EQ(pool.capacity(), 0u);
+}
+
+TEST(Pool, flushBadDropsOutOfScopeResources)
+{
+    auto isGood = [](const ref<TestResource> & r) { return false; };
+    auto createResource = []() { return make_ref<TestResource>(); };
+
+    Pool<TestResource> pool = Pool<TestResource>((size_t) 1, createResource, isGood);
+
+    {
+        auto _r = pool.get();
         ASSERT_EQ(pool.count(), 1u);
-        ASSERT_EQ(pool.capacity(), 1u);
-        ASSERT_EQ(r.dummyValue, 1);
-        ASSERT_EQ(r.good, true);
     }
 
-    TEST(Pool, capacityCanBeIncremented) {
-        auto isGood = [](const ref<TestResource> & r) { return r->good; };
-        auto createResource = []() { return make_ref<TestResource>(); };
+    pool.flushBad();
+    ASSERT_EQ(pool.count(), 0u);
+}
 
-        Pool<TestResource> pool = Pool<TestResource>((size_t)1, createResource, isGood);
-        ASSERT_EQ(pool.capacity(), 1u);
-        pool.incCapacity();
-        ASSERT_EQ(pool.capacity(), 2u);
-    }
+// Test that the resources we allocate are being reused when they are still good.
+TEST(Pool, reuseResource)
+{
+    auto isGood = [](const ref<TestResource> & r) { return true; };
+    auto createResource = []() { return make_ref<TestResource>(); };
 
-    TEST(Pool, capacityCanBeDecremented) {
-        auto isGood = [](const ref<TestResource> & r) { return r->good; };
-        auto createResource = []() { return make_ref<TestResource>(); };
+    Pool<TestResource> pool = Pool<TestResource>((size_t) 1, createResource, isGood);
 
-        Pool<TestResource> pool = Pool<TestResource>((size_t)1, createResource, isGood);
-        ASSERT_EQ(pool.capacity(), 1u);
-        pool.decCapacity();
-        ASSERT_EQ(pool.capacity(), 0u);
-    }
+    // Compare the instance counter between the two handles. We expect them to be equal
+    // as the pool should hand out the same (still) good one again.
+    int counter = -1;
+    {
+        Pool<TestResource>::Handle h = pool.get();
+        counter = h->num;
+    } // the first handle goes out of scope
 
-    TEST(Pool, flushBadDropsOutOfScopeResources) {
-        auto isGood = [](const ref<TestResource> & r) { return false; };
-        auto createResource = []() { return make_ref<TestResource>(); };
-
-        Pool<TestResource> pool = Pool<TestResource>((size_t)1, createResource, isGood);
-
-        {
-            auto _r = pool.get();
-            ASSERT_EQ(pool.count(), 1u);
-        }
-
-        pool.flushBad();
-        ASSERT_EQ(pool.count(), 0u);
-    }
-
-    // Test that the resources we allocate are being reused when they are still good.
-    TEST(Pool, reuseResource) {
-        auto isGood = [](const ref<TestResource> & r) { return true; };
-        auto createResource = []() { return make_ref<TestResource>(); };
-
-        Pool<TestResource> pool = Pool<TestResource>((size_t)1, createResource, isGood);
-
-        // Compare the instance counter between the two handles. We expect them to be equal
-        // as the pool should hand out the same (still) good one again.
-        int counter = -1;
-        {
-            Pool<TestResource>::Handle h = pool.get();
-            counter = h->num;
-        } // the first handle goes out of scope
-
-        { // the second handle should contain the same resource (with the same counter value)
-            Pool<TestResource>::Handle h = pool.get();
-            ASSERT_EQ(h->num, counter);
-        }
-    }
-
-    // Test that the resources we allocate are being thrown away when they are no longer good.
-    TEST(Pool, badResourceIsNotReused) {
-        auto isGood = [](const ref<TestResource> & r) { return false; };
-        auto createResource = []() { return make_ref<TestResource>(); };
-
-        Pool<TestResource> pool = Pool<TestResource>((size_t)1, createResource, isGood);
-
-        // Compare the instance counter between the two handles. We expect them
-        // to *not* be equal as the pool should hand out a new instance after
-        // the first one was returned.
-        int counter = -1;
-        {
-            Pool<TestResource>::Handle h = pool.get();
-            counter = h->num;
-        } // the first handle goes out of scope
-
-        {
-          // the second handle should contain a different resource (with a
-          //different counter value)
-            Pool<TestResource>::Handle h = pool.get();
-            ASSERT_NE(h->num, counter);
-        }
+    { // the second handle should contain the same resource (with the same counter value)
+        Pool<TestResource>::Handle h = pool.get();
+        ASSERT_EQ(h->num, counter);
     }
 }
+
+// Test that the resources we allocate are being thrown away when they are no longer good.
+TEST(Pool, badResourceIsNotReused)
+{
+    auto isGood = [](const ref<TestResource> & r) { return false; };
+    auto createResource = []() { return make_ref<TestResource>(); };
+
+    Pool<TestResource> pool = Pool<TestResource>((size_t) 1, createResource, isGood);
+
+    // Compare the instance counter between the two handles. We expect them
+    // to *not* be equal as the pool should hand out a new instance after
+    // the first one was returned.
+    int counter = -1;
+    {
+        Pool<TestResource>::Handle h = pool.get();
+        counter = h->num;
+    } // the first handle goes out of scope
+
+    {
+        // the second handle should contain a different resource (with a
+        // different counter value)
+        Pool<TestResource>::Handle h = pool.get();
+        ASSERT_NE(h->num, counter);
+    }
+}
+} // namespace nix
diff --git a/src/libutil-tests/position.cc b/src/libutil-tests/position.cc
index fd65acd03..9a2354923 100644
--- a/src/libutil-tests/position.cc
+++ b/src/libutil-tests/position.cc
@@ -15,6 +15,7 @@ TEST(Position, getSnippetUpTo_0)
     Pos p(1, 1, o);
     ASSERT_EQ(p.getSnippetUpTo(p), "");
 }
+
 TEST(Position, getSnippetUpTo_1)
 {
     Pos::Origin o = makeStdin("x");
@@ -56,6 +57,7 @@ TEST(Position, getSnippetUpTo_1)
         ASSERT_EQ(end.getSnippetUpTo(start), std::nullopt);
     }
 }
+
 TEST(Position, getSnippetUpTo_2)
 {
     Pos::Origin o = makeStdin("asdf\njkl\nqwer");
diff --git a/src/libutil-tests/references.cc b/src/libutil-tests/references.cc
deleted file mode 100644
index 622b3c35a..000000000
--- a/src/libutil-tests/references.cc
+++ /dev/null
@@ -1,46 +0,0 @@
-#include "nix/util/references.hh"
-#include <gtest/gtest.h>
-
-namespace nix {
-
-using std::string;
-
-struct RewriteParams {
-    string originalString, finalString;
-    StringMap rewrites;
-
-    friend std::ostream& operator<<(std::ostream& os, const RewriteParams& bar) {
-        StringSet strRewrites;
-        for (auto & [from, to] : bar.rewrites)
-            strRewrites.insert(from + "->" + to);
-        return os <<
-            "OriginalString: " << bar.originalString << std::endl <<
-            "Rewrites: " << dropEmptyInitThenConcatStringsSep(",", strRewrites) << std::endl <<
-            "Expected result: " << bar.finalString;
-    }
-};
-
-class RewriteTest : public ::testing::TestWithParam<RewriteParams> {
-};
-
-TEST_P(RewriteTest, IdentityRewriteIsIdentity) {
-    RewriteParams param = GetParam();
-    StringSink rewritten;
-    auto rewriter = RewritingSink(param.rewrites, rewritten);
-    rewriter(param.originalString);
-    rewriter.flush();
-    ASSERT_EQ(rewritten.s, param.finalString);
-}
-
-INSTANTIATE_TEST_CASE_P(
-    references,
-    RewriteTest,
-    ::testing::Values(
-        RewriteParams{ "foooo", "baroo", {{"foo", "bar"}, {"bar", "baz"}}},
-        RewriteParams{ "foooo", "bazoo", {{"fou", "bar"}, {"foo", "baz"}}},
-        RewriteParams{ "foooo", "foooo", {}}
-    )
-);
-
-}
-
diff --git a/src/libutil-tests/spawn.cc b/src/libutil-tests/spawn.cc
index 594bced59..cf3645260 100644
--- a/src/libutil-tests/spawn.cc
+++ b/src/libutil-tests/spawn.cc
@@ -33,4 +33,4 @@ TEST(SpawnTest, windowsEscape)
     ASSERT_EQ(space, R"("hello world")");
 }
 #endif
-}
+} // namespace nix
diff --git a/src/libutil-tests/strings.cc b/src/libutil-tests/strings.cc
index bf1f66025..bd740ce0c 100644
--- a/src/libutil-tests/strings.cc
+++ b/src/libutil-tests/strings.cc
@@ -2,6 +2,7 @@
 #include <rapidcheck/gtest.h>
 
 #include "nix/util/strings.hh"
+#include "nix/util/strings-inline.hh"
 #include "nix/util/error.hh"
 
 namespace nix {
@@ -271,113 +272,122 @@ TEST(tokenizeString, tokenizeSepEmpty)
  * splitString
  * --------------------------------------------------------------------------*/
 
-TEST(splitString, empty)
-{
-    Strings expected = {""};
+using SplitStringTestContainerTypes = ::testing::
+    Types<std::vector<std::string>, std::vector<std::string_view>, std::list<std::string>, std::list<std::string_view>>;
 
-    ASSERT_EQ(splitString<Strings>("", " \t\n\r"), expected);
+template<typename T>
+class splitStringTest : public ::testing::Test
+{};
+
+TYPED_TEST_SUITE(splitStringTest, SplitStringTestContainerTypes);
+
+TYPED_TEST(splitStringTest, empty)
+{
+    TypeParam expected = {""};
+
+    EXPECT_EQ(splitString<TypeParam>("", " \t\n\r"), expected);
 }
 
-TEST(splitString, oneSep)
+TYPED_TEST(splitStringTest, oneSep)
 {
-    Strings expected = {"", ""};
+    TypeParam expected = {"", ""};
 
-    ASSERT_EQ(splitString<Strings>(" ", " \t\n\r"), expected);
+    EXPECT_EQ(splitString<TypeParam>(" ", " \t\n\r"), expected);
 }
 
-TEST(splitString, twoSep)
+TYPED_TEST(splitStringTest, twoSep)
 {
-    Strings expected = {"", "", ""};
+    TypeParam expected = {"", "", ""};
 
-    ASSERT_EQ(splitString<Strings>(" \n", " \t\n\r"), expected);
+    EXPECT_EQ(splitString<TypeParam>(" \n", " \t\n\r"), expected);
 }
 
-TEST(splitString, tokenizeSpacesWithSpaces)
+TYPED_TEST(splitStringTest, tokenizeSpacesWithSpaces)
 {
     auto s = "foo bar baz";
-    Strings expected = {"foo", "bar", "baz"};
+    TypeParam expected = {"foo", "bar", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s, " \t\n\r"), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, " \t\n\r"), expected);
 }
 
-TEST(splitString, tokenizeTabsWithDefaults)
+TYPED_TEST(splitStringTest, tokenizeTabsWithDefaults)
 {
     auto s = "foo\tbar\tbaz";
     // Using it like this is weird, but shows the difference with tokenizeString, which also has this test
-    Strings expected = {"foo", "bar", "baz"};
+    TypeParam expected = {"foo", "bar", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s, " \t\n\r"), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, " \t\n\r"), expected);
 }
 
-TEST(splitString, tokenizeTabsSpacesWithDefaults)
+TYPED_TEST(splitStringTest, tokenizeTabsSpacesWithDefaults)
 {
     auto s = "foo\t bar\t baz";
     // Using it like this is weird, but shows the difference with tokenizeString, which also has this test
-    Strings expected = {"foo", "", "bar", "", "baz"};
+    TypeParam expected = {"foo", "", "bar", "", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s, " \t\n\r"), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, " \t\n\r"), expected);
 }
 
-TEST(splitString, tokenizeTabsSpacesNewlineWithDefaults)
+TYPED_TEST(splitStringTest, tokenizeTabsSpacesNewlineWithDefaults)
 {
     auto s = "foo\t\n bar\t\n baz";
     // Using it like this is weird, but shows the difference with tokenizeString, which also has this test
-    Strings expected = {"foo", "", "", "bar", "", "", "baz"};
+    TypeParam expected = {"foo", "", "", "bar", "", "", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s, " \t\n\r"), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, " \t\n\r"), expected);
 }
 
-TEST(splitString, tokenizeTabsSpacesNewlineRetWithDefaults)
+TYPED_TEST(splitStringTest, tokenizeTabsSpacesNewlineRetWithDefaults)
 {
     auto s = "foo\t\n\r bar\t\n\r baz";
     // Using it like this is weird, but shows the difference with tokenizeString, which also has this test
-    Strings expected = {"foo", "", "", "", "bar", "", "", "", "baz"};
+    TypeParam expected = {"foo", "", "", "", "bar", "", "", "", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s, " \t\n\r"), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, " \t\n\r"), expected);
 
     auto s2 = "foo \t\n\r bar \t\n\r baz";
-    Strings expected2 = {"foo", "", "", "", "", "bar", "", "", "", "", "baz"};
+    TypeParam expected2 = {"foo", "", "", "", "", "bar", "", "", "", "", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s2, " \t\n\r"), expected2);
+    EXPECT_EQ(splitString<TypeParam>(s2, " \t\n\r"), expected2);
 }
 
-TEST(splitString, tokenizeWithCustomSep)
+TYPED_TEST(splitStringTest, tokenizeWithCustomSep)
 {
     auto s = "foo\n,bar\n,baz\n";
-    Strings expected = {"foo\n", "bar\n", "baz\n"};
+    TypeParam expected = {"foo\n", "bar\n", "baz\n"};
 
-    ASSERT_EQ(splitString<Strings>(s, ","), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, ","), expected);
 }
 
-TEST(splitString, tokenizeSepAtStart)
+TYPED_TEST(splitStringTest, tokenizeSepAtStart)
 {
     auto s = ",foo,bar,baz";
-    Strings expected = {"", "foo", "bar", "baz"};
+    TypeParam expected = {"", "foo", "bar", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s, ","), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, ","), expected);
 }
 
-TEST(splitString, tokenizeSepAtEnd)
+TYPED_TEST(splitStringTest, tokenizeSepAtEnd)
 {
     auto s = "foo,bar,baz,";
-    Strings expected = {"foo", "bar", "baz", ""};
+    TypeParam expected = {"foo", "bar", "baz", ""};
 
-    ASSERT_EQ(splitString<Strings>(s, ","), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, ","), expected);
 }
 
-TEST(splitString, tokenizeSepEmpty)
+TYPED_TEST(splitStringTest, tokenizeSepEmpty)
 {
     auto s = "foo,,baz";
-    Strings expected = {"foo", "", "baz"};
+    TypeParam expected = {"foo", "", "baz"};
 
-    ASSERT_EQ(splitString<Strings>(s, ","), expected);
+    EXPECT_EQ(splitString<TypeParam>(s, ","), expected);
 }
 
 // concatStringsSep sep . splitString sep = id   if sep is 1 char
-RC_GTEST_PROP(splitString, recoveredByConcatStringsSep, (const std::string & s))
+RC_GTEST_TYPED_FIXTURE_PROP(splitStringTest, recoveredByConcatStringsSep, (const std::string & s))
 {
-    RC_ASSERT(concatStringsSep("/", splitString<Strings>(s, "/")) == s);
-    RC_ASSERT(concatStringsSep("a", splitString<Strings>(s, "a")) == s);
+    RC_ASSERT(concatStringsSep("/", splitString<TypeParam>(s, "/")) == s);
+    RC_ASSERT(concatStringsSep("a", splitString<TypeParam>(s, "a")) == s);
 }
 
 /* ----------------------------------------------------------------------------
diff --git a/src/libutil-tests/suggestions.cc b/src/libutil-tests/suggestions.cc
index d21b286c8..a23e5d3f4 100644
--- a/src/libutil-tests/suggestions.cc
+++ b/src/libutil-tests/suggestions.cc
@@ -3,41 +3,43 @@
 
 namespace nix {
 
-    struct LevenshteinDistanceParam {
-        std::string s1, s2;
-        int distance;
-    };
+struct LevenshteinDistanceParam
+{
+    std::string s1, s2;
+    int distance;
+};
 
-    class LevenshteinDistanceTest :
-        public testing::TestWithParam<LevenshteinDistanceParam> {
-    };
+class LevenshteinDistanceTest : public testing::TestWithParam<LevenshteinDistanceParam>
+{};
 
-    TEST_P(LevenshteinDistanceTest, CorrectlyComputed) {
-        auto params = GetParam();
+TEST_P(LevenshteinDistanceTest, CorrectlyComputed)
+{
+    auto params = GetParam();
 
-        ASSERT_EQ(levenshteinDistance(params.s1, params.s2), params.distance);
-        ASSERT_EQ(levenshteinDistance(params.s2, params.s1), params.distance);
-    }
-
-    INSTANTIATE_TEST_SUITE_P(LevenshteinDistance, LevenshteinDistanceTest,
-            testing::Values(
-                LevenshteinDistanceParam{"foo", "foo", 0},
-                LevenshteinDistanceParam{"foo", "", 3},
-                LevenshteinDistanceParam{"", "", 0},
-                LevenshteinDistanceParam{"foo", "fo", 1},
-                LevenshteinDistanceParam{"foo", "oo", 1},
-                LevenshteinDistanceParam{"foo", "fao", 1},
-                LevenshteinDistanceParam{"foo", "abc", 3}
-            )
-    );
-
-    TEST(Suggestions, Trim) {
-        auto suggestions = Suggestions::bestMatches({"foooo", "bar", "fo", "gao"}, "foo");
-        auto onlyOne = suggestions.trim(1);
-        ASSERT_EQ(onlyOne.suggestions.size(), 1u);
-        ASSERT_TRUE(onlyOne.suggestions.begin()->suggestion == "fo");
-
-        auto closest = suggestions.trim(999, 2);
-        ASSERT_EQ(closest.suggestions.size(), 3u);
-    }
+    ASSERT_EQ(levenshteinDistance(params.s1, params.s2), params.distance);
+    ASSERT_EQ(levenshteinDistance(params.s2, params.s1), params.distance);
 }
+
+INSTANTIATE_TEST_SUITE_P(
+    LevenshteinDistance,
+    LevenshteinDistanceTest,
+    testing::Values(
+        LevenshteinDistanceParam{"foo", "foo", 0},
+        LevenshteinDistanceParam{"foo", "", 3},
+        LevenshteinDistanceParam{"", "", 0},
+        LevenshteinDistanceParam{"foo", "fo", 1},
+        LevenshteinDistanceParam{"foo", "oo", 1},
+        LevenshteinDistanceParam{"foo", "fao", 1},
+        LevenshteinDistanceParam{"foo", "abc", 3}));
+
+TEST(Suggestions, Trim)
+{
+    auto suggestions = Suggestions::bestMatches({"foooo", "bar", "fo", "gao"}, "foo");
+    auto onlyOne = suggestions.trim(1);
+    ASSERT_EQ(onlyOne.suggestions.size(), 1u);
+    ASSERT_TRUE(onlyOne.suggestions.begin()->suggestion == "fo");
+
+    auto closest = suggestions.trim(999, 2);
+    ASSERT_EQ(closest.suggestions.size(), 3u);
+}
+} // namespace nix
diff --git a/src/libutil-tests/url.cc b/src/libutil-tests/url.cc
index c93a96d84..5c7b02248 100644
--- a/src/libutil-tests/url.cc
+++ b/src/libutil-tests/url.cc
@@ -1,317 +1,945 @@
 #include "nix/util/url.hh"
+#include "nix/util/tests/gmock-matchers.hh"
 #include <gtest/gtest.h>
+#include <gmock/gmock.h>
+
+#include <ranges>
 
 namespace nix {
 
 /* ----------- tests for url.hh --------------------------------------------------*/
 
-    std::string print_map(StringMap m) {
-        StringMap::iterator it;
-        std::string s = "{ ";
-        for (it = m.begin(); it != m.end(); ++it) {
-            s += "{ ";
-            s += it->first;
-            s += " = ";
-            s += it->second;
-            s += " } ";
-        }
-        s += "}";
-        return s;
-    }
+using Authority = ParsedURL::Authority;
+using HostType = Authority::HostType;
 
+struct FixGitURLParam
+{
+    std::string input;
+    std::string expected;
+    ParsedURL parsed;
+};
 
-    TEST(parseURL, parsesSimpleHttpUrl) {
-        auto s = "http://www.example.org/file.tar.gz";
-        auto parsed = parseURL(s);
+std::ostream & operator<<(std::ostream & os, const FixGitURLParam & param)
+{
+    return os << "Input: \"" << param.input << "\", Expected: \"" << param.expected << "\"";
+}
 
-        ParsedURL expected {
-            .scheme = "http",
-            .authority = "www.example.org",
-            .path = "/file.tar.gz",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
+class FixGitURLTestSuite : public ::testing::TestWithParam<FixGitURLParam>
+{};
 
-        ASSERT_EQ(parsed, expected);
-    }
+INSTANTIATE_TEST_SUITE_P(
+    FixGitURLs,
+    FixGitURLTestSuite,
+    ::testing::Values(
+        // https://github.com/NixOS/nix/issues/5958
+        // Already proper URL with git+ssh
+        FixGitURLParam{
+            .input = "git+ssh://user@domain:1234/path",
+            .expected = "git+ssh://user@domain:1234/path",
+            .parsed =
+                ParsedURL{
+                    .scheme = "git+ssh",
+                    .authority =
+                        ParsedURL::Authority{
+                            .host = "domain",
+                            .user = "user",
+                            .port = 1234,
+                        },
+                    .path = {"", "path"},
+                },
+        },
+        // SCP-like URL (rewritten to ssh://)
+        FixGitURLParam{
+            .input = "git@github.com:owner/repo.git",
+            .expected = "ssh://git@github.com/owner/repo.git",
+            .parsed =
+                ParsedURL{
+                    .scheme = "ssh",
+                    .authority =
+                        ParsedURL::Authority{
+                            .host = "github.com",
+                            .user = "git",
+                        },
+                    .path = {"", "owner", "repo.git"},
+                },
+        },
+        // Absolute path (becomes file:)
+        FixGitURLParam{
+            .input = "/home/me/repo",
+            .expected = "file:///home/me/repo",
+            .parsed =
+                ParsedURL{
+                    .scheme = "file",
+                    .authority = ParsedURL::Authority{},
+                    .path = {"", "home", "me", "repo"},
+                },
+        },
+        // Already file: scheme
+        // NOTE: Git/SCP treat this as a `<hostname>:<path>`, so we are
+        // failing to "fix up" this case.
+        FixGitURLParam{
+            .input = "file:/var/repos/x",
+            .expected = "file:/var/repos/x",
+            .parsed =
+                ParsedURL{
+                    .scheme = "file",
+                    .authority = std::nullopt,
+                    .path = {"", "var", "repos", "x"},
+                },
+        },
+        // IPV6 test case
+        FixGitURLParam{
+            .input = "user@[2001:db8:1::2]:/home/file",
+            .expected = "ssh://user@[2001:db8:1::2]//home/file",
+            .parsed =
+                ParsedURL{
+                    .scheme = "ssh",
+                    .authority =
+                        ParsedURL::Authority{
+                            .hostType = HostType::IPv6,
+                            .host = "2001:db8:1::2",
+                            .user = "user",
+                        },
+                    .path = {"", "", "home", "file"},
+                },
+        }));
 
-    TEST(parseURL, parsesSimpleHttpsUrl) {
-        auto s = "https://www.example.org/file.tar.gz";
-        auto parsed = parseURL(s);
+TEST_P(FixGitURLTestSuite, parsesVariedGitUrls)
+{
+    auto & p = GetParam();
+    const auto actual = fixGitURL(p.input);
+    EXPECT_EQ(actual, p.parsed);
+    EXPECT_EQ(actual.to_string(), p.expected);
+}
 
-        ParsedURL expected {
-            .scheme = "https",
-            .authority = "www.example.org",
-            .path = "/file.tar.gz",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
+TEST(FixGitURLTestSuite, scpLikeNoUserParsesPoorly)
+{
+    // SCP-like URL (no user)
 
-        ASSERT_EQ(parsed, expected);
-    }
-
-    TEST(parseURL, parsesSimpleHttpUrlWithQueryAndFragment) {
-        auto s = "https://www.example.org/file.tar.gz?download=fast&when=now#hello";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
-            .scheme = "https",
-            .authority = "www.example.org",
-            .path = "/file.tar.gz",
-            .query = (StringMap) { { "download", "fast" }, { "when", "now" } },
-            .fragment = "hello",
-        };
-
-        ASSERT_EQ(parsed, expected);
-    }
-
-    TEST(parseURL, parsesSimpleHttpUrlWithComplexFragment) {
-        auto s = "http://www.example.org/file.tar.gz?field=value#?foo=bar%23";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
-            .scheme = "http",
-            .authority = "www.example.org",
-            .path = "/file.tar.gz",
-            .query = (StringMap) { { "field", "value" } },
-            .fragment = "?foo=bar#",
-        };
-
-        ASSERT_EQ(parsed, expected);
-    }
-
-    TEST(parseURL, parsesFilePlusHttpsUrl) {
-        auto s = "file+https://www.example.org/video.mp4";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
-            .scheme = "file+https",
-            .authority = "www.example.org",
-            .path = "/video.mp4",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
-
-        ASSERT_EQ(parsed, expected);
-    }
-
-    TEST(parseURL, rejectsAuthorityInUrlsWithFileTransportation) {
-        auto s = "file://www.example.org/video.mp4";
-        ASSERT_THROW(parseURL(s), Error);
-    }
-
-    TEST(parseURL, parseIPv4Address) {
-        auto s = "http://127.0.0.1:8080/file.tar.gz?download=fast&when=now#hello";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
-            .scheme = "http",
-            .authority = "127.0.0.1:8080",
-            .path = "/file.tar.gz",
-            .query = (StringMap) { { "download", "fast" }, { "when", "now" } },
-            .fragment = "hello",
-        };
-
-        ASSERT_EQ(parsed, expected);
-    }
-
-    TEST(parseURL, parseScopedRFC4007IPv6Address) {
-        auto s = "http://[fe80::818c:da4d:8975:415c\%enp0s25]:8080";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
-            .scheme = "http",
-            .authority = "[fe80::818c:da4d:8975:415c\%enp0s25]:8080",
-            .path = "",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
-
-        ASSERT_EQ(parsed, expected);
-
-    }
-
-    TEST(parseURL, parseIPv6Address) {
-        auto s = "http://[2a02:8071:8192:c100:311d:192d:81ac:11ea]:8080";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
-            .scheme = "http",
-            .authority = "[2a02:8071:8192:c100:311d:192d:81ac:11ea]:8080",
-            .path = "",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
-
-        ASSERT_EQ(parsed, expected);
-
-    }
-
-    TEST(parseURL, parseEmptyQueryParams) {
-        auto s = "http://127.0.0.1:8080/file.tar.gz?&&&&&";
-        auto parsed = parseURL(s);
-        ASSERT_EQ(parsed.query, (StringMap) { });
-    }
-
-    TEST(parseURL, parseUserPassword) {
-        auto s = "http://user:pass@www.example.org:8080/file.tar.gz";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
-            .scheme = "http",
-            .authority = "user:pass@www.example.org:8080",
-            .path = "/file.tar.gz",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
-
-
-        ASSERT_EQ(parsed, expected);
-    }
-
-    TEST(parseURL, parseFileURLWithQueryAndFragment) {
-        auto s = "file:///none/of//your/business";
-        auto parsed = parseURL(s);
-
-        ParsedURL expected {
+    // Cannot "to_string" this because has illegal path not starting
+    // with `/`.
+    EXPECT_EQ(
+        fixGitURL("github.com:owner/repo.git"),
+        (ParsedURL{
             .scheme = "file",
-            .authority = "",
-            .path = "/none/of//your/business",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
+            .authority = ParsedURL::Authority{},
+            .path = {"github.com:owner", "repo.git"},
+        }));
+}
 
-        ASSERT_EQ(parsed, expected);
+TEST(FixGitURLTestSuite, properlyRejectFileURLWithAuthority)
+{
+    /* From the underlying `parseURL` validations. */
+    EXPECT_THAT(
+        []() { fixGitURL("file://var/repos/x"); },
+        ::testing::ThrowsMessage<BadURL>(
+            testing::HasSubstrIgnoreANSIMatcher("file:// URL 'file://var/repos/x' has unexpected authority 'var'")));
+}
 
-    }
+TEST(FixGitURLTestSuite, scpLikePathLeadingSlashParsesPoorly)
+{
+    // SCP-like URL (no user)
 
-    TEST(parseURL, parsedUrlsIsEqualToItself) {
-        auto s = "http://www.example.org/file.tar.gz";
-        auto url = parseURL(s);
+    // Cannot "to_string" this because has illegal path not starting
+    // with `/`.
+    EXPECT_EQ(
+        fixGitURL("github.com:/owner/repo.git"),
+        (ParsedURL{
+            .scheme = "file",
+            .authority = ParsedURL::Authority{},
+            .path = {"github.com:", "owner", "repo.git"},
+        }));
+}
 
-        ASSERT_TRUE(url == url);
-    }
+TEST(FixGitURLTestSuite, relativePathParsesPoorly)
+{
+    // Relative path (becomes file:// absolute)
 
-    TEST(parseURL, parseFTPUrl) {
-        auto s = "ftp://ftp.nixos.org/downloads/nixos.iso";
-        auto parsed = parseURL(s);
+    // Cannot "to_string" this because has illegal path not starting
+    // with `/`.
+    EXPECT_EQ(
+        fixGitURL("relative/repo"),
+        (ParsedURL{
+            .scheme = "file",
+            .authority =
+                ParsedURL::Authority{
+                    .hostType = ParsedURL::Authority::HostType::Name,
+                    .host = "",
+                },
+            .path = {"relative", "repo"}}));
+}
 
-        ParsedURL expected {
-            .scheme = "ftp",
-            .authority = "ftp.nixos.org",
-            .path = "/downloads/nixos.iso",
-            .query = (StringMap) { },
-            .fragment = "",
-        };
+struct ParseURLSuccessCase
+{
+    std::string_view input;
+    ParsedURL expected;
+};
 
-        ASSERT_EQ(parsed, expected);
-    }
+class ParseURLSuccess : public ::testing::TestWithParam<ParseURLSuccessCase>
+{};
 
-    TEST(parseURL, parsesAnythingInUriFormat) {
-        auto s = "whatever://github.com/NixOS/nixpkgs.git";
-        auto parsed = parseURL(s);
-    }
+INSTANTIATE_TEST_SUITE_P(
+    ParseURLSuccessCases,
+    ParseURLSuccess,
+    ::testing::Values(
+        ParseURLSuccessCase{
+            .input = "http://www.example.org/file.tar.gz",
+            .expected =
+                ParsedURL{
+                    .scheme = "http",
+                    .authority = Authority{.hostType = HostType::Name, .host = "www.example.org"},
+                    .path = {"", "file.tar.gz"},
+                    .query = (StringMap) {},
+                    .fragment = "",
+                },
+        },
+        ParseURLSuccessCase{
+            .input = "https://www.example.org/file.tar.gz",
+            .expected =
+                ParsedURL{
+                    .scheme = "https",
+                    .authority = Authority{.hostType = HostType::Name, .host = "www.example.org"},
+                    .path = {"", "file.tar.gz"},
+                    .query = (StringMap) {},
+                    .fragment = "",
+                },
+        },
+        ParseURLSuccessCase{
+            .input = "https://www.example.org/file.tar.gz?download=fast&when=now#hello",
+            .expected =
+                ParsedURL{
+                    .scheme = "https",
+                    .authority = Authority{.hostType = HostType::Name, .host = "www.example.org"},
+                    .path = {"", "file.tar.gz"},
+                    .query = (StringMap) {{"download", "fast"}, {"when", "now"}},
+                    .fragment = "hello",
+                },
+        },
+        ParseURLSuccessCase{
+            .input = "file+https://www.example.org/video.mp4",
+            .expected =
+                ParsedURL{
+                    .scheme = "file+https",
+                    .authority = Authority{.hostType = HostType::Name, .host = "www.example.org"},
+                    .path = {"", "video.mp4"},
+                    .query = (StringMap) {},
+                    .fragment = "",
+                },
+        },
+        ParseURLSuccessCase{
+            .input = "http://127.0.0.1:8080/file.tar.gz?download=fast&when=now#hello",
+            .expected =
+                ParsedURL{
+                    .scheme = "http",
+                    .authority = Authority{.hostType = HostType::IPv4, .host = "127.0.0.1", .port = 8080},
+                    .path = {"", "file.tar.gz"},
+                    .query = (StringMap) {{"download", "fast"}, {"when", "now"}},
+                    .fragment = "hello",
+                },
+        },
+        ParseURLSuccessCase{
+            .input = "http://[fe80::818c:da4d:8975:415c\%25enp0s25]:8080",
+            .expected =
+                ParsedURL{
+                    .scheme = "http",
+                    .authority =
+                        Authority{
+                            .hostType = HostType::IPv6, .host = "fe80::818c:da4d:8975:415c\%enp0s25", .port = 8080},
+                    .path = {""},
+                    .query = (StringMap) {},
+                    .fragment = "",
+                },
 
-    TEST(parseURL, parsesAnythingInUriFormatWithoutDoubleSlash) {
-        auto s = "whatever:github.com/NixOS/nixpkgs.git";
-        auto parsed = parseURL(s);
-    }
+        },
+        ParseURLSuccessCase{
+            .input = "http://[2a02:8071:8192:c100:311d:192d:81ac:11ea]:8080",
+            .expected =
+                ParsedURL{
+                    .scheme = "http",
+                    .authority =
+                        Authority{
+                            .hostType = HostType::IPv6,
+                            .host = "2a02:8071:8192:c100:311d:192d:81ac:11ea",
+                            .port = 8080,
+                        },
+                    .path = {""},
+                    .query = (StringMap) {},
+                    .fragment = "",
+                },
+        }));
 
-    TEST(parseURL, emptyStringIsInvalidURL) {
-        ASSERT_THROW(parseURL(""), Error);
-    }
+TEST_P(ParseURLSuccess, parsesAsExpected)
+{
+    auto & p = GetParam();
+    const auto parsed = parseURL(p.input);
+    EXPECT_EQ(parsed, p.expected);
+}
 
-    /* ----------------------------------------------------------------------------
-     * decodeQuery
-     * --------------------------------------------------------------------------*/
+TEST_P(ParseURLSuccess, toStringRoundTrips)
+{
+    auto & p = GetParam();
+    const auto parsed = parseURL(p.input);
+    EXPECT_EQ(p.input, parsed.to_string());
+}
 
-    TEST(decodeQuery, emptyStringYieldsEmptyMap) {
-        auto d = decodeQuery("");
-        ASSERT_EQ(d, (StringMap) { });
-    }
+TEST_P(ParseURLSuccess, makeSureFixGitURLDoesNotModify)
+{
+    auto & p = GetParam();
+    const auto parsed = fixGitURL(std::string{p.input});
+    EXPECT_EQ(p.input, parsed.to_string());
+}
 
-    TEST(decodeQuery, simpleDecode) {
-        auto d = decodeQuery("yi=one&er=two");
-        ASSERT_EQ(d, ((StringMap) { { "yi", "one" }, { "er", "two" } }));
-    }
+TEST(parseURL, parsesSimpleHttpUrlWithComplexFragment)
+{
+    auto s = "http://www.example.org/file.tar.gz?field=value#?foo=bar%23";
+    auto parsed = parseURL(s);
 
-    TEST(decodeQuery, decodeUrlEncodedArgs) {
-        auto d = decodeQuery("arg=%3D%3D%40%3D%3D");
-        ASSERT_EQ(d, ((StringMap) { { "arg", "==@==" } }));
-    }
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = Authority{.hostType = HostType::Name, .host = "www.example.org"},
+        .path = {"", "file.tar.gz"},
+        .query = (StringMap) {{"field", "value"}},
+        .fragment = "?foo=bar#",
+    };
 
-    TEST(decodeQuery, decodeArgWithEmptyValue) {
-        auto d = decodeQuery("arg=");
-        ASSERT_EQ(d, ((StringMap) { { "arg", ""} }));
-    }
+    ASSERT_EQ(parsed, expected);
+}
 
-    /* ----------------------------------------------------------------------------
-     * percentDecode
-     * --------------------------------------------------------------------------*/
+TEST(parseURL, rejectsAuthorityInUrlsWithFileTransportation)
+{
+    EXPECT_THAT(
+        []() { parseURL("file://www.example.org/video.mp4"); },
+        ::testing::ThrowsMessage<BadURL>(
+            testing::HasSubstrIgnoreANSIMatcher("has unexpected authority 'www.example.org'")));
+}
 
-    TEST(percentDecode, decodesUrlEncodedString) {
-        std::string s = "==@==";
-        std::string d = percentDecode("%3D%3D%40%3D%3D");
-        ASSERT_EQ(d, s);
-    }
+TEST(parseURL, parseEmptyQueryParams)
+{
+    auto s = "http://127.0.0.1:8080/file.tar.gz?&&&&&";
+    auto parsed = parseURL(s);
+    ASSERT_EQ(parsed.query, (StringMap) {});
+}
 
-    TEST(percentDecode, multipleDecodesAreIdempotent) {
-        std::string once = percentDecode("%3D%3D%40%3D%3D");
-        std::string twice = percentDecode(once);
+TEST(parseURL, parseUserPassword)
+{
+    auto s = "http://user:pass@www.example.org:8080/file.tar.gz";
+    auto parsed = parseURL(s);
 
-        ASSERT_EQ(once, twice);
-    }
+    ParsedURL expected{
+        .scheme = "http",
+        .authority =
+            Authority{
+                .hostType = HostType::Name,
+                .host = "www.example.org",
+                .user = "user",
+                .password = "pass",
+                .port = 8080,
+            },
+        .path = {"", "file.tar.gz"},
+        .query = (StringMap) {},
+        .fragment = "",
+    };
 
-    TEST(percentDecode, trailingPercent) {
-        std::string s = "==@==%";
-        std::string d = percentDecode("%3D%3D%40%3D%3D%25");
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ(s, parsed.to_string());
+}
 
-        ASSERT_EQ(d, s);
-    }
+TEST(parseURL, parseFileURLWithQueryAndFragment)
+{
+    auto s = "file:///none/of//your/business";
+    auto parsed = parseURL(s);
 
+    ParsedURL expected{
+        .scheme = "file",
+        .authority = Authority{},
+        .path = {"", "none", "of", "", "your", "business"},
+        .query = (StringMap) {},
+        .fragment = "",
+    };
 
-    /* ----------------------------------------------------------------------------
-     * percentEncode
-     * --------------------------------------------------------------------------*/
+    ASSERT_EQ(parsed.renderPath(), "/none/of//your/business");
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ(s, parsed.to_string());
+}
 
-    TEST(percentEncode, encodesUrlEncodedString) {
-        std::string s = percentEncode("==@==");
-        std::string d = "%3D%3D%40%3D%3D";
-        ASSERT_EQ(d, s);
-    }
+TEST(parseURL, parseFileURL)
+{
+    auto s = "file:/none/of/your/business/";
+    auto parsed = parseURL(s);
 
-    TEST(percentEncode, keepArgument) {
-        std::string a = percentEncode("abd / def");
-        std::string b = percentEncode("abd / def", "/");
-        ASSERT_EQ(a, "abd%20%2F%20def");
-        ASSERT_EQ(b, "abd%20/%20def");
-    }
+    ParsedURL expected{
+        .scheme = "file",
+        .authority = std::nullopt,
+        .path = {"", "none", "of", "your", "business", ""},
+    };
 
-    TEST(percentEncode, inverseOfDecode) {
-        std::string original = "%3D%3D%40%3D%3D";
-        std::string once = percentEncode(original);
-        std::string back = percentDecode(once);
+    ASSERT_EQ(parsed.renderPath(), "/none/of/your/business/");
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ(s, parsed.to_string());
+}
 
-        ASSERT_EQ(back, original);
-    }
+TEST(parseURL, parseFileURLWithAuthority)
+{
+    auto s = "file://///of/your/business//";
+    auto parsed = parseURL(s);
 
-    TEST(percentEncode, trailingPercent) {
-        std::string s = percentEncode("==@==%");
-        std::string d = "%3D%3D%40%3D%3D%25";
+    ParsedURL expected{
+        .scheme = "file",
+        .authority = Authority{.host = ""},
+        .path = {"", "", "", "of", "your", "business", "", ""},
+    };
 
-        ASSERT_EQ(d, s);
-    }
+    ASSERT_EQ(parsed.path, expected.path);
+    ASSERT_EQ(parsed.renderPath(), "///of/your/business//");
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ(s, parsed.to_string());
+}
 
-    TEST(percentEncode, yen) {
-        // https://en.wikipedia.org/wiki/Percent-encoding#Character_data
-        std::string s = reinterpret_cast<const char*>(u8"円");
-        std::string e = "%E5%86%86";
+TEST(parseURL, parseFileURLNoLeadingSlash)
+{
+    auto s = "file:none/of/your/business/";
+    auto parsed = parseURL(s);
 
-        ASSERT_EQ(percentEncode(s), e);
-        ASSERT_EQ(percentDecode(e), s);
-    }
+    ParsedURL expected{
+        .scheme = "file",
+        .authority = std::nullopt,
+        .path = {"none", "of", "your", "business", ""},
+    };
 
-TEST(nix, isValidSchemeName) {
+    ASSERT_EQ(parsed.renderPath(), "none/of/your/business/");
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ("file:none/of/your/business/", parsed.to_string());
+}
+
+TEST(parseURL, parseHttpTrailingSlash)
+{
+    auto s = "http://example.com/";
+    auto parsed = parseURL(s);
+
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = Authority{.host = "example.com"},
+        .path = {"", ""},
+    };
+
+    ASSERT_EQ(parsed.renderPath(), "/");
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ(s, parsed.to_string());
+}
+
+TEST(parseURL, parsedUrlsIsEqualToItself)
+{
+    auto s = "http://www.example.org/file.tar.gz";
+    auto url = parseURL(s);
+
+    ASSERT_TRUE(url == url);
+}
+
+TEST(parseURL, parsedUrlsWithUnescapedChars)
+{
+    /* Test for back-compat. Behavior is rather questionable, but
+     * is ingrained pretty deep into how URL parsing is shared between
+     * flakes and libstore.
+     * 1. Unescaped spaces, quotes and shevron (^) in fragment.
+     * 2. Unescaped spaces and quotes in query.
+     */
+    auto s = "http://www.example.org/file.tar.gz?query \"= 123\"#shevron^quote\"space ";
+
+    /* Without leniency for back compat, this should throw. */
+    EXPECT_THROW(parseURL(s), Error);
+
+    /* With leniency for back compat, this should parse. */
+    auto url = parseURL(s, /*lenient=*/true);
+
+    EXPECT_EQ(url.fragment, "shevron^quote\"space ");
+
+    auto query = StringMap{
+        {"query \"", " 123\""},
+    };
+
+    EXPECT_EQ(url.query, query);
+}
+
+TEST(parseURL, parseFTPUrl)
+{
+    auto s = "ftp://ftp.nixos.org/downloads/nixos.iso";
+    auto parsed = parseURL(s);
+
+    ParsedURL expected{
+        .scheme = "ftp",
+        .authority = Authority{.hostType = HostType::Name, .host = "ftp.nixos.org"},
+        .path = {"", "downloads", "nixos.iso"},
+        .query = (StringMap) {},
+        .fragment = "",
+    };
+
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ(s, parsed.to_string());
+}
+
+TEST(parseURL, parsesAnythingInUriFormat)
+{
+    auto s = "whatever://github.com/NixOS/nixpkgs.git";
+    auto parsed = parseURL(s);
+    ASSERT_EQ(s, parsed.to_string());
+}
+
+TEST(parseURL, parsesAnythingInUriFormatWithoutDoubleSlash)
+{
+    auto s = "whatever:github.com/NixOS/nixpkgs.git";
+    auto parsed = parseURL(s);
+    ASSERT_EQ(s, parsed.to_string());
+}
+
+TEST(parseURL, emptyStringIsInvalidURL)
+{
+    ASSERT_THROW(parseURL(""), Error);
+}
+
+TEST(parseURL, parsesHttpUrlWithEmptyPort)
+{
+    auto s = "http://www.example.org:/file.tar.gz?foo=bar";
+    auto parsed = parseURL(s);
+
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = Authority{.hostType = HostType::Name, .host = "www.example.org"},
+        .path = {"", "file.tar.gz"},
+        .query = (StringMap) {{"foo", "bar"}},
+        .fragment = "",
+    };
+
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ("http://www.example.org/file.tar.gz?foo=bar", parsed.to_string());
+}
+
+/* ----------------------------------------------------------------------------
+ * parseURLRelative
+ * --------------------------------------------------------------------------*/
+
+TEST(parseURLRelative, resolvesRelativePath)
+{
+    ParsedURL base = parseURL("http://example.org/dir/page.html");
+    auto parsed = parseURLRelative("subdir/file.txt", base);
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "example.org"},
+        .path = {"", "dir", "subdir", "file.txt"},
+        .query = {},
+        .fragment = "",
+    };
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, baseUrlIpv6AddressWithoutZoneId)
+{
+    ParsedURL base = parseURL("http://[fe80::818c:da4d:8975:415c]/dir/page.html");
+    auto parsed = parseURLRelative("subdir/file.txt", base);
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = ParsedURL::Authority{.hostType = HostType::IPv6, .host = "fe80::818c:da4d:8975:415c"},
+        .path = {"", "dir", "subdir", "file.txt"},
+        .query = {},
+        .fragment = "",
+    };
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, resolvesRelativePathIpv6AddressWithZoneId)
+{
+    ParsedURL base = parseURL("http://[fe80::818c:da4d:8975:415c\%25enp0s25]:8080/dir/page.html");
+    auto parsed = parseURLRelative("subdir/file2.txt", base);
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = Authority{.hostType = HostType::IPv6, .host = "fe80::818c:da4d:8975:415c\%enp0s25", .port = 8080},
+        .path = {"", "dir", "subdir", "file2.txt"},
+        .query = {},
+        .fragment = "",
+    };
+
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, resolvesRelativePathWithDot)
+{
+    ParsedURL base = parseURL("http://example.org/dir/page.html");
+    auto parsed = parseURLRelative("./subdir/file.txt", base);
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "example.org"},
+        .path = {"", "dir", "subdir", "file.txt"},
+        .query = {},
+        .fragment = "",
+    };
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, resolvesParentDirectory)
+{
+    ParsedURL base = parseURL("http://example.org:234/dir/page.html");
+    auto parsed = parseURLRelative("../up.txt", base);
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "example.org", .port = 234},
+        .path = {"", "up.txt"},
+        .query = {},
+        .fragment = "",
+    };
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, resolvesParentDirectoryNotTrickedByEscapedSlash)
+{
+    ParsedURL base = parseURL("http://example.org:234/dir\%2Ffirst-trick/another-dir\%2Fsecond-trick/page.html");
+    auto parsed = parseURLRelative("../up.txt", base);
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "example.org", .port = 234},
+        .path = {"", "dir/first-trick", "up.txt"},
+        .query = {},
+        .fragment = "",
+    };
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, replacesPathWithAbsoluteRelative)
+{
+    ParsedURL base = parseURL("http://example.org/dir/page.html");
+    auto parsed = parseURLRelative("/rooted.txt", base);
+    ParsedURL expected{
+        .scheme = "http",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "example.org"},
+        .path = {"", "rooted.txt"},
+        .query = {},
+        .fragment = "",
+    };
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, keepsQueryAndFragmentFromRelative)
+{
+    // But discard query params on base URL
+    ParsedURL base = parseURL("https://www.example.org/path/index.html?z=3");
+    auto parsed = parseURLRelative("other.html?x=1&y=2#frag", base);
+    ParsedURL expected{
+        .scheme = "https",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "www.example.org"},
+        .path = {"", "path", "other.html"},
+        .query = {{"x", "1"}, {"y", "2"}},
+        .fragment = "frag",
+    };
+    ASSERT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, absOverride)
+{
+    ParsedURL base = parseURL("http://example.org/path/page.html");
+    std::string_view abs = "https://127.0.0.1.org/secure";
+    auto parsed = parseURLRelative(abs, base);
+    auto parsedAbs = parseURL(abs);
+    ASSERT_EQ(parsed, parsedAbs);
+}
+
+TEST(parseURLRelative, absOverrideWithZoneId)
+{
+    ParsedURL base = parseURL("http://example.org/path/page.html");
+    std::string_view abs = "https://[fe80::818c:da4d:8975:415c\%25enp0s25]/secure?foo=bar";
+    auto parsed = parseURLRelative(abs, base);
+    auto parsedAbs = parseURL(abs);
+    ASSERT_EQ(parsed, parsedAbs);
+}
+
+TEST(parseURLRelative, bothWithoutAuthority)
+{
+    ParsedURL base = parseURL("mailto:mail-base@bar.baz?bcc=alice@asdf.com");
+    std::string_view over = "mailto:mail-override@foo.bar?subject=url-testing";
+    auto parsed = parseURLRelative(over, base);
+    auto parsedOverride = parseURL(over);
+    ASSERT_EQ(parsed, parsedOverride);
+}
+
+TEST(parseURLRelative, emptyRelative)
+{
+    ParsedURL base = parseURL("https://www.example.org/path/index.html?a\%20b=5\%206&x\%20y=34#frag");
+    auto parsed = parseURLRelative("", base);
+    ParsedURL expected{
+        .scheme = "https",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "www.example.org"},
+        .path = {"", "path", "index.html"},
+        .query = {{"a b", "5 6"}, {"x y", "34"}},
+        .fragment = "",
+    };
+    EXPECT_EQ(base.fragment, "frag");
+    EXPECT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, fragmentRelative)
+{
+    ParsedURL base = parseURL("https://www.example.org/path/index.html?a\%20b=5\%206&x\%20y=34#frag");
+    auto parsed = parseURLRelative("#frag2", base);
+    ParsedURL expected{
+        .scheme = "https",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "www.example.org"},
+        .path = {"", "path", "index.html"},
+        .query = {{"a b", "5 6"}, {"x y", "34"}},
+        .fragment = "frag2",
+    };
+    EXPECT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, queryRelative)
+{
+    ParsedURL base = parseURL("https://www.example.org/path/index.html?a\%20b=5\%206&x\%20y=34#frag");
+    auto parsed = parseURLRelative("?asdf\%20qwer=1\%202\%203", base);
+    ParsedURL expected{
+        .scheme = "https",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "www.example.org"},
+        .path = {"", "path", "index.html"},
+        .query = {{"asdf qwer", "1 2 3"}},
+        .fragment = "",
+    };
+    EXPECT_EQ(parsed, expected);
+}
+
+TEST(parseURLRelative, queryFragmentRelative)
+{
+    ParsedURL base = parseURL("https://www.example.org/path/index.html?a\%20b=5\%206&x\%20y=34#frag");
+    auto parsed = parseURLRelative("?asdf\%20qwer=1\%202\%203#frag2", base);
+    ParsedURL expected{
+        .scheme = "https",
+        .authority = ParsedURL::Authority{.hostType = HostType::Name, .host = "www.example.org"},
+        .path = {"", "path", "index.html"},
+        .query = {{"asdf qwer", "1 2 3"}},
+        .fragment = "frag2",
+    };
+    EXPECT_EQ(parsed, expected);
+}
+
+/* ----------------------------------------------------------------------------
+ * decodeQuery
+ * --------------------------------------------------------------------------*/
+
+TEST(decodeQuery, emptyStringYieldsEmptyMap)
+{
+    auto d = decodeQuery("");
+    ASSERT_EQ(d, (StringMap) {});
+}
+
+TEST(decodeQuery, simpleDecode)
+{
+    auto d = decodeQuery("yi=one&er=two");
+    ASSERT_EQ(d, ((StringMap) {{"yi", "one"}, {"er", "two"}}));
+}
+
+TEST(decodeQuery, decodeUrlEncodedArgs)
+{
+    auto d = decodeQuery("arg=%3D%3D%40%3D%3D");
+    ASSERT_EQ(d, ((StringMap) {{"arg", "==@=="}}));
+}
+
+TEST(decodeQuery, decodeArgWithEmptyValue)
+{
+    auto d = decodeQuery("arg=");
+    ASSERT_EQ(d, ((StringMap) {{"arg", ""}}));
+}
+
+/* ----------------------------------------------------------------------------
+ * percentDecode
+ * --------------------------------------------------------------------------*/
+
+TEST(percentDecode, decodesUrlEncodedString)
+{
+    std::string s = "==@==";
+    std::string d = percentDecode("%3D%3D%40%3D%3D");
+    ASSERT_EQ(d, s);
+}
+
+TEST(percentDecode, multipleDecodesAreIdempotent)
+{
+    std::string once = percentDecode("%3D%3D%40%3D%3D");
+    std::string twice = percentDecode(once);
+
+    ASSERT_EQ(once, twice);
+}
+
+TEST(percentDecode, trailingPercent)
+{
+    std::string s = "==@==%";
+    std::string d = percentDecode("%3D%3D%40%3D%3D%25");
+
+    ASSERT_EQ(d, s);
+}
+
+TEST(percentDecode, incompleteEncoding)
+{
+    ASSERT_THAT(
+        []() { percentDecode("%1"); },
+        ::testing::ThrowsMessage<BadURL>(
+            testing::HasSubstrIgnoreANSIMatcher("error: invalid URI parameter '%1': incomplete pct-encoding")));
+}
+
+/* ----------------------------------------------------------------------------
+ * percentEncode
+ * --------------------------------------------------------------------------*/
+
+TEST(percentEncode, encodesUrlEncodedString)
+{
+    std::string s = percentEncode("==@==");
+    std::string d = "%3D%3D%40%3D%3D";
+    ASSERT_EQ(d, s);
+}
+
+TEST(percentEncode, keepArgument)
+{
+    std::string a = percentEncode("abd / def");
+    std::string b = percentEncode("abd / def", "/");
+    ASSERT_EQ(a, "abd%20%2F%20def");
+    ASSERT_EQ(b, "abd%20/%20def");
+}
+
+TEST(percentEncode, inverseOfDecode)
+{
+    std::string original = "%3D%3D%40%3D%3D";
+    std::string once = percentEncode(original);
+    std::string back = percentDecode(once);
+
+    ASSERT_EQ(back, original);
+}
+
+TEST(percentEncode, trailingPercent)
+{
+    std::string s = percentEncode("==@==%");
+    std::string d = "%3D%3D%40%3D%3D%25";
+
+    ASSERT_EQ(d, s);
+}
+
+TEST(percentEncode, yen)
+{
+    // https://en.wikipedia.org/wiki/Percent-encoding#Character_data
+    std::string s = reinterpret_cast<const char *>(u8"円");
+    std::string e = "%E5%86%86";
+
+    ASSERT_EQ(percentEncode(s), e);
+    ASSERT_EQ(percentDecode(e), s);
+}
+
+TEST(parseURL, gitlabNamespacedProjectUrls)
+{
+    // Test GitLab URL patterns with namespaced projects
+    // These should preserve %2F encoding in the path
+    auto s = "https://gitlab.example.com/api/v4/projects/group%2Fsubgroup%2Fproject/repository/archive.tar.gz";
+    auto parsed = parseURL(s);
+
+    ParsedURL expected{
+        .scheme = "https",
+        .authority = Authority{.hostType = HostType::Name, .host = "gitlab.example.com"},
+        .path = {"", "api", "v4", "projects", "group/subgroup/project", "repository", "archive.tar.gz"},
+        .query = {},
+        .fragment = "",
+    };
+
+    ASSERT_EQ(parsed, expected);
+    ASSERT_EQ(s, parsed.to_string());
+}
+
+/* ----------------------------------------------------------------------------
+ * pathSegments
+ * --------------------------------------------------------------------------*/
+
+struct ParsedURLPathSegmentsTestCase
+{
+    std::string url;
+    std::vector<std::string> segments;
+    std::string path;
+    bool skipEmpty;
+    std::string description;
+};
+
+class ParsedURLPathSegmentsTest : public ::testing::TestWithParam<ParsedURLPathSegmentsTestCase>
+{};
+
+TEST_P(ParsedURLPathSegmentsTest, segmentsAreCorrect)
+{
+    const auto & testCase = GetParam();
+    auto segments = parseURL(testCase.url).pathSegments(/*skipEmpty=*/testCase.skipEmpty)
+                    | std::ranges::to<decltype(testCase.segments)>();
+    EXPECT_EQ(segments, testCase.segments);
+    EXPECT_EQ(encodeUrlPath(segments), testCase.path);
+}
+
+INSTANTIATE_TEST_SUITE_P(
+    ParsedURL,
+    ParsedURLPathSegmentsTest,
+    ::testing::Values(
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme:",
+            .segments = {""},
+            .path = "",
+            .skipEmpty = false,
+            .description = "no_authority_empty_path",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme://",
+            .segments = {""},
+            .path = "",
+            .skipEmpty = false,
+            .description = "empty_authority_empty_path",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme:///",
+            .segments = {"", ""},
+            .path = "/",
+            .skipEmpty = false,
+            .description = "empty_authority_empty_path_trailing",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme://example.com/",
+            .segments = {"", ""},
+            .path = "/",
+            .skipEmpty = false,
+            .description = "non_empty_authority_empty_path",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme://example.com//",
+            .segments = {"", "", ""},
+            .path = "//",
+            .skipEmpty = false,
+            .description = "non_empty_authority_non_empty_path",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme://example.com///path///with//strange/empty///segments////",
+            .segments = {"path", "with", "strange", "empty", "segments"},
+            .path = "path/with/strange/empty/segments",
+            .skipEmpty = true,
+            .description = "skip_all_empty_segments_with_authority",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme://example.com///lots///empty///",
+            .segments = {"", "", "", "lots", "", "", "empty", "", "", ""},
+            .path = "///lots///empty///",
+            .skipEmpty = false,
+            .description = "empty_segments_with_authority",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme:/path///with//strange/empty///segments////",
+            .segments = {"path", "with", "strange", "empty", "segments"},
+            .path = "path/with/strange/empty/segments",
+            .skipEmpty = true,
+            .description = "skip_all_empty_segments_no_authority_starts_with_slash",
+        },
+        ParsedURLPathSegmentsTestCase{
+            .url = "scheme:path///with//strange/empty///segments////",
+            .segments = {"path", "with", "strange", "empty", "segments"},
+            .path = "path/with/strange/empty/segments",
+            .skipEmpty = true,
+            .description = "skip_all_empty_segments_no_authority_doesnt_start_with_slash",
+        }),
+    [](const auto & info) { return info.param.description; });
+
+TEST(nix, isValidSchemeName)
+
+{
     ASSERT_TRUE(isValidSchemeName("http"));
     ASSERT_TRUE(isValidSchemeName("https"));
     ASSERT_TRUE(isValidSchemeName("file"));
@@ -334,4 +962,4 @@ TEST(nix, isValidSchemeName) {
     ASSERT_FALSE(isValidSchemeName("http "));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil-tests/util.cc b/src/libutil-tests/util.cc
index 534731c6c..c48b97e8e 100644
--- a/src/libutil-tests/util.cc
+++ b/src/libutil-tests/util.cc
@@ -3,6 +3,7 @@
 #include "nix/util/file-system.hh"
 #include "nix/util/terminal.hh"
 #include "nix/util/strings.hh"
+#include "nix/util/base-n.hh"
 
 #include <limits.h>
 #include <gtest/gtest.h>
@@ -48,60 +49,6 @@ TEST(hasSuffix, trivialCase)
     ASSERT_TRUE(hasSuffix("foobar", "bar"));
 }
 
-/* ----------------------------------------------------------------------------
- * base64Encode
- * --------------------------------------------------------------------------*/
-
-TEST(base64Encode, emptyString)
-{
-    ASSERT_EQ(base64Encode(""), "");
-}
-
-TEST(base64Encode, encodesAString)
-{
-    ASSERT_EQ(base64Encode("quod erat demonstrandum"), "cXVvZCBlcmF0IGRlbW9uc3RyYW5kdW0=");
-}
-
-TEST(base64Encode, encodeAndDecode)
-{
-    auto s = "quod erat demonstrandum";
-    auto encoded = base64Encode(s);
-    auto decoded = base64Decode(encoded);
-
-    ASSERT_EQ(decoded, s);
-}
-
-TEST(base64Encode, encodeAndDecodeNonPrintable)
-{
-    char s[256];
-    std::iota(std::rbegin(s), std::rend(s), 0);
-
-    auto encoded = base64Encode(s);
-    auto decoded = base64Decode(encoded);
-
-    EXPECT_EQ(decoded.length(), 255u);
-    ASSERT_EQ(decoded, s);
-}
-
-/* ----------------------------------------------------------------------------
- * base64Decode
- * --------------------------------------------------------------------------*/
-
-TEST(base64Decode, emptyString)
-{
-    ASSERT_EQ(base64Decode(""), "");
-}
-
-TEST(base64Decode, decodeAString)
-{
-    ASSERT_EQ(base64Decode("cXVvZCBlcmF0IGRlbW9uc3RyYW5kdW0="), "quod erat demonstrandum");
-}
-
-TEST(base64Decode, decodeThrowsOnInvalidChar)
-{
-    ASSERT_THROW(base64Decode("cXVvZCBlcm_0IGRlbW9uc3RyYW5kdW0="), Error);
-}
-
 /* ----------------------------------------------------------------------------
  * getLine
  * --------------------------------------------------------------------------*/
diff --git a/src/libutil-tests/xml-writer.cc b/src/libutil-tests/xml-writer.cc
index 000af700c..d86baf32b 100644
--- a/src/libutil-tests/xml-writer.cc
+++ b/src/libutil-tests/xml-writer.cc
@@ -4,102 +4,101 @@
 
 namespace nix {
 
-    /* ----------------------------------------------------------------------------
-     * XMLWriter
-     * --------------------------------------------------------------------------*/
+/* ----------------------------------------------------------------------------
+ * XMLWriter
+ * --------------------------------------------------------------------------*/
 
-    TEST(XMLWriter, emptyObject) {
-        std::stringstream out;
-        {
-            XMLWriter t(false, out);
-        }
-
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n");
-    }
-
-    TEST(XMLWriter, objectWithEmptyElement) {
-        std::stringstream out;
-        {
-            XMLWriter t(false, out);
-            t.openElement("foobar");
-        }
-
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar></foobar>");
-    }
-
-    TEST(XMLWriter, objectWithElementWithAttrs) {
-        std::stringstream out;
-        {
-            XMLWriter t(false, out);
-            XMLAttrs attrs = {
-                { "foo", "bar" }
-            };
-            t.openElement("foobar", attrs);
-        }
-
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar foo=\"bar\"></foobar>");
-    }
-
-    TEST(XMLWriter, objectWithElementWithEmptyAttrs) {
-        std::stringstream out;
-        {
-            XMLWriter t(false, out);
-            XMLAttrs attrs = {};
-            t.openElement("foobar", attrs);
-        }
-
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar></foobar>");
-    }
-
-    TEST(XMLWriter, objectWithElementWithAttrsEscaping) {
-        std::stringstream out;
-        {
-            XMLWriter t(false, out);
-            XMLAttrs attrs = {
-                { "<key>", "<value>" }
-            };
-            t.openElement("foobar", attrs);
-        }
-
-        // XXX: While "<value>" is escaped, "<key>" isn't which I think is a bug.
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar <key>=\"&lt;value&gt;\"></foobar>");
-    }
-
-    TEST(XMLWriter, objectWithElementWithAttrsIndented) {
-        std::stringstream out;
-        {
-            XMLWriter t(true, out);
-            XMLAttrs attrs = {
-                { "foo", "bar" }
-            };
-            t.openElement("foobar", attrs);
-        }
-
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar foo=\"bar\">\n</foobar>\n");
-    }
-
-    TEST(XMLWriter, writeEmptyElement) {
-        std::stringstream out;
-        {
-            XMLWriter t(false, out);
-            t.writeEmptyElement("foobar");
-        }
-
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar />");
-    }
-
-    TEST(XMLWriter, writeEmptyElementWithAttributes) {
-        std::stringstream out;
-        {
-            XMLWriter t(false, out);
-            XMLAttrs attrs = {
-                { "foo", "bar" }
-            };
-            t.writeEmptyElement("foobar", attrs);
-
-        }
-
-        ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar foo=\"bar\" />");
+TEST(XMLWriter, emptyObject)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(false, out);
     }
 
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n");
 }
+
+TEST(XMLWriter, objectWithEmptyElement)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(false, out);
+        t.openElement("foobar");
+    }
+
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar></foobar>");
+}
+
+TEST(XMLWriter, objectWithElementWithAttrs)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(false, out);
+        XMLAttrs attrs = {{"foo", "bar"}};
+        t.openElement("foobar", attrs);
+    }
+
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar foo=\"bar\"></foobar>");
+}
+
+TEST(XMLWriter, objectWithElementWithEmptyAttrs)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(false, out);
+        XMLAttrs attrs = {};
+        t.openElement("foobar", attrs);
+    }
+
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar></foobar>");
+}
+
+TEST(XMLWriter, objectWithElementWithAttrsEscaping)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(false, out);
+        XMLAttrs attrs = {{"<key>", "<value>"}};
+        t.openElement("foobar", attrs);
+    }
+
+    // XXX: While "<value>" is escaped, "<key>" isn't which I think is a bug.
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar <key>=\"&lt;value&gt;\"></foobar>");
+}
+
+TEST(XMLWriter, objectWithElementWithAttrsIndented)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(true, out);
+        XMLAttrs attrs = {{"foo", "bar"}};
+        t.openElement("foobar", attrs);
+    }
+
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar foo=\"bar\">\n</foobar>\n");
+}
+
+TEST(XMLWriter, writeEmptyElement)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(false, out);
+        t.writeEmptyElement("foobar");
+    }
+
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar />");
+}
+
+TEST(XMLWriter, writeEmptyElementWithAttributes)
+{
+    std::stringstream out;
+    {
+        XMLWriter t(false, out);
+        XMLAttrs attrs = {{"foo", "bar"}};
+        t.writeEmptyElement("foobar", attrs);
+    }
+
+    ASSERT_EQ(out.str(), "<?xml version='1.0' encoding='utf-8'?>\n<foobar foo=\"bar\" />");
+}
+
+} // namespace nix
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index 9069e4b49..b978ac4db 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -16,12 +16,13 @@ namespace nix {
 
 struct ArchiveSettings : Config
 {
-    Setting<bool> useCaseHack{this,
-        #ifdef __APPLE__
-            true,
-        #else
-            false,
-        #endif
+    Setting<bool> useCaseHack{
+        this,
+#ifdef __APPLE__
+        true,
+#else
+        false,
+#endif
         "use-case-hack",
         "Whether to enable a macOS-specific hack for dealing with file name case collisions."};
 };
@@ -32,18 +33,12 @@ static GlobalConfig::Register rArchiveSettings(&archiveSettings);
 
 PathFilter defaultPathFilter = [](const Path &) { return true; };
 
-
-void SourceAccessor::dumpPath(
-    const CanonPath & path,
-    Sink & sink,
-    PathFilter & filter)
+void SourceAccessor::dumpPath(const CanonPath & path, Sink & sink, PathFilter & filter)
 {
-    auto dumpContents = [&](const CanonPath & path)
-    {
+    auto dumpContents = [&](const CanonPath & path) {
         sink << "contents";
         std::optional<uint64_t> size;
-        readFile(path, sink, [&](uint64_t _size)
-        {
+        readFile(path, sink, [&](uint64_t _size) {
             size = _size;
             sink << _size;
         });
@@ -82,9 +77,8 @@ void SourceAccessor::dumpPath(
                         name.erase(pos);
                     }
                     if (!unhacked.emplace(name, i.first).second)
-                        throw Error("file name collision between '%s' and '%s'",
-                            (path / unhacked[name]),
-                            (path / i.first));
+                        throw Error(
+                            "file name collision between '%s' and '%s'", (path / unhacked[name]), (path / i.first));
                 } else
                     unhacked.emplace(i.first, i.first);
 
@@ -99,7 +93,8 @@ void SourceAccessor::dumpPath(
         else if (st.type == tSymlink)
             sink << "type" << "symlink" << "target" << readLink(path);
 
-        else throw Error("file '%s' has an unsupported type", path);
+        else
+            throw Error("file '%s' has an unsupported type", path);
 
         sink << ")";
     };
@@ -108,7 +103,6 @@ void SourceAccessor::dumpPath(
     dump(path);
 }
 
-
 time_t dumpPathAndGetMtime(const Path & path, Sink & sink, PathFilter & filter)
 {
     auto path2 = PosixSourceAccessor::createAtRoot(path);
@@ -121,20 +115,17 @@ void dumpPath(const Path & path, Sink & sink, PathFilter & filter)
     dumpPathAndGetMtime(path, sink, filter);
 }
 
-
 void dumpString(std::string_view s, Sink & sink)
 {
     sink << narVersionMagic1 << "(" << "type" << "regular" << "contents" << s << ")";
 }
 
-
 template<typename... Args>
-static SerialisationError badArchive(std::string_view s, const Args & ... args)
+static SerialisationError badArchive(std::string_view s, const Args &... args)
 {
     return SerialisationError("bad archive: " + s, args...);
 }
 
-
 static void parseContents(CreateRegularFileSink & sink, Source & source)
 {
     uint64_t size = readLongLong(source);
@@ -147,7 +138,8 @@ static void parseContents(CreateRegularFileSink & sink, Source & source)
     while (left) {
         checkInterrupt();
         auto n = buf.size();
-        if ((uint64_t)n > left) n = left;
+        if ((uint64_t) n > left)
+            n = left;
         source(buf.data(), n);
         sink({buf.data(), n});
         left -= n;
@@ -156,16 +148,14 @@ static void parseContents(CreateRegularFileSink & sink, Source & source)
     readPadding(size, source);
 }
 
-
 struct CaseInsensitiveCompare
 {
-    bool operator() (const std::string & a, const std::string & b) const
+    bool operator()(const std::string & a, const std::string & b) const
     {
         return strcasecmp(a.c_str(), b.c_str()) < 0;
     }
 };
 
-
 static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath & path)
 {
     auto getString = [&]() {
@@ -191,7 +181,8 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
 
             if (tag == "executable") {
                 auto s2 = getString();
-                if (s2 != "") throw badArchive("executable marker has non-empty value");
+                if (s2 != "")
+                    throw badArchive("executable marker has non-empty value");
                 crf.isExecutable();
                 tag = getString();
             }
@@ -213,7 +204,8 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
         while (1) {
             auto tag = getString();
 
-            if (tag == ")") break;
+            if (tag == ")")
+                break;
 
             if (tag != "entry")
                 throw badArchive("expected tag 'entry' or ')', got '%s'", tag);
@@ -223,7 +215,8 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
             expectTag("name");
 
             auto name = getString();
-            if (name.empty() || name == "." || name == ".." || name.find('/') != std::string::npos || name.find((char) 0) != std::string::npos)
+            if (name.empty() || name == "." || name == ".." || name.find('/') != std::string::npos
+                || name.find((char) 0) != std::string::npos)
                 throw badArchive("NAR contains invalid file name '%1%'", name);
             if (name <= prevName)
                 throw badArchive("NAR directory is not sorted");
@@ -236,7 +229,10 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
                     name += std::to_string(++i->second);
                     auto j = names.find(name);
                     if (j != names.end())
-                        throw badArchive("NAR contains file name '%s' that collides with case-hacked file name '%s'", prevName, j->first);
+                        throw badArchive(
+                            "NAR contains file name '%s' that collides with case-hacked file name '%s'",
+                            prevName,
+                            j->first);
                 } else
                     names[name] = 0;
             }
@@ -258,10 +254,10 @@ static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath
         expectTag(")");
     }
 
-    else throw badArchive("unknown file type '%s'", type);
+    else
+        throw badArchive("unknown file type '%s'", type);
 }
 
-
 void parseDump(FileSystemObjectSink & sink, Source & source)
 {
     std::string version;
@@ -276,7 +272,6 @@ void parseDump(FileSystemObjectSink & sink, Source & source)
     parse(sink, source, CanonPath::root);
 }
 
-
 void restorePath(const std::filesystem::path & path, Source & source, bool startFsync)
 {
     RestoreSink sink{startFsync};
@@ -284,7 +279,6 @@ void restorePath(const std::filesystem::path & path, Source & source, bool start
     parseDump(sink, source);
 }
 
-
 void copyNAR(Source & source, Sink & sink)
 {
     // FIXME: if 'source' is the output of dumpPath() followed by EOF,
@@ -292,10 +286,9 @@ void copyNAR(Source & source, Sink & sink)
 
     NullFileSystemObjectSink parseSink; /* just parse the NAR */
 
-    TeeSource wrapper { source, sink };
+    TeeSource wrapper{source, sink};
 
     parseDump(parseSink, wrapper);
 }
 
-
-}
+} // namespace nix
diff --git a/src/libutil/args.cc b/src/libutil/args.cc
index d8d004e6f..f4309473b 100644
--- a/src/libutil/args.cc
+++ b/src/libutil/args.cc
@@ -10,7 +10,7 @@
 #include <string>
 #include <regex>
 #ifndef _WIN32
-# include <glob.h>
+#  include <glob.h>
 #endif
 
 namespace nix {
@@ -24,14 +24,16 @@ void Args::addFlag(Flag && flag_)
     longFlags[flag->longName] = flag;
     for (auto & alias : flag->aliases)
         longFlags[alias] = flag;
-    if (flag->shortName) shortFlags[flag->shortName] = flag;
+    if (flag->shortName)
+        shortFlags[flag->shortName] = flag;
 }
 
 void Args::removeFlag(const std::string & longName)
 {
     auto flag = longFlags.find(longName);
     assert(flag != longFlags.end());
-    if (flag->second->shortName) shortFlags.erase(flag->second->shortName);
+    if (flag->second->shortName)
+        shortFlags.erase(flag->second->shortName);
     longFlags.erase(flag);
 }
 
@@ -51,10 +53,7 @@ void Completions::add(std::string completion, std::string description)
         if (needs_ellipsis)
             description.append(" [...]");
     }
-    completions.insert(Completion {
-        .completion = completion,
-        .description = description
-    });
+    completions.insert(Completion{.completion = completion, .description = description});
 }
 
 auto Completion::operator<=>(const Completion & other) const noexcept = default;
@@ -74,19 +73,23 @@ RootArgs & Args::getRoot()
 
 std::optional<std::string> RootArgs::needsCompletion(std::string_view s)
 {
-    if (!completions) return {};
+    if (!completions)
+        return {};
     auto i = s.find(completionMarker);
     if (i != std::string::npos)
         return std::string(s.begin(), i);
     return {};
 }
 
+namespace {
+
 /**
  * Basically this is `typedef std::optional<Parser> Parser(std::string_view s, Strings & r);`
  *
  * Except we can't recursively reference the Parser typedef, so we have to write a class.
  */
-struct Parser {
+struct Parser
+{
     std::string_view remaining;
 
     /**
@@ -94,12 +97,14 @@ struct Parser {
      */
     virtual void operator()(std::shared_ptr<Parser> & state, Strings & r) = 0;
 
-    Parser(std::string_view s) : remaining(s) {};
+    Parser(std::string_view s)
+        : remaining(s) {};
 
-    virtual ~Parser() { };
+    virtual ~Parser() {};
 };
 
-struct ParseQuoted : public Parser {
+struct ParseQuoted : public Parser
+{
     /**
      * @brief Accumulated string
      *
@@ -107,13 +112,14 @@ struct ParseQuoted : public Parser {
      */
     std::string acc;
 
-    ParseQuoted(std::string_view s) : Parser(s) {};
+    ParseQuoted(std::string_view s)
+        : Parser(s) {};
 
     virtual void operator()(std::shared_ptr<Parser> & state, Strings & r) override;
 };
 
-
-struct ParseUnquoted : public Parser {
+struct ParseUnquoted : public Parser
+{
     /**
      * @brief Accumulated string
      *
@@ -122,9 +128,11 @@ struct ParseUnquoted : public Parser {
      */
     std::string acc;
 
-    ParseUnquoted(std::string_view s) : Parser(s) {};
+    ParseUnquoted(std::string_view s)
+        : Parser(s) {};
 
-    virtual void operator()(std::shared_ptr<Parser> & state, Strings & r) override {
+    virtual void operator()(std::shared_ptr<Parser> & state, Strings & r) override
+    {
         if (remaining.empty()) {
             if (!acc.empty())
                 r.push_back(acc);
@@ -132,111 +140,118 @@ struct ParseUnquoted : public Parser {
             return;
         }
         switch (remaining[0]) {
-            case ' ': case '\t': case '\n': case '\r':
-                if (!acc.empty())
-                    r.push_back(acc);
-                state = std::make_shared<ParseUnquoted>(ParseUnquoted(remaining.substr(1)));
+        case ' ':
+        case '\t':
+        case '\n':
+        case '\r':
+            if (!acc.empty())
+                r.push_back(acc);
+            state = std::make_shared<ParseUnquoted>(ParseUnquoted(remaining.substr(1)));
+            return;
+        case '`':
+            if (remaining.size() > 1 && remaining[1] == '`') {
+                state = std::make_shared<ParseQuoted>(ParseQuoted(remaining.substr(2)));
                 return;
-            case '`':
-                if (remaining.size() > 1 && remaining[1] == '`') {
-                    state = std::make_shared<ParseQuoted>(ParseQuoted(remaining.substr(2)));
-                    return;
-                }
-                else
-                    throw Error("single backtick is not a supported syntax in the nix shebang.");
+            } else
+                throw Error("single backtick is not a supported syntax in the nix shebang.");
 
-            // reserved characters
-            // meaning to be determined, or may be reserved indefinitely so that
-            // #!nix syntax looks unambiguous
-            case '$':
-            case '*':
-            case '~':
-            case '<':
-            case '>':
-            case '|':
-            case ';':
-            case '(':
-            case ')':
-            case '[':
-            case ']':
-            case '{':
-            case '}':
-            case '\'':
-            case '"':
-            case '\\':
-                throw Error("unsupported unquoted character in nix shebang: " + std::string(1, remaining[0]) + ". Use double backticks to escape?");
+        // reserved characters
+        // meaning to be determined, or may be reserved indefinitely so that
+        // #!nix syntax looks unambiguous
+        case '$':
+        case '*':
+        case '~':
+        case '<':
+        case '>':
+        case '|':
+        case ';':
+        case '(':
+        case ')':
+        case '[':
+        case ']':
+        case '{':
+        case '}':
+        case '\'':
+        case '"':
+        case '\\':
+            throw Error(
+                "unsupported unquoted character in nix shebang: " + std::string(1, remaining[0])
+                + ". Use double backticks to escape?");
 
-            case '#':
-                if (acc.empty()) {
-                    throw Error ("unquoted nix shebang argument cannot start with #. Use double backticks to escape?");
-                } else {
-                    acc += remaining[0];
-                    remaining = remaining.substr(1);
-                    return;
-                }
-
-            default:
+        case '#':
+            if (acc.empty()) {
+                throw Error("unquoted nix shebang argument cannot start with #. Use double backticks to escape?");
+            } else {
                 acc += remaining[0];
                 remaining = remaining.substr(1);
                 return;
+            }
+
+        default:
+            acc += remaining[0];
+            remaining = remaining.substr(1);
+            return;
         }
         assert(false);
     }
 };
 
-void ParseQuoted::operator()(std::shared_ptr<Parser> &state, Strings & r) {
+void ParseQuoted::operator()(std::shared_ptr<Parser> & state, Strings & r)
+{
     if (remaining.empty()) {
         throw Error("unterminated quoted string in nix shebang");
     }
     switch (remaining[0]) {
-        case ' ':
-            if ((remaining.size() == 3 && remaining[1] == '`' && remaining[2] == '`')
-                || (remaining.size() > 3 && remaining[1] == '`' && remaining[2] == '`' && remaining[3] != '`')) {
-                // exactly two backticks mark the end of a quoted string, but a preceding space is ignored if present.
-                state = std::make_shared<ParseUnquoted>(ParseUnquoted(remaining.substr(3)));
-                r.push_back(acc);
-                return;
-            }
-            else {
-                // just a normal space
-                acc += remaining[0];
-                remaining = remaining.substr(1);
-                return;
-            }
-        case '`':
-            // exactly two backticks mark the end of a quoted string
-            if ((remaining.size() == 2 && remaining[1] == '`')
-                || (remaining.size() > 2 && remaining[1] == '`' && remaining[2] != '`')) {
-                state = std::make_shared<ParseUnquoted>(ParseUnquoted(remaining.substr(2)));
-                r.push_back(acc);
-                return;
-            }
-
-            // a sequence of at least 3 backticks is one escape-backtick which is ignored, followed by any number of backticks, which are verbatim
-            else if (remaining.size() >= 3 && remaining[1] == '`' && remaining[2] == '`') {
-                // ignore "escape" backtick
-                remaining = remaining.substr(1);
-                // add the rest
-                while (remaining.size() > 0 && remaining[0] == '`') {
-                    acc += '`';
-                    remaining = remaining.substr(1);
-                }
-                return;
-            }
-            else {
-                acc += remaining[0];
-                remaining = remaining.substr(1);
-                return;
-            }
-        default:
+    case ' ':
+        if ((remaining.size() == 3 && remaining[1] == '`' && remaining[2] == '`')
+            || (remaining.size() > 3 && remaining[1] == '`' && remaining[2] == '`' && remaining[3] != '`')) {
+            // exactly two backticks mark the end of a quoted string, but a preceding space is ignored if present.
+            state = std::make_shared<ParseUnquoted>(ParseUnquoted(remaining.substr(3)));
+            r.push_back(acc);
+            return;
+        } else {
+            // just a normal space
             acc += remaining[0];
             remaining = remaining.substr(1);
             return;
+        }
+    case '`':
+        // exactly two backticks mark the end of a quoted string
+        if ((remaining.size() == 2 && remaining[1] == '`')
+            || (remaining.size() > 2 && remaining[1] == '`' && remaining[2] != '`')) {
+            state = std::make_shared<ParseUnquoted>(ParseUnquoted(remaining.substr(2)));
+            r.push_back(acc);
+            return;
+        }
+
+        // a sequence of at least 3 backticks is one escape-backtick which is ignored, followed by any number of
+        // backticks, which are verbatim
+        else if (remaining.size() >= 3 && remaining[1] == '`' && remaining[2] == '`') {
+            // ignore "escape" backtick
+            remaining = remaining.substr(1);
+            // add the rest
+            while (remaining.size() > 0 && remaining[0] == '`') {
+                acc += '`';
+                remaining = remaining.substr(1);
+            }
+            return;
+        } else {
+            acc += remaining[0];
+            remaining = remaining.substr(1);
+            return;
+        }
+    default:
+        acc += remaining[0];
+        remaining = remaining.substr(1);
+        return;
     }
     assert(false);
 }
 
-Strings parseShebangContent(std::string_view s) {
+} // namespace
+
+Strings parseShebangContent(std::string_view s)
+{
     Strings result;
     std::shared_ptr<Parser> parserState(std::make_shared<ParseUnquoted>(ParseUnquoted(s)));
 
@@ -268,22 +283,22 @@ void RootArgs::parseCmdline(const Strings & _cmdline, bool allowShebang)
     // if we have at least one argument, it's the name of an
     // executable file, and it starts with "#!".
     Strings savedArgs;
-    if (allowShebang){
+    if (allowShebang) {
         auto script = *cmdline.begin();
         try {
             std::ifstream stream(script);
-            char shebang[3]={0,0,0};
-            stream.get(shebang,3);
-            if (strncmp(shebang,"#!",2) == 0){
-                for (auto pos = std::next(cmdline.begin()); pos != cmdline.end();pos++)
+            char shebang[3] = {0, 0, 0};
+            stream.get(shebang, 3);
+            if (strncmp(shebang, "#!", 2) == 0) {
+                for (auto pos = std::next(cmdline.begin()); pos != cmdline.end(); pos++)
                     savedArgs.push_back(*pos);
                 cmdline.clear();
 
                 std::string line;
-                std::getline(stream,line);
+                std::getline(stream, line);
                 static const std::string commentChars("#/\\%@*-(");
                 std::string shebangContent;
-                while (std::getline(stream,line) && !line.empty() && commentChars.find(line[0]) != std::string::npos){
+                while (std::getline(stream, line) && !line.empty() && commentChars.find(line[0]) != std::string::npos) {
                     line = chomp(line);
 
                     std::smatch match;
@@ -297,12 +312,13 @@ void RootArgs::parseCmdline(const Strings & _cmdline, bool allowShebang)
                 }
                 cmdline.push_back(script);
                 commandBaseDir = dirOf(script);
-                for (auto pos = savedArgs.begin(); pos != savedArgs.end();pos++)
+                for (auto pos = savedArgs.begin(); pos != savedArgs.end(); pos++)
                     cmdline.push_back(*pos);
             }
-        } catch (SystemError &) { }
+        } catch (SystemError &) {
+        }
     }
-    for (auto pos = cmdline.begin(); pos != cmdline.end(); ) {
+    for (auto pos = cmdline.begin(); pos != cmdline.end();) {
 
         auto arg = *pos;
 
@@ -310,7 +326,8 @@ void RootArgs::parseCmdline(const Strings & _cmdline, bool allowShebang)
            `-j3` -> `-j 3`). */
         if (!dashDash && arg.length() > 2 && arg[0] == '-' && arg[1] != '-' && isalpha(arg[1])) {
             *pos = (std::string) "-" + arg[1];
-            auto next = pos; ++next;
+            auto next = pos;
+            ++next;
             for (unsigned int j = 2; j < arg.length(); j++)
                 if (isalpha(arg[j]))
                     cmdline.insert(next, (std::string) "-" + arg[j]);
@@ -324,12 +341,10 @@ void RootArgs::parseCmdline(const Strings & _cmdline, bool allowShebang)
         if (!dashDash && arg == "--") {
             dashDash = true;
             ++pos;
-        }
-        else if (!dashDash && std::string(arg, 0, 1) == "-") {
+        } else if (!dashDash && std::string(arg, 0, 1) == "-") {
             if (!processFlag(pos, cmdline.end()))
                 throw UsageError("unrecognised flag '%1%'", arg);
-        }
-        else {
+        } else {
             pos = rewriteArgs(cmdline, pos);
             pendingArgs.push_back(*pos++);
             if (processArgs(pendingArgs, false))
@@ -377,12 +392,12 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
 
         std::vector<std::string> args;
         bool anyCompleted = false;
-        for (size_t n = 0 ; n < flag.handler.arity; ++n) {
+        for (size_t n = 0; n < flag.handler.arity; ++n) {
             if (pos == end) {
-                if (flag.handler.arity == ArityAny || anyCompleted) break;
+                if (flag.handler.arity == ArityAny || anyCompleted)
+                    break;
                 throw UsageError(
-                    "flag '%s' requires %d argument(s), but only %d were given",
-                    name, flag.handler.arity, n);
+                    "flag '%s' requires %d argument(s), but only %d were given", name, flag.handler.arity, n);
             }
             if (auto prefix = rootArgs.needsCompletion(*pos)) {
                 anyCompleted = true;
@@ -404,9 +419,7 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
     if (std::string(*pos, 0, 2) == "--") {
         if (auto prefix = rootArgs.needsCompletion(*pos)) {
             for (auto & [name, flag] : longFlags) {
-                if (!hiddenCategories.count(flag->category)
-                    && hasPrefix(name, std::string(*prefix, 2)))
-                {
+                if (!hiddenCategories.count(flag->category) && hasPrefix(name, std::string(*prefix, 2))) {
                     if (auto & f = flag->experimentalFeature)
                         rootArgs.flagExperimentalFeatures.insert(*f);
                     rootArgs.completions->add("--" + name, flag->description);
@@ -415,14 +428,16 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
             return false;
         }
         auto i = longFlags.find(std::string(*pos, 2));
-        if (i == longFlags.end()) return false;
+        if (i == longFlags.end())
+            return false;
         return process("--" + i->first, *i->second);
     }
 
     if (std::string(*pos, 0, 1) == "-" && pos->size() == 2) {
         auto c = (*pos)[1];
         auto i = shortFlags.find(c);
-        if (i == shortFlags.end()) return false;
+        if (i == shortFlags.end())
+            return false;
         return process(std::string("-") + c, *i->second);
     }
 
@@ -452,12 +467,11 @@ bool Args::processArgs(const Strings & args, bool finish)
 
     bool res = false;
 
-    if ((exp.handler.arity == ArityAny && finish) ||
-        (exp.handler.arity != ArityAny && args.size() == exp.handler.arity))
-    {
+    if ((exp.handler.arity == ArityAny && finish)
+        || (exp.handler.arity != ArityAny && args.size() == exp.handler.arity)) {
         std::vector<std::string> ss;
         bool anyCompleted = false;
-        for (const auto &[n, s] : enumerate(args)) {
+        for (const auto & [n, s] : enumerate(args)) {
             if (auto prefix = rootArgs.needsCompletion(s)) {
                 anyCompleted = true;
                 ss.push_back(*prefix);
@@ -479,11 +493,7 @@ bool Args::processArgs(const Strings & args, bool finish)
            except that it will only adjust the next and prev pointers of the list
            elements, meaning the actual contents don't move in memory. This is
            critical to prevent invalidating internal pointers! */
-        processedArgs.splice(
-            processedArgs.end(),
-            expectedArgs,
-            expectedArgs.begin(),
-            ++expectedArgs.begin());
+        processedArgs.splice(processedArgs.end(), expectedArgs, expectedArgs.begin(), ++expectedArgs.begin());
 
         res = true;
     }
@@ -501,7 +511,8 @@ nlohmann::json Args::toJSON()
     for (auto & [name, flag] : longFlags) {
         auto j = nlohmann::json::object();
         j["hiddenCategory"] = hiddenCategories.count(flag->category) > 0;
-        if (flag->aliases.count(name)) continue;
+        if (flag->aliases.count(name))
+            continue;
         if (flag->shortName)
             j["shortName"] = std::string(1, flag->shortName);
         if (flag->description != "")
@@ -531,32 +542,34 @@ nlohmann::json Args::toJSON()
     res["flags"] = std::move(flags);
     res["args"] = std::move(args);
     auto s = doc();
-    if (s != "") res.emplace("doc", stripIndentation(s));
+    if (s != "")
+        res.emplace("doc", stripIndentation(s));
     return res;
 }
 
 static void _completePath(AddCompletions & completions, std::string_view prefix, bool onlyDirs)
 {
     completions.setType(Completions::Type::Filenames);
-    #ifndef _WIN32 // TODO implement globbing completions on Windows
+#ifndef _WIN32 // TODO implement globbing completions on Windows
     glob_t globbuf;
     int flags = GLOB_NOESCAPE;
-    #ifdef GLOB_ONLYDIR
+#  ifdef GLOB_ONLYDIR
     if (onlyDirs)
         flags |= GLOB_ONLYDIR;
-    #endif
+#  endif
     // using expandTilde here instead of GLOB_TILDE(_CHECK) so that ~<Tab> expands to /home/user/
     if (glob((expandTilde(prefix) + "*").c_str(), flags, nullptr, &globbuf) == 0) {
         for (size_t i = 0; i < globbuf.gl_pathc; ++i) {
             if (onlyDirs) {
                 auto st = stat(globbuf.gl_pathv[i]);
-                if (!S_ISDIR(st.st_mode)) continue;
+                if (!S_ISDIR(st.st_mode))
+                    continue;
             }
             completions.add(globbuf.gl_pathv[i]);
         }
     }
     globfree(&globbuf);
-    #endif
+#endif
 }
 
 void Args::completePath(AddCompletions & completions, size_t, std::string_view prefix)
@@ -569,53 +582,56 @@ void Args::completeDir(AddCompletions & completions, size_t, std::string_view pr
     _completePath(completions, prefix, true);
 }
 
-Strings argvToStrings(int argc, char * * argv)
+Strings argvToStrings(int argc, char ** argv)
 {
     Strings args;
-    argc--; argv++;
-    while (argc--) args.push_back(*argv++);
+    argc--;
+    argv++;
+    while (argc--)
+        args.push_back(*argv++);
     return args;
 }
 
-std::optional<ExperimentalFeature> Command::experimentalFeature ()
+std::optional<ExperimentalFeature> Command::experimentalFeature()
 {
-    return { Xp::NixCommand };
+    return {Xp::NixCommand};
 }
 
 MultiCommand::MultiCommand(std::string_view commandName, const Commands & commands_)
     : commands(commands_)
     , commandName(commandName)
 {
-    expectArgs({
-        .label = "subcommand",
-        .optional = true,
-        .handler = {[=,this](std::string s) {
-            assert(!command);
-            auto i = commands.find(s);
-            if (i == commands.end()) {
-                StringSet commandNames;
-                for (auto & [name, _] : commands)
-                    commandNames.insert(name);
-                auto suggestions = Suggestions::bestMatches(commandNames, s);
-                throw UsageError(suggestions, "'%s' is not a recognised command", s);
-            }
-            command = {s, i->second()};
-            command->second->parent = this;
-        }},
-        .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
-            for (auto & [name, command] : commands)
-                if (hasPrefix(name, prefix))
-                    completions.add(name);
-        }}
-    });
+    expectArgs(
+        {.label = "subcommand",
+         .optional = true,
+         .handler = {[=, this](std::string s) {
+             assert(!command);
+             auto i = commands.find(s);
+             if (i == commands.end()) {
+                 StringSet commandNames;
+                 for (auto & [name, _] : commands)
+                     commandNames.insert(name);
+                 auto suggestions = Suggestions::bestMatches(commandNames, s);
+                 throw UsageError(suggestions, "'%s' is not a recognised command", s);
+             }
+             command = {s, i->second()};
+             command->second->parent = this;
+         }},
+         .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
+             for (auto & [name, command] : commands)
+                 if (hasPrefix(name, prefix))
+                     completions.add(name);
+         }}});
 
     categories[Command::catDefault] = "Available commands";
 }
 
 bool MultiCommand::processFlag(Strings::iterator & pos, Strings::iterator end)
 {
-    if (Args::processFlag(pos, end)) return true;
-    if (command && command->second->processFlag(pos, end)) return true;
+    if (Args::processFlag(pos, end))
+        return true;
+    if (command && command->second->processFlag(pos, end))
+        return true;
     return false;
 }
 
@@ -652,14 +668,15 @@ Strings::iterator MultiCommand::rewriteArgs(Strings & args, Strings::iterator po
     if (command)
         return command->second->rewriteArgs(args, pos);
 
-    if (aliasUsed || pos == args.end()) return pos;
+    if (aliasUsed || pos == args.end())
+        return pos;
     auto arg = *pos;
     auto i = aliases.find(arg);
-    if (i == aliases.end()) return pos;
+    if (i == aliases.end())
+        return pos;
     auto & info = i->second;
     if (info.status == AliasStatus::Deprecated) {
-        warn("'%s' is a deprecated alias for '%s'",
-            arg, concatStringsSep(" ", info.replacement));
+        warn("'%s' is a deprecated alias for '%s'", arg, concatStringsSep(" ", info.replacement));
     }
     pos = args.erase(pos);
     for (auto j = info.replacement.rbegin(); j != info.replacement.rend(); ++j)
@@ -668,4 +685,4 @@ Strings::iterator MultiCommand::rewriteArgs(Strings & args, Strings::iterator po
     return pos;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/base-n.cc b/src/libutil/base-n.cc
new file mode 100644
index 000000000..4c9726ad2
--- /dev/null
+++ b/src/libutil/base-n.cc
@@ -0,0 +1,114 @@
+#include <string_view>
+
+#include "nix/util/array-from-string-literal.hh"
+#include "nix/util/util.hh"
+#include "nix/util/base-n.hh"
+
+using namespace std::literals;
+
+namespace nix {
+
+constexpr static const std::array<char, 16> base16Chars = "0123456789abcdef"_arrayNoNull;
+
+std::string base16::encode(std::span<const std::byte> b)
+{
+    std::string buf;
+    buf.reserve(b.size() * 2);
+    for (size_t i = 0; i < b.size(); i++) {
+        buf.push_back(base16Chars[(uint8_t) b.data()[i] >> 4]);
+        buf.push_back(base16Chars[(uint8_t) b.data()[i] & 0x0f]);
+    }
+    return buf;
+}
+
+std::string base16::decode(std::string_view s)
+{
+    auto parseHexDigit = [&](char c) {
+        if (c >= '0' && c <= '9')
+            return c - '0';
+        if (c >= 'A' && c <= 'F')
+            return c - 'A' + 10;
+        if (c >= 'a' && c <= 'f')
+            return c - 'a' + 10;
+        throw FormatError("invalid character in Base16 string: '%c'", c);
+    };
+
+    assert(s.size() % 2 == 0);
+    auto decodedSize = s.size() / 2;
+
+    std::string res;
+    res.reserve(decodedSize);
+
+    for (unsigned int i = 0; i < decodedSize; i++) {
+        res.push_back(parseHexDigit(s[i * 2]) << 4 | parseHexDigit(s[i * 2 + 1]));
+    }
+
+    return res;
+}
+
+constexpr static const std::array<char, 64> base64Chars =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"_arrayNoNull;
+
+std::string base64::encode(std::span<const std::byte> s)
+{
+    std::string res;
+    res.reserve((s.size() + 2) / 3 * 4);
+    int data = 0, nbits = 0;
+
+    for (std::byte c : s) {
+        data = data << 8 | (uint8_t) c;
+        nbits += 8;
+        while (nbits >= 6) {
+            nbits -= 6;
+            res.push_back(base64Chars[data >> nbits & 0x3f]);
+        }
+    }
+
+    if (nbits)
+        res.push_back(base64Chars[data << (6 - nbits) & 0x3f]);
+    while (res.size() % 4)
+        res.push_back('=');
+
+    return res;
+}
+
+std::string base64::decode(std::string_view s)
+{
+    constexpr char npos = -1;
+    constexpr std::array<char, 256> base64DecodeChars = [&] {
+        std::array<char, 256> result{};
+        for (auto & c : result)
+            c = npos;
+        for (int i = 0; i < 64; i++)
+            result[base64Chars[i]] = i;
+        return result;
+    }();
+
+    std::string res;
+    // Some sequences are missing the padding consisting of up to two '='.
+    //                    vvv
+    res.reserve((s.size() + 2) / 4 * 3);
+    unsigned int d = 0, bits = 0;
+
+    for (char c : s) {
+        if (c == '=')
+            break;
+        if (c == '\n')
+            continue;
+
+        char digit = base64DecodeChars[(unsigned char) c];
+        if (digit == npos)
+            throw FormatError("invalid character in Base64 string: '%c'", c);
+
+        bits += 6;
+        d = d << 6 | digit;
+        if (bits >= 8) {
+            res.push_back(d >> (bits - 8) & 0xff);
+            bits -= 8;
+        }
+    }
+
+    return res;
+}
+
+} // namespace nix
diff --git a/src/libutil/base-nix-32.cc b/src/libutil/base-nix-32.cc
new file mode 100644
index 000000000..4f5af462d
--- /dev/null
+++ b/src/libutil/base-nix-32.cc
@@ -0,0 +1,73 @@
+#include <cassert>
+
+#include "nix/util/base-nix-32.hh"
+#include "nix/util/util.hh"
+
+namespace nix {
+
+constexpr const std::array<unsigned char, 256> BaseNix32::reverseMap = [] {
+    std::array<unsigned char, 256> map{};
+
+    for (size_t i = 0; i < map.size(); ++i)
+        map[i] = invalid; // invalid
+
+    for (unsigned char i = 0; i < 32; ++i)
+        map[static_cast<unsigned char>(characters[i])] = i;
+
+    return map;
+}();
+
+std::string BaseNix32::encode(std::span<const std::byte> bs)
+{
+    if (bs.size() == 0)
+        return {};
+
+    size_t len = encodedLength(bs.size());
+    assert(len);
+
+    std::string s;
+    s.reserve(len);
+
+    for (int n = (int) len - 1; n >= 0; n--) {
+        unsigned int b = n * 5;
+        unsigned int i = b / 8;
+        unsigned int j = b % 8;
+        std::byte c = (bs.data()[i] >> j) | (i >= bs.size() - 1 ? std::byte{0} : bs.data()[i + 1] << (8 - j));
+        s.push_back(characters[uint8_t(c & std::byte{0x1f})]);
+    }
+
+    return s;
+}
+
+std::string BaseNix32::decode(std::string_view s)
+{
+    std::string res;
+    res.reserve((s.size() * 5 + 7) / 8); // ceiling(size * 5/8)
+
+    for (unsigned int n = 0; n < s.size(); ++n) {
+        char c = s[s.size() - n - 1];
+        auto digit_opt = BaseNix32::lookupReverse(c);
+
+        if (!digit_opt)
+            throw FormatError("invalid character in Nix32 (Nix's Base32 variation) string: '%c'", c);
+
+        uint8_t digit = *digit_opt;
+
+        unsigned int b = n * 5;
+        unsigned int i = b / 8;
+        unsigned int j = b % 8;
+
+        // Ensure res has enough space
+        res.resize(i + 1);
+        res[i] |= digit << j;
+
+        if (digit >> (8 - j)) {
+            res.resize(i + 2);
+            res[i + 1] |= digit >> (8 - j);
+        }
+    }
+
+    return res;
+}
+
+} // namespace nix
diff --git a/src/libutil/canon-path.cc b/src/libutil/canon-path.cc
index 33ac700f0..07a3a6193 100644
--- a/src/libutil/canon-path.cc
+++ b/src/libutil/canon-path.cc
@@ -9,19 +9,18 @@ CanonPath CanonPath::root = CanonPath("/");
 
 static std::string absPathPure(std::string_view path)
 {
-    return canonPathInner<UnixPathTrait>(path, [](auto &, auto &){});
+    return canonPathInner<UnixPathTrait>(path, [](auto &, auto &) {});
 }
 
 CanonPath::CanonPath(std::string_view raw)
     : path(absPathPure(concatStrings("/", raw)))
-{ }
+{
+}
 
 CanonPath::CanonPath(std::string_view raw, const CanonPath & root)
-    : path(absPathPure(
-        raw.size() > 0 && raw[0] == '/'
-            ? raw
-            : concatStrings(root.abs(), "/", raw)))
-{ }
+    : path(absPathPure(raw.size() > 0 && raw[0] == '/' ? raw : concatStrings(root.abs(), "/", raw)))
+{
+}
 
 CanonPath::CanonPath(const std::vector<std::string> & elems)
     : path("/")
@@ -32,7 +31,8 @@ CanonPath::CanonPath(const std::vector<std::string> & elems)
 
 std::optional<CanonPath> CanonPath::parent() const
 {
-    if (isRoot()) return std::nullopt;
+    if (isRoot())
+        return std::nullopt;
     return CanonPath(unchecked_t(), path.substr(0, std::max((size_t) 1, path.rfind('/'))));
 }
 
@@ -45,30 +45,31 @@ void CanonPath::pop()
 bool CanonPath::isWithin(const CanonPath & parent) const
 {
     return !(
-        path.size() < parent.path.size()
-        || path.substr(0, parent.path.size()) != parent.path
-        || (parent.path.size() > 1 && path.size() > parent.path.size()
-            && path[parent.path.size()] != '/'));
+        path.size() < parent.path.size() || path.substr(0, parent.path.size()) != parent.path
+        || (parent.path.size() > 1 && path.size() > parent.path.size() && path[parent.path.size()] != '/'));
 }
 
 CanonPath CanonPath::removePrefix(const CanonPath & prefix) const
 {
     assert(isWithin(prefix));
-    if (prefix.isRoot()) return *this;
-    if (path.size() == prefix.path.size()) return root;
+    if (prefix.isRoot())
+        return *this;
+    if (path.size() == prefix.path.size())
+        return root;
     return CanonPath(unchecked_t(), path.substr(prefix.path.size()));
 }
 
 void CanonPath::extend(const CanonPath & x)
 {
-    if (x.isRoot()) return;
+    if (x.isRoot())
+        return;
     if (isRoot())
         path += x.rel();
     else
         path += x.abs();
 }
 
-CanonPath CanonPath::operator / (const CanonPath & x) const
+CanonPath CanonPath::operator/(const CanonPath & x) const
 {
     auto res = *this;
     res.extend(x);
@@ -79,11 +80,12 @@ void CanonPath::push(std::string_view c)
 {
     assert(c.find('/') == c.npos);
     assert(c != "." && c != "..");
-    if (!isRoot()) path += '/';
+    if (!isRoot())
+        path += '/';
     path += c;
 }
 
-CanonPath CanonPath::operator / (std::string_view c) const
+CanonPath CanonPath::operator/(std::string_view c) const
 {
     auto res = *this;
     res.push(c);
@@ -111,7 +113,7 @@ bool CanonPath::isAllowed(const std::set<CanonPath> & allowed) const
     return false;
 }
 
-std::ostream & operator << (std::ostream & stream, const CanonPath & path)
+std::ostream & operator<<(std::ostream & stream, const CanonPath & path)
 {
     stream << path.abs();
     return stream;
@@ -122,7 +124,8 @@ std::string CanonPath::makeRelative(const CanonPath & path) const
     auto p1 = begin();
     auto p2 = path.begin();
 
-    for (; p1 != end() && p2 != path.end() && *p1 == *p2; ++p1, ++p2) ;
+    for (; p1 != end() && p2 != path.end() && *p1 == *p2; ++p1, ++p2)
+        ;
 
     if (p1 == end() && p2 == path.end())
         return ".";
@@ -132,15 +135,17 @@ std::string CanonPath::makeRelative(const CanonPath & path) const
         std::string res;
         while (p1 != end()) {
             ++p1;
-            if (!res.empty()) res += '/';
+            if (!res.empty())
+                res += '/';
             res += "..";
         }
         if (p2 != path.end()) {
-            if (!res.empty()) res += '/';
+            if (!res.empty())
+                res += '/';
             res += p2.remaining;
         }
         return res;
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/compression.cc b/src/libutil/compression.cc
index 0e38620d4..36b476e9a 100644
--- a/src/libutil/compression.cc
+++ b/src/libutil/compression.cc
@@ -39,12 +39,15 @@ struct ArchiveDecompressionSource : Source
     std::unique_ptr<TarArchive> archive = 0;
     Source & src;
     std::optional<std::string> compressionMethod;
+
     ArchiveDecompressionSource(Source & src, std::optional<std::string> compressionMethod = std::nullopt)
         : src(src)
         , compressionMethod(std::move(compressionMethod))
     {
     }
+
     ~ArchiveDecompressionSource() override {}
+
     size_t read(char * data, size_t len) override
     {
         struct archive_entry * ae;
@@ -139,16 +142,19 @@ private:
 struct NoneSink : CompressionSink
 {
     Sink & nextSink;
+
     NoneSink(Sink & nextSink, int level = COMPRESSION_LEVEL_DEFAULT)
         : nextSink(nextSink)
     {
         if (level != COMPRESSION_LEVEL_DEFAULT)
             warn("requested compression level '%d' not supported by compression method 'none'", level);
     }
+
     void finish() override
     {
         flush();
     }
+
     void writeUnbuffered(std::string_view data) override
     {
         nextSink(data);
@@ -215,7 +221,7 @@ std::string decompress(const std::string & method, std::string_view in)
 
 std::unique_ptr<FinishSink> makeDecompressionSink(const std::string & method, Sink & nextSink)
 {
-    if (method == "none" || method == "")
+    if (method == "none" || method == "" || method == "identity")
         return std::make_unique<NoneSink>(nextSink);
     else if (method == "br")
         return std::make_unique<BrotliDecompressionSink>(nextSink);
@@ -307,4 +313,4 @@ std::string compress(const std::string & method, std::string_view in, const bool
     return std::move(ssink.s);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/compute-levels.cc b/src/libutil/compute-levels.cc
index dd221bd70..5bd81a893 100644
--- a/src/libutil/compute-levels.cc
+++ b/src/libutil/compute-levels.cc
@@ -11,15 +11,16 @@ namespace nix {
 
 #if HAVE_LIBCPUID
 
-StringSet computeLevels() {
+StringSet computeLevels()
+{
     StringSet levels;
     struct cpu_id_t data;
 
     const std::map<cpu_feature_level_t, std::string> feature_strings = {
-        { FEATURE_LEVEL_X86_64_V1, "x86_64-v1" },
-        { FEATURE_LEVEL_X86_64_V2, "x86_64-v2" },
-        { FEATURE_LEVEL_X86_64_V3, "x86_64-v3" },
-        { FEATURE_LEVEL_X86_64_V4, "x86_64-v4" },
+        {FEATURE_LEVEL_X86_64_V1, "x86_64-v1"},
+        {FEATURE_LEVEL_X86_64_V2, "x86_64-v2"},
+        {FEATURE_LEVEL_X86_64_V3, "x86_64-v3"},
+        {FEATURE_LEVEL_X86_64_V4, "x86_64-v4"},
     };
 
     if (cpu_identify(NULL, &data) < 0)
@@ -34,10 +35,11 @@ StringSet computeLevels() {
 
 #else
 
-StringSet computeLevels() {
+StringSet computeLevels()
+{
     return StringSet{};
 }
 
 #endif // HAVE_LIBCPUID
 
-}
+} // namespace nix
diff --git a/src/libutil/config-global.cc b/src/libutil/config-global.cc
index 94d715443..cd461ea48 100644
--- a/src/libutil/config-global.cc
+++ b/src/libutil/config-global.cc
@@ -15,7 +15,7 @@ bool GlobalConfig::set(const std::string & name, const std::string & value)
     return false;
 }
 
-void GlobalConfig::getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly)
+void GlobalConfig::getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly) const
 {
     for (auto & config : configRegistrations())
         config->getSettings(res, overriddenOnly);
@@ -62,4 +62,4 @@ ExperimentalFeatureSettings experimentalFeatureSettings;
 
 static GlobalConfig::Register rSettings(&experimentalFeatureSettings);
 
-}
+} // namespace nix
diff --git a/src/libutil/configuration.cc b/src/libutil/configuration.cc
index 314ae34db..dc9d91f63 100644
--- a/src/libutil/configuration.cc
+++ b/src/libutil/configuration.cc
@@ -16,7 +16,8 @@ namespace nix {
 
 Config::Config(StringMap initials)
     : AbstractConfig(std::move(initials))
-{ }
+{
+}
 
 bool Config::set(const std::string & name, const std::string & value)
 {
@@ -54,8 +55,7 @@ void Config::addSetting(AbstractSetting * setting)
     for (auto & alias : setting->aliases) {
         if (auto i = unknownSettings.find(alias); i != unknownSettings.end()) {
             if (set)
-                warn("setting '%s' is set, but it's an alias of '%s' which is also set",
-                    alias, setting->name);
+                warn("setting '%s' is set, but it's an alias of '%s' which is also set", alias, setting->name);
             else {
                 setting->set(std::move(i->second));
                 setting->overridden = true;
@@ -68,7 +68,8 @@ void Config::addSetting(AbstractSetting * setting)
 
 AbstractConfig::AbstractConfig(StringMap initials)
     : unknownSettings(std::move(initials))
-{ }
+{
+}
 
 void AbstractConfig::warnUnknownSettings()
 {
@@ -84,24 +85,27 @@ void AbstractConfig::reapplyUnknownSettings()
         set(s.first, s.second);
 }
 
-void Config::getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly)
+void Config::getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly) const
 {
     for (const auto & opt : _settings)
-        if (!opt.second.isAlias
-            && (!overriddenOnly || opt.second.setting->overridden)
+        if (!opt.second.isAlias && (!overriddenOnly || opt.second.setting->overridden)
             && experimentalFeatureSettings.isEnabled(opt.second.setting->experimentalFeature))
             res.emplace(opt.first, SettingInfo{opt.second.setting->to_string(), opt.second.setting->description});
 }
 
-
 /**
- * Parse configuration in `contents`, and also the configuration files included from there, with their location specified relative to `path`.
+ * Parse configuration in `contents`, and also the configuration files included from there, with their location
+ * specified relative to `path`.
  *
  * `contents` and `path` represent the file that is being parsed.
  * The result is only an intermediate list of key-value pairs of strings.
  * More parsing according to the settings-specific semantics is being done by `loadConfFile` in `libstore/globals.cc`.
-*/
-static void parseConfigFiles(const std::string & contents, const std::string & path, std::vector<std::pair<std::string, std::string>> & parsedContents) {
+ */
+static void parseConfigFiles(
+    const std::string & contents,
+    const std::string & path,
+    std::vector<std::pair<std::string, std::string>> & parsedContents)
+{
     unsigned int pos = 0;
 
     while (pos < contents.size()) {
@@ -114,7 +118,8 @@ static void parseConfigFiles(const std::string & contents, const std::string & p
             line = std::string(line, 0, hash);
 
         auto tokens = tokenizeString<std::vector<std::string>>(line);
-        if (tokens.empty()) continue;
+        if (tokens.empty())
+            continue;
 
         if (tokens.size() < 2)
             throw UsageError("syntax error in configuration line '%1%' in '%2%'", line, path);
@@ -160,7 +165,8 @@ static void parseConfigFiles(const std::string & contents, const std::string & p
     };
 }
 
-void AbstractConfig::applyConfig(const std::string & contents, const std::string & path) {
+void AbstractConfig::applyConfig(const std::string & contents, const std::string & path)
+{
     std::vector<std::pair<std::string, std::string>> parsedContents;
 
     parseConfigFiles(contents, path, parsedContents);
@@ -176,8 +182,7 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
     // but at the time of writing it's not worth building that for just one thing
     for (const auto & [name, value] : parsedContents) {
         if (name != "experimental-features" && name != "extra-experimental-features") {
-            if ((name == "nix-path" || name == "extra-nix-path")
-                && getEnv("NIX_PATH").has_value()) {
+            if ((name == "nix-path" || name == "extra-nix-path") && getEnv("NIX_PATH").has_value()) {
                 continue;
             }
             set(name, value);
@@ -253,37 +258,42 @@ std::map<std::string, nlohmann::json> AbstractSetting::toJSONObject() const
     return obj;
 }
 
-void AbstractSetting::convertToArg(Args & args, const std::string & category)
+void AbstractSetting::convertToArg(Args & args, const std::string & category) {}
+
+bool AbstractSetting::isOverridden() const
 {
+    return overridden;
 }
 
-
-bool AbstractSetting::isOverridden() const { return overridden; }
-
-template<> std::string BaseSetting<std::string>::parse(const std::string & str) const
+template<>
+std::string BaseSetting<std::string>::parse(const std::string & str) const
 {
     return str;
 }
 
-template<> std::string BaseSetting<std::string>::to_string() const
+template<>
+std::string BaseSetting<std::string>::to_string() const
 {
     return value;
 }
 
-template<> std::optional<std::string> BaseSetting<std::optional<std::string>>::parse(const std::string & str) const
+template<>
+std::optional<std::string> BaseSetting<std::optional<std::string>>::parse(const std::string & str) const
 {
     if (str == "")
         return std::nullopt;
     else
-        return { str };
+        return {str};
 }
 
-template<> std::string BaseSetting<std::optional<std::string>>::to_string() const
+template<>
+std::string BaseSetting<std::optional<std::string>>::to_string() const
 {
     return value ? *value : "";
 }
 
-template<> bool BaseSetting<bool>::parse(const std::string & str) const
+template<>
+bool BaseSetting<bool>::parse(const std::string & str) const
 {
     if (str == "true" || str == "yes" || str == "1")
         return true;
@@ -293,12 +303,14 @@ template<> bool BaseSetting<bool>::parse(const std::string & str) const
         throw UsageError("Boolean setting '%s' has invalid value '%s'", name, str);
 }
 
-template<> std::string BaseSetting<bool>::to_string() const
+template<>
+std::string BaseSetting<bool>::to_string() const
 {
     return value ? "true" : "false";
 }
 
-template<> void BaseSetting<bool>::convertToArg(Args & args, const std::string & category)
+template<>
+void BaseSetting<bool>::convertToArg(Args & args, const std::string & category)
 {
     args.addFlag({
         .longName = name,
@@ -318,40 +330,48 @@ template<> void BaseSetting<bool>::convertToArg(Args & args, const std::string &
     });
 }
 
-template<> Strings BaseSetting<Strings>::parse(const std::string & str) const
+template<>
+Strings BaseSetting<Strings>::parse(const std::string & str) const
 {
     return tokenizeString<Strings>(str);
 }
 
-template<> void BaseSetting<Strings>::appendOrSet(Strings newValue, bool append)
+template<>
+void BaseSetting<Strings>::appendOrSet(Strings newValue, bool append)
 {
-    if (!append) value.clear();
-    value.insert(value.end(), std::make_move_iterator(newValue.begin()),
-                              std::make_move_iterator(newValue.end()));
+    if (!append)
+        value.clear();
+    value.insert(value.end(), std::make_move_iterator(newValue.begin()), std::make_move_iterator(newValue.end()));
 }
 
-template<> std::string BaseSetting<Strings>::to_string() const
+template<>
+std::string BaseSetting<Strings>::to_string() const
 {
     return concatStringsSep(" ", value);
 }
 
-template<> StringSet BaseSetting<StringSet>::parse(const std::string & str) const
+template<>
+StringSet BaseSetting<StringSet>::parse(const std::string & str) const
 {
     return tokenizeString<StringSet>(str);
 }
 
-template<> void BaseSetting<StringSet>::appendOrSet(StringSet newValue, bool append)
+template<>
+void BaseSetting<StringSet>::appendOrSet(StringSet newValue, bool append)
 {
-    if (!append) value.clear();
+    if (!append)
+        value.clear();
     value.insert(std::make_move_iterator(newValue.begin()), std::make_move_iterator(newValue.end()));
 }
 
-template<> std::string BaseSetting<StringSet>::to_string() const
+template<>
+std::string BaseSetting<StringSet>::to_string() const
 {
     return concatStringsSep(" ", value);
 }
 
-template<> std::set<ExperimentalFeature> BaseSetting<std::set<ExperimentalFeature>>::parse(const std::string & str) const
+template<>
+std::set<ExperimentalFeature> BaseSetting<std::set<ExperimentalFeature>>::parse(const std::string & str) const
 {
     std::set<ExperimentalFeature> res;
     for (auto & s : tokenizeString<StringSet>(str)) {
@@ -365,13 +385,16 @@ template<> std::set<ExperimentalFeature> BaseSetting<std::set<ExperimentalFeatur
     return res;
 }
 
-template<> void BaseSetting<std::set<ExperimentalFeature>>::appendOrSet(std::set<ExperimentalFeature> newValue, bool append)
+template<>
+void BaseSetting<std::set<ExperimentalFeature>>::appendOrSet(std::set<ExperimentalFeature> newValue, bool append)
 {
-    if (!append) value.clear();
+    if (!append)
+        value.clear();
     value.insert(std::make_move_iterator(newValue.begin()), std::make_move_iterator(newValue.end()));
 }
 
-template<> std::string BaseSetting<std::set<ExperimentalFeature>>::to_string() const
+template<>
+std::string BaseSetting<std::set<ExperimentalFeature>>::to_string() const
 {
     StringSet stringifiedXpFeatures;
     for (const auto & feature : value)
@@ -379,7 +402,8 @@ template<> std::string BaseSetting<std::set<ExperimentalFeature>>::to_string() c
     return concatStringsSep(" ", stringifiedXpFeatures);
 }
 
-template<> StringMap BaseSetting<StringMap>::parse(const std::string & str) const
+template<>
+StringMap BaseSetting<StringMap>::parse(const std::string & str) const
 {
     StringMap res;
     for (const auto & s : tokenizeString<Strings>(str)) {
@@ -390,17 +414,23 @@ template<> StringMap BaseSetting<StringMap>::parse(const std::string & str) cons
     return res;
 }
 
-template<> void BaseSetting<StringMap>::appendOrSet(StringMap newValue, bool append)
+template<>
+void BaseSetting<StringMap>::appendOrSet(StringMap newValue, bool append)
 {
-    if (!append) value.clear();
+    if (!append)
+        value.clear();
     value.insert(std::make_move_iterator(newValue.begin()), std::make_move_iterator(newValue.end()));
 }
 
-template<> std::string BaseSetting<StringMap>::to_string() const
+template<>
+std::string BaseSetting<StringMap>::to_string() const
 {
-    return std::transform_reduce(value.cbegin(), value.cend(), std::string{},
-        [](const auto & l, const auto  &r) { return l + " " + r; },
-        [](const auto & kvpair){ return kvpair.first + "=" + kvpair.second; });
+    return std::transform_reduce(
+        value.cbegin(),
+        value.cend(),
+        std::string{},
+        [](const auto & l, const auto & r) { return l + " " + r; },
+        [](const auto & kvpair) { return kvpair.first + "=" + kvpair.second; });
 }
 
 template class BaseSetting<int>;
@@ -424,7 +454,8 @@ static Path parsePath(const AbstractSetting & s, const std::string & str)
         return canonPath(str);
 }
 
-PathSetting::PathSetting(Config * options,
+PathSetting::PathSetting(
+    Config * options,
     const Path & def,
     const std::string & name,
     const std::string & description,
@@ -439,8 +470,8 @@ Path PathSetting::parse(const std::string & str) const
     return parsePath(*this, str);
 }
 
-
-OptionalPathSetting::OptionalPathSetting(Config * options,
+OptionalPathSetting::OptionalPathSetting(
+    Config * options,
     const std::optional<Path> & def,
     const std::string & name,
     const std::string & description,
@@ -450,7 +481,6 @@ OptionalPathSetting::OptionalPathSetting(Config * options,
     options->addSetting(this);
 }
 
-
 std::optional<Path> OptionalPathSetting::parse(const std::string & str) const
 {
     if (str == "")
@@ -459,7 +489,7 @@ std::optional<Path> OptionalPathSetting::parse(const std::string & str) const
         return parsePath(*this, str);
 }
 
-void OptionalPathSetting::operator =(const std::optional<Path> & v)
+void OptionalPathSetting::operator=(const std::optional<Path> & v)
 {
     this->assign(v);
 }
@@ -483,7 +513,8 @@ bool ExperimentalFeatureSettings::isEnabled(const std::optional<ExperimentalFeat
 
 void ExperimentalFeatureSettings::require(const std::optional<ExperimentalFeature> & feature) const
 {
-    if (feature) require(*feature);
+    if (feature)
+        require(*feature);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/current-process.cc b/src/libutil/current-process.cc
index 1afefbcb2..c7d3b78d0 100644
--- a/src/libutil/current-process.cc
+++ b/src/libutil/current-process.cc
@@ -10,28 +10,29 @@
 #include <math.h>
 
 #ifdef __APPLE__
-# include <mach-o/dyld.h>
+#  include <mach-o/dyld.h>
 #endif
 
 #ifdef __linux__
-# include <mutex>
-# include "nix/util/cgroup.hh"
-# include "nix/util/linux-namespaces.hh"
+#  include <mutex>
+#  include "nix/util/cgroup.hh"
+#  include "nix/util/linux-namespaces.hh"
 #endif
 
 #ifdef __FreeBSD__
-# include <sys/param.h>
-# include <sys/sysctl.h>
+#  include <sys/param.h>
+#  include <sys/sysctl.h>
 #endif
 
 namespace nix {
 
 unsigned int getMaxCPU()
 {
-    #ifdef __linux__
+#ifdef __linux__
     try {
         auto cgroupFS = getCgroupFS();
-        if (!cgroupFS) return 0;
+        if (!cgroupFS)
+            return 0;
 
         auto cpuFile = *cgroupFS + "/" + getCurrentCgroup() + "/cpu.max";
 
@@ -45,17 +46,17 @@ unsigned int getMaxCPU()
         auto quota = cpuMaxParts[0];
         auto period = cpuMaxParts[1];
         if (quota != "max")
-                return std::ceil(std::stoi(quota) / std::stof(period));
-    } catch (Error &) { ignoreExceptionInDestructor(lvlDebug); }
-    #endif
+            return std::ceil(std::stoi(quota) / std::stof(period));
+    } catch (Error &) {
+        ignoreExceptionInDestructor(lvlDebug);
+    }
+#endif
 
     return 0;
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-
 #ifndef _WIN32
 size_t savedStackSize = 0;
 
@@ -73,9 +74,8 @@ void setStackSize(size_t stackSize)
                     savedStackSize,
                     stackSize,
                     limit.rlim_max,
-                    std::strerror(errno)
-                ).str()
-            );
+                    std::strerror(errno))
+                    .str());
         }
     }
 }
@@ -83,16 +83,16 @@ void setStackSize(size_t stackSize)
 
 void restoreProcessContext(bool restoreMounts)
 {
-    #ifndef _WIN32
+#ifndef _WIN32
     unix::restoreSignals();
-    #endif
+#endif
     if (restoreMounts) {
-        #ifdef __linux__
+#ifdef __linux__
         restoreMountNamespace();
-        #endif
+#endif
     }
 
-    #ifndef _WIN32
+#ifndef _WIN32
     if (savedStackSize) {
         struct rlimit limit;
         if (getrlimit(RLIMIT_STACK, &limit) == 0) {
@@ -100,27 +100,24 @@ void restoreProcessContext(bool restoreMounts)
             setrlimit(RLIMIT_STACK, &limit);
         }
     }
-    #endif
+#endif
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-
 std::optional<Path> getSelfExe()
 {
-    static auto cached = []() -> std::optional<Path>
-    {
-        #if defined(__linux__) || defined(__GNU__)
+    static auto cached = []() -> std::optional<Path> {
+#if defined(__linux__) || defined(__GNU__)
         return readLink("/proc/self/exe");
-        #elif defined(__APPLE__)
+#elif defined(__APPLE__)
         char buf[1024];
         uint32_t size = sizeof(buf);
         if (_NSGetExecutablePath(buf, &size) == 0)
             return buf;
         else
             return std::nullopt;
-        #elif defined(__FreeBSD__)
+#elif defined(__FreeBSD__)
         int sysctlName[] = {
             CTL_KERN,
             KERN_PROC,
@@ -129,7 +126,7 @@ std::optional<Path> getSelfExe()
         };
         size_t pathLen = 0;
         if (sysctl(sysctlName, sizeof(sysctlName) / sizeof(sysctlName[0]), nullptr, &pathLen, nullptr, 0) < 0) {
-               return std::nullopt;
+            return std::nullopt;
         }
 
         std::vector<char> path(pathLen);
@@ -138,11 +135,11 @@ std::optional<Path> getSelfExe()
         }
 
         return Path(path.begin(), path.end());
-        #else
+#else
         return std::nullopt;
-        #endif
+#endif
     }();
     return cached;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/english.cc b/src/libutil/english.cc
index e697b8c30..421682eee 100644
--- a/src/libutil/english.cc
+++ b/src/libutil/english.cc
@@ -2,11 +2,8 @@
 
 namespace nix {
 
-std::ostream & pluralize(
-    std::ostream & output,
-    unsigned int count,
-    const std::string_view single,
-    const std::string_view plural)
+std::ostream &
+pluralize(std::ostream & output, unsigned int count, const std::string_view single, const std::string_view plural)
 {
     if (count == 1)
         output << "1 " << single;
@@ -15,4 +12,4 @@ std::ostream & pluralize(
     return output;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/environment-variables.cc b/src/libutil/environment-variables.cc
index adae17734..f2f24f7be 100644
--- a/src/libutil/environment-variables.cc
+++ b/src/libutil/environment-variables.cc
@@ -48,4 +48,4 @@ void replaceEnv(const StringMap & newEnv)
         setEnv(newEnvVar.first.c_str(), newEnvVar.second.c_str());
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index 049555ea3..35e42823c 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -6,6 +6,7 @@
 #include "nix/util/terminal.hh"
 #include "nix/util/position.hh"
 
+#include <cinttypes>
 #include <iostream>
 #include <optional>
 #include "nix/util/serialise.hh"
@@ -15,13 +16,14 @@ namespace nix {
 
 void BaseError::addTrace(std::shared_ptr<const Pos> && e, HintFmt hint, TracePrint print)
 {
-    err.traces.push_front(Trace { .pos = std::move(e), .hint = hint, .print = print });
+    err.traces.push_front(Trace{.pos = std::move(e), .hint = hint, .print = print});
 }
 
 void throwExceptionSelfCheck()
 {
     // This is meant to be caught in initLibUtil()
-    throw Error("C++ exception handling is broken. This would appear to be a problem with the way Nix was compiled and/or linked and/or loaded.");
+    throw Error(
+        "C++ exception handling is broken. This would appear to be a problem with the way Nix was compiled and/or linked and/or loaded.");
 }
 
 // c++ std::exception descendants must have a 'const char* what()' function.
@@ -40,7 +42,7 @@ const std::string & BaseError::calcWhat() const
 
 std::optional<std::string> ErrorInfo::programName = std::nullopt;
 
-std::ostream & operator <<(std::ostream & os, const HintFmt & hf)
+std::ostream & operator<<(std::ostream & os, const HintFmt & hf)
 {
     return os << hf.str();
 }
@@ -48,7 +50,7 @@ std::ostream & operator <<(std::ostream & os, const HintFmt & hf)
 /**
  * An arbitrarily defined value comparison for the purpose of using traces in the key of a sorted container.
  */
-inline std::strong_ordering operator<=>(const Trace& lhs, const Trace& rhs)
+inline std::strong_ordering operator<=>(const Trace & lhs, const Trace & rhs)
 {
     // `std::shared_ptr` does not have value semantics for its comparison
     // functions, so we need to check for nulls and compare the dereferenced
@@ -66,27 +68,16 @@ inline std::strong_ordering operator<=>(const Trace& lhs, const Trace& rhs)
 }
 
 // print lines of code to the ostream, indicating the error column.
-void printCodeLines(std::ostream & out,
-    const std::string & prefix,
-    const Pos & errPos,
-    const LinesOfCode & loc)
+void printCodeLines(std::ostream & out, const std::string & prefix, const Pos & errPos, const LinesOfCode & loc)
 {
     // previous line of code.
     if (loc.prevLineOfCode.has_value()) {
-        out << std::endl
-            << fmt("%1% %|2$5d|| %3%",
-            prefix,
-            (errPos.line - 1),
-            *loc.prevLineOfCode);
+        out << std::endl << fmt("%1% %|2$5d|| %3%", prefix, (errPos.line - 1), *loc.prevLineOfCode);
     }
 
     if (loc.errLineOfCode.has_value()) {
         // line of code containing the error.
-        out << std::endl
-            << fmt("%1% %|2$5d|| %3%",
-            prefix,
-            (errPos.line),
-            *loc.errLineOfCode);
+        out << std::endl << fmt("%1% %|2$5d|| %3%", prefix, (errPos.line), *loc.errLineOfCode);
         // error arrows for the column range.
         if (errPos.column > 0) {
             int start = errPos.column;
@@ -97,21 +88,13 @@ void printCodeLines(std::ostream & out,
 
             std::string arrows("^");
 
-            out << std::endl
-                << fmt("%1%      |%2%" ANSI_RED "%3%" ANSI_NORMAL,
-                prefix,
-                spaces,
-                arrows);
+            out << std::endl << fmt("%1%      |%2%" ANSI_RED "%3%" ANSI_NORMAL, prefix, spaces, arrows);
         }
     }
 
     // next line of code.
     if (loc.nextLineOfCode.has_value()) {
-        out << std::endl
-            << fmt("%1% %|2$5d|| %3%",
-            prefix,
-            (errPos.line + 1),
-            *loc.nextLineOfCode);
+        out << std::endl << fmt("%1% %|2$5d|| %3%", prefix, (errPos.line + 1), *loc.nextLineOfCode);
     }
 }
 
@@ -122,10 +105,12 @@ static std::string indent(std::string_view indentFirst, std::string_view indentR
 
     while (!s.empty()) {
         auto end = s.find('\n');
-        if (!first) res += "\n";
+        if (!first)
+            res += "\n";
         res += chomp(std::string(first ? indentFirst : indentRest) + std::string(s.substr(0, end)));
         first = false;
-        if (end == s.npos) break;
+        if (end == s.npos)
+            break;
         s = s.substr(end + 1);
     }
 
@@ -146,7 +131,8 @@ static bool printUnknownLocations = getEnv("_NIX_EVAL_SHOW_UNKNOWN_LOCATIONS").h
  *
  * @return true if a position was printed.
  */
-static bool printPosMaybe(std::ostream & oss, std::string_view indent, const std::shared_ptr<const Pos> & pos) {
+static bool printPosMaybe(std::ostream & oss, std::string_view indent, const std::shared_ptr<const Pos> & pos)
+{
     bool hasPos = pos && *pos;
     if (hasPos) {
         oss << indent << ANSI_BLUE << "at " ANSI_WARNING << *pos << ANSI_NORMAL << ":";
@@ -161,11 +147,7 @@ static bool printPosMaybe(std::ostream & oss, std::string_view indent, const std
     return hasPos;
 }
 
-static void printTrace(
-    std::ostream & output,
-    const std::string_view & indent,
-    size_t & count,
-    const Trace & trace)
+static void printTrace(std::ostream & output, const std::string_view & indent, size_t & count, const Trace & trace)
 {
     output << "\n" << "… " << trace.hint.str() << "\n";
 
@@ -188,7 +170,8 @@ void printSkippedTracesMaybe(
                 printTrace(output, indent, count, trace);
             }
         } else {
-            output << "\n" << ANSI_WARNING "(" << skippedTraces.size() << " duplicate frames omitted)" ANSI_NORMAL << "\n";
+            output << "\n"
+                   << ANSI_WARNING "(" << skippedTraces.size() << " duplicate frames omitted)" ANSI_NORMAL << "\n";
             // Clear the set of "seen" traces after printing a chunk of
             // `duplicate frames omitted`.
             //
@@ -228,43 +211,43 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
 {
     std::string prefix;
     switch (einfo.level) {
-        case Verbosity::lvlError: {
-            prefix = ANSI_RED "error";
-            break;
-        }
-        case Verbosity::lvlNotice: {
-            prefix = ANSI_RED "note";
-            break;
-        }
-        case Verbosity::lvlWarn: {
-            if (einfo.isFromExpr)
-                prefix = ANSI_WARNING "evaluation warning";
-            else
-                prefix = ANSI_WARNING "warning";
-            break;
-        }
-        case Verbosity::lvlInfo: {
-            prefix = ANSI_GREEN "info";
-            break;
-        }
-        case Verbosity::lvlTalkative: {
-            prefix = ANSI_GREEN "talk";
-            break;
-        }
-        case Verbosity::lvlChatty: {
-            prefix = ANSI_GREEN "chat";
-            break;
-        }
-        case Verbosity::lvlVomit: {
-            prefix = ANSI_GREEN "vomit";
-            break;
-        }
-        case Verbosity::lvlDebug: {
-            prefix = ANSI_WARNING "debug";
-            break;
-        }
-        default:
-            assert(false);
+    case Verbosity::lvlError: {
+        prefix = ANSI_RED "error";
+        break;
+    }
+    case Verbosity::lvlNotice: {
+        prefix = ANSI_RED "note";
+        break;
+    }
+    case Verbosity::lvlWarn: {
+        if (einfo.isFromExpr)
+            prefix = ANSI_WARNING "evaluation warning";
+        else
+            prefix = ANSI_WARNING "warning";
+        break;
+    }
+    case Verbosity::lvlInfo: {
+        prefix = ANSI_GREEN "info";
+        break;
+    }
+    case Verbosity::lvlTalkative: {
+        prefix = ANSI_GREEN "talk";
+        break;
+    }
+    case Verbosity::lvlChatty: {
+        prefix = ANSI_GREEN "chat";
+        break;
+    }
+    case Verbosity::lvlVomit: {
+        prefix = ANSI_GREEN "vomit";
+        break;
+    }
+    case Verbosity::lvlDebug: {
+        prefix = ANSI_WARNING "debug";
+        break;
+    }
+    default:
+        assert(false);
     }
 
     // FIXME: show the program name as part of the trace?
@@ -383,7 +366,8 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
         bool truncate = false;
 
         for (const auto & trace : einfo.traces) {
-            if (trace.hint.str().empty()) continue;
+            if (trace.hint.str().empty())
+                continue;
 
             if (!showTrace && count > 3) {
                 truncate = true;
@@ -406,11 +390,13 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
             }
         }
 
-
         printSkippedTracesMaybe(oss, ellipsisIndent, count, skippedTraces, tracesSeen);
 
         if (truncate) {
-            oss << "\n" << ANSI_WARNING "(stack trace truncated; use '--show-trace' to show the full, detailed trace)" ANSI_NORMAL << "\n";
+            oss << "\n"
+                << ANSI_WARNING
+                "(stack trace truncated; use '--show-trace' to show the full, detailed trace)" ANSI_NORMAL
+                << "\n";
         }
 
         oss << "\n" << prefix;
@@ -422,9 +408,7 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
 
     auto suggestions = einfo.suggestions.trim();
     if (!suggestions.suggestions.empty()) {
-        oss << "Did you mean " <<
-            suggestions.trim() <<
-            "?" << std::endl;
+        oss << "Did you mean " << suggestions.trim() << "?" << std::endl;
     }
 
     out << indent(prefix, std::string(filterANSIEscapes(prefix, true).size(), ' '), chomp(oss.str()));
@@ -440,7 +424,8 @@ static void writeErr(std::string_view buf)
     while (!buf.empty()) {
         auto n = write(STDERR_FILENO, buf.data(), buf.size());
         if (n < 0) {
-            if (errno == EINTR) continue;
+            if (errno == EINTR)
+                continue;
             abort();
         }
         buf = buf.substr(n);
@@ -449,19 +434,25 @@ static void writeErr(std::string_view buf)
 
 void panic(std::string_view msg)
 {
-    writeErr("\n\n" ANSI_RED "terminating due to unexpected unrecoverable internal error: " ANSI_NORMAL );
+    writeErr("\n\n" ANSI_RED "terminating due to unexpected unrecoverable internal error: " ANSI_NORMAL);
     writeErr(msg);
     writeErr("\n");
-    abort();
+    std::terminate();
 }
 
-void panic(const char * file, int line, const char * func)
+void unreachable(std::source_location loc)
 {
     char buf[512];
-    int n = snprintf(buf, sizeof(buf), "Unexpected condition in %s at %s:%d", func, file, line);
+    int n = snprintf(
+        buf,
+        sizeof(buf),
+        "Unexpected condition in %s at %s:%" PRIuLEAST32,
+        loc.function_name(),
+        loc.file_name(),
+        loc.line());
     if (n < 0)
         panic("Unexpected condition and could not format error message");
     panic(std::string_view(buf, std::min(static_cast<int>(sizeof(buf)), n)));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/exit.cc b/src/libutil/exit.cc
index 3c59e46af..313368ce4 100644
--- a/src/libutil/exit.cc
+++ b/src/libutil/exit.cc
@@ -4,4 +4,4 @@ namespace nix {
 
 Exit::~Exit() {}
 
-}
+} // namespace nix
diff --git a/src/libutil/experimental-features.cc b/src/libutil/experimental-features.cc
index 88f3783f5..60d6bf74d 100644
--- a/src/libutil/experimental-features.cc
+++ b/src/libutil/experimental-features.cc
@@ -317,7 +317,7 @@ constexpr std::array<ExperimentalFeatureDetails, numXpFeatures> xpFeatureDetails
 static_assert(
     []() constexpr {
         for (auto [index, feature] : enumerate(xpFeatureDetails))
-            if (index != (size_t)feature.tag)
+            if (index != (size_t) feature.tag)
                 return false;
         return true;
     }(),
@@ -342,8 +342,8 @@ const std::optional<ExperimentalFeature> parseExperimentalFeature(const std::str
 
 std::string_view showExperimentalFeature(const ExperimentalFeature tag)
 {
-    assert((size_t)tag < xpFeatureDetails.size());
-    return xpFeatureDetails[(size_t)tag].name;
+    assert((size_t) tag < xpFeatureDetails.size());
+    return xpFeatureDetails[(size_t) tag].name;
 }
 
 nlohmann::json documentExperimentalFeatures()
@@ -352,7 +352,8 @@ nlohmann::json documentExperimentalFeatures()
     for (auto & xpFeature : xpFeatureDetails) {
         std::stringstream docOss;
         docOss << stripIndentation(xpFeature.description);
-        docOss << fmt("\nRefer to [%1% tracking issue](%2%) for feature tracking.", xpFeature.name, xpFeature.trackingUrl);
+        docOss << fmt(
+            "\nRefer to [%1% tracking issue](%2%) for feature tracking.", xpFeature.name, xpFeature.trackingUrl);
         res[std::string{xpFeature.name}] = trim(docOss.str());
     }
     return (nlohmann::json) res;
@@ -368,11 +369,14 @@ std::set<ExperimentalFeature> parseFeatures(const StringSet & rawFeatures)
 }
 
 MissingExperimentalFeature::MissingExperimentalFeature(ExperimentalFeature feature)
-    : Error("experimental Nix feature '%1%' is disabled; add '--extra-experimental-features %1%' to enable it", showExperimentalFeature(feature))
+    : Error(
+          "experimental Nix feature '%1%' is disabled; add '--extra-experimental-features %1%' to enable it",
+          showExperimentalFeature(feature))
     , missingFeature(feature)
-{}
+{
+}
 
-std::ostream & operator <<(std::ostream & str, const ExperimentalFeature & feature)
+std::ostream & operator<<(std::ostream & str, const ExperimentalFeature & feature)
 {
     return str << showExperimentalFeature(feature);
 }
@@ -393,4 +397,4 @@ void from_json(const nlohmann::json & j, ExperimentalFeature & feature)
         throw Error("Unknown experimental feature '%s' in JSON input", input);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/file-content-address.cc b/src/libutil/file-content-address.cc
index d95781691..df1b09f6e 100644
--- a/src/libutil/file-content-address.cc
+++ b/src/libutil/file-content-address.cc
@@ -25,7 +25,6 @@ FileSerialisationMethod parseFileSerialisationMethod(std::string_view input)
         throw UsageError("Unknown file serialiation method '%s', expect `flat` or `nar`", input);
 }
 
-
 FileIngestionMethod parseFileIngestionMethod(std::string_view input)
 {
     if (input == "git") {
@@ -39,7 +38,6 @@ FileIngestionMethod parseFileIngestionMethod(std::string_view input)
     }
 }
 
-
 std::string_view renderFileSerialisationMethod(FileSerialisationMethod method)
 {
     switch (method) {
@@ -52,14 +50,12 @@ std::string_view renderFileSerialisationMethod(FileSerialisationMethod method)
     }
 }
 
-
 std::string_view renderFileIngestionMethod(FileIngestionMethod method)
 {
     switch (method) {
     case FileIngestionMethod::Flat:
     case FileIngestionMethod::NixArchive:
-        return renderFileSerialisationMethod(
-            static_cast<FileSerialisationMethod>(method));
+        return renderFileSerialisationMethod(static_cast<FileSerialisationMethod>(method));
     case FileIngestionMethod::Git:
         return "git";
     default:
@@ -67,12 +63,7 @@ std::string_view renderFileIngestionMethod(FileIngestionMethod method)
     }
 }
 
-
-void dumpPath(
-    const SourcePath & path,
-    Sink & sink,
-    FileSerialisationMethod method,
-    PathFilter & filter)
+void dumpPath(const SourcePath & path, Sink & sink, FileSerialisationMethod method, PathFilter & filter)
 {
     switch (method) {
     case FileSerialisationMethod::Flat:
@@ -84,12 +75,7 @@ void dumpPath(
     }
 }
 
-
-void restorePath(
-    const Path & path,
-    Source & source,
-    FileSerialisationMethod method,
-    bool startFsync)
+void restorePath(const Path & path, Source & source, FileSerialisationMethod method, bool startFsync)
 {
     switch (method) {
     case FileSerialisationMethod::Flat:
@@ -101,28 +87,21 @@ void restorePath(
     }
 }
 
-
-HashResult hashPath(
-    const SourcePath & path,
-    FileSerialisationMethod method, HashAlgorithm ha,
-    PathFilter & filter)
+HashResult hashPath(const SourcePath & path, FileSerialisationMethod method, HashAlgorithm ha, PathFilter & filter)
 {
-    HashSink sink { ha };
+    HashSink sink{ha};
     dumpPath(path, sink, method, filter);
     return sink.finish();
 }
 
-
-std::pair<Hash, std::optional<uint64_t>> hashPath(
-    const SourcePath & path,
-    FileIngestionMethod method, HashAlgorithm ht,
-    PathFilter & filter)
+std::pair<Hash, std::optional<uint64_t>>
+hashPath(const SourcePath & path, FileIngestionMethod method, HashAlgorithm ht, PathFilter & filter)
 {
     switch (method) {
     case FileIngestionMethod::Flat:
     case FileIngestionMethod::NixArchive: {
         auto res = hashPath(path, (FileSerialisationMethod) method, ht, filter);
-        return {res.first, {res.second}};
+        return {res.hash, res.numBytesDigested};
     }
     case FileIngestionMethod::Git:
         return {git::dumpHash(ht, path, filter).hash, std::nullopt};
@@ -130,4 +109,4 @@ std::pair<Hash, std::optional<uint64_t>> hashPath(
     assert(false);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/file-descriptor.cc b/src/libutil/file-descriptor.cc
index 9e0827442..6e07e6e88 100644
--- a/src/libutil/file-descriptor.cc
+++ b/src/libutil/file-descriptor.cc
@@ -4,9 +4,9 @@
 #include <fcntl.h>
 #include <unistd.h>
 #ifdef _WIN32
-# include <winnt.h>
-# include <fileapi.h>
-# include "nix/util/windows-error.hh"
+#  include <winnt.h>
+#  include <fileapi.h>
+#  include "nix/util/windows-error.hh"
 #endif
 
 namespace nix {
@@ -17,7 +17,6 @@ void writeLine(Descriptor fd, std::string s)
     writeFull(fd, s);
 }
 
-
 std::string drainFD(Descriptor fd, bool block, const size_t reserveSize)
 {
     // the parser needs two extra bytes to append terminating characters, other users will
@@ -33,24 +32,27 @@ std::string drainFD(Descriptor fd, bool block, const size_t reserveSize)
     return std::move(sink.s);
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
+AutoCloseFD::AutoCloseFD()
+    : fd{INVALID_DESCRIPTOR}
+{
+}
 
-AutoCloseFD::AutoCloseFD() : fd{INVALID_DESCRIPTOR} {}
-
-
-AutoCloseFD::AutoCloseFD(Descriptor fd) : fd{fd} {}
+AutoCloseFD::AutoCloseFD(Descriptor fd)
+    : fd{fd}
+{
+}
 
 // NOTE: This can be noexcept since we are just copying a value and resetting
 // the file descriptor in the rhs.
-AutoCloseFD::AutoCloseFD(AutoCloseFD && that) noexcept : fd{that.fd}
+AutoCloseFD::AutoCloseFD(AutoCloseFD && that) noexcept
+    : fd{that.fd}
 {
     that.fd = INVALID_DESCRIPTOR;
 }
 
-
-AutoCloseFD & AutoCloseFD::operator =(AutoCloseFD && that)
+AutoCloseFD & AutoCloseFD::operator=(AutoCloseFD && that)
 {
     close();
     fd = that.fd;
@@ -58,7 +60,6 @@ AutoCloseFD & AutoCloseFD::operator =(AutoCloseFD && that)
     return *this;
 }
 
-
 AutoCloseFD::~AutoCloseFD()
 {
     try {
@@ -68,23 +69,21 @@ AutoCloseFD::~AutoCloseFD()
     }
 }
 
-
 Descriptor AutoCloseFD::get() const
 {
     return fd;
 }
 
-
 void AutoCloseFD::close()
 {
     if (fd != INVALID_DESCRIPTOR) {
-        if(
+        if (
 #ifdef _WIN32
-           ::CloseHandle(fd)
+            ::CloseHandle(fd)
 #else
-           ::close(fd)
+            ::close(fd)
 #endif
-           == -1)
+            == -1)
             /* This should never happen. */
             throw NativeSysError("closing file descriptor %1%", fd);
         fd = INVALID_DESCRIPTOR;
@@ -109,25 +108,21 @@ void AutoCloseFD::fsync() const
     }
 }
 
-
-
 void AutoCloseFD::startFsync() const
 {
 #ifdef __linux__
-        if (fd != -1) {
-            /* Ignore failure, since fsync must be run later anyway. This is just a performance optimization. */
-            ::sync_file_range(fd, 0, 0, SYNC_FILE_RANGE_WRITE);
-        }
+    if (fd != -1) {
+        /* Ignore failure, since fsync must be run later anyway. This is just a performance optimization. */
+        ::sync_file_range(fd, 0, 0, SYNC_FILE_RANGE_WRITE);
+    }
 #endif
 }
 
-
 AutoCloseFD::operator bool() const
 {
     return fd != INVALID_DESCRIPTOR;
 }
 
-
 Descriptor AutoCloseFD::release()
 {
     Descriptor oldFD = fd;
@@ -135,14 +130,12 @@ Descriptor AutoCloseFD::release()
     return oldFD;
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-
 void Pipe::close()
 {
     readSide.close();
     writeSide.close();
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 79e6cf354..fba92dc8e 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -24,28 +24,30 @@
 #include <boost/iostreams/device/mapped_file.hpp>
 
 #ifdef __FreeBSD__
-# include <sys/param.h>
-# include <sys/mount.h>
+#  include <sys/param.h>
+#  include <sys/mount.h>
 #endif
 
 #ifdef _WIN32
-# include <io.h>
+#  include <io.h>
 #endif
 
 namespace nix {
 
-DirectoryIterator::DirectoryIterator(const std::filesystem::path& p) {
+DirectoryIterator::DirectoryIterator(const std::filesystem::path & p)
+{
     try {
         // **Attempt to create the underlying directory_iterator**
         it_ = std::filesystem::directory_iterator(p);
-    } catch (const std::filesystem::filesystem_error& e) {
+    } catch (const std::filesystem::filesystem_error & e) {
         // **Catch filesystem_error and throw SysError**
         // Adapt the error message as needed for SysError
         throw SysError("cannot read directory %s", p);
     }
 }
 
-DirectoryIterator& DirectoryIterator::operator++() {
+DirectoryIterator & DirectoryIterator::operator++()
+{
     // **Attempt to increment the underlying iterator**
     std::error_code ec;
     it_.increment(ec);
@@ -64,10 +66,9 @@ DirectoryIterator& DirectoryIterator::operator++() {
 
 bool isAbsolute(PathView path)
 {
-    return std::filesystem::path { path }.is_absolute();
+    return std::filesystem::path{path}.is_absolute();
 }
 
-
 Path absPath(PathView path, std::optional<PathView> dir, bool resolveSymlinks)
 {
     std::string scratch;
@@ -82,7 +83,7 @@ Path absPath(PathView path, std::optional<PathView> dir, bool resolveSymlinks)
 #ifdef __GNU__
             /* GNU (aka. GNU/Hurd) doesn't have any limitation on path
                lengths and doesn't define `PATH_MAX'.  */
-            char *buf = getcwd(NULL, 0);
+            char * buf = getcwd(NULL, 0);
             if (buf == NULL)
 #else
             char buf[PATH_MAX];
@@ -113,7 +114,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
         throw Error("not an absolute path: '%1%'", path);
 
     // For Windows
-    auto rootName = std::filesystem::path { path }.root_name();
+    auto rootName = std::filesystem::path{path}.root_name();
 
     /* This just exists because we cannot set the target of `remaining`
        (the callback parameter) directly to a newly-constructed string,
@@ -125,9 +126,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
     unsigned int followCount = 0, maxFollow = 1024;
 
     auto ret = canonPathInner<OsPathTrait<char>>(
-        path,
-        [&followCount, &temp, maxFollow, resolveSymlinks]
-        (std::string & result, std::string_view & remaining) {
+        path, [&followCount, &temp, maxFollow, resolveSymlinks](std::string & result, std::string_view & remaining) {
             if (resolveSymlinks && std::filesystem::is_symlink(result)) {
                 if (++followCount >= maxFollow)
                     throw Error("infinite symlink recursion in path '%1%'", remaining);
@@ -151,7 +150,6 @@ Path canonPath(PathView path, bool resolveSymlinks)
     return ret;
 }
 
-
 Path dirOf(const PathView path)
 {
     Path::size_type pos = OsPathTrait<char>::rfindPathSep(path);
@@ -160,7 +158,6 @@ Path dirOf(const PathView path)
     return std::filesystem::path{path}.parent_path().string();
 }
 
-
 std::string_view baseNameOf(std::string_view path)
 {
     if (path.empty())
@@ -179,7 +176,6 @@ std::string_view baseNameOf(std::string_view path)
     return path.substr(pos, last - pos + 1);
 }
 
-
 bool isInDir(const std::filesystem::path & path, const std::filesystem::path & dir)
 {
     /* Note that while the standard doesn't guarantee this, the
@@ -190,13 +186,11 @@ bool isInDir(const std::filesystem::path & path, const std::filesystem::path & d
     return !rel.empty() && rel.native()[0] != OS_STR('.');
 }
 
-
 bool isDirOrInDir(const std::filesystem::path & path, const std::filesystem::path & dir)
 {
     return path == dir || isInDir(path, dir);
 }
 
-
 struct stat stat(const Path & path)
 {
     struct stat st;
@@ -206,9 +200,9 @@ struct stat stat(const Path & path)
 }
 
 #ifdef _WIN32
-# define STAT stat
+#  define STAT stat
 #else
-# define STAT lstat
+#  define STAT lstat
 #endif
 
 struct stat lstat(const Path & path)
@@ -219,12 +213,10 @@ struct stat lstat(const Path & path)
     return st;
 }
 
-
 std::optional<struct stat> maybeLstat(const Path & path)
 {
     std::optional<struct stat> st{std::in_place};
-    if (STAT(path.c_str(), &*st))
-    {
+    if (STAT(path.c_str(), &*st)) {
         if (errno == ENOENT || errno == ENOTDIR)
             st.reset();
         else
@@ -233,7 +225,6 @@ std::optional<struct stat> maybeLstat(const Path & path)
     return st;
 }
 
-
 bool pathExists(const std::filesystem::path & path)
 {
     return maybeLstat(path.string()).has_value();
@@ -245,27 +236,28 @@ bool pathAccessible(const std::filesystem::path & path)
         return pathExists(path.string());
     } catch (SysError & e) {
         // swallow EPERM
-        if (e.errNo == EPERM) return false;
+        if (e.errNo == EPERM)
+            return false;
         throw;
     }
 }
 
-
 Path readLink(const Path & path)
 {
     checkInterrupt();
     return std::filesystem::read_symlink(path).string();
 }
 
-
 std::string readFile(const Path & path)
 {
-    AutoCloseFD fd = toDescriptor(open(path.c_str(), O_RDONLY
+    AutoCloseFD fd = toDescriptor(open(
+        path.c_str(),
+        O_RDONLY
 // TODO
 #ifndef _WIN32
-       | O_CLOEXEC
+            | O_CLOEXEC
 #endif
-       ));
+        ));
     if (!fd)
         throw SysError("opening file '%1%'", path);
     return readFile(fd.get());
@@ -273,7 +265,7 @@ std::string readFile(const Path & path)
 
 std::string readFile(const std::filesystem::path & path)
 {
-    return readFile(os_string_to_string(PathViewNG { path }));
+    return readFile(os_string_to_string(PathViewNG{path}));
 }
 
 void readFile(const Path & path, Sink & sink, bool memory_map)
@@ -292,26 +284,30 @@ void readFile(const Path & path, Sink & sink, bool memory_map)
     }
 
     // Stream the file instead if memory-mapping fails or is disabled.
-    AutoCloseFD fd = toDescriptor(open(path.c_str(), O_RDONLY
+    AutoCloseFD fd = toDescriptor(open(
+        path.c_str(),
+        O_RDONLY
 // TODO
 #ifndef _WIN32
-       | O_CLOEXEC
+            | O_CLOEXEC
 #endif
-       ));
+        ));
     if (!fd)
         throw SysError("opening file '%s'", path);
     drainFD(fd.get(), sink);
 }
 
-
 void writeFile(const Path & path, std::string_view s, mode_t mode, FsSync sync)
 {
-    AutoCloseFD fd = toDescriptor(open(path.c_str(), O_WRONLY | O_TRUNC | O_CREAT
+    AutoCloseFD fd = toDescriptor(open(
+        path.c_str(),
+        O_WRONLY | O_TRUNC | O_CREAT
 // TODO
 #ifndef _WIN32
-       | O_CLOEXEC
+            | O_CLOEXEC
 #endif
-       , mode));
+        ,
+        mode));
     if (!fd)
         throw SysError("opening file '%1%'", path);
 
@@ -338,12 +334,15 @@ void writeFile(AutoCloseFD & fd, const Path & origPath, std::string_view s, mode
 
 void writeFile(const Path & path, Source & source, mode_t mode, FsSync sync)
 {
-    AutoCloseFD fd = toDescriptor(open(path.c_str(), O_WRONLY | O_TRUNC | O_CREAT
+    AutoCloseFD fd = toDescriptor(open(
+        path.c_str(),
+        O_WRONLY | O_TRUNC | O_CREAT
 // TODO
 #ifndef _WIN32
-       | O_CLOEXEC
+            | O_CLOEXEC
 #endif
-       , mode));
+        ,
+        mode));
     if (!fd)
         throw SysError("opening file '%1%'", path);
 
@@ -354,7 +353,9 @@ void writeFile(const Path & path, Source & source, mode_t mode, FsSync sync)
             try {
                 auto n = source.read(buf.data(), buf.size());
                 writeFull(fd.get(), {buf.data(), n});
-            } catch (EndOfFile &) { break; }
+            } catch (EndOfFile &) {
+                break;
+            }
         }
     } catch (Error & e) {
         e.addTrace({}, "writing file '%1%'", path);
@@ -377,11 +378,11 @@ void syncParent(const Path & path)
 }
 
 #ifdef __FreeBSD__
-#define MOUNTEDPATHS_PARAM , std::set<Path> &mountedPaths
-#define MOUNTEDPATHS_ARG , mountedPaths
+#  define MOUNTEDPATHS_PARAM , std::set<Path> & mountedPaths
+#  define MOUNTEDPATHS_ARG , mountedPaths
 #else
-#define MOUNTEDPATHS_PARAM
-#define MOUNTEDPATHS_ARG
+#  define MOUNTEDPATHS_PARAM
+#  define MOUNTEDPATHS_ARG
 #endif
 
 void recursiveSync(const Path & path)
@@ -428,27 +429,30 @@ void recursiveSync(const Path & path)
     }
 }
 
-
-static void _deletePath(Descriptor parentfd, const std::filesystem::path & path, uint64_t & bytesFreed, std::exception_ptr & ex MOUNTEDPATHS_PARAM)
+static void _deletePath(
+    Descriptor parentfd,
+    const std::filesystem::path & path,
+    uint64_t & bytesFreed,
+    std::exception_ptr & ex MOUNTEDPATHS_PARAM)
 {
 #ifndef _WIN32
     checkInterrupt();
 
-#ifdef __FreeBSD__
+#  ifdef __FreeBSD__
     // In case of emergency (unmount fails for some reason) not recurse into mountpoints.
     // This prevents us from tearing up the nullfs-mounted nix store.
     if (mountedPaths.find(path) != mountedPaths.end()) {
         return;
     }
-#endif
+#  endif
 
     std::string name(path.filename());
     assert(name != "." && name != ".." && !name.empty());
 
     struct stat st;
-    if (fstatat(parentfd, name.c_str(), &st,
-            AT_SYMLINK_NOFOLLOW) == -1) {
-        if (errno == ENOENT) return;
+    if (fstatat(parentfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) == -1) {
+        if (errno == ENOENT)
+            return;
         throw SysError("getting status of %1%", path);
     }
 
@@ -456,23 +460,23 @@ static void _deletePath(Descriptor parentfd, const std::filesystem::path & path,
         /* We are about to delete a file. Will it likely free space? */
 
         switch (st.st_nlink) {
-            /* Yes: last link. */
-            case 1:
-                bytesFreed += st.st_size;
-                break;
-            /* Maybe: yes, if 'auto-optimise-store' or manual optimisation
-               was performed. Instead of checking for real let's assume
-               it's an optimised file and space will be freed.
+        /* Yes: last link. */
+        case 1:
+            bytesFreed += st.st_size;
+            break;
+        /* Maybe: yes, if 'auto-optimise-store' or manual optimisation
+           was performed. Instead of checking for real let's assume
+           it's an optimised file and space will be freed.
 
-               In worst case we will double count on freed space for files
-               with exactly two hardlinks for unoptimised packages.
-             */
-            case 2:
-                bytesFreed += st.st_size;
-                break;
-            /* No: 3+ links. */
-            default:
-                break;
+           In worst case we will double count on freed space for files
+           with exactly two hardlinks for unoptimised packages.
+         */
+        case 2:
+            bytesFreed += st.st_size;
+            break;
+        /* No: 3+ links. */
+        default:
+            break;
         }
     }
 
@@ -495,15 +499,18 @@ static void _deletePath(Descriptor parentfd, const std::filesystem::path & path,
         while (errno = 0, dirent = readdir(dir.get())) { /* sic */
             checkInterrupt();
             std::string childName = dirent->d_name;
-            if (childName == "." || childName == "..") continue;
+            if (childName == "." || childName == "..")
+                continue;
             _deletePath(dirfd(dir.get()), path / childName, bytesFreed, ex MOUNTEDPATHS_ARG);
         }
-        if (errno) throw SysError("reading directory %1%", path);
+        if (errno)
+            throw SysError("reading directory %1%", path);
     }
 
     int flags = S_ISDIR(st.st_mode) ? AT_REMOVEDIR : 0;
     if (unlinkat(parentfd, name.c_str(), flags) == -1) {
-        if (errno == ENOENT) return;
+        if (errno == ENOENT)
+            return;
         try {
             throw SysError("cannot unlink %1%", path);
         } catch (...) {
@@ -526,7 +533,8 @@ static void _deletePath(const std::filesystem::path & path, uint64_t & bytesFree
 
     AutoCloseFD dirfd = toDescriptor(open(path.parent_path().string().c_str(), O_RDONLY));
     if (!dirfd) {
-        if (errno == ENOENT) return;
+        if (errno == ENOENT)
+            return;
         throw SysError("opening directory %s", path.parent_path());
     }
 
@@ -538,7 +546,6 @@ static void _deletePath(const std::filesystem::path & path, uint64_t & bytesFree
         std::rethrow_exception(ex);
 }
 
-
 void deletePath(const std::filesystem::path & path)
 {
     uint64_t dummy;
@@ -547,30 +554,32 @@ void deletePath(const std::filesystem::path & path)
 
 void createDir(const Path & path, mode_t mode)
 {
-    if (mkdir(path.c_str()
+    if (mkdir(
+            path.c_str()
 #ifndef _WIN32
-                , mode
+                ,
+            mode
 #endif
-                ) == -1)
+            )
+        == -1)
         throw SysError("creating directory '%1%'", path);
 }
 
 void createDirs(const std::filesystem::path & path)
 {
     try {
-       std::filesystem::create_directories(path);
+        std::filesystem::create_directories(path);
     } catch (std::filesystem::filesystem_error & e) {
         throw SysError("creating directory '%1%'", path.string());
     }
 }
 
-
 void deletePath(const std::filesystem::path & path, uint64_t & bytesFreed)
 {
-    //Activity act(*logger, lvlDebug, "recursively deleting path '%1%'", path);
+    // Activity act(*logger, lvlDebug, "recursively deleting path '%1%'", path);
 #ifdef __FreeBSD__
     std::set<Path> mountedPaths;
-    struct statfs *mntbuf;
+    struct statfs * mntbuf;
     int count;
     if ((count = getmntinfo(&mntbuf, MNT_WAIT)) < 0) {
         throw SysError("getmntinfo");
@@ -584,12 +593,15 @@ void deletePath(const std::filesystem::path & path, uint64_t & bytesFreed)
     _deletePath(path, bytesFreed MOUNTEDPATHS_ARG);
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-AutoDelete::AutoDelete() : del{false} {}
+AutoDelete::AutoDelete()
+    : del{false}
+{
+}
 
-AutoDelete::AutoDelete(const std::filesystem::path & p, bool recursive) : _path(p)
+AutoDelete::AutoDelete(const std::filesystem::path & p, bool recursive)
+    : _path(p)
 {
     del = true;
     this->recursive = recursive;
@@ -615,7 +627,8 @@ void AutoDelete::cancel()
     del = false;
 }
 
-void AutoDelete::reset(const std::filesystem::path & p, bool recursive) {
+void AutoDelete::reset(const std::filesystem::path & p, bool recursive)
+{
     _path = p;
     this->recursive = recursive;
     del = true;
@@ -624,9 +637,16 @@ void AutoDelete::reset(const std::filesystem::path & p, bool recursive) {
 //////////////////////////////////////////////////////////////////////
 
 #ifdef __FreeBSD__
-AutoUnmount::AutoUnmount() : del{false} {}
+AutoUnmount::AutoUnmount()
+    : del{false}
+{
+}
 
-AutoUnmount::AutoUnmount(Path &p) : path(p), del(true) {}
+AutoUnmount::AutoUnmount(Path & p)
+    : path(p)
+    , del(true)
+{
+}
 
 AutoUnmount::~AutoUnmount()
 {
@@ -649,7 +669,8 @@ void AutoUnmount::cancel()
 
 //////////////////////////////////////////////////////////////////////
 
-std::string defaultTempDir() {
+std::string defaultTempDir()
+{
     return getEnvNonEmpty("TMPDIR").value_or("/tmp");
 }
 
@@ -658,11 +679,14 @@ Path createTempDir(const Path & tmpRoot, const Path & prefix, mode_t mode)
     while (1) {
         checkInterrupt();
         Path tmpDir = makeTempPath(tmpRoot, prefix);
-        if (mkdir(tmpDir.c_str()
+        if (mkdir(
+                tmpDir.c_str()
 #ifndef _WIN32 // TODO abstract mkdir perms for Windows
-                    , mode
+                    ,
+                mode
 #endif
-                    ) == 0) {
+                )
+            == 0) {
 #ifdef __FreeBSD__
             /* Explicitly set the group of the directory.  This is to
                work around around problems caused by BSD's group
@@ -682,7 +706,6 @@ Path createTempDir(const Path & tmpRoot, const Path & prefix, mode_t mode)
     }
 }
 
-
 std::pair<AutoCloseFD, Path> createTempFile(const Path & prefix)
 {
     Path tmpl(defaultTempDir() + "/" + prefix + ".XXXXXX");
@@ -717,24 +740,25 @@ void createSymlink(const Path & target, const Path & link)
 void replaceSymlink(const std::filesystem::path & target, const std::filesystem::path & link)
 {
     for (unsigned int n = 0; true; n++) {
-        auto tmp = link.parent_path() /std::filesystem::path{fmt(".%d_%s", n, link.filename().string())};
+        auto tmp = link.parent_path() / std::filesystem::path{fmt(".%d_%s", n, link.filename().string())};
         tmp = tmp.lexically_normal();
 
         try {
             std::filesystem::create_symlink(target, tmp);
         } catch (std::filesystem::filesystem_error & e) {
-            if (e.code() == std::errc::file_exists) continue;
+            if (e.code() == std::errc::file_exists)
+                continue;
             throw SysError("creating symlink %1% -> %2%", tmp, target);
         }
 
         try {
             std::filesystem::rename(tmp, link);
         } catch (std::filesystem::filesystem_error & e) {
-            if (e.code() == std::errc::file_exists) continue;
+            if (e.code() == std::errc::file_exists)
+                continue;
             throw SysError("renaming %1% to %2%", tmp, link);
         }
 
-
         break;
     }
 }
@@ -746,15 +770,19 @@ void setWriteTime(const std::filesystem::path & path, const struct stat & st)
 
 void copyFile(const std::filesystem::path & from, const std::filesystem::path & to, bool andDelete)
 {
-    auto fromStatus =std::filesystem::symlink_status(from);
+    auto fromStatus = std::filesystem::symlink_status(from);
 
     // Mark the directory as writable so that we can delete its children
-    if (andDelete &&std::filesystem::is_directory(fromStatus)) {
-        std::filesystem::permissions(from, std::filesystem::perms::owner_write, std::filesystem::perm_options::add | std::filesystem::perm_options::nofollow);
+    if (andDelete && std::filesystem::is_directory(fromStatus)) {
+        std::filesystem::permissions(
+            from,
+            std::filesystem::perms::owner_write,
+            std::filesystem::perm_options::add | std::filesystem::perm_options::nofollow);
     }
 
-    if (std::filesystem::is_symlink(fromStatus) ||std::filesystem::is_regular_file(fromStatus)) {
-        std::filesystem::copy(from, to, std::filesystem::copy_options::copy_symlinks | std::filesystem::copy_options::overwrite_existing);
+    if (std::filesystem::is_symlink(fromStatus) || std::filesystem::is_regular_file(fromStatus)) {
+        std::filesystem::copy(
+            from, to, std::filesystem::copy_options::copy_symlinks | std::filesystem::copy_options::overwrite_existing);
     } else if (std::filesystem::is_directory(fromStatus)) {
         std::filesystem::create_directory(to);
         for (auto & entry : DirectoryIterator(from)) {
@@ -767,7 +795,10 @@ void copyFile(const std::filesystem::path & from, const std::filesystem::path &
     setWriteTime(to, lstat(from.string().c_str()));
     if (andDelete) {
         if (!std::filesystem::is_symlink(fromStatus))
-            std::filesystem::permissions(from, std::filesystem::perms::owner_write, std::filesystem::perm_options::add | std::filesystem::perm_options::nofollow);
+            std::filesystem::permissions(
+                from,
+                std::filesystem::perms::owner_write,
+                std::filesystem::perm_options::add | std::filesystem::perm_options::nofollow);
         std::filesystem::remove(from);
     }
 }
@@ -781,9 +812,8 @@ void moveFile(const Path & oldName, const Path & newName)
         auto newPath = std::filesystem::path(newName);
         // For the move to be as atomic as possible, copy to a temporary
         // directory
-        std::filesystem::path temp = createTempDir(
-            os_string_to_string(PathViewNG { newPath.parent_path() }),
-            "rename-tmp");
+        std::filesystem::path temp =
+            createTempDir(os_string_to_string(PathViewNG{newPath.parent_path()}), "rename-tmp");
         Finally removeTemp = [&]() { std::filesystem::remove(temp); };
         auto tempCopyTarget = temp / "copy-target";
         if (e.code().value() == EXDEV) {
@@ -791,31 +821,34 @@ void moveFile(const Path & oldName, const Path & newName)
             warn("can’t rename %s as %s, copying instead", oldName, newName);
             copyFile(oldPath, tempCopyTarget, true);
             std::filesystem::rename(
-                os_string_to_string(PathViewNG { tempCopyTarget }),
-                os_string_to_string(PathViewNG { newPath }));
+                os_string_to_string(PathViewNG{tempCopyTarget}), os_string_to_string(PathViewNG{newPath}));
         }
     }
 }
 
 //////////////////////////////////////////////////////////////////////
 
-bool isExecutableFileAmbient(const std::filesystem::path & exe) {
+bool isExecutableFileAmbient(const std::filesystem::path & exe)
+{
     // Check file type, because directory being executable means
     // something completely different.
     // `is_regular_file` follows symlinks before checking.
     return std::filesystem::is_regular_file(exe)
-        && access(exe.string().c_str(),
+           && access(
+                  exe.string().c_str(),
 #ifdef WIN32
-        0 // TODO do better
+                  0 // TODO do better
 #else
-        X_OK
+                  X_OK
 #endif
-        ) == 0;
+                  )
+                  == 0;
 }
 
 std::filesystem::path makeParentCanonical(const std::filesystem::path & rawPath)
 {
-    std::filesystem::path path(absPath(rawPath));;
+    std::filesystem::path path(absPath(rawPath));
+    ;
     try {
         auto parent = path.parent_path();
         if (parent == path) {
diff --git a/src/libutil/freebsd/freebsd-jail.cc b/src/libutil/freebsd/freebsd-jail.cc
index 575f9287e..90fbe0cd6 100644
--- a/src/libutil/freebsd/freebsd-jail.cc
+++ b/src/libutil/freebsd/freebsd-jail.cc
@@ -48,5 +48,5 @@ void AutoRemoveJail::reset(int j)
 
 //////////////////////////////////////////////////////////////////////
 
-}
+} // namespace nix
 #endif
diff --git a/src/libutil/freebsd/include/nix/util/freebsd-jail.hh b/src/libutil/freebsd/include/nix/util/freebsd-jail.hh
index cb5abc511..33a86a398 100644
--- a/src/libutil/freebsd/include/nix/util/freebsd-jail.hh
+++ b/src/libutil/freebsd/include/nix/util/freebsd-jail.hh
@@ -17,4 +17,4 @@ public:
     void reset(int j);
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/freebsd/include/nix/util/meson.build b/src/libutil/freebsd/include/nix/util/meson.build
index 4b7d78624..561c8796c 100644
--- a/src/libutil/freebsd/include/nix/util/meson.build
+++ b/src/libutil/freebsd/include/nix/util/meson.build
@@ -4,5 +4,4 @@ include_dirs += include_directories('../..')
 
 headers += files(
   'freebsd-jail.hh',
-  # hack for trailing newline
 )
diff --git a/src/libutil/freebsd/meson.build b/src/libutil/freebsd/meson.build
index d9b91a03d..8ffdc2832 100644
--- a/src/libutil/freebsd/meson.build
+++ b/src/libutil/freebsd/meson.build
@@ -1,6 +1,5 @@
 sources += files(
   'freebsd-jail.cc',
-  # hack for trailing newline
 )
 
 subdir('include/nix/util')
diff --git a/src/libutil/fs-sink.cc b/src/libutil/fs-sink.cc
index 7b8fc3b2a..6efd5e0c7 100644
--- a/src/libutil/fs-sink.cc
+++ b/src/libutil/fs-sink.cc
@@ -5,47 +5,38 @@
 #include "nix/util/fs-sink.hh"
 
 #ifdef _WIN32
-# include <fileapi.h>
-# include "nix/util/file-path.hh"
-# include "nix/util/windows-error.hh"
+#  include <fileapi.h>
+#  include "nix/util/file-path.hh"
+#  include "nix/util/windows-error.hh"
 #endif
 
 #include "util-config-private.hh"
 
 namespace nix {
 
-void copyRecursive(
-    SourceAccessor & accessor, const CanonPath & from,
-    FileSystemObjectSink & sink, const CanonPath & to)
+void copyRecursive(SourceAccessor & accessor, const CanonPath & from, FileSystemObjectSink & sink, const CanonPath & to)
 {
     auto stat = accessor.lstat(from);
 
     switch (stat.type) {
-    case SourceAccessor::tSymlink:
-    {
+    case SourceAccessor::tSymlink: {
         sink.createSymlink(to, accessor.readLink(from));
         break;
     }
 
-    case SourceAccessor::tRegular:
-    {
+    case SourceAccessor::tRegular: {
         sink.createRegularFile(to, [&](CreateRegularFileSink & crf) {
             if (stat.isExecutable)
                 crf.isExecutable();
-            accessor.readFile(from, crf, [&](uint64_t size) {
-                crf.preallocateContents(size);
-            });
+            accessor.readFile(from, crf, [&](uint64_t size) { crf.preallocateContents(size); });
         });
         break;
     }
 
-    case SourceAccessor::tDirectory:
-    {
+    case SourceAccessor::tDirectory: {
         sink.createDirectory(to);
         for (auto & [name, _] : accessor.readDirectory(from)) {
-            copyRecursive(
-                accessor, from / name,
-                sink, to / name);
+            copyRecursive(accessor, from / name, sink, to / name);
             break;
         }
         break;
@@ -61,11 +52,10 @@ void copyRecursive(
     }
 }
 
-
 struct RestoreSinkSettings : Config
 {
-    Setting<bool> preallocateContents{this, false, "preallocate-contents",
-        "Whether to preallocate files when writing objects with known size."};
+    Setting<bool> preallocateContents{
+        this, false, "preallocate-contents", "Whether to preallocate files when writing objects with known size."};
 };
 
 static RestoreSinkSettings restoreSinkSettings;
@@ -87,7 +77,8 @@ void RestoreSink::createDirectory(const CanonPath & path)
         throw Error("path '%s' already exists", p.string());
 };
 
-struct RestoreRegularFile : CreateRegularFileSink {
+struct RestoreRegularFile : CreateRegularFileSink
+{
     AutoCloseFD fd;
     bool startFsync = false;
 
@@ -101,7 +92,7 @@ struct RestoreRegularFile : CreateRegularFileSink {
             fd.startFsync();
     }
 
-    void operator () (std::string_view data) override;
+    void operator()(std::string_view data) override;
     void isExecutable() override;
     void preallocateContents(uint64_t size) override;
 };
@@ -114,12 +105,20 @@ void RestoreSink::createRegularFile(const CanonPath & path, std::function<void(C
     crf.startFsync = startFsync;
     crf.fd =
 #ifdef _WIN32
-        CreateFileW(p.c_str(), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL)
+        CreateFileW(
+            p.c_str(),
+            GENERIC_READ | GENERIC_WRITE,
+            FILE_SHARE_READ | FILE_SHARE_WRITE,
+            NULL,
+            CREATE_NEW,
+            FILE_ATTRIBUTE_NORMAL,
+            NULL)
 #else
         open(p.c_str(), O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC, 0666)
 #endif
         ;
-    if (!crf.fd) throw NativeSysError("creating file '%1%'", p);
+    if (!crf.fd)
+        throw NativeSysError("creating file '%1%'", p);
     func(crf);
 }
 
@@ -154,7 +153,7 @@ void RestoreRegularFile::preallocateContents(uint64_t len)
 #endif
 }
 
-void RestoreRegularFile::operator () (std::string_view data)
+void RestoreRegularFile::operator()(std::string_view data)
 {
     writeFull(fd.get(), data);
 }
@@ -165,32 +164,42 @@ void RestoreSink::createSymlink(const CanonPath & path, const std::string & targ
     nix::createSymlink(target, p.string());
 }
 
-
 void RegularFileSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
-    struct CRF : CreateRegularFileSink {
+    struct CRF : CreateRegularFileSink
+    {
         RegularFileSink & back;
-        CRF(RegularFileSink & back) : back(back) {}
-        void operator () (std::string_view data) override
+
+        CRF(RegularFileSink & back)
+            : back(back)
+        {
+        }
+
+        void operator()(std::string_view data) override
         {
             back.sink(data);
         }
+
         void isExecutable() override {}
-    } crf { *this };
+    } crf{*this};
+
     func(crf);
 }
 
-
-void NullFileSystemObjectSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
+void NullFileSystemObjectSink::createRegularFile(
+    const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
-    struct : CreateRegularFileSink {
-        void operator () (std::string_view data) override {}
+    struct : CreateRegularFileSink
+    {
+        void operator()(std::string_view data) override {}
+
         void isExecutable() override {}
     } crf;
+
     // Even though `NullFileSystemObjectSink` doesn't do anything, it's important
     // that we call the function, to e.g. advance the parser using this
     // sink.
     func(crf);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/git.cc b/src/libutil/git.cc
index edeef71b7..b17fdf145 100644
--- a/src/libutil/git.cc
+++ b/src/libutil/git.cc
@@ -17,32 +17,31 @@ namespace nix::git {
 using namespace nix;
 using namespace std::string_literals;
 
-std::optional<Mode> decodeMode(RawMode m) {
+std::optional<Mode> decodeMode(RawMode m)
+{
     switch (m) {
-        case (RawMode) Mode::Directory:
-        case (RawMode) Mode::Executable:
-        case (RawMode) Mode::Regular:
-        case (RawMode) Mode::Symlink:
-            return (Mode) m;
-        default:
-            return std::nullopt;
+    case (RawMode) Mode::Directory:
+    case (RawMode) Mode::Executable:
+    case (RawMode) Mode::Regular:
+    case (RawMode) Mode::Symlink:
+        return (Mode) m;
+    default:
+        return std::nullopt;
     }
 }
 
-
 static std::string getStringUntil(Source & source, char byte)
 {
     std::string s;
-    char n[1] = { 0 };
-    source(std::string_view { n, 1 });
+    char n[1] = {0};
+    source(std::string_view{n, 1});
     while (*n != byte) {
         s += *n;
-        source(std::string_view { n, 1 });
+        source(std::string_view{n, 1});
     }
     return s;
 }
 
-
 static std::string getString(Source & source, int n)
 {
     std::string v;
@@ -60,7 +59,7 @@ void parseBlob(
 {
     xpSettings.require(Xp::GitHashing);
 
-    unsigned long long size = std::stoi(getStringUntil(source, 0));
+    const unsigned long long size = std::stoi(getStringUntil(source, 0));
 
     auto doRegularFile = [&](bool executable) {
         sink.createRegularFile(sinkPath, [&](auto & crf) {
@@ -75,7 +74,7 @@ void parseBlob(
 
             while (left) {
                 checkInterrupt();
-                buf.resize(std::min((unsigned long long)buf.capacity(), left));
+                buf.resize(std::min((unsigned long long) buf.capacity(), left));
                 source(buf);
                 crf(buf);
                 left -= buf.size();
@@ -93,16 +92,13 @@ void parseBlob(
         doRegularFile(true);
         break;
 
-    case BlobMode::Symlink:
-    {
+    case BlobMode::Symlink: {
         std::string target;
         target.resize(size, '0');
         target.reserve(size);
         for (size_t n = 0; n < target.size();) {
             checkInterrupt();
-            n += source.read(
-                const_cast<char *>(target.c_str()) + n,
-                target.size() - n);
+            n += source.read(const_cast<char *>(target.c_str()) + n, target.size() - n);
         }
 
         sink.createSymlink(sinkPath, target);
@@ -118,10 +114,11 @@ void parseTree(
     FileSystemObjectSink & sink,
     const CanonPath & sinkPath,
     Source & source,
+    HashAlgorithm hashAlgo,
     std::function<SinkHook> hook,
     const ExperimentalFeatureSettings & xpSettings)
 {
-    unsigned long long size = std::stoi(getStringUntil(source, 0));
+    const unsigned long long size = std::stoi(getStringUntil(source, 0));
     unsigned long long left = size;
 
     sink.createDirectory(sinkPath);
@@ -141,22 +138,27 @@ void parseTree(
         left -= name.size();
         left -= 1;
 
-        std::string hashs = getString(source, 20);
-        left -= 20;
+        const auto hashSize = regularHashSize(hashAlgo);
+        std::string hashs = getString(source, hashSize);
+        left -= hashSize;
 
-        Hash hash(HashAlgorithm::SHA1);
+        if (!(hashAlgo == HashAlgorithm::SHA1 || hashAlgo == HashAlgorithm::SHA256)) {
+            throw Error("Unsupported hash algorithm for git trees: %s", printHashAlgo(hashAlgo));
+        }
+
+        Hash hash(hashAlgo);
         std::copy(hashs.begin(), hashs.end(), hash.hash);
 
-        hook(CanonPath{name}, TreeEntry {
-            .mode = mode,
-            .hash = hash,
-        });
+        hook(
+            CanonPath{name},
+            TreeEntry{
+                .mode = mode,
+                .hash = hash,
+            });
     }
 }
 
-ObjectType parseObjectType(
-    Source & source,
-    const ExperimentalFeatureSettings & xpSettings)
+ObjectType parseObjectType(Source & source, const ExperimentalFeatureSettings & xpSettings)
 {
     xpSettings.require(Xp::GitHashing);
 
@@ -166,7 +168,8 @@ ObjectType parseObjectType(
         return ObjectType::Blob;
     } else if (type == "tree ") {
         return ObjectType::Tree;
-    } else throw Error("input doesn't look like a Git object");
+    } else
+        throw Error("input doesn't look like a Git object");
 }
 
 void parse(
@@ -174,6 +177,7 @@ void parse(
     const CanonPath & sinkPath,
     Source & source,
     BlobMode rootModeIfBlob,
+    HashAlgorithm hashAlgo,
     std::function<SinkHook> hook,
     const ExperimentalFeatureSettings & xpSettings)
 {
@@ -186,66 +190,64 @@ void parse(
         parseBlob(sink, sinkPath, source, rootModeIfBlob, xpSettings);
         break;
     case ObjectType::Tree:
-        parseTree(sink, sinkPath, source, hook, xpSettings);
+        parseTree(sink, sinkPath, source, hashAlgo, hook, xpSettings);
         break;
     default:
         assert(false);
     };
 }
 
-
 std::optional<Mode> convertMode(SourceAccessor::Type type)
 {
     switch (type) {
-    case SourceAccessor::tSymlink:   return Mode::Symlink;
-    case SourceAccessor::tRegular:   return Mode::Regular;
-    case SourceAccessor::tDirectory: return Mode::Directory;
+    case SourceAccessor::tSymlink:
+        return Mode::Symlink;
+    case SourceAccessor::tRegular:
+        return Mode::Regular;
+    case SourceAccessor::tDirectory:
+        return Mode::Directory;
     case SourceAccessor::tChar:
     case SourceAccessor::tBlock:
     case SourceAccessor::tSocket:
-    case SourceAccessor::tFifo:      return std::nullopt;
+    case SourceAccessor::tFifo:
+        return std::nullopt;
     case SourceAccessor::tUnknown:
-    default: unreachable();
+    default:
+        unreachable();
     }
 }
 
-
-void restore(FileSystemObjectSink & sink, Source & source, std::function<RestoreHook> hook)
+void restore(FileSystemObjectSink & sink, Source & source, HashAlgorithm hashAlgo, std::function<RestoreHook> hook)
 {
-    parse(sink, CanonPath::root, source, BlobMode::Regular, [&](CanonPath name, TreeEntry entry) {
+    parse(sink, CanonPath::root, source, BlobMode::Regular, hashAlgo, [&](CanonPath name, TreeEntry entry) {
         auto [accessor, from] = hook(entry.hash);
         auto stat = accessor->lstat(from);
         auto gotOpt = convertMode(stat.type);
         if (!gotOpt)
-            throw Error("file '%s' (git hash %s) has an unsupported type",
+            throw Error(
+                "file '%s' (git hash %s) has an unsupported type",
                 from,
                 entry.hash.to_string(HashFormat::Base16, false));
         auto & got = *gotOpt;
         if (got != entry.mode)
-            throw Error("git mode of file '%s' (git hash %s) is %o but expected %o",
+            throw Error(
+                "git mode of file '%s' (git hash %s) is %o but expected %o",
                 from,
                 entry.hash.to_string(HashFormat::Base16, false),
                 (RawMode) got,
                 (RawMode) entry.mode);
-        copyRecursive(
-            *accessor, from,
-            sink, name);
+        copyRecursive(*accessor, from, sink, name);
     });
 }
 
-
-void dumpBlobPrefix(
-    uint64_t size, Sink & sink,
-    const ExperimentalFeatureSettings & xpSettings)
+void dumpBlobPrefix(uint64_t size, Sink & sink, const ExperimentalFeatureSettings & xpSettings)
 {
     xpSettings.require(Xp::GitHashing);
     auto s = fmt("blob %d\0"s, std::to_string(size));
     sink(s);
 }
 
-
-void dumpTree(const Tree & entries, Sink & sink,
-    const ExperimentalFeatureSettings & xpSettings)
+void dumpTree(const Tree & entries, Sink & sink, const ExperimentalFeatureSettings & xpSettings)
 {
     xpSettings.require(Xp::GitHashing);
 
@@ -270,7 +272,6 @@ void dumpTree(const Tree & entries, Sink & sink,
     sink(v1);
 }
 
-
 Mode dump(
     const SourcePath & path,
     Sink & sink,
@@ -281,22 +282,17 @@ Mode dump(
     auto st = path.lstat();
 
     switch (st.type) {
-    case SourceAccessor::tRegular:
-    {
-        path.readFile(sink, [&](uint64_t size) {
-            dumpBlobPrefix(size, sink, xpSettings);
-        });
-        return st.isExecutable
-            ? Mode::Executable
-            : Mode::Regular;
+    case SourceAccessor::tRegular: {
+        path.readFile(sink, [&](uint64_t size) { dumpBlobPrefix(size, sink, xpSettings); });
+        return st.isExecutable ? Mode::Executable : Mode::Regular;
     }
 
-    case SourceAccessor::tDirectory:
-    {
+    case SourceAccessor::tDirectory: {
         Tree entries;
         for (auto & [name, _] : path.readDirectory()) {
             auto child = path / name;
-            if (!filter(child.path.abs())) continue;
+            if (!filter(child.path.abs()))
+                continue;
 
             auto entry = hook(child);
 
@@ -310,8 +306,7 @@ Mode dump(
         return Mode::Directory;
     }
 
-    case SourceAccessor::tSymlink:
-    {
+    case SourceAccessor::tSymlink: {
         auto target = path.readLink();
         dumpBlobPrefix(target.size(), sink, xpSettings);
         sink(target);
@@ -328,17 +323,13 @@ Mode dump(
     }
 }
 
-
-TreeEntry dumpHash(
-    HashAlgorithm ha,
-    const SourcePath & path,
-    PathFilter & filter)
+TreeEntry dumpHash(HashAlgorithm ha, const SourcePath & path, PathFilter & filter)
 {
     std::function<DumpHook> hook;
     hook = [&](const SourcePath & path) -> TreeEntry {
         auto hashSink = HashSink(ha);
         auto mode = dump(path, hashSink, hook, filter);
-        auto hash = hashSink.finish().first;
+        auto hash = hashSink.finish().hash;
         return {
             .mode = mode,
             .hash = hash,
@@ -348,7 +339,6 @@ TreeEntry dumpHash(
     return hook(path);
 }
 
-
 std::optional<LsRemoteRefLine> parseLsRemoteLine(std::string_view line)
 {
     const static std::regex line_regex("^(ref: *)?([^\\s]+)(?:\\t+(.*))?$");
@@ -356,13 +346,10 @@ std::optional<LsRemoteRefLine> parseLsRemoteLine(std::string_view line)
     if (!std::regex_match(line.cbegin(), line.cend(), match, line_regex))
         return std::nullopt;
 
-    return LsRemoteRefLine {
-        .kind = match[1].length() == 0
-            ? LsRemoteRefLine::Kind::Object
-            : LsRemoteRefLine::Kind::Symbolic,
+    return LsRemoteRefLine{
+        .kind = match[1].length() == 0 ? LsRemoteRefLine::Kind::Object : LsRemoteRefLine::Kind::Symbolic,
         .target = match[2],
-        .reference = match[3].length() == 0 ? std::nullopt : std::optional<std::string>{ match[3] }
-    };
+        .reference = match[3].length() == 0 ? std::nullopt : std::optional<std::string>{match[3]}};
 }
 
-}
+} // namespace nix::git
diff --git a/src/libutil/hash.cc b/src/libutil/hash.cc
index 319eb795e..b67dc7807 100644
--- a/src/libutil/hash.cc
+++ b/src/libutil/hash.cc
@@ -11,6 +11,8 @@
 #include "nix/util/archive.hh"
 #include "nix/util/configuration.hh"
 #include "nix/util/split.hh"
+#include "nix/util/base-n.hh"
+#include "nix/util/base-nix-32.hh"
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -20,23 +22,12 @@
 
 namespace nix {
 
-static size_t regularHashSize(HashAlgorithm type) {
-    switch (type) {
-    case HashAlgorithm::BLAKE3: return blake3HashSize;
-    case HashAlgorithm::MD5: return md5HashSize;
-    case HashAlgorithm::SHA1: return sha1HashSize;
-    case HashAlgorithm::SHA256: return sha256HashSize;
-    case HashAlgorithm::SHA512: return sha512HashSize;
-    }
-    unreachable();
-}
+const StringSet hashAlgorithms = {"blake3", "md5", "sha1", "sha256", "sha512"};
 
+const StringSet hashFormats = {"base64", "nix32", "base16", "sri"};
 
-const StringSet hashAlgorithms = {"blake3", "md5", "sha1", "sha256", "sha512" };
-
-const StringSet hashFormats = {"base64", "nix32", "base16", "sri" };
-
-Hash::Hash(HashAlgorithm algo, const ExperimentalFeatureSettings & xpSettings) : algo(algo)
+Hash::Hash(HashAlgorithm algo, const ExperimentalFeatureSettings & xpSettings)
+    : algo(algo)
 {
     if (algo == HashAlgorithm::BLAKE3) {
         xpSettings.require(Xp::BLAKE3Hashes);
@@ -46,76 +37,29 @@ Hash::Hash(HashAlgorithm algo, const ExperimentalFeatureSettings & xpSettings) :
     memset(hash, 0, maxHashSize);
 }
 
-
-bool Hash::operator == (const Hash & h2) const noexcept
+bool Hash::operator==(const Hash & h2) const noexcept
 {
-    if (hashSize != h2.hashSize) return false;
+    if (hashSize != h2.hashSize)
+        return false;
     for (unsigned int i = 0; i < hashSize; i++)
-        if (hash[i] != h2.hash[i]) return false;
+        if (hash[i] != h2.hash[i])
+            return false;
     return true;
 }
 
-
-std::strong_ordering Hash::operator <=> (const Hash & h) const noexcept
+std::strong_ordering Hash::operator<=>(const Hash & h) const noexcept
 {
-    if (auto cmp = hashSize <=> h.hashSize; cmp != 0) return cmp;
+    if (auto cmp = hashSize <=> h.hashSize; cmp != 0)
+        return cmp;
     for (unsigned int i = 0; i < hashSize; i++) {
-        if (auto cmp = hash[i] <=> h.hash[i]; cmp != 0) return cmp;
+        if (auto cmp = hash[i] <=> h.hash[i]; cmp != 0)
+            return cmp;
     }
-    if (auto cmp = algo <=> h.algo; cmp != 0) return cmp;
+    if (auto cmp = algo <=> h.algo; cmp != 0)
+        return cmp;
     return std::strong_ordering::equivalent;
 }
 
-
-const std::string base16Chars = "0123456789abcdef";
-
-
-static std::string printHash16(const Hash & hash)
-{
-    std::string buf;
-    buf.reserve(hash.hashSize * 2);
-    for (unsigned int i = 0; i < hash.hashSize; i++) {
-        buf.push_back(base16Chars[hash.hash[i] >> 4]);
-        buf.push_back(base16Chars[hash.hash[i] & 0x0f]);
-    }
-    return buf;
-}
-
-
-// omitted: E O U T
-const std::string nix32Chars = "0123456789abcdfghijklmnpqrsvwxyz";
-
-
-static std::string printHash32(const Hash & hash)
-{
-    assert(hash.hashSize);
-    size_t len = hash.base32Len();
-    assert(len);
-
-    std::string s;
-    s.reserve(len);
-
-    for (int n = (int) len - 1; n >= 0; n--) {
-        unsigned int b = n * 5;
-        unsigned int i = b / 8;
-        unsigned int j = b % 8;
-        unsigned char c =
-            (hash.hash[i] >> j)
-            | (i >= hash.hashSize - 1 ? 0 : hash.hash[i + 1] << (8 - j));
-        s.push_back(nix32Chars[c & 0x1f]);
-    }
-
-    return s;
-}
-
-
-std::string printHash16or32(const Hash & hash)
-{
-    assert(static_cast<char>(hash.algo));
-    return hash.to_string(hash.algo == HashAlgorithm::MD5 ? HashFormat::Base16 : HashFormat::Nix32, false);
-}
-
-
 std::string Hash::to_string(HashFormat hashFormat, bool includeAlgo) const
 {
     std::string s;
@@ -123,16 +67,20 @@ std::string Hash::to_string(HashFormat hashFormat, bool includeAlgo) const
         s += printHashAlgo(algo);
         s += hashFormat == HashFormat::SRI ? '-' : ':';
     }
+    const auto bytes = std::as_bytes(std::span<const uint8_t>{&hash[0], hashSize});
     switch (hashFormat) {
     case HashFormat::Base16:
-        s += printHash16(*this);
+        assert(hashSize);
+        s += base16::encode(bytes);
         break;
     case HashFormat::Nix32:
-        s += printHash32(*this);
+        assert(hashSize);
+        s += BaseNix32::encode(bytes);
         break;
     case HashFormat::Base64:
     case HashFormat::SRI:
-        s += base64Encode(std::string_view((const char *) hash, hashSize));
+        assert(hashSize);
+        s += base64::encode(bytes);
         break;
     }
     return s;
@@ -140,6 +88,77 @@ std::string Hash::to_string(HashFormat hashFormat, bool includeAlgo) const
 
 Hash Hash::dummy(HashAlgorithm::SHA256);
 
+namespace {
+
+/// Private convenience
+struct DecodeNamePair
+{
+    decltype(base16::decode) * decode;
+    std::string_view encodingName;
+};
+
+} // namespace
+
+static DecodeNamePair baseExplicit(HashFormat format)
+{
+    switch (format) {
+    case HashFormat::Base16:
+        return {base16::decode, "base16"};
+    case HashFormat::Nix32:
+        return {BaseNix32::decode, "nix32"};
+    case HashFormat::Base64:
+        return {base64::decode, "Base64"};
+    case HashFormat::SRI:
+        break;
+    }
+    unreachable();
+}
+
+/**
+ * Given the expected size of the message once decoded it, figure out
+ * which encoding we are using by looking at the size of the encoded
+ * message.
+ */
+static HashFormat baseFromSize(std::string_view rest, HashAlgorithm algo)
+{
+    auto hashSize = regularHashSize(algo);
+
+    if (rest.size() == base16::encodedLength(hashSize))
+        return HashFormat::Base16;
+
+    if (rest.size() == BaseNix32::encodedLength(hashSize))
+        return HashFormat::Nix32;
+
+    if (rest.size() == base64::encodedLength(hashSize))
+        return HashFormat::Base64;
+
+    throw BadHash("hash '%s' has wrong length for hash algorithm '%s'", rest, printHashAlgo(algo));
+}
+
+/**
+ * Given the exact decoding function, and a display name for in error
+ * messages.
+ *
+ * @param rest the string view to parse. Must not include any `<algo>(:|-)` prefix.
+ */
+static Hash parseLowLevel(std::string_view rest, HashAlgorithm algo, DecodeNamePair pair)
+{
+    Hash res{algo};
+    std::string d;
+    try {
+        d = pair.decode(rest);
+    } catch (Error & e) {
+        e.addTrace({}, "While decoding hash '%s'", rest);
+    }
+    if (d.size() != res.hashSize)
+        throw BadHash(
+            "invalid %s hash '%s', length %d != expected length %d", pair.encodingName, rest, d.size(), res.hashSize);
+    assert(res.hashSize);
+    memcpy(res.hash, d.data(), res.hashSize);
+
+    return res;
+}
+
 Hash Hash::parseSRI(std::string_view original)
 {
     auto rest = original;
@@ -150,16 +169,21 @@ Hash Hash::parseSRI(std::string_view original)
         throw BadHash("hash '%s' is not SRI", original);
     HashAlgorithm parsedType = parseHashAlgo(*hashRaw);
 
-    return Hash(rest, parsedType, true);
+    return parseLowLevel(rest, parsedType, {base64::decode, "SRI"});
 }
 
-// Mutates the string to eliminate the prefixes when found
-static std::pair<std::optional<HashAlgorithm>, bool> getParsedTypeAndSRI(std::string_view & rest)
+/**
+ * @param rest is the string to parse
+ *
+ * @param resolveAlgo resolves the parsed type (or throws an error when it is not
+ * possible.)
+ */
+static Hash parseAnyHelper(std::string_view rest, auto resolveAlgo)
 {
     bool isSRI = false;
 
     // Parse the hash type before the separator, if there was one.
-    std::optional<HashAlgorithm> optParsedType;
+    std::optional<HashAlgorithm> optParsedAlgo;
     {
         auto hashRaw = splitPrefixTo(rest, ':');
 
@@ -169,103 +193,60 @@ static std::pair<std::optional<HashAlgorithm>, bool> getParsedTypeAndSRI(std::st
                 isSRI = true;
         }
         if (hashRaw)
-            optParsedType = parseHashAlgo(*hashRaw);
+            optParsedAlgo = parseHashAlgo(*hashRaw);
     }
 
-    return {optParsedType, isSRI};
+    HashAlgorithm algo = resolveAlgo(std::move(optParsedAlgo));
+
+    auto [decode, formatName] = [&]() -> DecodeNamePair {
+        if (isSRI) {
+            /* In the SRI case, we always are using Base64. If the
+               length is wrong, get an error later. */
+            return {base64::decode, "SRI"};
+        } else {
+            /* Otherwise, decide via the length of the hash (for the
+               given algorithm) what base encoding it is. */
+            return baseExplicit(baseFromSize(rest, algo));
+        }
+    }();
+
+    return parseLowLevel(rest, algo, {decode, formatName});
 }
 
 Hash Hash::parseAnyPrefixed(std::string_view original)
 {
-    auto rest = original;
-    auto [optParsedType, isSRI] = getParsedTypeAndSRI(rest);
+    return parseAnyHelper(original, [&](std::optional<HashAlgorithm> optParsedAlgo) {
+        // Either the string or user must provide the type, if they both do they
+        // must agree.
+        if (!optParsedAlgo)
+            throw BadHash("hash '%s' does not include a type", original);
 
-    // Either the string or user must provide the type, if they both do they
-    // must agree.
-    if (!optParsedType)
-        throw BadHash("hash '%s' does not include a type", rest);
-
-    return Hash(rest, *optParsedType, isSRI);
+        return *optParsedAlgo;
+    });
 }
 
 Hash Hash::parseAny(std::string_view original, std::optional<HashAlgorithm> optAlgo)
 {
-    auto rest = original;
-    auto [optParsedType, isSRI] = getParsedTypeAndSRI(rest);
+    return parseAnyHelper(original, [&](std::optional<HashAlgorithm> optParsedAlgo) {
+        // Either the string or user must provide the type, if they both do they
+        // must agree.
+        if (!optParsedAlgo && !optAlgo)
+            throw BadHash("hash '%s' does not include a type, nor is the type otherwise known from context", original);
+        else if (optParsedAlgo && optAlgo && *optParsedAlgo != *optAlgo)
+            throw BadHash("hash '%s' should have type '%s'", original, printHashAlgo(*optAlgo));
 
-    // Either the string or user must provide the type, if they both do they
-    // must agree.
-    if (!optParsedType && !optAlgo)
-        throw BadHash("hash '%s' does not include a type, nor is the type otherwise known from context", rest);
-    else if (optParsedType && optAlgo && *optParsedType != *optAlgo)
-        throw BadHash("hash '%s' should have type '%s'", original, printHashAlgo(*optAlgo));
-
-    HashAlgorithm hashAlgo = optParsedType ? *optParsedType : *optAlgo;
-    return Hash(rest, hashAlgo, isSRI);
+        return optParsedAlgo ? *optParsedAlgo : *optAlgo;
+    });
 }
 
 Hash Hash::parseNonSRIUnprefixed(std::string_view s, HashAlgorithm algo)
 {
-    return Hash(s, algo, false);
+    return parseExplicitFormatUnprefixed(s, algo, baseFromSize(s, algo));
 }
 
-Hash::Hash(std::string_view rest, HashAlgorithm algo, bool isSRI)
-    : Hash(algo)
+Hash Hash::parseExplicitFormatUnprefixed(std::string_view s, HashAlgorithm algo, HashFormat format)
 {
-    if (!isSRI && rest.size() == base16Len()) {
-
-        auto parseHexDigit = [&](char c) {
-            if (c >= '0' && c <= '9') return c - '0';
-            if (c >= 'A' && c <= 'F') return c - 'A' + 10;
-            if (c >= 'a' && c <= 'f') return c - 'a' + 10;
-            throw BadHash("invalid base-16 hash '%s'", rest);
-        };
-
-        for (unsigned int i = 0; i < hashSize; i++) {
-            hash[i] =
-                parseHexDigit(rest[i * 2]) << 4
-                | parseHexDigit(rest[i * 2 + 1]);
-        }
-    }
-
-    else if (!isSRI && rest.size() == base32Len()) {
-
-        for (unsigned int n = 0; n < rest.size(); ++n) {
-            char c = rest[rest.size() - n - 1];
-            unsigned char digit;
-            for (digit = 0; digit < nix32Chars.size(); ++digit) /* !!! slow */
-                if (nix32Chars[digit] == c) break;
-            if (digit >= 32)
-                throw BadHash("invalid base-32 hash '%s'", rest);
-            unsigned int b = n * 5;
-            unsigned int i = b / 8;
-            unsigned int j = b % 8;
-            hash[i] |= digit << j;
-
-            if (i < hashSize - 1) {
-                hash[i + 1] |= digit >> (8 - j);
-            } else {
-                if (digit >> (8 - j))
-                    throw BadHash("invalid base-32 hash '%s'", rest);
-            }
-        }
-    }
-
-    else if (isSRI || rest.size() == base64Len()) {
-        std::string d;
-        try {
-            d = base64Decode(rest);
-        } catch (Error & e) {
-            e.addTrace({}, "While decoding hash '%s'", rest);
-        }
-        if (d.size() != hashSize)
-            throw BadHash("invalid %s hash '%s'", isSRI ? "SRI" : "base-64", rest);
-        assert(hashSize);
-        memcpy(hash, d.data(), hashSize);
-    }
-
-    else
-        throw BadHash("hash '%s' has wrong length for hash algorithm '%s'", rest, printHashAlgo(this->algo));
+    return parseLowLevel(s, algo, baseExplicit(format));
 }
 
 Hash Hash::random(HashAlgorithm algo)
@@ -287,8 +268,7 @@ Hash newHashAllowEmpty(std::string_view hashStr, std::optional<HashAlgorithm> ha
         return Hash::parseAny(hashStr, ha);
 }
 
-
-union Ctx
+union Hash::Ctx
 {
     blake3_hasher blake3;
     MD5_CTX md5;
@@ -297,14 +277,18 @@ union Ctx
     SHA512_CTX sha512;
 };
 
-
-static void start(HashAlgorithm ha, Ctx & ctx)
+static void start(HashAlgorithm ha, Hash::Ctx & ctx)
 {
-    if (ha == HashAlgorithm::BLAKE3) blake3_hasher_init(&ctx.blake3);
-    else if (ha == HashAlgorithm::MD5) MD5_Init(&ctx.md5);
-    else if (ha == HashAlgorithm::SHA1) SHA1_Init(&ctx.sha1);
-    else if (ha == HashAlgorithm::SHA256) SHA256_Init(&ctx.sha256);
-    else if (ha == HashAlgorithm::SHA512) SHA512_Init(&ctx.sha512);
+    if (ha == HashAlgorithm::BLAKE3)
+        blake3_hasher_init(&ctx.blake3);
+    else if (ha == HashAlgorithm::MD5)
+        MD5_Init(&ctx.md5);
+    else if (ha == HashAlgorithm::SHA1)
+        SHA1_Init(&ctx.sha1);
+    else if (ha == HashAlgorithm::SHA256)
+        SHA256_Init(&ctx.sha256);
+    else if (ha == HashAlgorithm::SHA512)
+        SHA512_Init(&ctx.sha512);
 }
 
 // BLAKE3 data size threshold beyond which parallel hashing with TBB is likely faster.
@@ -328,30 +312,37 @@ void blake3_hasher_update_with_heuristics(blake3_hasher * blake3, std::string_vi
     }
 }
 
-static void update(HashAlgorithm ha, Ctx & ctx,
-                   std::string_view data)
+static void update(HashAlgorithm ha, Hash::Ctx & ctx, std::string_view data)
 {
-    if (ha == HashAlgorithm::BLAKE3) blake3_hasher_update_with_heuristics(&ctx.blake3, data);
-    else if (ha == HashAlgorithm::MD5) MD5_Update(&ctx.md5, data.data(), data.size());
-    else if (ha == HashAlgorithm::SHA1) SHA1_Update(&ctx.sha1, data.data(), data.size());
-    else if (ha == HashAlgorithm::SHA256) SHA256_Update(&ctx.sha256, data.data(), data.size());
-    else if (ha == HashAlgorithm::SHA512) SHA512_Update(&ctx.sha512, data.data(), data.size());
+    if (ha == HashAlgorithm::BLAKE3)
+        blake3_hasher_update_with_heuristics(&ctx.blake3, data);
+    else if (ha == HashAlgorithm::MD5)
+        MD5_Update(&ctx.md5, data.data(), data.size());
+    else if (ha == HashAlgorithm::SHA1)
+        SHA1_Update(&ctx.sha1, data.data(), data.size());
+    else if (ha == HashAlgorithm::SHA256)
+        SHA256_Update(&ctx.sha256, data.data(), data.size());
+    else if (ha == HashAlgorithm::SHA512)
+        SHA512_Update(&ctx.sha512, data.data(), data.size());
 }
 
-
-static void finish(HashAlgorithm ha, Ctx & ctx, unsigned char * hash)
+static void finish(HashAlgorithm ha, Hash::Ctx & ctx, unsigned char * hash)
 {
-    if (ha == HashAlgorithm::BLAKE3) blake3_hasher_finalize(&ctx.blake3, hash, BLAKE3_OUT_LEN);
-    else if (ha == HashAlgorithm::MD5) MD5_Final(hash, &ctx.md5);
-    else if (ha == HashAlgorithm::SHA1) SHA1_Final(hash, &ctx.sha1);
-    else if (ha == HashAlgorithm::SHA256) SHA256_Final(hash, &ctx.sha256);
-    else if (ha == HashAlgorithm::SHA512) SHA512_Final(hash, &ctx.sha512);
+    if (ha == HashAlgorithm::BLAKE3)
+        blake3_hasher_finalize(&ctx.blake3, hash, BLAKE3_OUT_LEN);
+    else if (ha == HashAlgorithm::MD5)
+        MD5_Final(hash, &ctx.md5);
+    else if (ha == HashAlgorithm::SHA1)
+        SHA1_Final(hash, &ctx.sha1);
+    else if (ha == HashAlgorithm::SHA256)
+        SHA256_Final(hash, &ctx.sha256);
+    else if (ha == HashAlgorithm::SHA512)
+        SHA512_Final(hash, &ctx.sha512);
 }
 
-Hash hashString(
-    HashAlgorithm ha, std::string_view s, const ExperimentalFeatureSettings & xpSettings)
+Hash hashString(HashAlgorithm ha, std::string_view s, const ExperimentalFeatureSettings & xpSettings)
 {
-    Ctx ctx;
+    Hash::Ctx ctx;
     Hash hash(ha, xpSettings);
     start(ha, ctx);
     update(ha, ctx, s);
@@ -363,13 +354,13 @@ Hash hashFile(HashAlgorithm ha, const Path & path)
 {
     HashSink sink(ha);
     readFile(path, sink);
-    return sink.finish().first;
+    return sink.finish().hash;
 }
 
-
-HashSink::HashSink(HashAlgorithm ha) : ha(ha)
+HashSink::HashSink(HashAlgorithm ha)
+    : ha(ha)
 {
-    ctx = new Ctx;
+    ctx = new Hash::Ctx;
     bytes = 0;
     start(ha, *ctx);
 }
@@ -397,13 +388,12 @@ HashResult HashSink::finish()
 HashResult HashSink::currentHash()
 {
     flush();
-    Ctx ctx2 = *ctx;
+    Hash::Ctx ctx2 = *ctx;
     Hash hash(ha);
     nix::finish(ha, ctx2, hash.hash);
     return HashResult(hash, bytes);
 }
 
-
 Hash compressHash(const Hash & hash, unsigned int newSize)
 {
     Hash h(hash.algo);
@@ -413,17 +403,20 @@ Hash compressHash(const Hash & hash, unsigned int newSize)
     return h;
 }
 
-
 std::optional<HashFormat> parseHashFormatOpt(std::string_view hashFormatName)
 {
-    if (hashFormatName == "base16") return HashFormat::Base16;
-    if (hashFormatName == "nix32") return HashFormat::Nix32;
+    if (hashFormatName == "base16")
+        return HashFormat::Base16;
+    if (hashFormatName == "nix32")
+        return HashFormat::Nix32;
     if (hashFormatName == "base32") {
         warn(R"("base32" is a deprecated alias for hash format "nix32".)");
         return HashFormat::Nix32;
     }
-    if (hashFormatName == "base64") return HashFormat::Base64;
-    if (hashFormatName == "sri") return HashFormat::SRI;
+    if (hashFormatName == "base64")
+        return HashFormat::Base64;
+    if (hashFormatName == "sri")
+        return HashFormat::SRI;
     return std::nullopt;
 }
 
@@ -455,11 +448,16 @@ std::string_view printHashFormat(HashFormat HashFormat)
 
 std::optional<HashAlgorithm> parseHashAlgoOpt(std::string_view s)
 {
-    if (s == "blake3") return HashAlgorithm::BLAKE3;
-    if (s == "md5") return HashAlgorithm::MD5;
-    if (s == "sha1") return HashAlgorithm::SHA1;
-    if (s == "sha256") return HashAlgorithm::SHA256;
-    if (s == "sha512") return HashAlgorithm::SHA512;
+    if (s == "blake3")
+        return HashAlgorithm::BLAKE3;
+    if (s == "md5")
+        return HashAlgorithm::MD5;
+    if (s == "sha1")
+        return HashAlgorithm::SHA1;
+    if (s == "sha256")
+        return HashAlgorithm::SHA256;
+    if (s == "sha512")
+        return HashAlgorithm::SHA512;
     return std::nullopt;
 }
 
@@ -475,11 +473,16 @@ HashAlgorithm parseHashAlgo(std::string_view s)
 std::string_view printHashAlgo(HashAlgorithm ha)
 {
     switch (ha) {
-    case HashAlgorithm::BLAKE3: return "blake3";
-    case HashAlgorithm::MD5: return "md5";
-    case HashAlgorithm::SHA1: return "sha1";
-    case HashAlgorithm::SHA256: return "sha256";
-    case HashAlgorithm::SHA512: return "sha512";
+    case HashAlgorithm::BLAKE3:
+        return "blake3";
+    case HashAlgorithm::MD5:
+        return "md5";
+    case HashAlgorithm::SHA1:
+        return "sha1";
+    case HashAlgorithm::SHA256:
+        return "sha256";
+    case HashAlgorithm::SHA512:
+        return "sha512";
     default:
         // illegal hash type enum value internally, as opposed to external input
         // which should be validated with nice error message.
@@ -487,4 +490,4 @@ std::string_view printHashAlgo(HashAlgorithm ha)
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/hilite.cc b/src/libutil/hilite.cc
index 6d4eb17a1..8b7e3ff23 100644
--- a/src/libutil/hilite.cc
+++ b/src/libutil/hilite.cc
@@ -2,19 +2,15 @@
 
 namespace nix {
 
-std::string hiliteMatches(
-    std::string_view s,
-    std::vector<std::smatch> matches,
-    std::string_view prefix,
-    std::string_view postfix)
+std::string
+hiliteMatches(std::string_view s, std::vector<std::smatch> matches, std::string_view prefix, std::string_view postfix)
 {
     // Avoid extra work on zero matches
     if (matches.size() == 0)
         return std::string(s);
 
-    std::sort(matches.begin(), matches.end(), [](const auto & a, const auto & b) {
-        return a.position() < b.position();
-    });
+    std::sort(
+        matches.begin(), matches.end(), [](const auto & a, const auto & b) { return a.position() < b.position(); });
 
     std::string out;
     ssize_t last_end = 0;
@@ -41,4 +37,4 @@ std::string hiliteMatches(
     return out;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/abstract-setting-to-json.hh b/src/libutil/include/nix/util/abstract-setting-to-json.hh
index 2848f8afe..180aa59d2 100644
--- a/src/libutil/include/nix/util/abstract-setting-to-json.hh
+++ b/src/libutil/include/nix/util/abstract-setting-to-json.hh
@@ -15,4 +15,4 @@ std::map<std::string, nlohmann::json> BaseSetting<T>::toJSONObject() const
     obj.emplace("documentDefault", documentDefault);
     return obj;
 }
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/ansicolor.hh b/src/libutil/include/nix/util/ansicolor.hh
index 86becafa6..2f0749e6a 100644
--- a/src/libutil/include/nix/util/ansicolor.hh
+++ b/src/libutil/include/nix/util/ansicolor.hh
@@ -1,4 +1,5 @@
 #pragma once
+
 /**
  * @file
  *
@@ -18,4 +19,4 @@ namespace nix {
 #define ANSI_MAGENTA "\e[35;1m"
 #define ANSI_CYAN "\e[36;1m"
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/archive.hh b/src/libutil/include/nix/util/archive.hh
index ae3274fa6..b88e1fa2d 100644
--- a/src/libutil/include/nix/util/archive.hh
+++ b/src/libutil/include/nix/util/archive.hh
@@ -5,10 +5,8 @@
 #include "nix/util/serialise.hh"
 #include "nix/util/fs-sink.hh"
 
-
 namespace nix {
 
-
 /**
  * dumpPath creates a Nix archive of the specified path.
  *
@@ -57,14 +55,12 @@ namespace nix {
  *   `+` denotes string concatenation.
  * ```
  */
-void dumpPath(const Path & path, Sink & sink,
-    PathFilter & filter = defaultPathFilter);
+void dumpPath(const Path & path, Sink & sink, PathFilter & filter = defaultPathFilter);
 
 /**
  * Same as dumpPath(), but returns the last modified date of the path.
  */
-time_t dumpPathAndGetMtime(const Path & path, Sink & sink,
-    PathFilter & filter = defaultPathFilter);
+time_t dumpPathAndGetMtime(const Path & path, Sink & sink, PathFilter & filter = defaultPathFilter);
 
 /**
  * Dump an archive with a single file with these contents.
@@ -82,10 +78,8 @@ void restorePath(const std::filesystem::path & path, Source & source, bool start
  */
 void copyNAR(Source & source, Sink & sink);
 
-
 inline constexpr std::string_view narVersionMagic1 = "nix-archive-1";
 
 inline constexpr std::string_view caseHackSuffix = "~nix~case~hack~";
 
-
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/args.hh b/src/libutil/include/nix/util/args.hh
index f3ab0b532..443db445f 100644
--- a/src/libutil/include/nix/util/args.hh
+++ b/src/libutil/include/nix/util/args.hh
@@ -31,18 +31,28 @@ public:
 
     /**
      * Return a short one-line description of the command.
-    */
-    virtual std::string description() { return ""; }
+     */
+    virtual std::string description()
+    {
+        return "";
+    }
 
-    virtual bool forceImpureByDefault() { return false; }
+    virtual bool forceImpureByDefault()
+    {
+        return false;
+    }
 
     /**
      * Return documentation about this command, in Markdown format.
      */
-    virtual std::string doc() { return ""; }
+    virtual std::string doc()
+    {
+        return "";
+    }
 
     /**
-     * @brief Get the [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory) for the command.
+     * @brief Get the [base directory](https://nix.dev/manual/nix/development/glossary.html#gloss-base-directory) for
+     * the command.
      *
      * @return Generally the working directory, but in case of a shebang
      *         interpreter, returns the directory of the script.
@@ -78,73 +88,79 @@ protected:
         Handler(std::function<void(std::vector<std::string>)> && fun)
             : fun(std::move(fun))
             , arity(ArityAny)
-        { }
+        {
+        }
 
         Handler(std::function<void()> && handler)
             : fun([handler{std::move(handler)}](std::vector<std::string>) { handler(); })
             , arity(0)
-        { }
+        {
+        }
 
         Handler(std::function<void(std::string)> && handler)
-            : fun([handler{std::move(handler)}](std::vector<std::string> ss) {
-                handler(std::move(ss[0]));
-              })
+            : fun([handler{std::move(handler)}](std::vector<std::string> ss) { handler(std::move(ss[0])); })
             , arity(1)
-        { }
+        {
+        }
 
         Handler(std::function<void(std::string, std::string)> && handler)
             : fun([handler{std::move(handler)}](std::vector<std::string> ss) {
                 handler(std::move(ss[0]), std::move(ss[1]));
-              })
+            })
             , arity(2)
-        { }
+        {
+        }
 
         Handler(std::vector<std::string> * dest)
             : fun([dest](std::vector<std::string> ss) { *dest = ss; })
             , arity(ArityAny)
-        { }
+        {
+        }
 
         Handler(std::string * dest)
             : fun([dest](std::vector<std::string> ss) { *dest = ss[0]; })
             , arity(1)
-        { }
+        {
+        }
 
         Handler(std::optional<std::string> * dest)
             : fun([dest](std::vector<std::string> ss) { *dest = ss[0]; })
             , arity(1)
-        { }
+        {
+        }
 
         Handler(std::filesystem::path * dest)
             : fun([dest](std::vector<std::string> ss) { *dest = ss[0]; })
             , arity(1)
-        { }
+        {
+        }
 
         Handler(std::optional<std::filesystem::path> * dest)
             : fun([dest](std::vector<std::string> ss) { *dest = ss[0]; })
             , arity(1)
-        { }
+        {
+        }
 
         template<class T>
         Handler(T * dest, const T & val)
             : fun([dest, val](std::vector<std::string> ss) { *dest = val; })
             , arity(0)
-        { }
+        {
+        }
 
         template<class I>
         Handler(I * dest)
-            : fun([dest](std::vector<std::string> ss) {
-                *dest = string2IntWithUnitPrefix<I>(ss[0]);
-              })
+            : fun([dest](std::vector<std::string> ss) { *dest = string2IntWithUnitPrefix<I>(ss[0]); })
             , arity(1)
-        { }
+        {
+        }
 
         template<class I>
         Handler(std::optional<I> * dest)
-            : fun([dest](std::vector<std::string> ss) {
-                *dest = string2IntWithUnitPrefix<I>(ss[0]);
-            })
+            : fun([dest](std::vector<std::string> ss) { *dest = string2IntWithUnitPrefix<I>(ss[0]); })
             , arity(1)
-        { }
+        {
+        }
     };
 
     /**
@@ -248,8 +264,8 @@ protected:
      * This list is used to extend the lifetime of the argument forms.
      * If this is not done, some closures that reference the command
      * itself will segfault.
-    */
-   std::list<ExpectedArg> processedArgs;
+     */
+    std::list<ExpectedArg> processedArgs;
 
     /**
      * Process some positional arguments
@@ -261,7 +277,9 @@ protected:
     virtual bool processArgs(const Strings & args, bool finish);
 
     virtual Strings::iterator rewriteArgs(Strings & args, Strings::iterator pos)
-    { return pos; }
+    {
+        return pos;
+    }
 
     StringSet hiddenCategories;
 
@@ -287,11 +305,7 @@ public:
      */
     void expectArg(const std::string & label, std::string * dest, bool optional = false)
     {
-        expectArgs({
-            .label = label,
-            .optional = optional,
-            .handler = {dest}
-        });
+        expectArgs({.label = label, .optional = optional, .handler = {dest}});
     }
 
     /**
@@ -299,11 +313,7 @@ public:
      */
     void expectArg(const std::string & label, std::filesystem::path * dest, bool optional = false)
     {
-        expectArgs({
-            .label = label,
-            .optional = optional,
-            .handler = {dest}
-        });
+        expectArgs({.label = label, .optional = optional, .handler = {dest}});
     }
 
     /**
@@ -311,10 +321,7 @@ public:
      */
     void expectArgs(const std::string & label, std::vector<std::string> * dest)
     {
-        expectArgs({
-            .label = label,
-            .handler = {dest}
-        });
+        expectArgs({.label = label, .handler = {dest}});
     }
 
     static CompleterFun completePath;
@@ -364,7 +371,10 @@ struct Command : virtual public Args
 
     virtual std::optional<ExperimentalFeature> experimentalFeature();
 
-    virtual Category category() { return catDefault; }
+    virtual Category category()
+    {
+        return catDefault;
+    }
 };
 
 using Commands = std::map<std::string, std::function<ref<Command>()>>;
@@ -401,7 +411,8 @@ public:
     };
 
     /** An alias, except for the original syntax, which is in the map key. */
-    struct AliasInfo {
+    struct AliasInfo
+    {
         AliasStatus status;
         std::vector<std::string> replacement;
     };
@@ -419,9 +430,10 @@ protected:
     bool aliasUsed = false;
 };
 
-Strings argvToStrings(int argc, char * * argv);
+Strings argvToStrings(int argc, char ** argv);
 
-struct Completion {
+struct Completion
+{
     std::string completion;
     std::string description;
 
@@ -465,4 +477,4 @@ public:
 
 Strings parseShebangContent(std::string_view s);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/args/root.hh b/src/libutil/include/nix/util/args/root.hh
index cdc9be613..86b677be4 100644
--- a/src/libutil/include/nix/util/args/root.hh
+++ b/src/libutil/include/nix/util/args/root.hh
@@ -57,7 +57,8 @@ protected:
     /**
      * A pointer to the completion and its two arguments; a thunk;
      */
-    struct DeferredCompletion {
+    struct DeferredCompletion
+    {
         const CompleterClosure & completer;
         size_t n;
         std::string prefix;
@@ -82,4 +83,4 @@ private:
     std::optional<std::string> needsCompletion(std::string_view s);
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/array-from-string-literal.hh b/src/libutil/include/nix/util/array-from-string-literal.hh
new file mode 100644
index 000000000..a4a137609
--- /dev/null
+++ b/src/libutil/include/nix/util/array-from-string-literal.hh
@@ -0,0 +1,27 @@
+#pragma once
+///@file
+
+#include <algorithm>
+#include <array>
+
+namespace nix {
+
+template<size_t sizeWithNull>
+struct ArrayNoNullAdaptor
+{
+    std::array<char, sizeWithNull - 1> data;
+
+    constexpr ArrayNoNullAdaptor(const char (&init)[sizeWithNull])
+    {
+        static_assert(sizeWithNull > 0);
+        std::copy_n(init, sizeWithNull - 1, data.data());
+    }
+};
+
+template<ArrayNoNullAdaptor str>
+constexpr auto operator""_arrayNoNull()
+{
+    return str.data;
+}
+
+} // namespace nix
diff --git a/src/libutil/include/nix/util/base-n.hh b/src/libutil/include/nix/util/base-n.hh
new file mode 100644
index 000000000..637a06f3f
--- /dev/null
+++ b/src/libutil/include/nix/util/base-n.hh
@@ -0,0 +1,53 @@
+#pragma once
+///@file
+
+#include <string>
+#include <span>
+
+namespace nix {
+
+namespace base16 {
+
+/**
+ * Returns the length of a base-16 representation of this many bytes.
+ */
+[[nodiscard]] constexpr static inline size_t encodedLength(size_t origSize)
+{
+    return origSize * 2;
+}
+
+/**
+ * Encode arbitrary bytes as Base16.
+ */
+std::string encode(std::span<const std::byte> b);
+
+/**
+ * Decode arbitrary Base16 string to bytes.
+ */
+std::string decode(std::string_view s);
+
+} // namespace base16
+
+namespace base64 {
+
+/**
+ * Returns the length of a base-64 representation of this many bytes.
+ */
+[[nodiscard]] constexpr static inline size_t encodedLength(size_t origSize)
+{
+    return ((4 * origSize / 3) + 3) & ~3;
+}
+
+/**
+ * Encode arbitrary bytes as Base64.
+ */
+std::string encode(std::span<const std::byte> b);
+
+/**
+ * Decode arbitrary Base64 string to bytes.
+ */
+std::string decode(std::string_view s);
+
+} // namespace base64
+
+} // namespace nix
diff --git a/src/libutil/include/nix/util/base-nix-32.hh b/src/libutil/include/nix/util/base-nix-32.hh
new file mode 100644
index 000000000..28095e92c
--- /dev/null
+++ b/src/libutil/include/nix/util/base-nix-32.hh
@@ -0,0 +1,47 @@
+#pragma once
+///@file
+
+#include <array>
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <span>
+
+#include "nix/util/array-from-string-literal.hh"
+
+namespace nix {
+
+struct BaseNix32
+{
+    /// omitted: E O U T
+    constexpr static std::array<char, 32> characters = "0123456789abcdfghijklmnpqrsvwxyz"_arrayNoNull;
+
+private:
+    static const std::array<uint8_t, 256> reverseMap;
+
+    const static constexpr uint8_t invalid = 0xFF;
+
+public:
+    static inline std::optional<uint8_t> lookupReverse(char base32)
+    {
+        uint8_t digit = reverseMap[static_cast<unsigned char>(base32)];
+        if (digit == invalid)
+            return std::nullopt;
+        else
+            return digit;
+    }
+
+    /**
+     * Returns the length of a base-32 representation of this hash.
+     */
+    [[nodiscard]] constexpr static inline size_t encodedLength(size_t originalLength)
+    {
+        return (originalLength * 8 - 1) / 5 + 1;
+    }
+
+    static std::string encode(std::span<const std::byte> originalData);
+
+    static std::string decode(std::string_view s);
+};
+
+} // namespace nix
diff --git a/src/libutil/include/nix/util/callback.hh b/src/libutil/include/nix/util/callback.hh
index c2cada2f6..2ed48c7a3 100644
--- a/src/libutil/include/nix/util/callback.hh
+++ b/src/libutil/include/nix/util/callback.hh
@@ -20,14 +20,18 @@ class Callback
 
 public:
 
-    Callback(std::function<void(std::future<T>)> fun) : fun(fun) { }
+    Callback(std::function<void(std::future<T>)> fun)
+        : fun(fun)
+    {
+    }
 
     // NOTE: std::function is noexcept move-constructible since C++20.
     Callback(Callback && callback) noexcept(std::is_nothrow_move_constructible_v<decltype(fun)>)
         : fun(std::move(callback.fun))
     {
         auto prev = callback.done.test_and_set();
-        if (prev) done.test_and_set();
+        if (prev)
+            done.test_and_set();
     }
 
     void operator()(T && t) noexcept
@@ -49,4 +53,4 @@ public:
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/canon-path.hh b/src/libutil/include/nix/util/canon-path.hh
index f84347dc4..334c9e332 100644
--- a/src/libutil/include/nix/util/canon-path.hh
+++ b/src/libutil/include/nix/util/canon-path.hh
@@ -51,13 +51,16 @@ public:
 
     explicit CanonPath(const char * raw)
         : CanonPath(std::string_view(raw))
-    { }
+    {
+    }
 
-    struct unchecked_t { };
+    struct unchecked_t
+    {};
 
     CanonPath(unchecked_t _, std::string path)
         : path(std::move(path))
-    { }
+    {
+    }
 
     /**
      * Construct a canon path from a vector of elements.
@@ -74,13 +77,19 @@ public:
     CanonPath(std::string_view raw, const CanonPath & root);
 
     bool isRoot() const
-    { return path.size() <= 1; }
+    {
+        return path.size() <= 1;
+    }
 
     explicit operator std::string_view() const
-    { return path; }
+    {
+        return path;
+    }
 
     const std::string & abs() const
-    { return path; }
+    {
+        return path;
+    }
 
     /**
      * Like abs(), but return an empty string if this path is
@@ -93,10 +102,14 @@ public:
     }
 
     const char * c_str() const
-    { return path.c_str(); }
+    {
+        return path.c_str();
+    }
 
     std::string_view rel() const
-    { return ((std::string_view) path).substr(1); }
+    {
+        return ((std::string_view) path).substr(1);
+    }
 
     const char * rel_c_str() const
     {
@@ -113,18 +126,25 @@ public:
         Iterator(std::string_view remaining)
             : remaining(remaining)
             , slash(remaining.find('/'))
-        { }
+        {
+        }
 
-        bool operator != (const Iterator & x) const
-        { return remaining.data() != x.remaining.data(); }
+        bool operator!=(const Iterator & x) const
+        {
+            return remaining.data() != x.remaining.data();
+        }
 
-        bool operator == (const Iterator & x) const
-        { return !(*this != x); }
+        bool operator==(const Iterator & x) const
+        {
+            return !(*this != x);
+        }
 
-        const std::string_view operator * () const
-        { return remaining.substr(0, slash); }
+        const std::string_view operator*() const
+        {
+            return remaining.substr(0, slash);
+        }
 
-        void operator ++ ()
+        void operator++()
         {
             if (slash == remaining.npos)
                 remaining = remaining.substr(remaining.size());
@@ -135,8 +155,15 @@ public:
         }
     };
 
-    Iterator begin() const { return Iterator(rel()); }
-    Iterator end() const { return Iterator(rel().substr(path.size() - 1)); }
+    Iterator begin() const
+    {
+        return Iterator(rel());
+    }
+
+    Iterator end() const
+    {
+        return Iterator(rel().substr(path.size() - 1));
+    }
 
     std::optional<CanonPath> parent() const;
 
@@ -147,21 +174,27 @@ public:
 
     std::optional<std::string_view> dirOf() const
     {
-        if (isRoot()) return std::nullopt;
+        if (isRoot())
+            return std::nullopt;
         return ((std::string_view) path).substr(0, path.rfind('/'));
     }
 
     std::optional<std::string_view> baseName() const
     {
-        if (isRoot()) return std::nullopt;
+        if (isRoot())
+            return std::nullopt;
         return ((std::string_view) path).substr(path.rfind('/') + 1);
     }
 
-    bool operator == (const CanonPath & x) const
-    { return path == x.path; }
+    bool operator==(const CanonPath & x) const
+    {
+        return path == x.path;
+    }
 
-    bool operator != (const CanonPath & x) const
-    { return path != x.path; }
+    bool operator!=(const CanonPath & x) const
+    {
+        return path != x.path;
+    }
 
     /**
      * Compare paths lexicographically except that path separators
@@ -169,16 +202,19 @@ public:
      * a directory is always followed directly by its children. For
      * instance, 'foo' < 'foo/bar' < 'foo!'.
      */
-    auto operator <=> (const CanonPath & x) const
+    auto operator<=>(const CanonPath & x) const
     {
         auto i = path.begin();
         auto j = x.path.begin();
-        for ( ; i != path.end() && j != x.path.end(); ++i, ++j) {
+        for (; i != path.end() && j != x.path.end(); ++i, ++j) {
             auto c_i = *i;
-            if (c_i == '/') c_i = 0;
+            if (c_i == '/')
+                c_i = 0;
             auto c_j = *j;
-            if (c_j == '/') c_j = 0;
-            if (auto cmp = c_i <=> c_j; cmp != 0) return cmp;
+            if (c_j == '/')
+                c_j = 0;
+            if (auto cmp = c_i <=> c_j; cmp != 0)
+                return cmp;
         }
         return (i != path.end()) <=> (j != x.path.end());
     }
@@ -199,14 +235,14 @@ public:
     /**
      * Concatenate two paths.
      */
-    CanonPath operator / (const CanonPath & x) const;
+    CanonPath operator/(const CanonPath & x) const;
 
     /**
      * Add a path component to this one. It must not contain any slashes.
      */
     void push(std::string_view c);
 
-    CanonPath operator / (std::string_view c) const;
+    CanonPath operator/(std::string_view c) const;
 
     /**
      * Check whether access to this path is allowed, which is the case
@@ -222,17 +258,19 @@ public:
      */
     std::string makeRelative(const CanonPath & path) const;
 
-    friend class std::hash<CanonPath>;
+    friend struct std::hash<CanonPath>;
 };
 
-std::ostream & operator << (std::ostream & stream, const CanonPath & path);
+std::ostream & operator<<(std::ostream & stream, const CanonPath & path);
 
-}
+} // namespace nix
 
 template<>
 struct std::hash<nix::CanonPath>
 {
-    std::size_t operator ()(const nix::CanonPath & s) const noexcept
+    using is_avalanching = std::true_type;
+
+    std::size_t operator()(const nix::CanonPath & s) const noexcept
     {
         return std::hash<std::string>{}(s.path);
     }
diff --git a/src/libutil/include/nix/util/checked-arithmetic.hh b/src/libutil/include/nix/util/checked-arithmetic.hh
index dcc6d86af..48679622c 100644
--- a/src/libutil/include/nix/util/checked-arithmetic.hh
+++ b/src/libutil/include/nix/util/checked-arithmetic.hh
@@ -32,15 +32,18 @@ struct Checked
     T value;
 
     Checked() = default;
+
     explicit Checked(T const value)
         : value{value}
     {
     }
+
     Checked(Checked<T> const & other) = default;
     Checked(Checked<T> && other) = default;
     Checked<T> & operator=(Checked<T> const & other) = default;
 
     std::strong_ordering operator<=>(Checked<T> const & other) const = default;
+
     std::strong_ordering operator<=>(T const & other) const
     {
         return value <=> other;
@@ -68,6 +71,7 @@ struct Checked
             , overflowed_{overflowed ? OverflowKind::Overflow : OverflowKind::NoOverflow}
         {
         }
+
         Result(T value, OverflowKind overflowed)
             : value{value}
             , overflowed_{overflowed}
@@ -116,6 +120,7 @@ struct Checked
     {
         return (*this) + other.value;
     }
+
     Result operator+(T const other) const
     {
         T result;
@@ -127,6 +132,7 @@ struct Checked
     {
         return (*this) - other.value;
     }
+
     Result operator-(T const other) const
     {
         T result;
@@ -138,6 +144,7 @@ struct Checked
     {
         return (*this) * other.value;
     }
+
     Result operator*(T const other) const
     {
         T result;
@@ -149,6 +156,7 @@ struct Checked
     {
         return (*this) / other.value;
     }
+
     /**
      * Performs a checked division.
      *
@@ -181,4 +189,4 @@ std::ostream & operator<<(std::ostream & ios, Checked<T> v)
     return ios;
 }
 
-}
+} // namespace nix::checked
diff --git a/src/libutil/include/nix/util/chunked-vector.hh b/src/libutil/include/nix/util/chunked-vector.hh
index 2c21183ac..38e53c7f5 100644
--- a/src/libutil/include/nix/util/chunked-vector.hh
+++ b/src/libutil/include/nix/util/chunked-vector.hh
@@ -20,7 +20,8 @@ namespace nix {
  * references to its elements.
  */
 template<typename T, size_t ChunkSize>
-class ChunkedVector {
+class ChunkedVector
+{
 private:
     uint32_t size_ = 0;
     std::vector<std::vector<T>> chunks;
@@ -45,13 +46,16 @@ public:
         addChunk();
     }
 
-    uint32_t size() const noexcept { return size_; }
+    uint32_t size() const noexcept
+    {
+        return size_;
+    }
 
-    template <typename... Args>
+    template<typename... Args>
     std::pair<T &, uint32_t> add(Args &&... args)
     {
         const auto idx = size_++;
-        auto & chunk = [&] () -> auto & {
+        auto & chunk = [&]() -> auto & {
             if (auto & back = chunks.back(); back.size() < ChunkSize)
                 return back;
             return addChunk();
@@ -78,4 +82,4 @@ public:
                 fn(e);
     }
 };
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/closure.hh b/src/libutil/include/nix/util/closure.hh
index 54b18ab3d..d55d52c87 100644
--- a/src/libutil/include/nix/util/closure.hh
+++ b/src/libutil/include/nix/util/closure.hh
@@ -13,11 +13,7 @@ template<typename T>
 using GetEdgesAsync = std::function<void(const T &, std::function<void(std::promise<set<T>> &)>)>;
 
 template<typename T>
-void computeClosure(
-    const set<T> startElts,
-    set<T> & res,
-    GetEdgesAsync<T> getEdgesAsync
-)
+void computeClosure(const set<T> startElts, set<T> & res, GetEdgesAsync<T> getEdgesAsync)
 {
     struct State
     {
@@ -35,8 +31,10 @@ void computeClosure(
     enqueue = [&](const T & current) -> void {
         {
             auto state(state_.lock());
-            if (state->exc) return;
-            if (!state->res.insert(current).second) return;
+            if (state->exc)
+                return;
+            if (!state->res.insert(current).second)
+                return;
             state->pending++;
         }
 
@@ -48,13 +46,16 @@ void computeClosure(
                 {
                     auto state(state_.lock());
                     assert(state->pending);
-                    if (!--state->pending) done.notify_one();
+                    if (!--state->pending)
+                        done.notify_one();
                 }
             } catch (...) {
                 auto state(state_.lock());
-                if (!state->exc) state->exc = std::current_exception();
+                if (!state->exc)
+                    state->exc = std::current_exception();
                 assert(state->pending);
-                if (!--state->pending) done.notify_one();
+                if (!--state->pending)
+                    done.notify_one();
             };
         });
     };
@@ -64,9 +65,11 @@ void computeClosure(
 
     {
         auto state(state_.lock());
-        while (state->pending) state.wait(done);
-        if (state->exc) std::rethrow_exception(state->exc);
+        while (state->pending)
+            state.wait(done);
+        if (state->exc)
+            std::rethrow_exception(state->exc);
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/comparator.hh b/src/libutil/include/nix/util/comparator.hh
index c3af1758d..64ce47dc9 100644
--- a/src/libutil/include/nix/util/comparator.hh
+++ b/src/libutil/include/nix/util/comparator.hh
@@ -1,13 +1,14 @@
 #pragma once
 ///@file
 
-#define GENERATE_ONE_CMP(PRE, RET, QUAL, COMPARATOR, MY_TYPE, ...) \
-    PRE RET QUAL operator COMPARATOR(const MY_TYPE & other) const noexcept { \
-      __VA_OPT__(const MY_TYPE * me = this;) \
-      auto fields1 = std::tie( __VA_ARGS__ ); \
-      __VA_OPT__(me = &other;) \
-      auto fields2 = std::tie( __VA_ARGS__ ); \
-      return fields1 COMPARATOR fields2; \
+#define GENERATE_ONE_CMP(PRE, RET, QUAL, COMPARATOR, MY_TYPE, ...)         \
+    PRE RET QUAL operator COMPARATOR(const MY_TYPE & other) const noexcept \
+    {                                                                      \
+        __VA_OPT__(const MY_TYPE * me = this;)                             \
+        auto fields1 = std::tie(__VA_ARGS__);                              \
+        __VA_OPT__(me = &other;)                                           \
+        auto fields2 = std::tie(__VA_ARGS__);                              \
+        return fields1 COMPARATOR fields2;                                 \
     }
 #define GENERATE_EQUAL(prefix, qualification, my_type, args...) \
     GENERATE_ONE_CMP(prefix, bool, qualification, ==, my_type, args)
@@ -36,8 +37,8 @@
  * ```
  */
 #define GENERATE_CMP(args...) \
-    GENERATE_EQUAL(,,args) \
-    GENERATE_SPACESHIP(,auto,,args)
+    GENERATE_EQUAL(, , args)  \
+    GENERATE_SPACESHIP(, auto, , args)
 
 /**
  * @param prefix This is for something before each declaration like
@@ -46,5 +47,5 @@
  * @param my_type the type are defining operators for.
  */
 #define GENERATE_CMP_EXT(prefix, ret, my_type, args...) \
-    GENERATE_EQUAL(prefix, my_type ::, my_type, args) \
+    GENERATE_EQUAL(prefix, my_type ::, my_type, args)   \
     GENERATE_SPACESHIP(prefix, ret, my_type ::, my_type, args)
diff --git a/src/libutil/include/nix/util/compression.hh b/src/libutil/include/nix/util/compression.hh
index 15d869e88..351826856 100644
--- a/src/libutil/include/nix/util/compression.hh
+++ b/src/libutil/include/nix/util/compression.hh
@@ -29,4 +29,4 @@ MakeError(UnknownCompressionMethod, Error);
 
 MakeError(CompressionError, Error);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/config-global.hh b/src/libutil/include/nix/util/config-global.hh
index 44f89e06d..0e6f43ec4 100644
--- a/src/libutil/include/nix/util/config-global.hh
+++ b/src/libutil/include/nix/util/config-global.hh
@@ -17,7 +17,7 @@ struct GlobalConfig : public AbstractConfig
 
     bool set(const std::string & name, const std::string & value) override;
 
-    void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) override;
+    void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) const override;
 
     void resetOverridden() override;
 
@@ -35,4 +35,4 @@ struct GlobalConfig : public AbstractConfig
 
 extern GlobalConfig globalConfig;
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/config-impl.hh b/src/libutil/include/nix/util/config-impl.hh
index 15e0c9554..f407bc862 100644
--- a/src/libutil/include/nix/util/config-impl.hh
+++ b/src/libutil/include/nix/util/config-impl.hh
@@ -12,24 +12,33 @@
  * instantiation.
  */
 
+#include "nix/util/util.hh"
 #include "nix/util/configuration.hh"
 #include "nix/util/args.hh"
+#include "nix/util/logging.hh"
 
 namespace nix {
 
-template<> struct BaseSetting<Strings>::trait
+template<>
+struct BaseSetting<Strings>::trait
 {
     static constexpr bool appendable = true;
 };
-template<> struct BaseSetting<StringSet>::trait
+
+template<>
+struct BaseSetting<StringSet>::trait
 {
     static constexpr bool appendable = true;
 };
-template<> struct BaseSetting<StringMap>::trait
+
+template<>
+struct BaseSetting<StringMap>::trait
 {
     static constexpr bool appendable = true;
 };
-template<> struct BaseSetting<std::set<ExperimentalFeature>>::trait
+
+template<>
+struct BaseSetting<std::set<ExperimentalFeature>>::trait
 {
     static constexpr bool appendable = true;
 };
@@ -46,17 +55,19 @@ bool BaseSetting<T>::isAppendable()
     return trait::appendable;
 }
 
-template<> void BaseSetting<Strings>::appendOrSet(Strings newValue, bool append);
-template<> void BaseSetting<StringSet>::appendOrSet(StringSet newValue, bool append);
-template<> void BaseSetting<StringMap>::appendOrSet(StringMap newValue, bool append);
-template<> void BaseSetting<std::set<ExperimentalFeature>>::appendOrSet(std::set<ExperimentalFeature> newValue, bool append);
+template<>
+void BaseSetting<Strings>::appendOrSet(Strings newValue, bool append);
+template<>
+void BaseSetting<StringSet>::appendOrSet(StringSet newValue, bool append);
+template<>
+void BaseSetting<StringMap>::appendOrSet(StringMap newValue, bool append);
+template<>
+void BaseSetting<std::set<ExperimentalFeature>>::appendOrSet(std::set<ExperimentalFeature> newValue, bool append);
 
 template<typename T>
 void BaseSetting<T>::appendOrSet(T newValue, bool append)
 {
-    static_assert(
-        !trait::appendable,
-        "using default `appendOrSet` implementation with an appendable type");
+    static_assert(!trait::appendable, "using default `appendOrSet` implementation with an appendable type");
     assert(!append);
 
     value = std::move(newValue);
@@ -69,13 +80,15 @@ void BaseSetting<T>::set(const std::string & str, bool append)
         appendOrSet(parse(str), append);
     else {
         assert(experimentalFeature);
-        warn("Ignoring setting '%s' because experimental feature '%s' is not enabled",
+        warn(
+            "Ignoring setting '%s' because experimental feature '%s' is not enabled",
             name,
             showExperimentalFeature(*experimentalFeature));
     }
 }
 
-template<> void BaseSetting<bool>::convertToArg(Args & args, const std::string & category);
+template<>
+void BaseSetting<bool>::convertToArg(Args & args, const std::string & category);
 
 template<typename T>
 void BaseSetting<T>::convertToArg(Args & args, const std::string & category)
@@ -86,7 +99,10 @@ void BaseSetting<T>::convertToArg(Args & args, const std::string & category)
         .description = fmt("Set the `%s` setting.", name),
         .category = category,
         .labels = {"value"},
-        .handler = {[this](std::string s) { overridden = true; set(s); }},
+        .handler = {[this](std::string s) {
+            overridden = true;
+            set(s);
+        }},
         .experimentalFeature = experimentalFeature,
     });
 
@@ -97,14 +113,19 @@ void BaseSetting<T>::convertToArg(Args & args, const std::string & category)
             .description = fmt("Append to the `%s` setting.", name),
             .category = category,
             .labels = {"value"},
-            .handler = {[this](std::string s) { overridden = true; set(s, true); }},
+            .handler = {[this](std::string s) {
+                overridden = true;
+                set(s, true);
+            }},
             .experimentalFeature = experimentalFeature,
         });
 }
 
-#define DECLARE_CONFIG_SERIALISER(TY) \
-    template<> TY BaseSetting< TY >::parse(const std::string & str) const; \
-    template<> std::string BaseSetting< TY >::to_string() const;
+#define DECLARE_CONFIG_SERIALISER(TY)                         \
+    template<>                                                \
+    TY BaseSetting<TY>::parse(const std::string & str) const; \
+    template<>                                                \
+    std::string BaseSetting<TY>::to_string() const;
 
 DECLARE_CONFIG_SERIALISER(std::string)
 DECLARE_CONFIG_SERIALISER(std::optional<std::string>)
@@ -134,4 +155,4 @@ std::string BaseSetting<T>::to_string() const
     return std::to_string(value);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/configuration.hh b/src/libutil/include/nix/util/configuration.hh
index 24b42f02c..65391721c 100644
--- a/src/libutil/include/nix/util/configuration.hh
+++ b/src/libutil/include/nix/util/configuration.hh
@@ -73,7 +73,7 @@ public:
      * - res: map to store settings in
      * - overriddenOnly: when set to true only overridden settings will be added to `res`
      */
-    virtual void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) = 0;
+    virtual void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) const = 0;
 
     /**
      * Parses the configuration in `contents` and applies it
@@ -160,7 +160,7 @@ public:
 
     void addSetting(AbstractSetting * setting);
 
-    void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) override;
+    void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) const override;
 
     void resetOverridden() override;
 
@@ -247,7 +247,8 @@ protected:
 
 public:
 
-    BaseSetting(const T & def,
+    BaseSetting(
+        const T & def,
         const bool documentDefault,
         const std::string & name,
         const std::string & description,
@@ -257,21 +258,58 @@ public:
         , value(def)
         , defaultValue(def)
         , documentDefault(documentDefault)
-    { }
+    {
+    }
+
+    operator const T &() const
+    {
+        return value;
+    }
+
+    operator T &()
+    {
+        return value;
+    }
+
+    const T & get() const
+    {
+        return value;
+    }
+
+    T & get()
+    {
+        return value;
+    }
 
-    operator const T &() const { return value; }
-    operator T &() { return value; }
-    const T & get() const { return value; }
-    T & get() { return value; }
     template<typename U>
-    bool operator ==(const U & v2) const { return value == v2; }
+    bool operator==(const U & v2) const
+    {
+        return value == v2;
+    }
+
     template<typename U>
-    bool operator !=(const U & v2) const { return value != v2; }
+    bool operator!=(const U & v2) const
+    {
+        return value != v2;
+    }
+
     template<typename U>
-    void operator =(const U & v) { assign(v); }
-    virtual void assign(const T & v) { value = v; }
+    void operator=(const U & v)
+    {
+        assign(v);
+    }
+
+    virtual void assign(const T & v)
+    {
+        value = v;
+    }
+
     template<typename U>
-    void setDefault(const U & v) { if (!overridden) value = v; }
+    void setDefault(const U & v)
+    {
+        if (!overridden)
+            value = v;
+    }
 
     /**
      * Require any experimental feature the setting depends on
@@ -307,19 +345,23 @@ public:
 };
 
 template<typename T>
-std::ostream & operator <<(std::ostream & str, const BaseSetting<T> & opt)
+std::ostream & operator<<(std::ostream & str, const BaseSetting<T> & opt)
 {
     return str << static_cast<const T &>(opt);
 }
 
 template<typename T>
-bool operator ==(const T & v1, const BaseSetting<T> & v2) { return v1 == static_cast<const T &>(v2); }
+bool operator==(const T & v1, const BaseSetting<T> & v2)
+{
+    return v1 == static_cast<const T &>(v2);
+}
 
 template<typename T>
 class Setting : public BaseSetting<T>
 {
 public:
-    Setting(Config * options,
+    Setting(
+        Config * options,
         const T & def,
         const std::string & name,
         const std::string & description,
@@ -331,7 +373,10 @@ public:
         options->addSetting(this);
     }
 
-    void operator =(const T & v) { this->assign(v); }
+    void operator=(const T & v)
+    {
+        this->assign(v);
+    }
 };
 
 /**
@@ -345,7 +390,8 @@ class PathSetting : public BaseSetting<Path>
 {
 public:
 
-    PathSetting(Config * options,
+    PathSetting(
+        Config * options,
         const Path & def,
         const std::string & name,
         const std::string & description,
@@ -353,9 +399,15 @@ public:
 
     Path parse(const std::string & str) const override;
 
-    Path operator +(const char * p) const { return value + p; }
+    Path operator+(const char * p) const
+    {
+        return value + p;
+    }
 
-    void operator =(const Path & v) { this->assign(v); }
+    void operator=(const Path & v)
+    {
+        this->assign(v);
+    }
 };
 
 /**
@@ -367,7 +419,8 @@ class OptionalPathSetting : public BaseSetting<std::optional<Path>>
 {
 public:
 
-    OptionalPathSetting(Config * options,
+    OptionalPathSetting(
+        Config * options,
         const std::optional<Path> & def,
         const std::string & name,
         const std::string & description,
@@ -375,14 +428,16 @@ public:
 
     std::optional<Path> parse(const std::string & str) const override;
 
-    void operator =(const std::optional<Path> & v);
+    void operator=(const std::optional<Path> & v);
 };
 
-
-struct ExperimentalFeatureSettings : Config {
+struct ExperimentalFeatureSettings : Config
+{
 
     Setting<std::set<ExperimentalFeature>> experimentalFeatures{
-        this, {}, "experimental-features",
+        this,
+        {},
+        "experimental-features",
         R"(
           Experimental features that are enabled.
 
@@ -426,4 +481,4 @@ struct ExperimentalFeatureSettings : Config {
 // FIXME: don't use a global variable.
 extern ExperimentalFeatureSettings experimentalFeatureSettings;
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/current-process.hh b/src/libutil/include/nix/util/current-process.hh
index b2c92a34c..c4a952581 100644
--- a/src/libutil/include/nix/util/current-process.hh
+++ b/src/libutil/include/nix/util/current-process.hh
@@ -2,15 +2,21 @@
 ///@file
 
 #include <optional>
+#include <chrono>
 
 #ifndef _WIN32
-# include <sys/resource.h>
+#  include <sys/resource.h>
 #endif
 
 #include "nix/util/types.hh"
 
 namespace nix {
 
+/**
+ * Get the current process's user space CPU time.
+ */
+std::chrono::microseconds getCpuUserTime();
+
 /**
  * If cgroups are active, attempt to calculate the number of CPUs available.
  * If cgroups are unavailable or if cpu.max is set to "max", return 0.
@@ -38,4 +44,4 @@ void restoreProcessContext(bool restoreMounts = true);
  */
 std::optional<Path> getSelfExe();
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/english.hh b/src/libutil/include/nix/util/english.hh
index 9c6c93571..1dcff51ca 100644
--- a/src/libutil/include/nix/util/english.hh
+++ b/src/libutil/include/nix/util/english.hh
@@ -9,10 +9,7 @@ namespace nix {
  *
  * If `count == 1`, prints `1 {single}` to `output`, otherwise prints `{count} {plural}`.
  */
-std::ostream & pluralize(
-    std::ostream & output,
-    unsigned int count,
-    const std::string_view single,
-    const std::string_view plural);
+std::ostream &
+pluralize(std::ostream & output, unsigned int count, const std::string_view single, const std::string_view plural);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/environment-variables.hh b/src/libutil/include/nix/util/environment-variables.hh
index 9b2fab4f4..f8c3b7ad0 100644
--- a/src/libutil/include/nix/util/environment-variables.hh
+++ b/src/libutil/include/nix/util/environment-variables.hh
@@ -66,4 +66,4 @@ void clearEnv();
  */
 void replaceEnv(const StringMap & newEnv);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/error.hh b/src/libutil/include/nix/util/error.hh
index 7c96112ea..e564ca5b9 100644
--- a/src/libutil/include/nix/util/error.hh
+++ b/src/libutil/include/nix/util/error.hh
@@ -22,6 +22,7 @@
 #include <list>
 #include <memory>
 #include <optional>
+#include <utility>
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -29,22 +30,13 @@
 
 namespace nix {
 
-
-typedef enum {
-    lvlError = 0,
-    lvlWarn,
-    lvlNotice,
-    lvlInfo,
-    lvlTalkative,
-    lvlChatty,
-    lvlDebug,
-    lvlVomit
-} Verbosity;
+typedef enum { lvlError = 0, lvlWarn, lvlNotice, lvlInfo, lvlTalkative, lvlChatty, lvlDebug, lvlVomit } Verbosity;
 
 /**
  * The lines of code surrounding an error.
  */
-struct LinesOfCode {
+struct LinesOfCode
+{
     std::optional<std::string> prevLineOfCode;
     std::optional<std::string> errLineOfCode;
     std::optional<std::string> nextLineOfCode;
@@ -60,10 +52,7 @@ struct LinesOfCode {
    4feb7d9f71? */
 struct Pos;
 
-void printCodeLines(std::ostream & out,
-    const std::string & prefix,
-    const Pos & errPos,
-    const LinesOfCode & loc);
+void printCodeLines(std::ostream & out, const std::string & prefix, const Pos & errPos, const LinesOfCode & loc);
 
 /**
  * When a stack frame is printed.
@@ -77,15 +66,17 @@ enum struct TracePrint {
     Always,
 };
 
-struct Trace {
+struct Trace
+{
     std::shared_ptr<const Pos> pos;
     HintFmt hint;
     TracePrint print = TracePrint::Default;
 };
 
-inline std::strong_ordering operator<=>(const Trace& lhs, const Trace& rhs);
+inline std::strong_ordering operator<=>(const Trace & lhs, const Trace & rhs);
 
-struct ErrorInfo {
+struct ErrorInfo
+{
     Verbosity level;
     HintFmt msg;
     std::shared_ptr<const Pos> pos;
@@ -128,51 +119,71 @@ protected:
 
 public:
     BaseError(const BaseError &) = default;
-    BaseError& operator=(const BaseError &) = default;
-    BaseError& operator=(BaseError &&) = default;
+    BaseError & operator=(const BaseError &) = default;
+    BaseError & operator=(BaseError &&) = default;
 
     template<typename... Args>
-    BaseError(unsigned int status, const Args & ... args)
-        : err { .level = lvlError, .msg = HintFmt(args...), .status = status }
-    { }
+    BaseError(unsigned int status, const Args &... args)
+        : err{.level = lvlError, .msg = HintFmt(args...), .status = status}
+    {
+    }
 
     template<typename... Args>
-    explicit BaseError(const std::string & fs, const Args & ... args)
-        : err { .level = lvlError, .msg = HintFmt(fs, args...) }
-    { }
+    explicit BaseError(const std::string & fs, const Args &... args)
+        : err{.level = lvlError, .msg = HintFmt(fs, args...)}
+    {
+    }
 
     template<typename... Args>
-    BaseError(const Suggestions & sug, const Args & ... args)
-        : err { .level = lvlError, .msg = HintFmt(args...), .suggestions = sug }
-    { }
+    BaseError(const Suggestions & sug, const Args &... args)
+        : err{.level = lvlError, .msg = HintFmt(args...), .suggestions = sug}
+    {
+    }
 
     BaseError(HintFmt hint)
-        : err { .level = lvlError, .msg = hint }
-    { }
+        : err{.level = lvlError, .msg = hint}
+    {
+    }
 
     BaseError(ErrorInfo && e)
         : err(std::move(e))
-    { }
+    {
+    }
 
     BaseError(const ErrorInfo & e)
         : err(e)
-    { }
+    {
+    }
 
     /** The error message without "error: " prefixed to it. */
-    std::string message() {
+    std::string message()
+    {
         return err.msg.str();
     }
 
-    const char * what() const noexcept override { return calcWhat().c_str(); }
-    const std::string & msg() const { return calcWhat(); }
-    const ErrorInfo & info() const { calcWhat(); return err; }
+    const char * what() const noexcept override
+    {
+        return calcWhat().c_str();
+    }
+
+    const std::string & msg() const
+    {
+        return calcWhat();
+    }
+
+    const ErrorInfo & info() const
+    {
+        calcWhat();
+        return err;
+    }
 
     void withExitStatus(unsigned int status)
     {
         err.status = status;
     }
 
-    void atPos(std::shared_ptr<const Pos> pos) {
+    void atPos(std::shared_ptr<const Pos> pos)
+    {
         err.pos = pos;
     }
 
@@ -182,23 +193,29 @@ public:
     }
 
     template<typename... Args>
-    void addTrace(std::shared_ptr<const Pos> && e, std::string_view fs, const Args & ... args)
+    void addTrace(std::shared_ptr<const Pos> && e, std::string_view fs, const Args &... args)
     {
         addTrace(std::move(e), HintFmt(std::string(fs), args...));
     }
 
     void addTrace(std::shared_ptr<const Pos> && e, HintFmt hint, TracePrint print = TracePrint::Default);
 
-    bool hasTrace() const { return !err.traces.empty(); }
+    bool hasTrace() const
+    {
+        return !err.traces.empty();
+    }
 
-    const ErrorInfo & info() { return err; };
+    const ErrorInfo & info()
+    {
+        return err;
+    };
 };
 
 #define MakeError(newClass, superClass) \
-    class newClass : public superClass                  \
-    {                                                   \
-    public:                                             \
-        using superClass::superClass;                   \
+    class newClass : public superClass  \
+    {                                   \
+    public:                             \
+        using superClass::superClass;   \
     }
 
 MakeError(Error, BaseError);
@@ -236,8 +253,9 @@ public:
      * will be used to try to add additional information to the message.
      */
     template<typename... Args>
-    SysError(int errNo, const Args & ... args)
-        : SystemError(""), errNo(errNo)
+    SysError(int errNo, const Args &... args)
+        : SystemError("")
+        , errNo(errNo)
     {
         auto hf = HintFmt(args...);
         err.msg = HintFmt("%1%: %2%", Uncolored(hf.str()), strerror(errNo));
@@ -250,15 +268,15 @@ public:
      * calling this constructor!
      */
     template<typename... Args>
-    SysError(const Args & ... args)
-        : SysError(errno, args ...)
+    SysError(const Args &... args)
+        : SysError(errno, args...)
     {
     }
 };
 
 #ifdef _WIN32
 namespace windows {
-    class WinError;
+class WinError;
 }
 #endif
 
@@ -282,23 +300,16 @@ using NativeSysError =
 void throwExceptionSelfCheck();
 
 /**
- * Print a message and abort().
+ * Print a message and std::terminate().
  */
 [[noreturn]]
 void panic(std::string_view msg);
 
 /**
- * Print a basic error message with source position and abort().
- * Use the unreachable() macro to call this.
- */
-[[noreturn]]
-void panic(const char * file, int line, const char * func);
-
-/**
- * Print a basic error message with source position and abort().
+ * Print a basic error message with source position and std::terminate().
  *
  * @note: This assumes that the logger is operational
  */
-#define unreachable() (::nix::panic(__FILE__, __LINE__, __func__))
+[[gnu::noinline, gnu::cold, noreturn]] void unreachable(std::source_location loc = std::source_location::current());
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/exec.hh b/src/libutil/include/nix/util/exec.hh
index a362cef35..e4c9bf772 100644
--- a/src/libutil/include/nix/util/exec.hh
+++ b/src/libutil/include/nix/util/exec.hh
@@ -12,4 +12,4 @@ namespace nix {
  */
 int execvpe(const OsChar * file0, const OsChar * const argv[], const OsChar * const envp[]);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/exit.hh b/src/libutil/include/nix/util/exit.hh
index 55f33e62f..5f0f256ed 100644
--- a/src/libutil/include/nix/util/exit.hh
+++ b/src/libutil/include/nix/util/exit.hh
@@ -11,9 +11,18 @@ class Exit : public std::exception
 {
 public:
     int status;
-    Exit() : status(0) { }
-    explicit Exit(int status) : status(status) { }
+
+    Exit()
+        : status(0)
+    {
+    }
+
+    explicit Exit(int status)
+        : status(status)
+    {
+    }
+
     virtual ~Exit();
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/experimental-features.hh b/src/libutil/include/nix/util/experimental-features.hh
index 8923517ba..0a8f15863 100644
--- a/src/libutil/include/nix/util/experimental-features.hh
+++ b/src/libutil/include/nix/util/experimental-features.hh
@@ -3,6 +3,7 @@
 
 #include "nix/util/error.hh"
 #include "nix/util/types.hh"
+#include "nix/util/json-non-null.hh"
 
 #include <nlohmann/json_fwd.hpp>
 
@@ -15,8 +16,7 @@ namespace nix {
  * their string representation and documentation in the corresponding
  * `.cc` file as well.
  */
-enum struct ExperimentalFeature
-{
+enum struct ExperimentalFeature {
     CaDerivations,
     ImpureDerivations,
     Flakes,
@@ -49,8 +49,7 @@ using Xp = ExperimentalFeature;
  * Parse an experimental feature (enum value) from its name. Experimental
  * feature flag names are hyphenated and do not contain spaces.
  */
-const std::optional<ExperimentalFeature> parseExperimentalFeature(
-        const std::string_view & name);
+const std::optional<ExperimentalFeature> parseExperimentalFeature(const std::string_view & name);
 
 /**
  * Show the name of an experimental feature. This is the opposite of
@@ -68,9 +67,7 @@ nlohmann::json documentExperimentalFeatures();
 /**
  * Shorthand for `str << showExperimentalFeature(feature)`.
  */
-std::ostream & operator<<(
-        std::ostream & str,
-        const ExperimentalFeature & feature);
+std::ostream & operator<<(std::ostream & str, const ExperimentalFeature & feature);
 
 /**
  * Parse a set of strings to the corresponding set of experimental
@@ -93,6 +90,13 @@ public:
     MissingExperimentalFeature(ExperimentalFeature missingFeature);
 };
 
+/**
+ * `ExperimentalFeature` is always rendered as a string.
+ */
+template<>
+struct json_avoids_null<ExperimentalFeature> : std::true_type
+{};
+
 /**
  * Semi-magic conversion to and from json.
  * See the nlohmann/json readme for more details.
@@ -100,4 +104,4 @@ public:
 void to_json(nlohmann::json &, const ExperimentalFeature &);
 void from_json(const nlohmann::json &, ExperimentalFeature &);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/file-content-address.hh b/src/libutil/include/nix/util/file-content-address.hh
index 0922604f8..def123202 100644
--- a/src/libutil/include/nix/util/file-content-address.hh
+++ b/src/libutil/include/nix/util/file-content-address.hh
@@ -57,22 +57,14 @@ std::string_view renderFileSerialisationMethod(FileSerialisationMethod method);
  * Dump a serialization of the given file system object.
  */
 void dumpPath(
-    const SourcePath & path,
-    Sink & sink,
-    FileSerialisationMethod method,
-    PathFilter & filter = defaultPathFilter);
+    const SourcePath & path, Sink & sink, FileSerialisationMethod method, PathFilter & filter = defaultPathFilter);
 
 /**
  * Restore a serialisation of the given file system object.
  *
  * \todo use an arbitrary `FileSystemObjectSink`.
  */
-void restorePath(
-    const Path & path,
-    Source & source,
-    FileSerialisationMethod method,
-    bool startFsync = false);
-
+void restorePath(const Path & path, Source & source, FileSerialisationMethod method, bool startFsync = false);
 
 /**
  * Compute the hash of the given file system object according to the
@@ -85,9 +77,7 @@ void restorePath(
  * ```
  */
 HashResult hashPath(
-    const SourcePath & path,
-    FileSerialisationMethod method, HashAlgorithm ha,
-    PathFilter & filter = defaultPathFilter);
+    const SourcePath & path, FileSerialisationMethod method, HashAlgorithm ha, PathFilter & filter = defaultPathFilter);
 
 /**
  * An enumeration of the ways we can ingest file system
@@ -153,8 +143,6 @@ std::string_view renderFileIngestionMethod(FileIngestionMethod method);
  * useful defined for a merkle format.
  */
 std::pair<Hash, std::optional<uint64_t>> hashPath(
-    const SourcePath & path,
-    FileIngestionMethod method, HashAlgorithm ha,
-    PathFilter & filter = defaultPathFilter);
+    const SourcePath & path, FileIngestionMethod method, HashAlgorithm ha, PathFilter & filter = defaultPathFilter);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/file-descriptor.hh b/src/libutil/include/nix/util/file-descriptor.hh
index e2bcce2a2..3dd2dd8e6 100644
--- a/src/libutil/include/nix/util/file-descriptor.hh
+++ b/src/libutil/include/nix/util/file-descriptor.hh
@@ -5,8 +5,8 @@
 #include "nix/util/error.hh"
 
 #ifdef _WIN32
-# define WIN32_LEAN_AND_MEAN
-# include <windows.h>
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
 #endif
 
 namespace nix {
@@ -93,18 +93,19 @@ void writeLine(Descriptor fd, std::string s);
 /**
  * Read a file descriptor until EOF occurs.
  */
-std::string drainFD(Descriptor fd, bool block = true, const size_t reserveSize=0);
+std::string drainFD(Descriptor fd, bool block = true, const size_t reserveSize = 0);
 
 /**
  * The Windows version is always blocking.
  */
 void drainFD(
-      Descriptor fd
-    , Sink & sink
+    Descriptor fd,
+    Sink & sink
 #ifndef _WIN32
-    , bool block = true
+    ,
+    bool block = true
 #endif
-    );
+);
 
 /**
  * Get [Standard Input](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin))
@@ -155,10 +156,10 @@ public:
     AutoCloseFD();
     AutoCloseFD(Descriptor fd);
     AutoCloseFD(const AutoCloseFD & fd) = delete;
-    AutoCloseFD(AutoCloseFD&& fd) noexcept;
+    AutoCloseFD(AutoCloseFD && fd) noexcept;
     ~AutoCloseFD();
-    AutoCloseFD& operator =(const AutoCloseFD & fd) = delete;
-    AutoCloseFD& operator =(AutoCloseFD&& fd);
+    AutoCloseFD & operator=(const AutoCloseFD & fd) = delete;
+    AutoCloseFD & operator=(AutoCloseFD && fd);
     Descriptor get() const;
     explicit operator bool() const;
     Descriptor release();
@@ -213,4 +214,4 @@ std::wstring handleToFileName(Descriptor handle);
 
 MakeError(EndOfFile, Error);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/file-path-impl.hh b/src/libutil/include/nix/util/file-path-impl.hh
index 1b4dd28f1..91c1a58cd 100644
--- a/src/libutil/include/nix/util/file-path-impl.hh
+++ b/src/libutil/include/nix/util/file-path-impl.hh
@@ -42,7 +42,6 @@ struct UnixPathTrait
     }
 };
 
-
 /**
  * Windows-style path primitives.
  *
@@ -75,22 +74,17 @@ struct WindowsPathTrait
     {
         size_t p1 = path.find('/', from);
         size_t p2 = path.find(preferredSep, from);
-        return p1 == String::npos ? p2 :
-               p2 == String::npos ? p1 :
-               std::min(p1, p2);
+        return p1 == String::npos ? p2 : p2 == String::npos ? p1 : std::min(p1, p2);
     }
 
     static size_t rfindPathSep(StringView path, size_t from = String::npos)
     {
         size_t p1 = path.rfind('/', from);
         size_t p2 = path.rfind(preferredSep, from);
-        return p1 == String::npos ? p2 :
-               p2 == String::npos ? p1 :
-               std::max(p1, p2);
+        return p1 == String::npos ? p2 : p2 == String::npos ? p1 : std::max(p1, p2);
     }
 };
 
-
 template<typename CharT>
 using OsPathTrait =
 #ifdef _WIN32
@@ -100,7 +94,6 @@ using OsPathTrait =
 #endif
     ;
 
-
 /**
  * Core pure path canonicalization algorithm.
  *
@@ -116,9 +109,7 @@ using OsPathTrait =
  *   "result" points to a symlink.
  */
 template<class PathDict>
-typename PathDict::String canonPathInner(
-    typename PathDict::StringView remaining,
-    auto && hookComponent)
+typename PathDict::String canonPathInner(typename PathDict::StringView remaining, auto && hookComponent)
 {
     assert(remaining != "");
 
@@ -131,7 +122,8 @@ typename PathDict::String canonPathInner(
         while (!remaining.empty() && PathDict::isPathSep(remaining[0]))
             remaining.remove_prefix(1);
 
-        if (remaining.empty()) break;
+        if (remaining.empty())
+            break;
 
         auto nextComp = ({
             auto nextPathSep = PathDict::findPathSep(remaining);
@@ -143,9 +135,9 @@ typename PathDict::String canonPathInner(
             remaining.remove_prefix(1);
 
         /* If `..', delete the last component. */
-        else if (nextComp == "..")
-        {
-            if (!result.empty()) result.erase(PathDict::rfindPathSep(result));
+        else if (nextComp == "..") {
+            if (!result.empty())
+                result.erase(PathDict::rfindPathSep(result));
             remaining.remove_prefix(2);
         }
 
@@ -165,9 +157,9 @@ typename PathDict::String canonPathInner(
     }
 
     if (result.empty())
-        result = typename PathDict::String { PathDict::preferredSep };
+        result = typename PathDict::String{PathDict::preferredSep};
 
     return result;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/file-path.hh b/src/libutil/include/nix/util/file-path.hh
index deff076f1..25349eaf7 100644
--- a/src/libutil/include/nix/util/file-path.hh
+++ b/src/libutil/include/nix/util/file-path.hh
@@ -30,18 +30,27 @@ struct PathViewNG : OsStringView
 
     PathViewNG(const std::filesystem::path & path)
         : OsStringView{path.native()}
-    { }
+    {
+    }
 
     PathViewNG(const OsString & path)
         : OsStringView{path}
-    { }
+    {
+    }
 
-    const string_view & native() const { return *this; }
-    string_view & native() { return *this; }
+    const string_view & native() const
+    {
+        return *this;
+    }
+
+    string_view & native()
+    {
+        return *this;
+    }
 };
 
 std::optional<std::filesystem::path> maybePath(PathView path);
 
 std::filesystem::path pathNG(PathView path);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/file-system.hh b/src/libutil/include/nix/util/file-system.hh
index c45cb55aa..98b992472 100644
--- a/src/libutil/include/nix/util/file-system.hh
+++ b/src/libutil/include/nix/util/file-system.hh
@@ -14,7 +14,7 @@
 #include <dirent.h>
 #include <unistd.h>
 #ifdef _WIN32
-# include <windef.h>
+#  include <windef.h>
 #endif
 
 #include <functional>
@@ -28,7 +28,7 @@
  * @todo get rid of this, and stop using `stat` when we want `lstat` too.
  */
 #ifndef S_ISLNK
-# define S_ISLNK(m) false
+#  define S_ISLNK(m) false
 #endif
 
 namespace nix {
@@ -48,19 +48,14 @@ bool isAbsolute(PathView path);
  *
  * In the process of being deprecated for `std::filesystem::absolute`.
  */
-Path absPath(PathView path,
-    std::optional<PathView> dir = {},
-    bool resolveSymlinks = false);
+Path absPath(PathView path, std::optional<PathView> dir = {}, bool resolveSymlinks = false);
 
-inline Path absPath(const Path & path,
-    std::optional<PathView> dir = {},
-    bool resolveSymlinks = false)
+inline Path absPath(const Path & path, std::optional<PathView> dir = {}, bool resolveSymlinks = false)
 {
     return absPath(PathView{path}, dir, resolveSymlinks);
 }
 
-std::filesystem::path absPath(const std::filesystem::path & path,
-    bool resolveSymlinks = false);
+std::filesystem::path absPath(const std::filesystem::path & path, bool resolveSymlinks = false);
 
 /**
  * Canonicalise a path by removing all `.` or `..` components and
@@ -176,19 +171,22 @@ enum struct FsSync { Yes, No };
  */
 void writeFile(const Path & path, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No);
 
-static inline void writeFile(const std::filesystem::path & path, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No)
+static inline void
+writeFile(const std::filesystem::path & path, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No)
 {
     return writeFile(path.string(), s, mode, sync);
 }
 
 void writeFile(const Path & path, Source & source, mode_t mode = 0666, FsSync sync = FsSync::No);
 
-static inline void writeFile(const std::filesystem::path & path, Source & source, mode_t mode = 0666, FsSync sync = FsSync::No)
+static inline void
+writeFile(const std::filesystem::path & path, Source & source, mode_t mode = 0666, FsSync sync = FsSync::No)
 {
     return writeFile(path.string(), source, mode, sync);
 }
 
-void writeFile(AutoCloseFD & fd, const Path & origPath, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No);
+void writeFile(
+    AutoCloseFD & fd, const Path & origPath, std::string_view s, mode_t mode = 0666, FsSync sync = FsSync::No);
 
 /**
  * Flush a path's parent directory to disk.
@@ -295,29 +293,41 @@ public:
 
     void reset(const std::filesystem::path & p, bool recursive = true);
 
-    const std::filesystem::path & path() const { return _path; }
-    PathViewNG view() const { return _path; }
+    const std::filesystem::path & path() const
+    {
+        return _path;
+    }
 
-    operator const std::filesystem::path & () const { return _path; }
-    operator PathViewNG () const { return _path; }
+    PathViewNG view() const
+    {
+        return _path;
+    }
+
+    operator const std::filesystem::path &() const
+    {
+        return _path;
+    }
+
+    operator PathViewNG() const
+    {
+        return _path;
+    }
 };
 
-
 struct DIRDeleter
 {
-    void operator()(DIR * dir) const {
+    void operator()(DIR * dir) const
+    {
         closedir(dir);
     }
 };
 
 typedef std::unique_ptr<DIR, DIRDeleter> AutoCloseDir;
 
-
 /**
  * Create a temporary directory.
  */
-Path createTempDir(const Path & tmpRoot = "", const Path & prefix = "nix",
-                   mode_t mode = 0755);
+Path createTempDir(const Path & tmpRoot = "", const Path & prefix = "nix", mode_t mode = 0755);
 
 /**
  * Create a temporary file, returning a file handle and its path.
@@ -367,59 +377,71 @@ extern PathFilter defaultPathFilter;
 bool chmodIfNeeded(const std::filesystem::path & path, mode_t mode, mode_t mask = S_IRWXU | S_IRWXG | S_IRWXO);
 
 /**
-  * @brief A directory iterator that can be used to iterate over the
-  * contents of a directory. It is similar to std::filesystem::directory_iterator
-  * but throws NixError on failure instead of std::filesystem::filesystem_error.
-  */
-class DirectoryIterator {
+ * @brief A directory iterator that can be used to iterate over the
+ * contents of a directory. It is similar to std::filesystem::directory_iterator
+ * but throws NixError on failure instead of std::filesystem::filesystem_error.
+ */
+class DirectoryIterator
+{
 public:
     // --- Iterator Traits ---
     using iterator_category = std::input_iterator_tag;
-    using value_type        = std::filesystem::directory_entry;
-    using difference_type   = std::ptrdiff_t;
-    using pointer           = const std::filesystem::directory_entry*;
-    using reference         = const std::filesystem::directory_entry&;
+    using value_type = std::filesystem::directory_entry;
+    using difference_type = std::ptrdiff_t;
+    using pointer = const std::filesystem::directory_entry *;
+    using reference = const std::filesystem::directory_entry &;
 
     // Default constructor (represents end iterator)
     DirectoryIterator() noexcept = default;
 
     // Constructor taking a path
-    explicit DirectoryIterator(const std::filesystem::path& p);
+    explicit DirectoryIterator(const std::filesystem::path & p);
 
-    reference operator*() const {
+    reference operator*() const
+    {
         // Accessing the value itself doesn't typically throw filesystem_error
         // after successful construction/increment, but underlying operations might.
         // If directory_entry methods called via -> could throw, add try-catch there.
         return *it_;
     }
 
-    pointer operator->() const {
+    pointer operator->() const
+    {
         return &(*it_);
     }
 
-
-    DirectoryIterator& operator++();
+    DirectoryIterator & operator++();
 
     // Postfix increment operator
-    DirectoryIterator operator++(int) {
+    DirectoryIterator operator++(int)
+    {
         DirectoryIterator temp = *this;
         ++(*this); // Uses the prefix increment's try-catch logic
         return temp;
     }
 
     // Equality comparison
-    friend bool operator==(const DirectoryIterator& a, const DirectoryIterator& b) noexcept {
+    friend bool operator==(const DirectoryIterator & a, const DirectoryIterator & b) noexcept
+    {
         return a.it_ == b.it_;
     }
 
     // Inequality comparison
-    friend bool operator!=(const DirectoryIterator& a, const DirectoryIterator& b) noexcept {
+    friend bool operator!=(const DirectoryIterator & a, const DirectoryIterator & b) noexcept
+    {
         return !(a == b);
     }
 
     // Allow direct use in range-based for loops if iterating over an instance
-    DirectoryIterator begin() const { return *this; }
-    DirectoryIterator end() const { return DirectoryIterator{}; }
+    DirectoryIterator begin() const
+    {
+        return *this;
+    }
+
+    DirectoryIterator end() const
+    {
+        return DirectoryIterator{};
+    }
 
 
 private:
@@ -432,11 +454,11 @@ class AutoUnmount
     Path path;
     bool del;
 public:
-    AutoUnmount(Path&);
+    AutoUnmount(Path &);
     AutoUnmount();
     ~AutoUnmount();
     void cancel();
 };
 #endif
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/finally.hh b/src/libutil/include/nix/util/finally.hh
index 2b25010a1..a5656ad41 100644
--- a/src/libutil/include/nix/util/finally.hh
+++ b/src/libutil/include/nix/util/finally.hh
@@ -16,10 +16,15 @@ private:
     bool movedFrom = false;
 
 public:
-    Finally(Fn fun) : fun(std::move(fun)) { }
+    Finally(Fn fun)
+        : fun(std::move(fun))
+    {
+    }
+
     // Copying Finallys is definitely not a good idea and will cause them to be
     // called twice.
-    Finally(Finally &other) = delete;
+    Finally(Finally & other) = delete;
+
     // NOTE: Move constructor can be nothrow if the callable type is itself nothrow
     // move-constructible.
     Finally(Finally && other) noexcept(std::is_nothrow_move_constructible_v<Fn>)
@@ -27,6 +32,7 @@ public:
     {
         other.movedFrom = true;
     }
+
     ~Finally() noexcept(false)
     {
         try {
diff --git a/src/libutil/include/nix/util/fmt.hh b/src/libutil/include/nix/util/fmt.hh
index 5435a4ebf..f32a0b62b 100644
--- a/src/libutil/include/nix/util/fmt.hh
+++ b/src/libutil/include/nix/util/fmt.hh
@@ -5,7 +5,6 @@
 #include <string>
 #include "nix/util/ansicolor.hh"
 
-
 namespace nix {
 
 /**
@@ -22,10 +21,11 @@ namespace nix {
  */
 template<class F>
 inline void formatHelper(F & f)
-{ }
+{
+}
 
 template<class F, typename T, typename... Args>
-inline void formatHelper(F & f, const T & x, const Args & ... args)
+inline void formatHelper(F & f, const T & x, const Args &... args)
 {
     // Interpolate one argument and then recurse.
     formatHelper(f % x, args...);
@@ -36,10 +36,7 @@ inline void formatHelper(F & f, const T & x, const Args & ... args)
  */
 inline void setExceptions(boost::format & fmt)
 {
-    fmt.exceptions(
-        boost::io::all_error_bits ^
-        boost::io::too_many_args_bit ^
-        boost::io::too_few_args_bit);
+    fmt.exceptions(boost::io::all_error_bits ^ boost::io::too_many_args_bit ^ boost::io::too_few_args_bit);
 }
 
 /**
@@ -80,7 +77,7 @@ inline std::string fmt(const char * s)
 }
 
 template<typename... Args>
-inline std::string fmt(const std::string & fs, const Args & ... args)
+inline std::string fmt(const std::string & fs, const Args &... args)
 {
     boost::format f(fs);
     setExceptions(f);
@@ -95,14 +92,18 @@ inline std::string fmt(const std::string & fs, const Args & ... args)
  * either wrap the argument in `Uncolored` or add a specialization of
  * `HintFmt::operator%`.
  */
-template <class T>
+template<class T>
 struct Magenta
 {
-    Magenta(const T &s) : value(s) {}
+    Magenta(const T & s)
+        : value(s)
+    {
+    }
+
     const T & value;
 };
 
-template <class T>
+template<class T>
 std::ostream & operator<<(std::ostream & out, const Magenta<T> & y)
 {
     return out << ANSI_WARNING << y.value << ANSI_NORMAL;
@@ -115,14 +116,18 @@ std::ostream & operator<<(std::ostream & out, const Magenta<T> & y)
  *
  * By default, arguments to `HintFmt` are printed in magenta (see `Magenta`).
  */
-template <class T>
+template<class T>
 struct Uncolored
 {
-    Uncolored(const T & s) : value(s) {}
+    Uncolored(const T & s)
+        : value(s)
+    {
+    }
+
     const T & value;
 };
 
-template <class T>
+template<class T>
 std::ostream & operator<<(std::ostream & out, const Uncolored<T> & y)
 {
     return out << ANSI_NORMAL << y.value;
@@ -144,9 +149,11 @@ public:
      */
     HintFmt(const std::string & literal)
         : HintFmt("%s", Uncolored(literal))
-    { }
+    {
+    }
 
-    static HintFmt fromFormatString(const std::string & format) {
+    static HintFmt fromFormatString(const std::string & format)
+    {
         return HintFmt(boost::format(format));
     }
 
@@ -154,16 +161,18 @@ public:
      * Interpolate the given arguments into the format string.
      */
     template<typename... Args>
-    HintFmt(const std::string & format, const Args & ... args)
+    HintFmt(const std::string & format, const Args &... args)
         : HintFmt(boost::format(format), args...)
-    { }
+    {
+    }
 
     HintFmt(const HintFmt & hf)
         : fmt(hf.fmt)
-    { }
+    {
+    }
 
     template<typename... Args>
-    HintFmt(boost::format && fmt, const Args & ... args)
+    HintFmt(boost::format && fmt, const Args &... args)
         : fmt(std::move(fmt))
     {
         setExceptions(fmt);
@@ -194,4 +203,4 @@ public:
 
 std::ostream & operator<<(std::ostream & os, const HintFmt & hf);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/fs-sink.hh b/src/libutil/include/nix/util/fs-sink.hh
index 1c34fba93..f96fe3ef9 100644
--- a/src/libutil/include/nix/util/fs-sink.hh
+++ b/src/libutil/include/nix/util/fs-sink.hh
@@ -19,10 +19,9 @@ struct CreateRegularFileSink : Sink
     /**
      * An optimization. By default, do nothing.
      */
-    virtual void preallocateContents(uint64_t size) { };
+    virtual void preallocateContents(uint64_t size) {};
 };
 
-
 struct FileSystemObjectSink
 {
     virtual ~FileSystemObjectSink() = default;
@@ -33,9 +32,7 @@ struct FileSystemObjectSink
      * This function in general is no re-entrant. Only one file can be
      * written at a time.
      */
-    virtual void createRegularFile(
-        const CanonPath & path,
-        std::function<void(CreateRegularFileSink &)>) = 0;
+    virtual void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)>) = 0;
 
     virtual void createSymlink(const CanonPath & path, const std::string & target) = 0;
 };
@@ -57,19 +54,18 @@ struct ExtendedFileSystemObjectSink : virtual FileSystemObjectSink
  * Recursively copy file system objects from the source into the sink.
  */
 void copyRecursive(
-    SourceAccessor & accessor, const CanonPath & sourcePath,
-    FileSystemObjectSink & sink, const CanonPath & destPath);
+    SourceAccessor & accessor, const CanonPath & sourcePath, FileSystemObjectSink & sink, const CanonPath & destPath);
 
 /**
  * Ignore everything and do nothing
  */
 struct NullFileSystemObjectSink : FileSystemObjectSink
 {
-    void createDirectory(const CanonPath & path) override { }
-    void createSymlink(const CanonPath & path, const std::string & target) override { }
-    void createRegularFile(
-        const CanonPath & path,
-        std::function<void(CreateRegularFileSink &)>) override;
+    void createDirectory(const CanonPath & path) override {}
+
+    void createSymlink(const CanonPath & path, const std::string & target) override {}
+
+    void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)>) override;
 };
 
 /**
@@ -82,13 +78,12 @@ struct RestoreSink : FileSystemObjectSink
 
     explicit RestoreSink(bool startFsync)
         : startFsync{startFsync}
-    { }
+    {
+    }
 
     void createDirectory(const CanonPath & path) override;
 
-    void createRegularFile(
-        const CanonPath & path,
-        std::function<void(CreateRegularFileSink &)>) override;
+    void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)>) override;
 
     void createSymlink(const CanonPath & path, const std::string & target) override;
 };
@@ -103,7 +98,10 @@ struct RegularFileSink : FileSystemObjectSink
     bool regular = true;
     Sink & sink;
 
-    RegularFileSink(Sink & sink) : sink(sink) { }
+    RegularFileSink(Sink & sink)
+        : sink(sink)
+    {
+    }
 
     void createDirectory(const CanonPath & path) override
     {
@@ -115,9 +113,7 @@ struct RegularFileSink : FileSystemObjectSink
         regular = false;
     }
 
-    void createRegularFile(
-        const CanonPath & path,
-        std::function<void(CreateRegularFileSink &)>) override;
+    void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)>) override;
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/git.hh b/src/libutil/include/nix/util/git.hh
index 9bdb30bb9..5140c76c4 100644
--- a/src/libutil/include/nix/util/git.hh
+++ b/src/libutil/include/nix/util/git.hh
@@ -16,8 +16,8 @@ namespace nix::git {
 enum struct ObjectType {
     Blob,
     Tree,
-    //Commit,
-    //Tag,
+    // Commit,
+    // Tag,
 };
 
 using RawMode = uint32_t;
@@ -39,8 +39,8 @@ struct TreeEntry
     Mode mode;
     Hash hash;
 
-    bool operator ==(const TreeEntry &) const = default;
-    auto operator <=>(const TreeEntry &) const = default;
+    bool operator==(const TreeEntry &) const = default;
+    auto operator<=>(const TreeEntry &) const = default;
 };
 
 /**
@@ -72,9 +72,8 @@ using SinkHook = void(const CanonPath & name, TreeEntry entry);
  *
  * @throws if prefix not recognized
  */
-ObjectType parseObjectType(
-    Source & source,
-    const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+ObjectType
+parseObjectType(Source & source, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
 /**
  * These 3 modes are represented by blob objects.
@@ -82,22 +81,27 @@ ObjectType parseObjectType(
  * Sometimes we need this information to disambiguate how a blob is
  * being used to better match our own "file system object" data model.
  */
-enum struct BlobMode : RawMode
-{
+enum struct BlobMode : RawMode {
     Regular = static_cast<RawMode>(Mode::Regular),
     Executable = static_cast<RawMode>(Mode::Executable),
     Symlink = static_cast<RawMode>(Mode::Symlink),
 };
 
 void parseBlob(
-    FileSystemObjectSink & sink, const CanonPath & sinkPath,
+    FileSystemObjectSink & sink,
+    const CanonPath & sinkPath,
     Source & source,
     BlobMode blobMode,
     const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
+/**
+ * @param hashAlgo must be `HashAlgo::SHA1` or `HashAlgo::SHA256` for now.
+ */
 void parseTree(
-    FileSystemObjectSink & sink, const CanonPath & sinkPath,
+    FileSystemObjectSink & sink,
+    const CanonPath & sinkPath,
     Source & source,
+    HashAlgorithm hashAlgo,
     std::function<SinkHook> hook,
     const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
@@ -107,11 +111,15 @@ void parseTree(
  * @param rootModeIfBlob How to interpret a root blob, for which there is no
  * disambiguating dir entry to answer that questino. If the root it not
  * a blob, this is ignored.
+ *
+ * @param hashAlgo must be `HashAlgo::SHA1` or `HashAlgo::SHA256` for now.
  */
 void parse(
-    FileSystemObjectSink & sink, const CanonPath & sinkPath,
+    FileSystemObjectSink & sink,
+    const CanonPath & sinkPath,
     Source & source,
     BlobMode rootModeIfBlob,
+    HashAlgorithm hashAlgo,
     std::function<SinkHook> hook,
     const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
@@ -130,8 +138,10 @@ using RestoreHook = SourcePath(Hash);
 
 /**
  * Wrapper around `parse` and `RestoreSink`
+ *
+ * @param hashAlgo must be `HashAlgo::SHA1` or `HashAlgo::SHA256` for now.
  */
-void restore(FileSystemObjectSink & sink, Source & source, std::function<RestoreHook> hook);
+void restore(FileSystemObjectSink & sink, Source & source, HashAlgorithm hashAlgo, std::function<RestoreHook> hook);
 
 /**
  * Dumps a single file to a sink
@@ -139,15 +149,13 @@ void restore(FileSystemObjectSink & sink, Source & source, std::function<Restore
  * @param xpSettings for testing purposes
  */
 void dumpBlobPrefix(
-    uint64_t size, Sink & sink,
-    const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+    uint64_t size, Sink & sink, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
 /**
  * Dumps a representation of a git tree to a sink
  */
 void dumpTree(
-    const Tree & entries, Sink & sink,
-    const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+    const Tree & entries, Sink & sink, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
 /**
  * Callback for processing a child with `dump`
@@ -172,10 +180,7 @@ Mode dump(
  *
  * A smaller wrapper around `dump`.
  */
-TreeEntry dumpHash(
-    HashAlgorithm ha,
-    const SourcePath & path,
-    PathFilter & filter = defaultPathFilter);
+TreeEntry dumpHash(HashAlgorithm ha, const SourcePath & path, PathFilter & filter = defaultPathFilter);
 
 /**
  * A line from the output of `git ls-remote --symref`.
@@ -196,11 +201,9 @@ TreeEntry dumpHash(
  *   ```
  *   where {target} is a commit id and {reference} is mandatory
  */
-struct LsRemoteRefLine {
-    enum struct Kind {
-        Symbolic,
-        Object
-    };
+struct LsRemoteRefLine
+{
+    enum struct Kind { Symbolic, Object };
     Kind kind;
     std::string target;
     std::optional<std::string> reference;
@@ -211,4 +214,4 @@ struct LsRemoteRefLine {
  */
 std::optional<LsRemoteRefLine> parseLsRemoteLine(std::string_view line);
 
-}
+} // namespace nix::git
diff --git a/src/libutil/include/nix/util/hash.hh b/src/libutil/include/nix/util/hash.hh
index 715537456..571b6acca 100644
--- a/src/libutil/include/nix/util/hash.hh
+++ b/src/libutil/include/nix/util/hash.hh
@@ -8,22 +8,33 @@
 
 namespace nix {
 
-
 MakeError(BadHash, Error);
 
-
 enum struct HashAlgorithm : char { MD5 = 42, SHA1, SHA256, SHA512, BLAKE3 };
 
-const int blake3HashSize = 32;
-const int md5HashSize = 16;
-const int sha1HashSize = 20;
-const int sha256HashSize = 32;
-const int sha512HashSize = 64;
+/**
+ * @return the size of a hash for the given algorithm
+ */
+constexpr inline size_t regularHashSize(HashAlgorithm type)
+{
+    switch (type) {
+    case HashAlgorithm::BLAKE3:
+        return 32;
+    case HashAlgorithm::MD5:
+        return 16;
+    case HashAlgorithm::SHA1:
+        return 20;
+    case HashAlgorithm::SHA256:
+        return 32;
+    case HashAlgorithm::SHA512:
+        return 64;
+    default:
+        assert(false);
+    }
+}
 
 extern const StringSet hashAlgorithms;
 
-extern const std::string nix32Chars;
-
 /**
  * @brief Enumeration representing the hash formats.
  */
@@ -31,7 +42,7 @@ enum struct HashFormat : int {
     /// @brief Base 64 encoding.
     /// @see [IETF RFC 4648, section 4](https://datatracker.ietf.org/doc/html/rfc4648#section-4).
     Base64,
-    /// @brief Nix-specific base-32 encoding. @see nix32Chars
+    /// @brief Nix-specific base-32 encoding. @see BaseNix32
     Nix32,
     /// @brief Lowercase hexadecimal encoding. @see base16Chars
     Base16,
@@ -44,6 +55,9 @@ extern const StringSet hashFormats;
 
 struct Hash
 {
+    /** Opaque handle type for the hash calculation state. */
+    union Ctx;
+
     constexpr static size_t maxHashSize = 64;
     size_t hashSize = 0;
     uint8_t hash[maxHashSize] = {};
@@ -76,49 +90,27 @@ struct Hash
      */
     static Hash parseNonSRIUnprefixed(std::string_view s, HashAlgorithm algo);
 
-    static Hash parseSRI(std::string_view original);
-
-private:
     /**
-     * The type must be provided, the string view must not include <type>
-     * prefix. `isSRI` helps disambigate the various base-* encodings.
+     * Like `parseNonSRIUnprefixed`, but the hash format has been
+     * explicitly given.
+     *
+     * @param explicitFormat cannot be SRI, but must be one of the
+     * "bases".
      */
-    Hash(std::string_view s, HashAlgorithm algo, bool isSRI);
+    static Hash parseExplicitFormatUnprefixed(std::string_view s, HashAlgorithm algo, HashFormat explicitFormat);
+
+    static Hash parseSRI(std::string_view original);
 
 public:
     /**
      * Check whether two hashes are equal.
      */
-    bool operator == (const Hash & h2) const noexcept;
+    bool operator==(const Hash & h2) const noexcept;
 
     /**
      * Compare how two hashes are ordered.
      */
-    std::strong_ordering operator <=> (const Hash & h2) const noexcept;
-
-    /**
-     * Returns the length of a base-16 representation of this hash.
-     */
-    [[nodiscard]] size_t base16Len() const
-    {
-        return hashSize * 2;
-    }
-
-    /**
-     * Returns the length of a base-32 representation of this hash.
-     */
-    [[nodiscard]] size_t base32Len() const
-    {
-        return (hashSize * 8 - 1) / 5 + 1;
-    }
-
-    /**
-     * Returns the length of a base-64 representation of this hash.
-     */
-    [[nodiscard]] size_t base64Len() const
-    {
-        return ((4 * hashSize / 3) + 3) & ~3;
-    }
+    std::strong_ordering operator<=>(const Hash & h2) const noexcept;
 
     /**
      * Return a string representation of the hash, in base-16, base-32
@@ -150,15 +142,11 @@ public:
  */
 Hash newHashAllowEmpty(std::string_view hashStr, std::optional<HashAlgorithm> ha);
 
-/**
- * Print a hash in base-16 if it's MD5, or base-32 otherwise.
- */
-std::string printHash16or32(const Hash & hash);
-
 /**
  * Compute the hash of the given string.
  */
-Hash hashString(HashAlgorithm ha, std::string_view s, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
+Hash hashString(
+    HashAlgorithm ha, std::string_view s, const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
 /**
  * Compute the hash of the given file, hashing its contents directly.
@@ -169,10 +157,12 @@ Hash hashFile(HashAlgorithm ha, const Path & path);
 
 /**
  * The final hash and the number of bytes digested.
- *
- * @todo Convert to proper struct
  */
-typedef std::pair<Hash, uint64_t> HashResult;
+struct HashResult
+{
+    Hash hash;
+    uint64_t numBytesDigested;
+};
 
 /**
  * Compress a hash to the specified number of bytes by cyclically
@@ -210,9 +200,6 @@ std::optional<HashAlgorithm> parseHashAlgoOpt(std::string_view s);
  */
 std::string_view printHashAlgo(HashAlgorithm ha);
 
-
-union Ctx;
-
 struct AbstractHashSink : virtual Sink
 {
     virtual HashResult finish() = 0;
@@ -222,7 +209,7 @@ class HashSink : public BufferedSink, public AbstractHashSink
 {
 private:
     HashAlgorithm ha;
-    Ctx * ctx;
+    Hash::Ctx * ctx;
     uint64_t bytes;
 
 public:
@@ -234,5 +221,4 @@ public:
     HashResult currentHash();
 };
 
-
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/hilite.hh b/src/libutil/include/nix/util/hilite.hh
index 2d5cf7c6f..ee9985f39 100644
--- a/src/libutil/include/nix/util/hilite.hh
+++ b/src/libutil/include/nix/util/hilite.hh
@@ -14,10 +14,7 @@ namespace nix {
  * If some matches overlap, then their union will be wrapped rather
  * than the individual matches.
  */
-std::string hiliteMatches(
-    std::string_view s,
-    std::vector<std::smatch> matches,
-    std::string_view prefix,
-    std::string_view postfix);
+std::string
+hiliteMatches(std::string_view s, std::vector<std::smatch> matches, std::string_view prefix, std::string_view postfix);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/json-impls.hh b/src/libutil/include/nix/util/json-impls.hh
index 9dd344c50..8a6198313 100644
--- a/src/libutil/include/nix/util/json-impls.hh
+++ b/src/libutil/include/nix/util/json-impls.hh
@@ -4,12 +4,13 @@
 #include <nlohmann/json_fwd.hpp>
 
 // Following https://github.com/nlohmann/json#how-can-i-use-get-for-non-default-constructiblenon-copyable-types
-#define JSON_IMPL(TYPE)                                                \
-    namespace nlohmann {                                               \
-        using namespace nix;                                           \
-        template <>                                                    \
-        struct adl_serializer<TYPE> {                                  \
-            static TYPE from_json(const json & json);                  \
-            static void to_json(json & json, TYPE t);                  \
-        };                                                             \
+#define JSON_IMPL(TYPE)                           \
+    namespace nlohmann {                          \
+    using namespace nix;                          \
+    template<>                                    \
+    struct adl_serializer<TYPE>                   \
+    {                                             \
+        static TYPE from_json(const json & json); \
+        static void to_json(json & json, TYPE t); \
+    };                                            \
     }
diff --git a/src/libutil/include/nix/util/json-non-null.hh b/src/libutil/include/nix/util/json-non-null.hh
new file mode 100644
index 000000000..6bacce58f
--- /dev/null
+++ b/src/libutil/include/nix/util/json-non-null.hh
@@ -0,0 +1,55 @@
+#pragma once
+///@file
+
+#include <string>
+#include <vector>
+#include <set>
+#include <map>
+#include <list>
+
+namespace nix {
+
+/**
+ * For `adl_serializer<std::optional<T>>` below, we need to track what
+ * types are not already using `null`. Only for them can we use `null`
+ * to represent `std::nullopt`.
+ */
+template<typename T>
+struct json_avoids_null;
+
+/**
+ * Handle numbers in default impl
+ */
+template<typename T>
+struct json_avoids_null : std::bool_constant<std::is_integral<T>::value>
+{};
+
+template<>
+struct json_avoids_null<std::nullptr_t> : std::false_type
+{};
+
+template<>
+struct json_avoids_null<bool> : std::true_type
+{};
+
+template<>
+struct json_avoids_null<std::string> : std::true_type
+{};
+
+template<typename T>
+struct json_avoids_null<std::vector<T>> : std::true_type
+{};
+
+template<typename T>
+struct json_avoids_null<std::list<T>> : std::true_type
+{};
+
+template<typename T, typename Compare>
+struct json_avoids_null<std::set<T, Compare>> : std::true_type
+{};
+
+template<typename K, typename V, typename Compare>
+struct json_avoids_null<std::map<K, V, Compare>> : std::true_type
+{};
+
+} // namespace nix
diff --git a/src/libutil/include/nix/util/json-utils.hh b/src/libutil/include/nix/util/json-utils.hh
index 37f4d58f8..4b5fb4b21 100644
--- a/src/libutil/include/nix/util/json-utils.hh
+++ b/src/libutil/include/nix/util/json-utils.hh
@@ -6,6 +6,7 @@
 
 #include "nix/util/error.hh"
 #include "nix/util/types.hh"
+#include "nix/util/json-non-null.hh"
 
 namespace nix {
 
@@ -21,9 +22,7 @@ nlohmann::json * get(nlohmann::json & map, const std::string & key);
  *
  * Use instead of nlohmann::json::at() to avoid ugly exceptions.
  */
-const nlohmann::json & valueAt(
-    const nlohmann::json::object_t & map,
-    const std::string & key);
+const nlohmann::json & valueAt(const nlohmann::json::object_t & map, const std::string & key);
 
 std::optional<nlohmann::json> optionalValueAt(const nlohmann::json::object_t & value, const std::string & key);
 std::optional<nlohmann::json> nullableValueAt(const nlohmann::json::object_t & value, const std::string & key);
@@ -61,48 +60,7 @@ Strings getStringList(const nlohmann::json & value);
 StringMap getStringMap(const nlohmann::json & value);
 StringSet getStringSet(const nlohmann::json & value);
 
-/**
- * For `adl_serializer<std::optional<T>>` below, we need to track what
- * types are not already using `null`. Only for them can we use `null`
- * to represent `std::nullopt`.
- */
-template<typename T>
-struct json_avoids_null;
-
-/**
- * Handle numbers in default impl
- */
-template<typename T>
-struct json_avoids_null : std::bool_constant<std::is_integral<T>::value> {};
-
-template<>
-struct json_avoids_null<std::nullptr_t> : std::false_type {};
-
-template<>
-struct json_avoids_null<bool> : std::true_type {};
-
-template<>
-struct json_avoids_null<std::string> : std::true_type {};
-
-template<typename T>
-struct json_avoids_null<std::vector<T>> : std::true_type {};
-
-template<typename T>
-struct json_avoids_null<std::list<T>> : std::true_type {};
-
-template<typename T, typename Compare>
-struct json_avoids_null<std::set<T, Compare>> : std::true_type {};
-
-template<typename K, typename V>
-struct json_avoids_null<std::map<K, V>> : std::true_type {};
-
-/**
- * `ExperimentalFeature` is always rendered as a string.
- */
-template<>
-struct json_avoids_null<ExperimentalFeature> : std::true_type {};
-
-}
+} // namespace nix
 
 namespace nlohmann {
 
@@ -123,12 +81,8 @@ struct adl_serializer<std::optional<T>>
      */
     static void from_json(const json & json, std::optional<T> & t)
     {
-        static_assert(
-            nix::json_avoids_null<T>::value,
-            "null is already in use for underlying type's JSON");
-        t = json.is_null()
-            ? std::nullopt
-            : std::make_optional(json.template get<T>());
+        static_assert(nix::json_avoids_null<T>::value, "null is already in use for underlying type's JSON");
+        t = json.is_null() ? std::nullopt : std::make_optional(json.template get<T>());
     }
 
     /**
@@ -137,9 +91,7 @@ struct adl_serializer<std::optional<T>>
      */
     static void to_json(json & json, const std::optional<T> & t)
     {
-        static_assert(
-            nix::json_avoids_null<T>::value,
-            "null is already in use for underlying type's JSON");
+        static_assert(nix::json_avoids_null<T>::value, "null is already in use for underlying type's JSON");
         if (t)
             json = *t;
         else
@@ -147,4 +99,4 @@ struct adl_serializer<std::optional<T>>
     }
 };
 
-}
+} // namespace nlohmann
diff --git a/src/libutil/include/nix/util/logging.hh b/src/libutil/include/nix/util/logging.hh
index dabfac483..500d443e6 100644
--- a/src/libutil/include/nix/util/logging.hh
+++ b/src/libutil/include/nix/util/logging.hh
@@ -46,14 +46,18 @@ typedef uint64_t ActivityId;
 struct LoggerSettings : Config
 {
     Setting<bool> showTrace{
-        this, false, "show-trace",
+        this,
+        false,
+        "show-trace",
         R"(
           Whether Nix should print out a stack trace in case of Nix
           expression evaluation errors.
         )"};
 
     Setting<Path> jsonLogPath{
-        this, "", "json-log-path",
+        this,
+        "",
+        "json-log-path",
         R"(
           A file or unix socket to which JSON records of Nix's log output are
           written, in the same format as `--log-format internal-json`
@@ -75,23 +79,40 @@ public:
     {
         // FIXME: use std::variant.
         enum { tInt = 0, tString = 1 } type;
+
         uint64_t i = 0;
         std::string s;
-        Field(const std::string & s) : type(tString), s(s) { }
-        Field(const char * s) : type(tString), s(s) { }
-        Field(const uint64_t & i) : type(tInt), i(i) { }
+
+        Field(const std::string & s)
+            : type(tString)
+            , s(s)
+        {
+        }
+
+        Field(const char * s)
+            : type(tString)
+            , s(s)
+        {
+        }
+
+        Field(const uint64_t & i)
+            : type(tInt)
+            , i(i)
+        {
+        }
     };
 
     typedef std::vector<Field> Fields;
 
-    virtual ~Logger() { }
+    virtual ~Logger() {}
 
-    virtual void stop() { };
+    virtual void stop() {};
 
     /**
      * Guard object to resume the logger when done.
      */
-    struct Suspension {
+    struct Suspension
+    {
         Finally<std::function<void()>> _finalize;
     };
 
@@ -99,11 +120,14 @@ public:
 
     std::optional<Suspension> suspendIf(bool cond);
 
-    virtual void pause() { };
-    virtual void resume() { };
+    virtual void pause() {};
+    virtual void resume() {};
 
     // Whether the logger prints the whole build log
-    virtual bool isVerbose() { return false; }
+    virtual bool isVerbose()
+    {
+        return false;
+    }
 
     virtual void log(Verbosity lvl, std::string_view s) = 0;
 
@@ -122,26 +146,32 @@ public:
 
     virtual void warn(const std::string & msg);
 
-    virtual void startActivity(ActivityId act, Verbosity lvl, ActivityType type,
-        const std::string & s, const Fields & fields, ActivityId parent) { };
+    virtual void startActivity(
+        ActivityId act,
+        Verbosity lvl,
+        ActivityType type,
+        const std::string & s,
+        const Fields & fields,
+        ActivityId parent) {};
 
-    virtual void stopActivity(ActivityId act) { };
+    virtual void stopActivity(ActivityId act) {};
 
-    virtual void result(ActivityId act, ResultType type, const Fields & fields) { };
+    virtual void result(ActivityId act, ResultType type, const Fields & fields) {};
 
     virtual void writeToStdout(std::string_view s);
 
     template<typename... Args>
-    inline void cout(const Args & ... args)
+    inline void cout(const Args &... args)
     {
         writeToStdout(fmt(args...));
     }
 
     virtual std::optional<char> ask(std::string_view s)
-    { return {}; }
+    {
+        return {};
+    }
 
-    virtual void setPrintBuildLogs(bool printBuildLogs)
-    { }
+    virtual void setPrintBuildLogs(bool printBuildLogs) {}
 };
 
 /**
@@ -151,8 +181,10 @@ public:
  */
 struct nop
 {
-    template<typename... T> nop(T...)
-    { }
+    template<typename... T>
+    nop(T...)
+    {
+    }
 };
 
 ActivityId getCurActivity();
@@ -164,25 +196,34 @@ struct Activity
 
     const ActivityId id;
 
-    Activity(Logger & logger, Verbosity lvl, ActivityType type, const std::string & s = "",
-        const Logger::Fields & fields = {}, ActivityId parent = getCurActivity());
+    Activity(
+        Logger & logger,
+        Verbosity lvl,
+        ActivityType type,
+        const std::string & s = "",
+        const Logger::Fields & fields = {},
+        ActivityId parent = getCurActivity());
 
-    Activity(Logger & logger, ActivityType type,
-        const Logger::Fields & fields = {}, ActivityId parent = getCurActivity())
-        : Activity(logger, lvlError, type, "", fields, parent) { };
+    Activity(
+        Logger & logger, ActivityType type, const Logger::Fields & fields = {}, ActivityId parent = getCurActivity())
+        : Activity(logger, lvlError, type, "", fields, parent) {};
 
     Activity(const Activity & act) = delete;
 
     ~Activity();
 
     void progress(uint64_t done = 0, uint64_t expected = 0, uint64_t running = 0, uint64_t failed = 0) const
-    { result(resProgress, done, expected, running, failed); }
+    {
+        result(resProgress, done, expected, running, failed);
+    }
 
     void setExpected(ActivityType type2, uint64_t expected) const
-    { result(resSetExpected, type2, expected); }
+    {
+        result(resSetExpected, type2, expected);
+    }
 
     template<typename... Args>
-    void result(ResultType type, const Args & ... args) const
+    void result(ResultType type, const Args &... args) const
     {
         Logger::Fields fields;
         nop{(fields.emplace_back(Logger::Field(args)), 1)...};
@@ -200,8 +241,17 @@ struct Activity
 struct PushActivity
 {
     const ActivityId prevAct;
-    PushActivity(ActivityId act) : prevAct(getCurActivity()) { setCurActivity(act); }
-    ~PushActivity() { setCurActivity(prevAct); }
+
+    PushActivity(ActivityId act)
+        : prevAct(getCurActivity())
+    {
+        setCurActivity(act);
+    }
+
+    ~PushActivity()
+    {
+        setCurActivity(prevAct);
+    }
 };
 
 extern std::unique_ptr<Logger> logger;
@@ -213,9 +263,8 @@ std::unique_ptr<Logger> makeSimpleLogger(bool printBuildLogs = true);
  * list of loggers in `extraLoggers`. Only `mainLogger` is used for
  * writing to stdout and getting user input.
  */
-std::unique_ptr<Logger> makeTeeLogger(
-    std::unique_ptr<Logger> mainLogger,
-    std::vector<std::unique_ptr<Logger>> && extraLoggers);
+std::unique_ptr<Logger>
+makeTeeLogger(std::unique_ptr<Logger> mainLogger, std::vector<std::unique_ptr<Logger>> && extraLoggers);
 
 std::unique_ptr<Logger> makeJSONLogger(Descriptor fd, bool includeNixPrefix = true);
 
@@ -231,16 +280,20 @@ std::optional<nlohmann::json> parseJSONMessage(const std::string & msg, std::str
 /**
  * @param source A noun phrase describing the source of the message, e.g. "the builder".
  */
-bool handleJSONLogMessage(nlohmann::json & json,
-    const Activity & act, std::map<ActivityId, Activity> & activities,
+bool handleJSONLogMessage(
+    nlohmann::json & json,
+    const Activity & act,
+    std::map<ActivityId, Activity> & activities,
     std::string_view source,
     bool trusted);
 
 /**
  * @param source A noun phrase describing the source of the message, e.g. "the builder".
  */
-bool handleJSONLogMessage(const std::string & msg,
-    const Activity & act, std::map<ActivityId, Activity> & activities,
+bool handleJSONLogMessage(
+    const std::string & msg,
+    const Activity & act,
+    std::map<ActivityId, Activity> & activities,
     std::string_view source,
     bool trusted);
 
@@ -255,11 +308,11 @@ extern Verbosity verbosity;
  * intervention or that need more explanation.  Use the 'print' macros for more
  * lightweight status messages.
  */
-#define logErrorInfo(level, errorInfo...) \
-    do { \
-        if ((level) <= nix::verbosity) {     \
-            logger->logEI((level), errorInfo);  \
-        } \
+#define logErrorInfo(level, errorInfo...)      \
+    do {                                       \
+        if ((level) <= nix::verbosity) {       \
+            logger->logEI((level), errorInfo); \
+        }                                      \
     } while (0)
 
 #define logError(errorInfo...) logErrorInfo(lvlError, errorInfo)
@@ -271,11 +324,11 @@ extern Verbosity verbosity;
  * arguments are evaluated lazily.
  */
 #define printMsgUsing(loggerParam, level, args...) \
-    do { \
-        auto __lvl = level; \
-        if (__lvl <= nix::verbosity) { \
-            loggerParam->log(__lvl, fmt(args)); \
-        } \
+    do {                                           \
+        auto __lvl = level;                        \
+        if (__lvl <= nix::verbosity) {             \
+            loggerParam->log(__lvl, fmt(args));    \
+        }                                          \
     } while (0)
 #define printMsg(level, args...) printMsgUsing(logger, level, args)
 
@@ -290,7 +343,7 @@ extern Verbosity verbosity;
  * if verbosity >= lvlWarn, print a message with a yellow 'warning:' prefix.
  */
 template<typename... Args>
-inline void warn(const std::string & fs, const Args & ... args)
+inline void warn(const std::string & fs, const Args &... args)
 {
     boost::format f(fs);
     formatHelper(f, args...);
@@ -305,4 +358,4 @@ inline void warn(const std::string & fs, const Args & ... args)
 
 void writeToStderr(std::string_view s);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/lru-cache.hh b/src/libutil/include/nix/util/lru-cache.hh
index 0834a8e74..23cfa91e1 100644
--- a/src/libutil/include/nix/util/lru-cache.hh
+++ b/src/libutil/include/nix/util/lru-cache.hh
@@ -141,4 +141,4 @@ public:
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/memory-source-accessor.hh b/src/libutil/include/nix/util/memory-source-accessor.hh
index d09ba153d..a04d1d347 100644
--- a/src/libutil/include/nix/util/memory-source-accessor.hh
+++ b/src/libutil/include/nix/util/memory-source-accessor.hh
@@ -14,33 +14,37 @@ struct MemorySourceAccessor : virtual SourceAccessor
      * `MemorySourceAccessor`, this has a side benefit of nicely
      * defining what a "file system object" is in Nix.
      */
-    struct File {
-        bool operator == (const File &) const noexcept;
-        std::strong_ordering operator <=> (const File &) const noexcept;
+    struct File
+    {
+        bool operator==(const File &) const noexcept;
+        std::strong_ordering operator<=>(const File &) const noexcept;
 
-        struct Regular {
+        struct Regular
+        {
             bool executable = false;
             std::string contents;
 
-            bool operator == (const Regular &) const = default;
-            auto operator <=> (const Regular &) const = default;
+            bool operator==(const Regular &) const = default;
+            auto operator<=>(const Regular &) const = default;
         };
 
-        struct Directory {
+        struct Directory
+        {
             using Name = std::string;
 
             std::map<Name, File, std::less<>> contents;
 
-            bool operator == (const Directory &) const noexcept;
+            bool operator==(const Directory &) const noexcept;
             // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-            bool operator < (const Directory &) const noexcept;
+            bool operator<(const Directory &) const noexcept;
         };
 
-        struct Symlink {
+        struct Symlink
+        {
             std::string target;
 
-            bool operator == (const Symlink &) const = default;
-            auto operator <=> (const Symlink &) const = default;
+            bool operator==(const Symlink &) const = default;
+            auto operator<=>(const Symlink &) const = default;
         };
 
         using Raw = std::variant<Regular, Directory, Symlink>;
@@ -51,10 +55,12 @@ struct MemorySourceAccessor : virtual SourceAccessor
         Stat lstat() const;
     };
 
-    File root { File::Directory {} };
+    File root{File::Directory{}};
 
-    bool operator == (const MemorySourceAccessor &) const noexcept = default;
-    bool operator < (const MemorySourceAccessor & other) const noexcept {
+    bool operator==(const MemorySourceAccessor &) const noexcept = default;
+
+    bool operator<(const MemorySourceAccessor & other) const noexcept
+    {
         return root < other.root;
     }
 
@@ -80,19 +86,18 @@ struct MemorySourceAccessor : virtual SourceAccessor
     SourcePath addFile(CanonPath path, std::string && contents);
 };
 
-
-inline bool MemorySourceAccessor::File::Directory::operator == (
+inline bool MemorySourceAccessor::File::Directory::operator==(
     const MemorySourceAccessor::File::Directory &) const noexcept = default;
-inline bool MemorySourceAccessor::File::Directory::operator < (
-    const MemorySourceAccessor::File::Directory & other) const noexcept
+
+inline bool
+MemorySourceAccessor::File::Directory::operator<(const MemorySourceAccessor::File::Directory & other) const noexcept
 {
     return contents < other.contents;
 }
 
-inline bool MemorySourceAccessor::File::operator == (
-    const MemorySourceAccessor::File &) const noexcept = default;
-inline std::strong_ordering MemorySourceAccessor::File::operator <=> (
-    const MemorySourceAccessor::File &) const noexcept = default;
+inline bool MemorySourceAccessor::File::operator==(const MemorySourceAccessor::File &) const noexcept = default;
+inline std::strong_ordering
+MemorySourceAccessor::File::operator<=>(const MemorySourceAccessor::File &) const noexcept = default;
 
 /**
  * Write to a `MemorySourceAccessor` at the given path
@@ -101,15 +106,16 @@ struct MemorySink : FileSystemObjectSink
 {
     MemorySourceAccessor & dst;
 
-    MemorySink(MemorySourceAccessor & dst) : dst(dst) { }
+    MemorySink(MemorySourceAccessor & dst)
+        : dst(dst)
+    {
+    }
 
     void createDirectory(const CanonPath & path) override;
 
-    void createRegularFile(
-        const CanonPath & path,
-        std::function<void(CreateRegularFileSink &)>) override;
+    void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)>) override;
 
     void createSymlink(const CanonPath & path, const std::string & target) override;
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/meson.build b/src/libutil/include/nix/util/meson.build
index 22438c1d0..07a4f1d11 100644
--- a/src/libutil/include/nix/util/meson.build
+++ b/src/libutil/include/nix/util/meson.build
@@ -8,6 +8,9 @@ headers = files(
   'archive.hh',
   'args.hh',
   'args/root.hh',
+  'array-from-string-literal.hh',
+  'base-n.hh',
+  'base-nix-32.hh',
   'callback.hh',
   'canon-path.hh',
   'checked-arithmetic.hh',
@@ -39,6 +42,7 @@ headers = files(
   'hash.hh',
   'hilite.hh',
   'json-impls.hh',
+  'json-non-null.hh',
   'json-utils.hh',
   'logging.hh',
   'lru-cache.hh',
@@ -52,7 +56,6 @@ headers = files(
   'posix-source-accessor.hh',
   'processes.hh',
   'ref.hh',
-  'references.hh',
   'regex-combinators.hh',
   'repair-flag.hh',
   'serialise.hh',
diff --git a/src/libutil/include/nix/util/muxable-pipe.hh b/src/libutil/include/nix/util/muxable-pipe.hh
index d912627fb..f15c8e5f8 100644
--- a/src/libutil/include/nix/util/muxable-pipe.hh
+++ b/src/libutil/include/nix/util/muxable-pipe.hh
@@ -79,4 +79,4 @@ struct MuxablePipePollState
         std::function<void(Descriptor fd)> handleEOF);
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/os-string.hh b/src/libutil/include/nix/util/os-string.hh
index 3e24763fb..f0cbcbaba 100644
--- a/src/libutil/include/nix/util/os-string.hh
+++ b/src/libutil/include/nix/util/os-string.hh
@@ -49,4 +49,4 @@ OsString string_to_os_string(std::string_view s);
 #  define OS_STR(s) L##s
 #endif
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/pool.hh b/src/libutil/include/nix/util/pool.hh
index a63db50de..a9091c2de 100644
--- a/src/libutil/include/nix/util/pool.hh
+++ b/src/libutil/include/nix/util/pool.hh
@@ -29,7 +29,7 @@ namespace nix {
  * Here, the Connection object referenced by ‘conn’ is automatically
  * returned to the pool when ‘conn’ goes out of scope.
  */
-template <class R>
+template<class R>
 class Pool
 {
 public:
@@ -63,7 +63,8 @@ private:
 
 public:
 
-    Pool(size_t max = std::numeric_limits<size_t>::max(),
+    Pool(
+        size_t max = std::numeric_limits<size_t>::max(),
         const Factory & factory = []() { return make_ref<R>(); },
         const Validator & validator = [](ref<R> r) { return true; })
         : factory(factory)
@@ -106,7 +107,11 @@ public:
 
         friend Pool;
 
-        Handle(Pool & pool, std::shared_ptr<R> r) : pool(pool), r(r) { }
+        Handle(Pool & pool, std::shared_ptr<R> r)
+            : pool(pool)
+            , r(r)
+        {
+        }
 
     public:
         // NOTE: Copying std::shared_ptr and calling a .reset() on it is always noexcept.
@@ -123,7 +128,8 @@ public:
 
         ~Handle()
         {
-            if (!r) return;
+            if (!r)
+                return;
             {
                 auto state_(pool.state.lock());
                 if (!bad)
@@ -134,10 +140,20 @@ public:
             pool.wakeup.notify_one();
         }
 
-        R * operator -> () { return &*r; }
-        R & operator * () { return *r; }
+        R * operator->()
+        {
+            return &*r;
+        }
 
-        void markBad() { bad = true; }
+        R & operator*()
+        {
+            return *r;
+        }
+
+        void markBad()
+        {
+            bad = true;
+        }
     };
 
     Handle get()
@@ -197,4 +213,4 @@ public:
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/pos-idx.hh b/src/libutil/include/nix/util/pos-idx.hh
index 0bf59301a..8e668176c 100644
--- a/src/libutil/include/nix/util/pos-idx.hh
+++ b/src/libutil/include/nix/util/pos-idx.hh
@@ -49,7 +49,7 @@ public:
 
 inline PosIdx noPos = {};
 
-}
+} // namespace nix
 
 namespace std {
 
diff --git a/src/libutil/include/nix/util/pos-table.hh b/src/libutil/include/nix/util/pos-table.hh
index f64466c21..d944b1353 100644
--- a/src/libutil/include/nix/util/pos-table.hh
+++ b/src/libutil/include/nix/util/pos-table.hh
@@ -113,4 +113,4 @@ public:
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/position.hh b/src/libutil/include/nix/util/position.hh
index 34cf86392..48f381439 100644
--- a/src/libutil/include/nix/util/position.hh
+++ b/src/libutil/include/nix/util/position.hh
@@ -21,30 +21,53 @@ struct Pos
     uint32_t line = 0;
     uint32_t column = 0;
 
-    struct Stdin {
+    struct Stdin
+    {
         ref<std::string> source;
+
         bool operator==(const Stdin & rhs) const noexcept
-        { return *source == *rhs.source; }
+        {
+            return *source == *rhs.source;
+        }
+
         std::strong_ordering operator<=>(const Stdin & rhs) const noexcept
-        { return *source <=> *rhs.source; }
+        {
+            return *source <=> *rhs.source;
+        }
     };
-    struct String {
+
+    struct String
+    {
         ref<std::string> source;
+
         bool operator==(const String & rhs) const noexcept
-        { return *source == *rhs.source; }
+        {
+            return *source == *rhs.source;
+        }
+
         std::strong_ordering operator<=>(const String & rhs) const noexcept
-        { return *source <=> *rhs.source; }
+        {
+            return *source <=> *rhs.source;
+        }
     };
 
     typedef std::variant<std::monostate, Stdin, String, SourcePath> Origin;
 
     Origin origin = std::monostate();
 
-    Pos() { }
-    Pos(uint32_t line, uint32_t column, Origin origin)
-        : line(line), column(column), origin(origin) { }
+    Pos() {}
 
-    explicit operator bool() const { return line > 0; }
+    Pos(uint32_t line, uint32_t column, Origin origin)
+        : line(line)
+        , column(column)
+        , origin(origin)
+    {
+    }
+
+    explicit operator bool() const
+    {
+        return line > 0;
+    }
 
     operator std::shared_ptr<const Pos>() const;
 
@@ -67,39 +90,60 @@ struct Pos
      */
     std::optional<SourcePath> getSourcePath() const;
 
-    struct LinesIterator {
+    struct LinesIterator
+    {
         using difference_type = size_t;
         using value_type = std::string_view;
         using reference = const std::string_view &;
         using pointer = const std::string_view *;
         using iterator_category = std::input_iterator_tag;
 
-        LinesIterator(): pastEnd(true) {}
-        explicit LinesIterator(std::string_view input): input(input), pastEnd(input.empty()) {
+        LinesIterator()
+            : pastEnd(true)
+        {
+        }
+
+        explicit LinesIterator(std::string_view input)
+            : input(input)
+            , pastEnd(input.empty())
+        {
             if (!pastEnd)
                 bump(true);
         }
 
-        LinesIterator & operator++() {
+        LinesIterator & operator++()
+        {
             bump(false);
             return *this;
         }
-        LinesIterator operator++(int) {
+
+        LinesIterator operator++(int)
+        {
             auto result = *this;
             ++*this;
             return result;
         }
 
-        reference operator*() const { return curLine; }
-        pointer operator->() const { return &curLine; }
+        reference operator*() const
+        {
+            return curLine;
+        }
 
-        bool operator!=(const LinesIterator & other) const {
+        pointer operator->() const
+        {
+            return &curLine;
+        }
+
+        bool operator!=(const LinesIterator & other) const
+        {
             return !(*this == other);
         }
-        bool operator==(const LinesIterator & other) const {
+
+        bool operator==(const LinesIterator & other) const
+        {
             return (pastEnd && other.pastEnd)
-                || (std::forward_as_tuple(input.size(), input.data())
-                    == std::forward_as_tuple(other.input.size(), other.input.data()));
+                   || (std::forward_as_tuple(input.size(), input.data())
+                       == std::forward_as_tuple(other.input.size(), other.input.data()));
         }
 
     private:
@@ -112,4 +156,4 @@ struct Pos
 
 std::ostream & operator<<(std::ostream & str, const Pos & pos);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/posix-source-accessor.hh b/src/libutil/include/nix/util/posix-source-accessor.hh
index ea65b148f..895e2e1c1 100644
--- a/src/libutil/include/nix/util/posix-source-accessor.hh
+++ b/src/libutil/include/nix/util/posix-source-accessor.hh
@@ -27,10 +27,7 @@ struct PosixSourceAccessor : virtual SourceAccessor
      */
     time_t mtime = 0;
 
-    void readFile(
-        const CanonPath & path,
-        Sink & sink,
-        std::function<void(uint64_t)> sizeCallback) override;
+    void readFile(const CanonPath & path, Sink & sink, std::function<void(uint64_t)> sizeCallback) override;
 
     bool pathExists(const CanonPath & path) override;
 
@@ -81,4 +78,4 @@ private:
     std::filesystem::path makeAbsPath(const CanonPath & path);
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/processes.hh b/src/libutil/include/nix/util/processes.hh
index ab5f23e49..23dee8713 100644
--- a/src/libutil/include/nix/util/processes.hh
+++ b/src/libutil/include/nix/util/processes.hh
@@ -37,11 +37,11 @@ public:
     Pid();
 #ifndef _WIN32
     Pid(pid_t pid);
-    void operator =(pid_t pid);
+    void operator=(pid_t pid);
     operator pid_t();
 #else
     Pid(AutoCloseFD pid);
-    void operator =(AutoCloseFD pid);
+    void operator=(AutoCloseFD pid);
 #endif
     ~Pid();
     int kill();
@@ -55,7 +55,6 @@ public:
 #endif
 };
 
-
 #ifndef _WIN32
 /**
  * Kill all processes running under the specified uid by sending them
@@ -64,7 +63,6 @@ public:
 void killUser(uid_t uid);
 #endif
 
-
 /**
  * Fork a process that runs the given function, and return the child
  * pid to the caller.
@@ -89,9 +87,12 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options = P
  * Run a program and return its stdout in a string (i.e., like the
  * shell backtick operator).
  */
-std::string runProgram(Path program, bool lookupPath = false,
+std::string runProgram(
+    Path program,
+    bool lookupPath = false,
     const Strings & args = Strings(),
-    const std::optional<std::string> & input = {}, bool isInteractive = false);
+    const std::optional<std::string> & input = {},
+    bool isInteractive = false);
 
 struct RunOptions
 {
@@ -115,16 +116,17 @@ std::pair<int, std::string> runProgram(RunOptions && options);
 
 void runProgram2(const RunOptions & options);
 
-
 class ExecError : public Error
 {
 public:
     int status;
 
     template<typename... Args>
-    ExecError(int status, const Args & ... args)
-        : Error(args...), status(status)
-    { }
+    ExecError(int status, const Args &... args)
+        : Error(args...)
+        , status(status)
+    {
+    }
 };
 
 /**
@@ -135,4 +137,4 @@ std::string statusToString(int status);
 
 bool statusOk(int status);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/ref.hh b/src/libutil/include/nix/util/ref.hh
index 92688bf1e..7cf5ef25e 100644
--- a/src/libutil/include/nix/util/ref.hh
+++ b/src/libutil/include/nix/util/ref.hh
@@ -18,6 +18,9 @@ private:
     std::shared_ptr<T> p;
 
 public:
+
+    using element_type = T;
+
     explicit ref(const std::shared_ptr<T> & p)
         : p(p)
     {
@@ -32,17 +35,17 @@ public:
             throw std::invalid_argument("null pointer cast to ref");
     }
 
-    T* operator ->() const
+    T * operator->() const
     {
         return &*p;
     }
 
-    T& operator *() const
+    T & operator*() const
     {
         return *p;
     }
 
-    operator std::shared_ptr<T> () const
+    operator std::shared_ptr<T>() const
     {
         return p;
     }
@@ -65,22 +68,22 @@ public:
     }
 
     template<typename T2>
-    operator ref<T2> () const
+    operator ref<T2>() const
     {
         return ref<T2>((std::shared_ptr<T2>) p);
     }
 
-    bool operator == (const ref<T> & other) const
+    bool operator==(const ref<T> & other) const
     {
         return p == other.p;
     }
 
-    bool operator != (const ref<T> & other) const
+    bool operator!=(const ref<T> & other) const
     {
         return p != other.p;
     }
 
-    auto operator <=> (const ref<T> & other) const
+    auto operator<=>(const ref<T> & other) const
     {
         return p <=> other.p;
     }
@@ -88,17 +91,14 @@ public:
 private:
 
     template<typename T2, typename... Args>
-    friend ref<T2>
-    make_ref(Args&&... args);
-
+    friend ref<T2> make_ref(Args &&... args);
 };
 
 template<typename T, typename... Args>
-inline ref<T>
-make_ref(Args&&... args)
+inline ref<T> make_ref(Args &&... args)
 {
     auto p = std::make_shared<T>(std::forward<Args>(args)...);
     return ref<T>(p);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/regex-combinators.hh b/src/libutil/include/nix/util/regex-combinators.hh
index 75ccd4e6c..c86ad8204 100644
--- a/src/libutil/include/nix/util/regex-combinators.hh
+++ b/src/libutil/include/nix/util/regex-combinators.hh
@@ -31,4 +31,4 @@ static inline std::string list(std::string_view a)
     return ss.str();
 }
 
-}
+} // namespace nix::regex
diff --git a/src/libutil/include/nix/util/repair-flag.hh b/src/libutil/include/nix/util/repair-flag.hh
index f412d6a20..ad59108f6 100644
--- a/src/libutil/include/nix/util/repair-flag.hh
+++ b/src/libutil/include/nix/util/repair-flag.hh
@@ -1,4 +1,5 @@
 #pragma once
+
 ///@file
 
 namespace nix {
diff --git a/src/libutil/include/nix/util/serialise.hh b/src/libutil/include/nix/util/serialise.hh
index 97fdddae3..16e0d0fa5 100644
--- a/src/libutil/include/nix/util/serialise.hh
+++ b/src/libutil/include/nix/util/serialise.hh
@@ -8,19 +8,25 @@
 #include "nix/util/util.hh"
 #include "nix/util/file-descriptor.hh"
 
-namespace boost::context { struct stack_context; }
+namespace boost::context {
+struct stack_context;
+}
 
 namespace nix {
 
-
 /**
  * Abstract destination of binary data.
  */
 struct Sink
 {
-    virtual ~Sink() { }
-    virtual void operator () (std::string_view data) = 0;
-    virtual bool good() { return true; }
+    virtual ~Sink() {}
+
+    virtual void operator()(std::string_view data) = 0;
+
+    virtual bool good()
+    {
+        return true;
+    }
 };
 
 /**
@@ -28,17 +34,14 @@ struct Sink
  */
 struct NullSink : Sink
 {
-    void operator () (std::string_view data) override
-    { }
+    void operator()(std::string_view data) override {}
 };
 
-
 struct FinishSink : virtual Sink
 {
     virtual void finish() = 0;
 };
 
-
 /**
  * A buffered abstract sink. Warning: a BufferedSink should not be
  * used from multiple threads concurrently.
@@ -49,9 +52,13 @@ struct BufferedSink : virtual Sink
     std::unique_ptr<char[]> buffer;
 
     BufferedSink(size_t bufSize = 32 * 1024)
-        : bufSize(bufSize), bufPos(0), buffer(nullptr) { }
+        : bufSize(bufSize)
+        , bufPos(0)
+        , buffer(nullptr)
+    {
+    }
 
-    void operator () (std::string_view data) override;
+    void operator()(std::string_view data) override;
 
     void flush();
 
@@ -60,21 +67,20 @@ protected:
     virtual void writeUnbuffered(std::string_view data) = 0;
 };
 
-
 /**
  * Abstract source of binary data.
  */
 struct Source
 {
-    virtual ~Source() { }
+    virtual ~Source() {}
 
     /**
      * Store exactly ‘len’ bytes in the buffer pointed to by ‘data’.
      * It blocks until all the requested data is available, or throws
      * an error if it is not going to be available.
      */
-    void operator () (char * data, size_t len);
-    void operator () (std::string_view data);
+    void operator()(char * data, size_t len);
+    void operator()(std::string_view data);
 
     /**
      * Store up to ‘len’ in the buffer pointed to by ‘data’, and
@@ -83,14 +89,16 @@ struct Source
      */
     virtual size_t read(char * data, size_t len) = 0;
 
-    virtual bool good() { return true; }
+    virtual bool good()
+    {
+        return true;
+    }
 
     void drainInto(Sink & sink);
 
     std::string drain();
 };
 
-
 /**
  * A buffered abstract source. Warning: a BufferedSource should not be
  * used from multiple threads concurrently.
@@ -101,7 +109,12 @@ struct BufferedSource : Source
     std::unique_ptr<char[]> buffer;
 
     BufferedSource(size_t bufSize = 32 * 1024)
-        : bufSize(bufSize), bufPosIn(0), bufPosOut(0), buffer(nullptr) { }
+        : bufSize(bufSize)
+        , bufPosIn(0)
+        , bufPosOut(0)
+        , buffer(nullptr)
+    {
+    }
 
     size_t read(char * data, size_t len) override;
 
@@ -117,7 +130,6 @@ protected:
     virtual size_t readUnbuffered(char * data, size_t len) = 0;
 };
 
-
 /**
  * A sink that writes data to a file descriptor.
  */
@@ -126,9 +138,17 @@ struct FdSink : BufferedSink
     Descriptor fd;
     size_t written = 0;
 
-    FdSink() : fd(INVALID_DESCRIPTOR) { }
-    FdSink(Descriptor fd) : fd(fd) { }
-    FdSink(FdSink&&) = default;
+    FdSink()
+        : fd(INVALID_DESCRIPTOR)
+    {
+    }
+
+    FdSink(Descriptor fd)
+        : fd(fd)
+    {
+    }
+
+    FdSink(FdSink &&) = default;
 
     FdSink & operator=(FdSink && s)
     {
@@ -149,7 +169,6 @@ private:
     bool _good = true;
 };
 
-
 /**
  * A source that reads data from a file descriptor.
  */
@@ -159,8 +178,16 @@ struct FdSource : BufferedSource
     size_t read = 0;
     BackedStringView endOfFileError{"unexpected end-of-file"};
 
-    FdSource() : fd(INVALID_DESCRIPTOR) { }
-    FdSource(Descriptor fd) : fd(fd) { }
+    FdSource()
+        : fd(INVALID_DESCRIPTOR)
+    {
+    }
+
+    FdSource(Descriptor fd)
+        : fd(fd)
+    {
+    }
+
     FdSource(FdSource &&) = default;
 
     FdSource & operator=(FdSource && s) = default;
@@ -179,22 +206,24 @@ private:
     bool _good = true;
 };
 
-
 /**
  * A sink that writes data to a string.
  */
 struct StringSink : Sink
 {
     std::string s;
-    StringSink() { }
+
+    StringSink() {}
+
     explicit StringSink(const size_t reservedSize)
     {
-      s.reserve(reservedSize);
+        s.reserve(reservedSize);
     };
-    StringSink(std::string && s) : s(std::move(s)) { };
-    void operator () (std::string_view data) override;
-};
 
+    StringSink(std::string && s)
+        : s(std::move(s)) {};
+    void operator()(std::string_view data) override;
+};
 
 /**
  * A source that reads data from a string.
@@ -208,28 +237,41 @@ struct StringSource : Source
     // from std::string -> std::string_view occurs when the string is passed
     // by rvalue.
     StringSource(std::string &&) = delete;
-    StringSource(std::string_view s) : s(s), pos(0) { }
-    StringSource(const std::string& str): StringSource(std::string_view(str)) {}
+
+    StringSource(std::string_view s)
+        : s(s)
+        , pos(0)
+    {
+    }
+
+    StringSource(const std::string & str)
+        : StringSource(std::string_view(str))
+    {
+    }
 
     size_t read(char * data, size_t len) override;
 };
 
-
 /**
  * A sink that writes all incoming data to two other sinks.
  */
 struct TeeSink : Sink
 {
-    Sink & sink1, & sink2;
-    TeeSink(Sink & sink1, Sink & sink2) : sink1(sink1), sink2(sink2) { }
-    virtual void operator () (std::string_view data) override
+    Sink &sink1, &sink2;
+
+    TeeSink(Sink & sink1, Sink & sink2)
+        : sink1(sink1)
+        , sink2(sink2)
+    {
+    }
+
+    virtual void operator()(std::string_view data) override
     {
         sink1(data);
         sink2(data);
     }
 };
 
-
 /**
  * Adapter class of a Source that saves all data read to a sink.
  */
@@ -237,8 +279,13 @@ struct TeeSource : Source
 {
     Source & orig;
     Sink & sink;
+
     TeeSource(Source & orig, Sink & sink)
-        : orig(orig), sink(sink) { }
+        : orig(orig)
+        , sink(sink)
+    {
+    }
+
     size_t read(char * data, size_t len) override
     {
         size_t n = orig.read(data, len);
@@ -254,8 +301,13 @@ struct SizedSource : Source
 {
     Source & orig;
     size_t remain;
+
     SizedSource(Source & orig, size_t size)
-        : orig(orig), remain(size) { }
+        : orig(orig)
+        , remain(size)
+    {
+    }
+
     size_t read(char * data, size_t len) override
     {
         if (this->remain <= 0) {
@@ -289,7 +341,7 @@ struct LengthSink : Sink
 {
     uint64_t length = 0;
 
-    void operator () (std::string_view data) override
+    void operator()(std::string_view data) override
     {
         length += data.size();
     }
@@ -302,8 +354,10 @@ struct LengthSource : Source
 {
     Source & next;
 
-    LengthSource(Source & next) : next(next)
-    { }
+    LengthSource(Source & next)
+        : next(next)
+    {
+    }
 
     uint64_t total = 0;
 
@@ -324,15 +378,17 @@ struct LambdaSink : Sink
 
     lambda_t lambda;
 
-    LambdaSink(const lambda_t & lambda) : lambda(lambda) { }
+    LambdaSink(const lambda_t & lambda)
+        : lambda(lambda)
+    {
+    }
 
-    void operator () (std::string_view data) override
+    void operator()(std::string_view data) override
     {
         lambda(data);
     }
 };
 
-
 /**
  * Convert a function into a source.
  */
@@ -342,7 +398,10 @@ struct LambdaSource : Source
 
     lambda_t lambda;
 
-    LambdaSource(const lambda_t & lambda) : lambda(lambda) { }
+    LambdaSource(const lambda_t & lambda)
+        : lambda(lambda)
+    {
+    }
 
     size_t read(char * data, size_t len) override
     {
@@ -356,11 +415,14 @@ struct LambdaSource : Source
  */
 struct ChainSource : Source
 {
-    Source & source1, & source2;
+    Source &source1, &source2;
     bool useSecond = false;
+
     ChainSource(Source & s1, Source & s2)
-        : source1(s1), source2(s2)
-    { }
+        : source1(s1)
+        , source2(s2)
+    {
+    }
 
     size_t read(char * data, size_t len) override;
 };
@@ -372,16 +434,12 @@ std::unique_ptr<FinishSink> sourceToSink(std::function<void(Source &)> fun);
  * Source executes the function as a coroutine.
  */
 std::unique_ptr<Source> sinkToSource(
-    std::function<void(Sink &)> fun,
-    std::function<void()> eof = []() {
-        throw EndOfFile("coroutine has finished");
-    });
-
+    std::function<void(Sink &)> fun, std::function<void()> eof = []() { throw EndOfFile("coroutine has finished"); });
 
 void writePadding(size_t len, Sink & sink);
 void writeString(std::string_view s, Sink & sink);
 
-inline Sink & operator << (Sink & sink, uint64_t n)
+inline Sink & operator<<(Sink & sink, uint64_t n)
 {
     unsigned char buf[8];
     buf[0] = n & 0xff;
@@ -396,15 +454,13 @@ inline Sink & operator << (Sink & sink, uint64_t n)
     return sink;
 }
 
-Sink & operator << (Sink & in, const Error & ex);
-Sink & operator << (Sink & sink, std::string_view s);
-Sink & operator << (Sink & sink, const Strings & s);
-Sink & operator << (Sink & sink, const StringSet & s);
-
+Sink & operator<<(Sink & in, const Error & ex);
+Sink & operator<<(Sink & sink, std::string_view s);
+Sink & operator<<(Sink & sink, const Strings & s);
+Sink & operator<<(Sink & sink, const StringSet & s);
 
 MakeError(SerialisationError, Error);
 
-
 template<typename T>
 T readNum(Source & source)
 {
@@ -419,35 +475,33 @@ T readNum(Source & source)
     return (T) n;
 }
 
-
 inline unsigned int readInt(Source & source)
 {
     return readNum<unsigned int>(source);
 }
 
-
 inline uint64_t readLongLong(Source & source)
 {
     return readNum<uint64_t>(source);
 }
 
-
 void readPadding(size_t len, Source & source);
 size_t readString(char * buf, size_t max, Source & source);
 std::string readString(Source & source, size_t max = std::numeric_limits<size_t>::max());
-template<class T> T readStrings(Source & source);
+template<class T>
+T readStrings(Source & source);
 
-Source & operator >> (Source & in, std::string & s);
+Source & operator>>(Source & in, std::string & s);
 
 template<typename T>
-Source & operator >> (Source & in, T & n)
+Source & operator>>(Source & in, T & n)
 {
     n = readNum<T>(in);
     return in;
 }
 
 template<typename T>
-Source & operator >> (Source & in, bool & b)
+Source & operator>>(Source & in, bool & b)
 {
     b = readNum<uint64_t>(in);
     return in;
@@ -455,7 +509,6 @@ Source & operator >> (Source & in, bool & b)
 
 Error readError(Source & source);
 
-
 /**
  * An adapter that converts a std::basic_istream into a source.
  */
@@ -465,7 +518,8 @@ struct StreamToSourceAdapter : Source
 
     StreamToSourceAdapter(std::shared_ptr<std::basic_istream<char>> istream)
         : istream(istream)
-    { }
+    {
+    }
 
     size_t read(char * data, size_t len) override
     {
@@ -480,7 +534,6 @@ struct StreamToSourceAdapter : Source
     }
 };
 
-
 /**
  * A source that reads a distinct format of concatenated chunks back into its
  * logical form, in order to guarantee a known state to the original stream,
@@ -496,8 +549,10 @@ struct FramedSource : Source
     std::vector<char> pending;
     size_t pos = 0;
 
-    FramedSource(Source & from) : from(from)
-    { }
+    FramedSource(Source & from)
+        : from(from)
+    {
+    }
 
     ~FramedSource()
     {
@@ -505,7 +560,8 @@ struct FramedSource : Source
             if (!eof) {
                 while (true) {
                     auto n = readInt(from);
-                    if (!n) break;
+                    if (!n)
+                        break;
                     std::vector<char> data(n);
                     from(data.data(), n);
                 }
@@ -517,7 +573,8 @@ struct FramedSource : Source
 
     size_t read(char * data, size_t len) override
     {
-        if (eof) throw EndOfFile("reached end of FramedSource");
+        if (eof)
+            throw EndOfFile("reached end of FramedSource");
 
         if (pos >= pending.size()) {
             size_t len = readInt(from);
@@ -549,8 +606,10 @@ struct FramedSink : nix::BufferedSink
     std::function<void()> checkError;
 
     FramedSink(BufferedSink & to, std::function<void()> && checkError)
-        : to(to), checkError(checkError)
-    { }
+        : to(to)
+        , checkError(checkError)
+    {
+    }
 
     ~FramedSink()
     {
@@ -572,4 +631,4 @@ struct FramedSink : nix::BufferedSink
     };
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/signals.hh b/src/libutil/include/nix/util/signals.hh
index 5a2ba8e75..8facec37f 100644
--- a/src/libutil/include/nix/util/signals.hh
+++ b/src/libutil/include/nix/util/signals.hh
@@ -41,10 +41,9 @@ inline void checkInterrupt();
  */
 MakeError(Interrupted, BaseError);
 
-
 struct InterruptCallback
 {
-    virtual ~InterruptCallback() { };
+    virtual ~InterruptCallback() {};
 };
 
 /**
@@ -53,8 +52,7 @@ struct InterruptCallback
  *
  * @note Does nothing on Windows
  */
-std::unique_ptr<InterruptCallback> createInterruptCallback(
-    std::function<void()> callback);
+std::unique_ptr<InterruptCallback> createInterruptCallback(std::function<void()> callback);
 
 /**
  * A RAII class that causes the current thread to receive SIGUSR1 when
@@ -65,6 +63,6 @@ std::unique_ptr<InterruptCallback> createInterruptCallback(
  */
 struct ReceiveInterrupts;
 
-}
+} // namespace nix
 
 #include "nix/util/signals-impl.hh"
diff --git a/src/libutil/include/nix/util/signature/local-keys.hh b/src/libutil/include/nix/util/signature/local-keys.hh
index 85918f906..1c0579ce9 100644
--- a/src/libutil/include/nix/util/signature/local-keys.hh
+++ b/src/libutil/include/nix/util/signature/local-keys.hh
@@ -15,7 +15,8 @@ namespace nix {
  * <name>:<key/signature-in-Base64>
  * ```
  */
-struct BorrowedCryptoValue {
+struct BorrowedCryptoValue
+{
     std::string_view name;
     std::string_view payload;
 
@@ -45,7 +46,10 @@ protected:
     Key(std::string_view s, bool sensitiveValue);
 
     Key(std::string_view name, std::string && key)
-        : name(name), key(std::move(key)) { }
+        : name(name)
+        , key(std::move(key))
+    {
+    }
 };
 
 struct PublicKey;
@@ -65,7 +69,9 @@ struct SecretKey : Key
 
 private:
     SecretKey(std::string_view name, std::string && key)
-        : Key(name, std::move(key)) { }
+        : Key(name, std::move(key))
+    {
+    }
 };
 
 struct PublicKey : Key
@@ -89,7 +95,9 @@ struct PublicKey : Key
 
 private:
     PublicKey(std::string_view name, std::string && key)
-        : Key(name, std::move(key)) { }
+        : Key(name, std::move(key))
+    {
+    }
     friend struct SecretKey;
 };
 
@@ -104,4 +112,4 @@ typedef std::map<std::string, PublicKey> PublicKeys;
  */
 bool verifyDetached(std::string_view data, std::string_view sig, const PublicKeys & publicKeys);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/signature/signer.hh b/src/libutil/include/nix/util/signature/signer.hh
index ca2905eef..074c0c6e5 100644
--- a/src/libutil/include/nix/util/signature/signer.hh
+++ b/src/libutil/include/nix/util/signature/signer.hh
@@ -37,7 +37,7 @@ struct Signer
     virtual const PublicKey & getPublicKey() = 0;
 };
 
-using Signers = std::map<std::string, Signer*>;
+using Signers = std::map<std::string, Signer *>;
 
 /**
  * Local signer
@@ -58,4 +58,4 @@ private:
     PublicKey publicKey;
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/sort.hh b/src/libutil/include/nix/util/sort.hh
index 0affdf3ce..2a4eb6e7c 100644
--- a/src/libutil/include/nix/util/sort.hh
+++ b/src/libutil/include/nix/util/sort.hh
@@ -296,4 +296,4 @@ void peeksort(Iter begin, Iter end, Comparator comp = {})
     peeksortImpl(peeksortImpl, begin, end, /*leftRunEnd=*/begin, /*rightRunBegin=*/end);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/source-accessor.hh b/src/libutil/include/nix/util/source-accessor.hh
index 92a9adc46..aa937da48 100644
--- a/src/libutil/include/nix/util/source-accessor.hh
+++ b/src/libutil/include/nix/util/source-accessor.hh
@@ -46,8 +46,7 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
 
     SourceAccessor();
 
-    virtual ~SourceAccessor()
-    { }
+    virtual ~SourceAccessor() {}
 
     /**
      * Return the contents of a file as a string.
@@ -72,24 +71,28 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
      * @note subclasses of `SourceAccessor` need to implement at least
      * one of the `readFile()` variants.
      */
-    virtual void readFile(
-        const CanonPath & path,
-        Sink & sink,
-        std::function<void(uint64_t)> sizeCallback = [](uint64_t size){});
+    virtual void
+    readFile(const CanonPath & path, Sink & sink, std::function<void(uint64_t)> sizeCallback = [](uint64_t size) {});
 
     virtual bool pathExists(const CanonPath & path);
 
     enum Type {
-      tRegular, tSymlink, tDirectory,
-      /**
-        Any other node types that may be encountered on the file system, such as device nodes, sockets, named pipe, and possibly even more exotic things.
+        tRegular,
+        tSymlink,
+        tDirectory,
+        /**
+          Any other node types that may be encountered on the file system, such as device nodes, sockets, named pipe,
+          and possibly even more exotic things.
 
-        Responsible for `"unknown"` from `builtins.readFileType "/dev/null"`.
+          Responsible for `"unknown"` from `builtins.readFileType "/dev/null"`.
 
-        Unlike `DT_UNKNOWN`, this must not be used for deferring the lookup of types.
-      */
-      tChar, tBlock, tSocket, tFifo,
-      tUnknown
+          Unlike `DT_UNKNOWN`, this must not be used for deferring the lookup of types.
+        */
+        tChar,
+        tBlock,
+        tSocket,
+        tFifo,
+        tUnknown
     };
 
     struct Stat
@@ -133,15 +136,10 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
 
     virtual std::string readLink(const CanonPath & path) = 0;
 
-    virtual void dumpPath(
-        const CanonPath & path,
-        Sink & sink,
-        PathFilter & filter = defaultPathFilter);
+    virtual void dumpPath(const CanonPath & path, Sink & sink, PathFilter & filter = defaultPathFilter);
 
-    Hash hashPath(
-        const CanonPath & path,
-        PathFilter & filter = defaultPathFilter,
-        HashAlgorithm ha = HashAlgorithm::SHA256);
+    Hash
+    hashPath(const CanonPath & path, PathFilter & filter = defaultPathFilter, HashAlgorithm ha = HashAlgorithm::SHA256);
 
     /**
      * Return a corresponding path in the root filesystem, if
@@ -149,14 +147,16 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
      * materialized in the root filesystem.
      */
     virtual std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path)
-    { return std::nullopt; }
+    {
+        return std::nullopt;
+    }
 
-    bool operator == (const SourceAccessor & x) const
+    bool operator==(const SourceAccessor & x) const
     {
         return number == x.number;
     }
 
-    auto operator <=> (const SourceAccessor & x) const
+    auto operator<=>(const SourceAccessor & x) const
     {
         return number <=> x.number;
     }
@@ -172,9 +172,7 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
      * @param mode might only be a temporary solution for this.
      * See the discussion in https://github.com/NixOS/nix/pull/9985.
      */
-    CanonPath resolveSymlinks(
-        const CanonPath & path,
-        SymlinkResolution mode = SymlinkResolution::Full);
+    CanonPath resolveSymlinks(const CanonPath & path, SymlinkResolution mode = SymlinkResolution::Full);
 
     /**
      * A string that uniquely represents the contents of this
@@ -187,7 +185,9 @@ struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
      * tree, if available.
      */
     virtual std::optional<time_t> getLastModified()
-    { return std::nullopt; }
+    {
+        return std::nullopt;
+    }
 };
 
 /**
@@ -228,4 +228,4 @@ ref<SourceAccessor> makeUnionSourceAccessor(std::vector<ref<SourceAccessor>> &&
  */
 ref<SourceAccessor> projectSubdirSourceAccessor(ref<SourceAccessor>, CanonPath subdirectory);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/source-path.hh b/src/libutil/include/nix/util/source-path.hh
index c0cba0241..f7cfc8ef7 100644
--- a/src/libutil/include/nix/util/source-path.hh
+++ b/src/libutil/include/nix/util/source-path.hh
@@ -26,7 +26,8 @@ struct SourcePath
     SourcePath(ref<SourceAccessor> accessor, CanonPath path = CanonPath::root)
         : accessor(std::move(accessor))
         , path(std::move(path))
-    { }
+    {
+    }
 
     std::string_view baseName() const;
 
@@ -42,15 +43,15 @@ struct SourcePath
      */
     std::string readFile() const;
 
-    void readFile(
-        Sink & sink,
-        std::function<void(uint64_t)> sizeCallback = [](uint64_t size){}) const
-    { return accessor->readFile(path, sink, sizeCallback); }
+    void readFile(Sink & sink, std::function<void(uint64_t)> sizeCallback = [](uint64_t size) {}) const
+    {
+        return accessor->readFile(path, sink, sizeCallback);
+    }
 
     /**
      * Return whether this `SourcePath` denotes a file (of any type)
      * that exists
-    */
+     */
     bool pathExists() const;
 
     /**
@@ -80,9 +81,7 @@ struct SourcePath
     /**
      * Dump this `SourcePath` to `sink` as a NAR archive.
      */
-    void dumpPath(
-        Sink & sink,
-        PathFilter & filter = defaultPathFilter) const;
+    void dumpPath(Sink & sink, PathFilter & filter = defaultPathFilter) const;
 
     /**
      * Return the location of this path in the "real" filesystem, if
@@ -95,14 +94,14 @@ struct SourcePath
     /**
      * Append a `CanonPath` to this path.
      */
-    SourcePath operator / (const CanonPath & x) const;
+    SourcePath operator/(const CanonPath & x) const;
 
     /**
      * Append a single component `c` to this path. `c` must not
      * contain a slash. A slash is implicitly added between this path
      * and `c`.
      */
-    SourcePath operator / (std::string_view c) const;
+    SourcePath operator/(std::string_view c) const;
 
     bool operator==(const SourcePath & x) const noexcept;
     std::strong_ordering operator<=>(const SourcePath & x) const noexcept;
@@ -110,8 +109,7 @@ struct SourcePath
     /**
      * Convenience wrapper around `SourceAccessor::resolveSymlinks()`.
      */
-    SourcePath resolveSymlinks(
-        SymlinkResolution mode = SymlinkResolution::Full) const
+    SourcePath resolveSymlinks(SymlinkResolution mode = SymlinkResolution::Full) const
     {
         return {accessor, accessor->resolveSymlinks(path, mode)};
     }
@@ -119,9 +117,9 @@ struct SourcePath
     friend class std::hash<nix::SourcePath>;
 };
 
-std::ostream & operator << (std::ostream & str, const SourcePath & path);
+std::ostream & operator<<(std::ostream & str, const SourcePath & path);
 
-}
+} // namespace nix
 
 template<>
 struct std::hash<nix::SourcePath>
diff --git a/src/libutil/include/nix/util/split.hh b/src/libutil/include/nix/util/split.hh
index 24a73fea8..838dcdd58 100644
--- a/src/libutil/include/nix/util/split.hh
+++ b/src/libutil/include/nix/util/split.hh
@@ -14,23 +14,25 @@ namespace nix {
  * separator. Otherwise, we return `std::nullopt`, and we leave the argument
  * string alone.
  */
-static inline std::optional<std::string_view> splitPrefixTo(std::string_view & string, char separator) {
+static inline std::optional<std::string_view> splitPrefixTo(std::string_view & string, char separator)
+{
     auto sepInstance = string.find(separator);
 
     if (sepInstance != std::string_view::npos) {
         auto prefix = string.substr(0, sepInstance);
-        string.remove_prefix(sepInstance+1);
+        string.remove_prefix(sepInstance + 1);
         return prefix;
     }
 
     return std::nullopt;
 }
 
-static inline bool splitPrefix(std::string_view & string, std::string_view prefix) {
+static inline bool splitPrefix(std::string_view & string, std::string_view prefix)
+{
     bool res = hasPrefix(string, prefix);
     if (res)
         string.remove_prefix(prefix.length());
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/strings-inline.hh b/src/libutil/include/nix/util/strings-inline.hh
index d99b686fc..61bddfeda 100644
--- a/src/libutil/include/nix/util/strings-inline.hh
+++ b/src/libutil/include/nix/util/strings-inline.hh
@@ -26,18 +26,29 @@ C tokenizeString(std::string_view s, std::string_view separators)
 }
 
 template<class C, class CharT>
-C basicSplitString(std::basic_string_view<CharT> s, std::basic_string_view<CharT> separators)
+void basicSplitStringInto(C & accum, std::basic_string_view<CharT> s, std::basic_string_view<CharT> separators)
 {
-    C result;
     size_t pos = 0;
     while (pos <= s.size()) {
         auto end = s.find_first_of(separators, pos);
         if (end == s.npos)
             end = s.size();
-        result.insert(result.end(), std::basic_string<CharT>(s, pos, end - pos));
+        accum.insert(accum.end(), typename C::value_type{s.substr(pos, end - pos)});
         pos = end + 1;
     }
+}
 
+template<typename C>
+void splitStringInto(C & accum, std::string_view s, std::string_view separators)
+{
+    basicSplitStringInto<C, char>(accum, s, separators);
+}
+
+template<class C, class CharT>
+C basicSplitString(std::basic_string_view<CharT> s, std::basic_string_view<CharT> separators)
+{
+    C result;
+    basicSplitStringInto(result, s, separators);
     return result;
 }
 
diff --git a/src/libutil/include/nix/util/strings.hh b/src/libutil/include/nix/util/strings.hh
index 4c77516a3..b4ef66bfe 100644
--- a/src/libutil/include/nix/util/strings.hh
+++ b/src/libutil/include/nix/util/strings.hh
@@ -132,4 +132,4 @@ public:
     }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/suggestions.hh b/src/libutil/include/nix/util/suggestions.hh
index 6a76eb9d9..6b20f37ab 100644
--- a/src/libutil/include/nix/util/suggestions.hh
+++ b/src/libutil/include/nix/util/suggestions.hh
@@ -11,7 +11,8 @@ int levenshteinDistance(std::string_view first, std::string_view second);
 /**
  * A potential suggestion for the cli interface.
  */
-class Suggestion {
+class Suggestion
+{
 public:
     /// The smaller the better
     int distance;
@@ -19,27 +20,22 @@ public:
 
     std::string to_string() const;
 
-    bool operator ==(const Suggestion &) const = default;
-    auto operator <=>(const Suggestion &) const = default;
+    bool operator==(const Suggestion &) const = default;
+    auto operator<=>(const Suggestion &) const = default;
 };
 
-class Suggestions {
+class Suggestions
+{
 public:
     std::set<Suggestion> suggestions;
 
     std::string to_string() const;
 
-    Suggestions trim(
-        int limit = 5,
-        int maxDistance = 2
-    ) const;
+    Suggestions trim(int limit = 5, int maxDistance = 2) const;
 
-    static Suggestions bestMatches (
-        const StringSet & allMatches,
-        std::string_view query
-    );
+    static Suggestions bestMatches(const StringSet & allMatches, std::string_view query);
 
-    Suggestions& operator+=(const Suggestions & other);
+    Suggestions & operator+=(const Suggestions & other);
 };
 
 std::ostream & operator<<(std::ostream & str, const Suggestion &);
@@ -49,18 +45,19 @@ std::ostream & operator<<(std::ostream & str, const Suggestions &);
  * Either a value of type `T`, or some suggestions
  */
 template<typename T>
-class OrSuggestions {
+class OrSuggestions
+{
 public:
     using Raw = std::variant<T, Suggestions>;
 
     Raw raw;
 
-    T* operator ->()
+    T * operator->()
     {
         return &**this;
     }
 
-    T& operator *()
+    T & operator*()
     {
         return std::get<T>(raw);
     }
@@ -100,7 +97,6 @@ public:
         else
             return noSuggestions;
     }
-
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/sync.hh b/src/libutil/include/nix/util/sync.hh
index 4b9d546d2..3a41d1bd8 100644
--- a/src/libutil/include/nix/util/sync.hh
+++ b/src/libutil/include/nix/util/sync.hh
@@ -36,10 +36,24 @@ private:
 
 public:
 
-    SyncBase() { }
-    SyncBase(const T & data) : data(data) { }
-    SyncBase(T && data) noexcept : data(std::move(data)) { }
-    SyncBase(SyncBase && other) noexcept : data(std::move(*other.lock())) { }
+    using element_type = T;
+
+    SyncBase() {}
+
+    SyncBase(const T & data)
+        : data(data)
+    {
+    }
+
+    SyncBase(T && data) noexcept
+        : data(std::move(data))
+    {
+    }
+
+    SyncBase(SyncBase && other) noexcept
+        : data(std::move(*other.lock()))
+    {
+    }
 
     template<class L>
     class Lock
@@ -48,11 +62,22 @@ public:
         SyncBase * s;
         L lk;
         friend SyncBase;
-        Lock(SyncBase * s) : s(s), lk(s->mutex) { }
+
+        Lock(SyncBase * s)
+            : s(s)
+            , lk(s->mutex)
+        {
+        }
     public:
-        Lock(Lock && l) : s(l.s) { unreachable(); }
+        Lock(Lock && l)
+            : s(l.s)
+        {
+            unreachable();
+        }
+
         Lock(const Lock & l) = delete;
-        ~Lock() { }
+
+        ~Lock() {}
 
         void wait(std::condition_variable & cv)
         {
@@ -61,25 +86,22 @@ public:
         }
 
         template<class Rep, class Period>
-        std::cv_status wait_for(std::condition_variable & cv,
-            const std::chrono::duration<Rep, Period> & duration)
+        std::cv_status wait_for(std::condition_variable & cv, const std::chrono::duration<Rep, Period> & duration)
         {
             assert(s);
             return cv.wait_for(lk, duration);
         }
 
         template<class Rep, class Period, class Predicate>
-        bool wait_for(std::condition_variable & cv,
-            const std::chrono::duration<Rep, Period> & duration,
-            Predicate pred)
+        bool wait_for(std::condition_variable & cv, const std::chrono::duration<Rep, Period> & duration, Predicate pred)
         {
             assert(s);
             return cv.wait_for(lk, duration, pred);
         }
 
         template<class Clock, class Duration>
-        std::cv_status wait_until(std::condition_variable & cv,
-            const std::chrono::time_point<Clock, Duration> & duration)
+        std::cv_status
+        wait_until(std::condition_variable & cv, const std::chrono::time_point<Clock, Duration> & duration)
         {
             assert(s);
             return cv.wait_until(lk, duration);
@@ -88,32 +110,53 @@ public:
 
     struct WriteLock : Lock<WL>
     {
-        T * operator -> () { return &WriteLock::s->data; }
-        T & operator * () { return WriteLock::s->data; }
+        T * operator->()
+        {
+            return &WriteLock::s->data;
+        }
+
+        T & operator*()
+        {
+            return WriteLock::s->data;
+        }
     };
 
     /**
      * Acquire write (exclusive) access to the inner value.
      */
-    WriteLock lock() { return WriteLock(this); }
+    WriteLock lock()
+    {
+        return WriteLock(this);
+    }
 
     struct ReadLock : Lock<RL>
     {
-        const T * operator -> () { return &ReadLock::s->data; }
-        const T & operator * () { return ReadLock::s->data; }
+        const T * operator->()
+        {
+            return &ReadLock::s->data;
+        }
+
+        const T & operator*()
+        {
+            return ReadLock::s->data;
+        }
     };
 
     /**
      * Acquire read access to the inner value. When using
      * `std::shared_mutex`, this will use a shared lock.
      */
-    ReadLock readLock() const { return ReadLock(const_cast<SyncBase *>(this)); }
+    ReadLock readLock() const
+    {
+        return ReadLock(const_cast<SyncBase *>(this));
+    }
 };
 
 template<class T>
 using Sync = SyncBase<T, std::mutex, std::unique_lock<std::mutex>, std::unique_lock<std::mutex>>;
 
 template<class T>
-using SharedSync = SyncBase<T, std::shared_mutex, std::unique_lock<std::shared_mutex>, std::shared_lock<std::shared_mutex>>;
+using SharedSync =
+    SyncBase<T, std::shared_mutex, std::unique_lock<std::shared_mutex>, std::shared_lock<std::shared_mutex>>;
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/tarfile.hh b/src/libutil/include/nix/util/tarfile.hh
index 2005d13ca..c66e05ef6 100644
--- a/src/libutil/include/nix/util/tarfile.hh
+++ b/src/libutil/include/nix/util/tarfile.hh
@@ -43,4 +43,4 @@ void unpackTarfile(const std::filesystem::path & tarFile, const std::filesystem:
 
 time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink & parseSink);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/terminal.hh b/src/libutil/include/nix/util/terminal.hh
index 7ff05a487..f19de268c 100644
--- a/src/libutil/include/nix/util/terminal.hh
+++ b/src/libutil/include/nix/util/terminal.hh
@@ -18,9 +18,8 @@ bool isTTY();
  * included in the character count. Also, tabs are expanded to
  * spaces.
  */
-std::string filterANSIEscapes(std::string_view s,
-    bool filterAll = false,
-    unsigned int width = std::numeric_limits<unsigned int>::max());
+std::string filterANSIEscapes(
+    std::string_view s, bool filterAll = false, unsigned int width = std::numeric_limits<unsigned int>::max());
 
 /**
  * Recalculate the window size, updating a global variable.
@@ -37,4 +36,4 @@ void updateWindowSize();
  */
 std::pair<unsigned short, unsigned short> getWindowSize();
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/thread-pool.hh b/src/libutil/include/nix/util/thread-pool.hh
index 92009e396..811c03d88 100644
--- a/src/libutil/include/nix/util/thread-pool.hh
+++ b/src/libutil/include/nix/util/thread-pool.hh
@@ -87,7 +87,8 @@ void processGraph(
     std::function<std::set<T>(const T &)> getEdges,
     std::function<void(const T &)> processNode)
 {
-    struct Graph {
+    struct Graph
+    {
         std::set<T> left;
         std::map<T, std::set<T>> refs, rrefs;
     };
@@ -101,7 +102,6 @@ void processGraph(
     ThreadPool pool;
 
     worker = [&](const T & node) {
-
         {
             auto graph(graph_.lock());
             auto i = graph->refs.find(node);
@@ -110,22 +110,21 @@ void processGraph(
             goto doWork;
         }
 
-    getRefs:
-        {
-            auto refs = getEdges(node);
-            refs.erase(node);
+    getRefs: {
+        auto refs = getEdges(node);
+        refs.erase(node);
 
-            {
-                auto graph(graph_.lock());
-                for (auto & ref : refs)
-                    if (graph->left.count(ref)) {
-                        graph->refs[node].insert(ref);
-                        graph->rrefs[ref].insert(node);
-                    }
-                if (graph->refs[node].empty())
-                    goto doWork;
-            }
+        {
+            auto graph(graph_.lock());
+            for (auto & ref : refs)
+                if (graph->left.count(ref)) {
+                    graph->refs[node].insert(ref);
+                    graph->rrefs[ref].insert(node);
+                }
+            if (graph->refs[node].empty())
+                goto doWork;
         }
+    }
 
         return;
 
@@ -167,4 +166,4 @@ void processGraph(
         throw Error("graph processing incomplete (cyclic reference?)");
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/topo-sort.hh b/src/libutil/include/nix/util/topo-sort.hh
index 6ba6fda71..9f403e2e6 100644
--- a/src/libutil/include/nix/util/topo-sort.hh
+++ b/src/libutil/include/nix/util/topo-sort.hh
@@ -6,9 +6,10 @@
 namespace nix {
 
 template<typename T, typename Compare>
-std::vector<T> topoSort(std::set<T, Compare> items,
-        std::function<std::set<T, Compare>(const T &)> getChildren,
-        std::function<Error(const T &, const T &)> makeCycleError)
+std::vector<T> topoSort(
+    std::set<T, Compare> items,
+    std::function<std::set<T, Compare>(const T &)> getChildren,
+    std::function<Error(const T &, const T &)> makeCycleError)
 {
     std::vector<T> sorted;
     decltype(items) visited, parents;
@@ -16,9 +17,11 @@ std::vector<T> topoSort(std::set<T, Compare> items,
     std::function<void(const T & path, const T * parent)> dfsVisit;
 
     dfsVisit = [&](const T & path, const T * parent) {
-        if (parents.count(path)) throw makeCycleError(path, *parent);
+        if (parents.count(path))
+            throw makeCycleError(path, *parent);
 
-        if (!visited.insert(path).second) return;
+        if (!visited.insert(path).second)
+            return;
         parents.insert(path);
 
         auto references = getChildren(path);
@@ -40,4 +43,4 @@ std::vector<T> topoSort(std::set<T, Compare> items,
     return sorted;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/types.hh b/src/libutil/include/nix/util/types.hh
index edb34f5e2..f8c6c0979 100644
--- a/src/libutil/include/nix/util/types.hh
+++ b/src/libutil/include/nix/util/types.hh
@@ -1,7 +1,6 @@
 #pragma once
 ///@file
 
-
 #include <list>
 #include <set>
 #include <string>
@@ -67,7 +66,10 @@ typedef std::vector<std::pair<std::string, std::string>> Headers;
 template<typename T>
 struct OnStartup
 {
-    OnStartup(T && t) { t(); }
+    OnStartup(T && t)
+    {
+        t();
+    }
 };
 
 /**
@@ -75,18 +77,18 @@ struct OnStartup
  * cast to a bool in Attr.
  */
 template<typename T>
-struct Explicit {
+struct Explicit
+{
     T t;
 
-    bool operator ==(const Explicit<T> & other) const = default;
+    bool operator==(const Explicit<T> & other) const = default;
 
-    bool operator <(const Explicit<T> & other) const
+    bool operator<(const Explicit<T> & other) const
     {
         return t < other.t;
     }
 };
 
-
 /**
  * This wants to be a little bit like rust's Cow type.
  * Some parts of the evaluator benefit greatly from being able to reuse
@@ -97,7 +99,8 @@ struct Explicit {
  * since those can easily become ambiguous to the reader and can degrade
  * into copying behaviour we want to avoid.
  */
-class BackedStringView {
+class BackedStringView
+{
 private:
     std::variant<std::string, std::string_view> data;
 
@@ -106,19 +109,38 @@ private:
      * a pointer. Without this we'd need to store the view object
      * even when we already own a string.
      */
-    class Ptr {
+    class Ptr
+    {
     private:
         std::string_view view;
     public:
-        Ptr(std::string_view view): view(view) {}
-        const std::string_view * operator->() const { return &view; }
+        Ptr(std::string_view view)
+            : view(view)
+        {
+        }
+
+        const std::string_view * operator->() const
+        {
+            return &view;
+        }
     };
 
 public:
-    BackedStringView(std::string && s): data(std::move(s)) {}
-    BackedStringView(std::string_view sv): data(sv) {}
+    BackedStringView(std::string && s)
+        : data(std::move(s))
+    {
+    }
+
+    BackedStringView(std::string_view sv)
+        : data(sv)
+    {
+    }
+
     template<size_t N>
-    BackedStringView(const char (& lit)[N]): data(std::string_view(lit)) {}
+    BackedStringView(const char (&lit)[N])
+        : data(std::string_view(lit))
+    {
+    }
 
     BackedStringView(const BackedStringView &) = delete;
     BackedStringView & operator=(const BackedStringView &) = delete;
@@ -137,18 +159,18 @@ public:
 
     std::string toOwned() &&
     {
-        return isOwned()
-            ? std::move(std::get<std::string>(data))
-            : std::string(std::get<std::string_view>(data));
+        return isOwned() ? std::move(std::get<std::string>(data)) : std::string(std::get<std::string_view>(data));
     }
 
     std::string_view operator*() const
     {
-        return isOwned()
-            ? std::get<std::string>(data)
-            : std::get<std::string_view>(data);
+        return isOwned() ? std::get<std::string>(data) : std::get<std::string_view>(data);
+    }
+
+    Ptr operator->() const
+    {
+        return Ptr(**this);
     }
-    Ptr operator->() const { return Ptr(**this); }
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/unix-domain-socket.hh b/src/libutil/include/nix/util/unix-domain-socket.hh
index 3aaaddf82..6d28b6276 100644
--- a/src/libutil/include/nix/util/unix-domain-socket.hh
+++ b/src/libutil/include/nix/util/unix-domain-socket.hh
@@ -87,4 +87,4 @@ void connect(Socket fd, const std::filesystem::path & path);
  */
 AutoCloseFD connect(const std::filesystem::path & path);
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/url-parts.hh b/src/libutil/include/nix/util/url-parts.hh
index 1ddc6a536..c57c32e61 100644
--- a/src/libutil/include/nix/util/url-parts.hh
+++ b/src/libutil/include/nix/util/url-parts.hh
@@ -8,21 +8,10 @@ namespace nix {
 
 // URI stuff.
 const static std::string pctEncoded = "(?:%[0-9a-fA-F][0-9a-fA-F])";
-const static std::string schemeNameRegex = "(?:[a-z][a-z0-9+.-]*)";
-const static std::string ipv6AddressSegmentRegex = "[0-9a-fA-F:]+(?:%\\w+)?";
-const static std::string ipv6AddressRegex = "(?:\\[" + ipv6AddressSegmentRegex + "\\]|" + ipv6AddressSegmentRegex + ")";
 const static std::string unreservedRegex = "(?:[a-zA-Z0-9-._~])";
 const static std::string subdelimsRegex = "(?:[!$&'\"()*+,;=])";
-const static std::string hostnameRegex = "(?:(?:" + unreservedRegex + "|" + pctEncoded + "|" + subdelimsRegex + ")*)";
-const static std::string hostRegex = "(?:" + ipv6AddressRegex + "|" + hostnameRegex + ")";
-const static std::string userRegex = "(?:(?:" + unreservedRegex + "|" + pctEncoded + "|" + subdelimsRegex + "|:)*)";
-const static std::string authorityRegex = "(?:" + userRegex + "@)?" + hostRegex + "(?::[0-9]+)?";
 const static std::string pcharRegex = "(?:" + unreservedRegex + "|" + pctEncoded + "|" + subdelimsRegex + "|[:@])";
-const static std::string queryRegex = "(?:" + pcharRegex + "|[/? \"])*";
 const static std::string fragmentRegex = "(?:" + pcharRegex + "|[/? \"^])*";
-const static std::string segmentRegex = "(?:" + pcharRegex + "*)";
-const static std::string absPathRegex = "(?:(?:/" + segmentRegex + ")*/?)";
-const static std::string pathRegex = "(?:" + segmentRegex + "(?:/" + segmentRegex + ")*/?)";
 
 /// A Git ref (i.e. branch or tag name).
 /// \todo check that this is correct.
@@ -30,12 +19,6 @@ const static std::string pathRegex = "(?:" + segmentRegex + "(?:/" + segmentRege
 const static std::string refRegexS = "[a-zA-Z0-9@][a-zA-Z0-9_.\\/@+-]*";
 extern std::regex refRegex;
 
-/// Instead of defining what a good Git Ref is, we define what a bad Git Ref is
-/// This is because of the definition of a ref in refs.c in https://github.com/git/git
-/// See tests/functional/fetchGitRefs.sh for the full definition
-const static std::string badGitRefRegexS = "//|^[./]|/\\.|\\.\\.|[[:cntrl:][:space:]:?^~\[]|\\\\|\\*|\\.lock$|\\.lock/|@\\{|[/.]$|^@$|^$";
-extern std::regex badGitRefRegex;
-
 /// A Git revision (a SHA-1 commit hash).
 const static std::string revRegexS = "[0-9a-fA-F]{40}";
 extern std::regex revRegex;
@@ -43,4 +26,4 @@ extern std::regex revRegex;
 /// A ref or revision, or a ref followed by a revision.
 const static std::string refAndOrRevRegex = "(?:(" + revRegexS + ")|(?:(" + refRegexS + ")(?:/(" + revRegexS + "))?))";
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/url.hh b/src/libutil/include/nix/util/url.hh
index a509f06da..f2bd79b08 100644
--- a/src/libutil/include/nix/util/url.hh
+++ b/src/libutil/include/nix/util/url.hh
@@ -1,40 +1,315 @@
 #pragma once
 ///@file
 
+#include <ranges>
+#include <span>
+
 #include "nix/util/error.hh"
+#include "nix/util/canon-path.hh"
 
 namespace nix {
 
+/**
+ * Represents a parsed RFC3986 URL.
+ *
+ * @note All fields are already percent decoded.
+ */
 struct ParsedURL
 {
+    /**
+     * Parsed representation of a URL authority.
+     *
+     * It consists of user information, hostname and an optional port number.
+     * Note that passwords in the userinfo are not yet supported and are ignored.
+     *
+     * @todo Maybe support passwords in userinfo part of the url for auth.
+     */
+    struct Authority
+    {
+        enum class HostType {
+            Name, //< Registered name (can be empty)
+            IPv4,
+            IPv6,
+            IPvFuture
+        };
+
+        static Authority parse(std::string_view encodedAuthority);
+        auto operator<=>(const Authority & other) const = default;
+        std::string to_string() const;
+        friend std::ostream & operator<<(std::ostream & os, const Authority & self);
+
+        /**
+         * Type of the host subcomponent, as specified by rfc3986 3.2.2. Host.
+         */
+        HostType hostType = HostType::Name;
+
+        /**
+         * Host subcomponent. Either a registered name or IPv{4,6,Future} literal addresses.
+         *
+         * IPv6 enclosing brackets are already stripped. Percent encoded characters
+         * in the hostname are decoded.
+         */
+        std::string host;
+
+        /** Percent-decoded user part of the userinfo. */
+        std::optional<std::string> user;
+
+        /**
+         * Password subcomponent of the authority (if specified).
+         *
+         * @warning As per the rfc3986, the password syntax is deprecated,
+         * but it's necessary to make the parse -> to_string roundtrip.
+         * We don't use it anywhere (at least intentionally).
+         * @todo Warn about unused password subcomponent.
+         */
+        std::optional<std::string> password;
+
+        /** Port subcomponent (if specified). Default value is determined by the scheme. */
+        std::optional<uint16_t> port;
+    };
+
     std::string scheme;
-    std::optional<std::string> authority;
-    std::string path;
+
+    /**
+     * Optional parsed authority component of the URL.
+     *
+     * IMPORTANT: An empty authority (i.e. one with an empty host string) and
+     * a missing authority (std::nullopt) are drastically different cases. This
+     * is especially important for "file:///path/to/file" URLs defined by RFC8089.
+     * The presence of the authority is indicated by `//` following the <scheme>:
+     * part of the URL.
+     */
+    std::optional<Authority> authority;
+
+    /**
+     * @note Unlike Unix paths, URLs provide a way to escape path
+     * separators, in the form of the `%2F` encoding of `/`. That means
+     * that if one percent-decodes the path into a single string, that
+     * decoding will be *lossy*, because `/` and `%2F` both become `/`.
+     * The right thing to do is instead split up the path on `/`, and
+     * then percent decode each part.
+     *
+     * For an example, the path
+     * ```
+     * foo/bar%2Fbaz/quux
+     * ```
+     * is parsed as
+     * ```
+     * {"foo, "bar/baz", "quux"}
+     * ```
+     *
+     * We're doing splitting and joining that assumes the separator (`/` in this case) only goes *between* elements.
+     *
+     * That means the parsed representation will begin with an empty
+     * element to make an initial `/`, and will end with an ementy
+     * element to make a trailing `/`. That means that elements of this
+     * vector mostly, but *not always*, correspond to segments of the
+     * path.
+     *
+     * Examples:
+     *
+     * - ```
+     *   https://foo.com/bar
+     *   ```
+     *   has path
+     *   ```
+     *   {"", "bar"}
+     *   ```
+     *
+     * - ```
+     *   https://foo.com/bar/
+     *   ```
+     *   has path
+     *   ```
+     *   {"", "bar", ""}
+     *   ```
+     *
+     * - ```
+     *   https://foo.com//bar///
+     *   ```
+     *   has path
+     *   ```
+     *   {"", "", "bar", "", "", ""}
+     *   ```
+     *
+     * - ```
+     *   https://foo.com
+     *   ```
+     *   has path
+     *   ```
+     *   {""}
+     *   ```
+     *
+     * - ```
+     *   https://foo.com/
+     *   ```
+     *   has path
+     *   ```
+     *   {"", ""}
+     *   ```
+     *
+     * - ```
+     *   tel:01234
+     *   ```
+     *   has path `{"01234"}` (and no authority)
+     *
+     * - ```
+     *   foo:/01234
+     *   ```
+     *   has path `{"", "01234"}` (and no authority)
+     *
+     * Note that both trailing and leading slashes are, in general,
+     * semantically significant.
+     *
+     * For trailing slashes, the main example affecting many schemes is
+     * that `../baz` resolves against a base URL different depending on
+     * the presence/absence of a trailing slash:
+     *
+     * - `https://foo.com/bar` is `https://foo.com/baz`
+     *
+     * - `https://foo.com/bar/` is `https://foo.com/bar/baz`
+     *
+     * See `parseURLRelative` for more details.
+     *
+     * For leading slashes, there are some requirements to be aware of.
+     *
+     * - When there is an authority, the path *must* start with a leading
+     *   slash. Otherwise the path will not be separated from the
+     *   authority, and will not round trip though the parser:
+     *
+     *   ```
+     *   {.scheme="https", .authority.host = "foo", .path={"bad"}}
+     *   ```
+     *   will render to `https://foobar`. but that would parse back as as
+     *   ```
+     *   {.scheme="https", .authority.host = "foobar", .path={}}
+     *   ```
+     *
+     * - When there is no authority, the path must *not* begin with two
+     *   slashes. Otherwise, there will be another parser round trip
+     *   issue:
+     *
+     *   ```
+     *   {.scheme="https", .path={"", "", "bad"}}
+     *   ```
+     *   will render to `https://bad`. but that would parse back as as
+     *   ```
+     *   {.scheme="https", .authority.host = "bad", .path={}}
+     *   ```
+     *
+     * These invariants will be checked in `to_string` and
+     * `renderAuthorityAndPath`.
+     */
+    std::vector<std::string> path;
+
     StringMap query;
+
     std::string fragment;
 
+    /**
+     * Render just the middle part of a URL, without the `//` which
+     * indicates whether the authority is present.
+     *
+     * @note This is kind of an ad-hoc
+     * operation, but it ends up coming up with some frequency, probably
+     * due to the current design of `StoreReference` in `nix-store`.
+     */
+    std::string renderAuthorityAndPath() const;
+
     std::string to_string() const;
 
-    bool operator ==(const ParsedURL & other) const noexcept;
+    /**
+     * Render the path to a string.
+     *
+     * @param encode Whether to percent encode path segments.
+     */
+    std::string renderPath(bool encode = false) const;
+
+    auto operator<=>(const ParsedURL & other) const noexcept = default;
 
     /**
-     * Remove `.` and `..` path elements.
+     * Remove `.` and `..` path segments.
      */
     ParsedURL canonicalise();
+
+    /**
+     * Get a range of path segments (the substrings separated by '/' characters).
+     *
+     * @param skipEmpty Skip all empty path segments
+     */
+    auto pathSegments(bool skipEmpty) const &
+    {
+        return std::views::filter(path, [skipEmpty](std::string_view segment) {
+            if (skipEmpty)
+                return !segment.empty();
+            return true;
+        });
+    }
 };
 
-std::ostream & operator << (std::ostream & os, const ParsedURL & url);
+std::ostream & operator<<(std::ostream & os, const ParsedURL & url);
 
 MakeError(BadURL, Error);
 
 std::string percentDecode(std::string_view in);
-std::string percentEncode(std::string_view s, std::string_view keep="");
+std::string percentEncode(std::string_view s, std::string_view keep = "");
 
-StringMap decodeQuery(const std::string & query);
+/**
+ * Get the path part of the URL as an absolute or relative Path.
+ *
+ * @throws if any path component contains an slash (which would have
+ * been escaped `%2F` in the rendered URL). This is because OS file
+ * paths have no escape sequences --- file names cannot contain a
+ * `/`.
+ */
+Path renderUrlPathEnsureLegal(const std::vector<std::string> & urlPath);
+
+/**
+ * Percent encode path. `%2F` for "interior slashes" is the most
+ * important.
+ */
+std::string encodeUrlPath(std::span<const std::string> urlPath);
+
+/**
+ * @param lenient @see parseURL
+ */
+StringMap decodeQuery(std::string_view query, bool lenient = false);
 
 std::string encodeQuery(const StringMap & query);
 
-ParsedURL parseURL(const std::string & url);
+/**
+ * Parse a URL into a ParsedURL.
+ *
+ * @parm lenient Also allow some long-supported Nix URIs that are not quite compliant with RFC3986.
+ * Here are the deviations:
+ * - Fragments can contain unescaped (not URL encoded) '^', '"' or space literals.
+ * - Queries may contain unescaped '"' or spaces.
+ *
+ * @note IPv6 ZoneId literals (RFC4007) are represented in URIs according to RFC6874.
+ *
+ * @throws BadURL
+ *
+ * The WHATWG specification of the URL constructor in Java Script is
+ * also a useful reference:
+ * https://url.spec.whatwg.org/#concept-basic-url-parser. Note, however,
+ * that it includes various scheme-specific normalizations / extra steps
+ * that we do not implement.
+ */
+ParsedURL parseURL(std::string_view url, bool lenient = false);
+
+/**
+ * Like `parseURL`, but also accepts relative URLs, which are resolved
+ * against the given base URL.
+ *
+ * This is specified in [IETF RFC 3986, section 5](https://datatracker.ietf.org/doc/html/rfc3986#section-5)
+ *
+ * @throws BadURL
+ *
+ * Behavior should also match the `new URL(url, base)` JavaScript
+ * constructor, except for extra steps specific to the HTTP scheme. See
+ * `parseURL` for link to the relevant WHATWG standard.
+ */
+ParsedURL parseURLRelative(std::string_view url, const ParsedURL & base);
 
 /**
  * Although that’s not really standardized anywhere, an number of tools
@@ -44,7 +319,8 @@ ParsedURL parseURL(const std::string & url);
  * For example git uses `git+https` to designate remotes using a Git
  * protocol over http.
  */
-struct ParsedUrlScheme {
+struct ParsedUrlScheme
+{
     std::optional<std::string_view> application;
     std::string_view transport;
 };
@@ -54,7 +330,7 @@ ParsedUrlScheme parseUrlScheme(std::string_view scheme);
 /* Detects scp-style uris (e.g. git@github.com:NixOS/nix) and fixes
    them by removing the `:` and assuming a scheme of `ssh://`. Also
    changes absolute paths into file:// URLs. */
-std::string fixGitURL(const std::string & url);
+ParsedURL fixGitURL(const std::string & url);
 
 /**
  * Whether a string is valid as RFC 3986 scheme name.
@@ -65,4 +341,63 @@ std::string fixGitURL(const std::string & url);
  */
 bool isValidSchemeName(std::string_view scheme);
 
-}
+/**
+ * Either a ParsedURL or a verbatim string, but the string must be a valid
+ * ParsedURL. This is necessary because in certain cases URI must be passed
+ * verbatim (e.g. in builtin fetchers), since those are specified by the user.
+ * In those cases normalizations performed by the ParsedURL might be surprising
+ * and undesirable, since Nix must be a universal client that has to work with
+ * various broken services that might interpret URLs in quirky and non-standard ways.
+ *
+ * One of those examples is space-as-plus encoding that is very widespread, but it's
+ * not strictly RFC3986 compliant. We must preserve that information verbatim.
+ *
+ * Though we perform parsing and validation for internal needs.
+ */
+struct ValidURL : private ParsedURL
+{
+    std::optional<std::string> encoded;
+
+    ValidURL(std::string str)
+        : ParsedURL(parseURL(str, /*lenient=*/false))
+        , encoded(std::move(str))
+    {
+    }
+
+    ValidURL(std::string_view str)
+        : ValidURL(std::string{str})
+    {
+    }
+
+    ValidURL(ParsedURL parsed)
+        : ParsedURL{std::move(parsed)}
+    {
+    }
+
+    /**
+     * Get the encoded URL (if specified) verbatim or encode the parsed URL.
+     */
+    std::string to_string() const
+    {
+        return encoded.or_else([&]() -> std::optional<std::string> { return ParsedURL::to_string(); }).value();
+    }
+
+    const ParsedURL & parsed() const &
+    {
+        return *this;
+    }
+
+    std::string_view scheme() const &
+    {
+        return ParsedURL::scheme;
+    }
+
+    const auto & path() const &
+    {
+        return ParsedURL::path;
+    }
+};
+
+std::ostream & operator<<(std::ostream & os, const ValidURL & url);
+
+} // namespace nix
diff --git a/src/libutil/include/nix/util/users.hh b/src/libutil/include/nix/util/users.hh
index 1d467173c..f2c6caecf 100644
--- a/src/libutil/include/nix/util/users.hh
+++ b/src/libutil/include/nix/util/users.hh
@@ -4,7 +4,7 @@
 #include "nix/util/types.hh"
 
 #ifndef _WIN32
-# include <sys/types.h>
+#  include <sys/types.h>
 #endif
 
 namespace nix {
@@ -59,7 +59,6 @@ Path createNixStateDir();
  */
 std::string expandTilde(std::string_view path);
 
-
 /**
  * Is the current user UID 0 on Unix?
  *
@@ -67,4 +66,4 @@ std::string expandTilde(std::string_view path);
  */
 bool isRootUser();
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/util.hh b/src/libutil/include/nix/util/util.hh
index 2361bf2e7..561550c41 100644
--- a/src/libutil/include/nix/util/util.hh
+++ b/src/libutil/include/nix/util/util.hh
@@ -4,14 +4,13 @@
 #include "nix/util/types.hh"
 #include "nix/util/error.hh"
 #include "nix/util/logging.hh"
-
+#include "nix/util/strings.hh"
 
 #include <functional>
 #include <map>
 #include <sstream>
 #include <optional>
-
-#include "nix/util/strings.hh"
+#include <ranges>
 
 namespace nix {
 
@@ -24,10 +23,8 @@ void initLibUtil();
  */
 std::vector<char *> stringsToCharPtrs(const Strings & ss);
 
-
 MakeError(FormatError, Error);
 
-
 template<class... Parts>
 auto concatStrings(Parts &&... parts)
     -> std::enable_if_t<(... && std::is_convertible_v<Parts, std::string_view>), std::string>
@@ -36,11 +33,11 @@ auto concatStrings(Parts &&... parts)
     return concatStringsSep({}, views);
 }
 
-
 /**
  * Add quotes around a collection of strings.
  */
-template<class C> Strings quoteStrings(const C & c)
+template<class C>
+Strings quoteStrings(const C & c)
 {
     Strings res;
     for (auto & s : c)
@@ -55,25 +52,18 @@ template<class C> Strings quoteStrings(const C & c)
  */
 std::string chomp(std::string_view s);
 
-
 /**
  * Remove whitespace from the start and end of a string.
  */
 std::string trim(std::string_view s, std::string_view whitespace = " \n\r\t");
 
-
 /**
  * Replace all occurrences of a string inside another string.
  */
-std::string replaceStrings(
-    std::string s,
-    std::string_view from,
-    std::string_view to);
-
+std::string replaceStrings(std::string s, std::string_view from, std::string_view to);
 
 std::string rewriteStrings(std::string s, const StringMap & rewrites);
 
-
 /**
  * Parse a string into an integer.
  */
@@ -91,11 +81,16 @@ N string2IntWithUnitPrefix(std::string_view s)
     if (!s.empty()) {
         char u = std::toupper(*s.rbegin());
         if (std::isalpha(u)) {
-            if (u == 'K') multiplier = 1ULL << 10;
-            else if (u == 'M') multiplier = 1ULL << 20;
-            else if (u == 'G') multiplier = 1ULL << 30;
-            else if (u == 'T') multiplier = 1ULL << 40;
-            else throw UsageError("invalid unit specifier '%1%'", u);
+            if (u == 'K')
+                multiplier = 1ULL << 10;
+            else if (u == 'M')
+                multiplier = 1ULL << 20;
+            else if (u == 'G')
+                multiplier = 1ULL << 30;
+            else if (u == 'T')
+                multiplier = 1ULL << 40;
+            else
+                throw UsageError("invalid unit specifier '%1%'", u);
             s.remove_suffix(1);
         }
     }
@@ -117,7 +112,6 @@ std::string renderSize(uint64_t value, bool align = false);
 template<class N>
 std::optional<N> string2Float(const std::string_view s);
 
-
 /**
  * Convert a little-endian integer to host order.
  */
@@ -131,25 +125,21 @@ T readLittleEndian(unsigned char * p)
     return x;
 }
 
-
 /**
  * @return true iff `s` starts with `prefix`.
  */
 bool hasPrefix(std::string_view s, std::string_view prefix);
 
-
 /**
  * @return true iff `s` ends in `suffix`.
  */
 bool hasSuffix(std::string_view s, std::string_view suffix);
 
-
 /**
  * Convert a string to lower case.
  */
 std::string toLower(std::string s);
 
-
 /**
  * Escape a string as a shell word.
  *
@@ -160,7 +150,6 @@ std::string toLower(std::string s);
  */
 std::string escapeShellArgAlways(const std::string_view s);
 
-
 /**
  * Exception handling in destructors: print an error message, then
  * ignore the exception.
@@ -182,8 +171,6 @@ void ignoreExceptionInDestructor(Verbosity lvl = lvlError);
  */
 void ignoreExceptionExceptInterrupt(Verbosity lvl = lvlError);
 
-
-
 /**
  * Tree formatting.
  */
@@ -192,18 +179,6 @@ constexpr char treeLast[] = "└───";
 constexpr char treeLine[] = "│   ";
 constexpr char treeNull[] = "    ";
 
-
-/**
- * Encode arbitrary bytes as Base64.
- */
-std::string base64Encode(std::string_view s);
-
-/**
- * Decode arbitrary bytes to Base64.
- */
-std::string base64Decode(std::string_view s);
-
-
 /**
  * Remove common leading whitespace from the lines in the string
  * 's'. For example, if every line is indented by at least 3 spaces,
@@ -211,7 +186,6 @@ std::string base64Decode(std::string_view s);
  */
 std::string stripIndentation(std::string_view s);
 
-
 /**
  * Get the prefix of 's' up to and excluding the next line break (LF
  * optionally preceded by CR), and the remainder following the line
@@ -219,66 +193,75 @@ std::string stripIndentation(std::string_view s);
  */
 std::pair<std::string_view, std::string_view> getLine(std::string_view s);
 
-
 /**
  * Get a value for the specified key from an associate container.
  */
-template <class T>
-const typename T::mapped_type * get(const T & map, const typename T::key_type & key)
+template<class T, typename K>
+const typename T::mapped_type * get(const T & map, K & key)
 {
     auto i = map.find(key);
-    if (i == map.end()) return nullptr;
+    if (i == map.end())
+        return nullptr;
     return &i->second;
 }
 
-template <class T>
-typename T::mapped_type * get(T & map, const typename T::key_type & key)
+template<class T, typename K>
+typename T::mapped_type * get(T & map, K & key)
 {
     auto i = map.find(key);
-    if (i == map.end()) return nullptr;
+    if (i == map.end())
+        return nullptr;
     return &i->second;
 }
 
+/** Deleted because this is use-after-free liability. Just don't pass temporaries to this overload set. */
+template<class T>
+typename T::mapped_type * get(T && map, const typename T::key_type & key) = delete;
+
 /**
  * Get a value for the specified key from an associate container, or a default value if the key isn't present.
  */
-template <class T>
-const typename T::mapped_type & getOr(T & map,
-    const typename T::key_type & key,
-    const typename T::mapped_type & defaultValue)
+template<class T, typename K>
+const typename T::mapped_type & getOr(T & map, K & key, const typename T::mapped_type & defaultValue)
 {
     auto i = map.find(key);
-    if (i == map.end()) return defaultValue;
+    if (i == map.end())
+        return defaultValue;
     return i->second;
 }
 
+/** Deleted because this is use-after-free liability. Just don't pass temporaries to this overload set. */
+template<class T>
+const typename T::mapped_type &
+getOr(T && map, const typename T::key_type & key, const typename T::mapped_type & defaultValue) = delete;
+
 /**
  * Remove and return the first item from a container.
  */
-template <class T>
+template<class T>
 std::optional<typename T::value_type> remove_begin(T & c)
 {
     auto i = c.begin();
-    if (i == c.end()) return {};
+    if (i == c.end())
+        return {};
     auto v = std::move(*i);
     c.erase(i);
     return v;
 }
 
-
 /**
  * Remove and return the first item from a container.
  */
-template <class T>
+template<class T>
 std::optional<typename T::value_type> pop(T & c)
 {
-    if (c.empty()) return {};
+    if (c.empty())
+        return {};
     auto v = std::move(c.front());
     c.pop();
     return v;
 }
 
-
 /**
  * Append items to a container. TODO: remove this once we can use
  * C++23's `append_range()`.
@@ -289,11 +272,9 @@ void append(C & c, std::initializer_list<T> l)
     c.insert(c.end(), l.begin(), l.end());
 }
 
-
 template<typename T>
 class Callback;
 
-
 /**
  * A RAII helper that increments a counter on construction and
  * decrements it on destruction.
@@ -303,56 +284,48 @@ struct MaintainCount
 {
     T & counter;
     long delta;
-    MaintainCount(T & counter, long delta = 1) : counter(counter), delta(delta) { counter += delta; }
-    ~MaintainCount() { counter -= delta; }
-};
 
+    MaintainCount(T & counter, long delta = 1)
+        : counter(counter)
+        , delta(delta)
+    {
+        counter += delta;
+    }
+
+    ~MaintainCount()
+    {
+        counter -= delta;
+    }
+};
 
 /**
  * A Rust/Python-like enumerate() iterator adapter.
- *
- * Borrowed from http://reedbeta.com/blog/python-like-enumerate-in-cpp17.
  */
-template <typename T,
-          typename TIter = decltype(std::begin(std::declval<T>())),
-          typename = decltype(std::end(std::declval<T>()))>
-constexpr auto enumerate(T && iterable)
+template<std::ranges::viewable_range R>
+constexpr auto enumerate(R && range)
 {
-    struct iterator
-    {
-        size_t i;
-        TIter iter;
-        constexpr bool operator != (const iterator & other) const { return iter != other.iter; }
-        constexpr void operator ++ () { ++i; ++iter; }
-        constexpr auto operator * () const { return std::tie(i, *iter); }
-    };
-
-    struct iterable_wrapper
-    {
-        T iterable;
-        constexpr auto begin() { return iterator{ 0, std::begin(iterable) }; }
-        constexpr auto end() { return iterator{ 0, std::end(iterable) }; }
-    };
-
-    return iterable_wrapper{ std::forward<T>(iterable) };
+    /* Not std::views::enumerate because it uses difference_type for the index. */
+    return std::views::zip(std::views::iota(size_t{0}), std::forward<R>(range));
 }
 
-
 /**
  * C++17 std::visit boilerplate
  */
-template<class... Ts> struct overloaded : Ts... { using Ts::operator()...; };
-template<class... Ts> overloaded(Ts...) -> overloaded<Ts...>;
-
+template<class... Ts>
+struct overloaded : Ts...
+{
+    using Ts::operator()...;
+};
+template<class... Ts>
+overloaded(Ts...) -> overloaded<Ts...>;
 
 std::string showBytes(uint64_t bytes);
 
-
 /**
  * Provide an addition operator between strings and string_views
  * inexplicably omitted from the standard library.
  */
-inline std::string operator + (const std::string & s1, std::string_view s2)
+inline std::string operator+(const std::string & s1, std::string_view s2)
 {
     std::string s;
     s.reserve(s1.size() + s2.size());
@@ -361,13 +334,13 @@ inline std::string operator + (const std::string & s1, std::string_view s2)
     return s;
 }
 
-inline std::string operator + (std::string && s, std::string_view s2)
+inline std::string operator+(std::string && s, std::string_view s2)
 {
     s.append(s2);
     return std::move(s);
 }
 
-inline std::string operator + (std::string_view s1, const char * s2)
+inline std::string operator+(std::string_view s1, const char * s2)
 {
     auto s2Size = strlen(s2);
     std::string s;
@@ -377,4 +350,4 @@ inline std::string operator + (std::string_view s1, const char * s2)
     return s;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/include/nix/util/variant-wrapper.hh b/src/libutil/include/nix/util/variant-wrapper.hh
index cedcb999c..146ae07b6 100644
--- a/src/libutil/include/nix/util/variant-wrapper.hh
+++ b/src/libutil/include/nix/util/variant-wrapper.hh
@@ -8,13 +8,13 @@
  * Force the default versions of all constructors (copy, move, copy
  * assignment).
  */
-#define FORCE_DEFAULT_CONSTRUCTORS(CLASS_NAME) \
-    CLASS_NAME(const CLASS_NAME &) = default; \
-    CLASS_NAME(CLASS_NAME &) = default; \
-    CLASS_NAME(CLASS_NAME &&) = default; \
-    \
-    CLASS_NAME & operator =(const CLASS_NAME &) = default; \
-    CLASS_NAME & operator =(CLASS_NAME &) = default;
+#define FORCE_DEFAULT_CONSTRUCTORS(CLASS_NAME)            \
+    CLASS_NAME(const CLASS_NAME &) = default;             \
+    CLASS_NAME(CLASS_NAME &) = default;                   \
+    CLASS_NAME(CLASS_NAME &&) = default;                  \
+                                                          \
+    CLASS_NAME & operator=(const CLASS_NAME &) = default; \
+    CLASS_NAME & operator=(CLASS_NAME &) = default;
 
 /**
  * Make a wrapper constructor. All args are forwarded to the
@@ -22,9 +22,10 @@
  *
  * The moral equivalent of `using Raw::Raw;`
  */
-#define MAKE_WRAPPER_CONSTRUCTOR(CLASS_NAME) \
-    FORCE_DEFAULT_CONSTRUCTORS(CLASS_NAME) \
-    \
-    CLASS_NAME(auto &&... arg) \
+#define MAKE_WRAPPER_CONSTRUCTOR(CLASS_NAME)       \
+    FORCE_DEFAULT_CONSTRUCTORS(CLASS_NAME)         \
+                                                   \
+    CLASS_NAME(auto &&... arg)                     \
         : raw(std::forward<decltype(arg)>(arg)...) \
-    { }
+    {                                              \
+    }
diff --git a/src/libutil/include/nix/util/xml-writer.hh b/src/libutil/include/nix/util/xml-writer.hh
index ae5a6ced7..8d084ad11 100644
--- a/src/libutil/include/nix/util/xml-writer.hh
+++ b/src/libutil/include/nix/util/xml-writer.hh
@@ -6,13 +6,10 @@
 #include <list>
 #include <map>
 
-
 namespace nix {
 
-
 typedef std::map<std::string, std::string, std::less<>> XMLAttrs;
 
-
 class XMLWriter
 {
 private:
@@ -31,12 +28,10 @@ public:
 
     void close();
 
-    void openElement(std::string_view name,
-        const XMLAttrs & attrs = XMLAttrs());
+    void openElement(std::string_view name, const XMLAttrs & attrs = XMLAttrs());
     void closeElement();
 
-    void writeEmptyElement(std::string_view name,
-        const XMLAttrs & attrs = XMLAttrs());
+    void writeEmptyElement(std::string_view name, const XMLAttrs & attrs = XMLAttrs());
 
 private:
     void writeAttrs(const XMLAttrs & attrs);
@@ -44,23 +39,21 @@ private:
     void indent_(size_t depth);
 };
 
-
 class XMLOpenElement
 {
 private:
     XMLWriter & writer;
 public:
-    XMLOpenElement(XMLWriter & writer, std::string_view name,
-        const XMLAttrs & attrs = XMLAttrs())
+    XMLOpenElement(XMLWriter & writer, std::string_view name, const XMLAttrs & attrs = XMLAttrs())
         : writer(writer)
     {
         writer.openElement(name, attrs);
     }
+
     ~XMLOpenElement()
     {
         writer.closeElement();
     }
 };
 
-
-}
+} // namespace nix
diff --git a/src/libutil/json-utils.cc b/src/libutil/json-utils.cc
index 34da83a2c..74b3b27cc 100644
--- a/src/libutil/json-utils.cc
+++ b/src/libutil/json-utils.cc
@@ -10,20 +10,20 @@ namespace nix {
 const nlohmann::json * get(const nlohmann::json & map, const std::string & key)
 {
     auto i = map.find(key);
-    if (i == map.end()) return nullptr;
+    if (i == map.end())
+        return nullptr;
     return &*i;
 }
 
 nlohmann::json * get(nlohmann::json & map, const std::string & key)
 {
     auto i = map.find(key);
-    if (i == map.end()) return nullptr;
+    if (i == map.end())
+        return nullptr;
     return &*i;
 }
 
-const nlohmann::json & valueAt(
-    const nlohmann::json::object_t & map,
-    const std::string & key)
+const nlohmann::json & valueAt(const nlohmann::json::object_t & map, const std::string & key)
 {
     if (!map.contains(key))
         throw Error("Expected JSON object to contain key '%s' but it doesn't: %s", key, nlohmann::json(map).dump());
@@ -36,7 +36,7 @@ std::optional<nlohmann::json> optionalValueAt(const nlohmann::json::object_t & m
     if (!map.contains(key))
         return std::nullopt;
 
-    return std::optional { map.at(key) };
+    return std::optional{map.at(key)};
 }
 
 std::optional<nlohmann::json> nullableValueAt(const nlohmann::json::object_t & map, const std::string & key)
@@ -46,7 +46,7 @@ std::optional<nlohmann::json> nullableValueAt(const nlohmann::json::object_t & m
     if (value.is_null())
         return std::nullopt;
 
-    return std::optional { std::move(value) };
+    return std::optional{std::move(value)};
 }
 
 const nlohmann::json * getNullable(const nlohmann::json & value)
@@ -63,16 +63,14 @@ const nlohmann::json * getNullable(const nlohmann::json & value)
  * functions. It is too cumbersome and easy to forget to expect regular
  * JSON code to use it directly.
  */
-static const nlohmann::json & ensureType(
-    const nlohmann::json & value,
-    nlohmann::json::value_type expectedType
-    )
+static const nlohmann::json & ensureType(const nlohmann::json & value, nlohmann::json::value_type expectedType)
 {
     if (value.type() != expectedType)
         throw Error(
             "Expected JSON value to be of type '%s' but it is of type '%s': %s",
             nlohmann::json(expectedType).type_name(),
-            value.type_name(), value.dump());
+            value.type_name(),
+            value.dump());
 
     return value;
 }
@@ -102,8 +100,7 @@ const nlohmann::json::number_unsigned_t & getUnsigned(const nlohmann::json & val
         typeName = value.is_number_float() ? "floating point number" : "signed integral number";
     }
     throw Error(
-        "Expected JSON value to be an unsigned integral number but it is of type '%s': %s",
-        typeName, value.dump());
+        "Expected JSON value to be an unsigned integral number but it is of type '%s': %s", typeName, value.dump());
 }
 
 const nlohmann::json::boolean_t & getBoolean(const nlohmann::json & value)
@@ -146,4 +143,4 @@ StringSet getStringSet(const nlohmann::json & value)
 
     return stringSet;
 }
-}
+} // namespace nix
diff --git a/src/libutil/linux/cgroup.cc b/src/libutil/linux/cgroup.cc
index c82fdc11c..9e78ac6d2 100644
--- a/src/libutil/linux/cgroup.cc
+++ b/src/libutil/linux/cgroup.cc
@@ -4,10 +4,10 @@
 #include "nix/util/file-system.hh"
 #include "nix/util/finally.hh"
 
+#include <boost/unordered/unordered_flat_set.hpp>
 #include <chrono>
 #include <cmath>
 #include <regex>
-#include <unordered_set>
 #include <thread>
 
 #include <dirent.h>
@@ -19,7 +19,8 @@ std::optional<Path> getCgroupFS()
 {
     static auto res = [&]() -> std::optional<Path> {
         auto fp = fopen("/proc/mounts", "r");
-        if (!fp) return std::nullopt;
+        if (!fp)
+            return std::nullopt;
         Finally delFP = [&]() { fclose(fp); };
         while (auto ent = getmntent(fp))
             if (std::string_view(ent->mnt_type) == "cgroup2")
@@ -50,7 +51,8 @@ StringMap getCgroups(const Path & cgroupFile)
 
 static CgroupStats destroyCgroup(const std::filesystem::path & cgroup, bool returnStats)
 {
-    if (!pathExists(cgroup)) return {};
+    if (!pathExists(cgroup))
+        return {};
 
     auto procsFile = cgroup / "cgroup.procs";
 
@@ -67,18 +69,20 @@ static CgroupStats destroyCgroup(const std::filesystem::path & cgroup, bool retu
        this cgroup. */
     for (auto & entry : DirectoryIterator{cgroup}) {
         checkInterrupt();
-        if (entry.symlink_status().type() != std::filesystem::file_type::directory) continue;
+        if (entry.symlink_status().type() != std::filesystem::file_type::directory)
+            continue;
         destroyCgroup(cgroup / entry.path().filename(), false);
     }
 
     int round = 1;
 
-    std::unordered_set<pid_t> pidsShown;
+    boost::unordered_flat_set<pid_t> pidsShown;
 
     while (true) {
         auto pids = tokenizeString<std::vector<std::string>>(readFile(procsFile));
 
-        if (pids.empty()) break;
+        if (pids.empty())
+            break;
 
         if (round > 20)
             throw Error("cannot kill cgroup '%s'", cgroup);
@@ -93,8 +97,7 @@ static CgroupStats destroyCgroup(const std::filesystem::path & cgroup, bool retu
                 try {
                     auto cmdline = readFile(fmt("/proc/%d/cmdline", pid));
                     using namespace std::string_literals;
-                    warn("killing stray builder process %d (%s)...",
-                        pid, trim(replaceStrings(cmdline, "\0"s, " ")));
+                    warn("killing stray builder process %d (%s)...", pid, trim(replaceStrings(cmdline, "\0"s, " ")));
                 } catch (SystemError &) {
                 }
             }
@@ -120,17 +123,18 @@ static CgroupStats destroyCgroup(const std::filesystem::path & cgroup, bool retu
                 std::string_view userPrefix = "user_usec ";
                 if (hasPrefix(line, userPrefix)) {
                     auto n = string2Int<uint64_t>(line.substr(userPrefix.size()));
-                    if (n) stats.cpuUser = std::chrono::microseconds(*n);
+                    if (n)
+                        stats.cpuUser = std::chrono::microseconds(*n);
                 }
 
                 std::string_view systemPrefix = "system_usec ";
                 if (hasPrefix(line, systemPrefix)) {
                     auto n = string2Int<uint64_t>(line.substr(systemPrefix.size()));
-                    if (n) stats.cpuSystem = std::chrono::microseconds(*n);
+                    if (n)
+                        stats.cpuSystem = std::chrono::microseconds(*n);
                 }
             }
         }
-
     }
 
     if (rmdir(cgroup.c_str()) == -1)
@@ -163,4 +167,4 @@ std::string getRootCgroup()
     return rootCgroup;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/linux/include/nix/util/cgroup.hh b/src/libutil/linux/include/nix/util/cgroup.hh
index eb49c3419..59de13d46 100644
--- a/src/libutil/linux/include/nix/util/cgroup.hh
+++ b/src/libutil/linux/include/nix/util/cgroup.hh
@@ -34,4 +34,4 @@ std::string getCurrentCgroup();
  */
 std::string getRootCgroup();
 
-}
+} // namespace nix
diff --git a/src/libutil/linux/include/nix/util/linux-namespaces.hh b/src/libutil/linux/include/nix/util/linux-namespaces.hh
index 59db745d3..8f7ffa8df 100644
--- a/src/libutil/linux/include/nix/util/linux-namespaces.hh
+++ b/src/libutil/linux/include/nix/util/linux-namespaces.hh
@@ -32,4 +32,4 @@ bool userNamespacesSupported();
 
 bool mountAndPidNamespacesSupported();
 
-}
+} // namespace nix
diff --git a/src/libutil/linux/include/nix/util/meson.build b/src/libutil/linux/include/nix/util/meson.build
index ec7030c49..e28ad8e05 100644
--- a/src/libutil/linux/include/nix/util/meson.build
+++ b/src/libutil/linux/include/nix/util/meson.build
@@ -5,5 +5,4 @@ include_dirs += include_directories('../..')
 headers += files(
   'cgroup.hh',
   'linux-namespaces.hh',
-  # hack for trailing newline
 )
diff --git a/src/libutil/linux/linux-namespaces.cc b/src/libutil/linux/linux-namespaces.cc
index 93f299076..b7787cb6f 100644
--- a/src/libutil/linux/linux-namespaces.cc
+++ b/src/libutil/linux/linux-namespaces.cc
@@ -16,36 +16,27 @@ namespace nix {
 
 bool userNamespacesSupported()
 {
-    static auto res = [&]() -> bool
-    {
+    static auto res = [&]() -> bool {
         if (!pathExists("/proc/self/ns/user")) {
             debug("'/proc/self/ns/user' does not exist; your kernel was likely built without CONFIG_USER_NS=y");
             return false;
         }
 
         Path maxUserNamespaces = "/proc/sys/user/max_user_namespaces";
-        if (!pathExists(maxUserNamespaces) ||
-            trim(readFile(maxUserNamespaces)) == "0")
-        {
+        if (!pathExists(maxUserNamespaces) || trim(readFile(maxUserNamespaces)) == "0") {
             debug("user namespaces appear to be disabled; check '/proc/sys/user/max_user_namespaces'");
             return false;
         }
 
         Path procSysKernelUnprivilegedUsernsClone = "/proc/sys/kernel/unprivileged_userns_clone";
         if (pathExists(procSysKernelUnprivilegedUsernsClone)
-            && trim(readFile(procSysKernelUnprivilegedUsernsClone)) == "0")
-        {
+            && trim(readFile(procSysKernelUnprivilegedUsernsClone)) == "0") {
             debug("user namespaces appear to be disabled; check '/proc/sys/kernel/unprivileged_userns_clone'");
             return false;
         }
 
         try {
-            Pid pid = startProcess([&]()
-            {
-                _exit(0);
-            }, {
-                .cloneFlags = CLONE_NEWUSER
-            });
+            Pid pid = startProcess([&]() { _exit(0); }, {.cloneFlags = CLONE_NEWUSER});
 
             auto r = pid.wait();
             assert(!r);
@@ -61,27 +52,25 @@ bool userNamespacesSupported()
 
 bool mountAndPidNamespacesSupported()
 {
-    static auto res = [&]() -> bool
-    {
+    static auto res = [&]() -> bool {
         try {
 
-            Pid pid = startProcess([&]()
-            {
-                /* Make sure we don't remount the parent's /proc. */
-                if (mount(0, "/", 0, MS_PRIVATE | MS_REC, 0) == -1)
-                    _exit(1);
+            Pid pid = startProcess(
+                [&]() {
+                    /* Make sure we don't remount the parent's /proc. */
+                    if (mount(0, "/", 0, MS_PRIVATE | MS_REC, 0) == -1)
+                        _exit(1);
 
-                /* Test whether we can remount /proc. The kernel disallows
-                   this if /proc is not fully visible, i.e. if there are
-                   filesystems mounted on top of files inside /proc.  See
-                   https://lore.kernel.org/lkml/87tvsrjai0.fsf@xmission.com/T/. */
-                if (mount("none", "/proc", "proc", 0, 0) == -1)
-                    _exit(2);
+                    /* Test whether we can remount /proc. The kernel disallows
+                       this if /proc is not fully visible, i.e. if there are
+                       filesystems mounted on top of files inside /proc.  See
+                       https://lore.kernel.org/lkml/87tvsrjai0.fsf@xmission.com/T/. */
+                    if (mount("none", "/proc", "proc", 0, 0) == -1)
+                        _exit(2);
 
-                _exit(0);
-            }, {
-                .cloneFlags = CLONE_NEWNS | CLONE_NEWPID | (userNamespacesSupported() ? CLONE_NEWUSER : 0)
-            });
+                    _exit(0);
+                },
+                {.cloneFlags = CLONE_NEWNS | CLONE_NEWPID | (userNamespacesSupported() ? CLONE_NEWUSER : 0)});
 
             if (pid.wait()) {
                 debug("PID namespaces do not work on this system: cannot remount /proc");
@@ -98,7 +87,6 @@ bool mountAndPidNamespacesSupported()
     return res;
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
 static AutoCloseFD fdSavedMountNamespace;
@@ -144,4 +132,4 @@ void tryUnshareFilesystem()
         throw SysError("unsharing filesystem state");
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/linux/meson.build b/src/libutil/linux/meson.build
index 230dd46f3..b8053a5bb 100644
--- a/src/libutil/linux/meson.build
+++ b/src/libutil/linux/meson.build
@@ -1,7 +1,6 @@
 sources += files(
   'cgroup.cc',
   'linux-namespaces.cc',
-  # hack for trailing newline
 )
 
 subdir('include/nix/util')
diff --git a/src/libutil/logging.cc b/src/libutil/logging.cc
index 4dadf1550..997110617 100644
--- a/src/libutil/logging.cc
+++ b/src/libutil/logging.cc
@@ -26,6 +26,7 @@ ActivityId getCurActivity()
 {
     return curActivity;
 }
+
 void setCurActivity(const ActivityId activityId)
 {
     curActivity = activityId;
@@ -48,7 +49,7 @@ void Logger::writeToStdout(std::string_view s)
 Logger::Suspension Logger::suspend()
 {
     pause();
-    return Suspension { ._finalize = {[this](){this->resume();}} };
+    return Suspension{._finalize = {[this]() { this->resume(); }}};
 }
 
 std::optional<Logger::Suspension> Logger::suspendIf(bool cond)
@@ -72,25 +73,42 @@ public:
         tty = isTTY();
     }
 
-    bool isVerbose() override {
+    bool isVerbose() override
+    {
         return printBuildLogs;
     }
 
     void log(Verbosity lvl, std::string_view s) override
     {
-        if (lvl > verbosity) return;
+        if (lvl > verbosity)
+            return;
 
         std::string prefix;
 
         if (systemd) {
             char c;
             switch (lvl) {
-            case lvlError: c = '3'; break;
-            case lvlWarn: c = '4'; break;
-            case lvlNotice: case lvlInfo: c = '5'; break;
-            case lvlTalkative: case lvlChatty: c = '6'; break;
-            case lvlDebug: case lvlVomit: c = '7'; break;
-            default: c = '7'; break; // should not happen, and missing enum case is reported by -Werror=switch-enum
+            case lvlError:
+                c = '3';
+                break;
+            case lvlWarn:
+                c = '4';
+                break;
+            case lvlNotice:
+            case lvlInfo:
+                c = '5';
+                break;
+            case lvlTalkative:
+            case lvlChatty:
+                c = '6';
+                break;
+            case lvlDebug:
+            case lvlVomit:
+                c = '7';
+                break;
+            default:
+                c = '7';
+                break; // should not happen, and missing enum case is reported by -Werror=switch-enum
             }
             prefix = std::string("<") + c + ">";
         }
@@ -106,9 +124,13 @@ public:
         log(ei.level, toView(oss));
     }
 
-    void startActivity(ActivityId act, Verbosity lvl, ActivityType type,
-        const std::string & s, const Fields & fields, ActivityId parent)
-        override
+    void startActivity(
+        ActivityId act,
+        Verbosity lvl,
+        ActivityType type,
+        const std::string & s,
+        const Fields & fields,
+        ActivityId parent) override
     {
         if (lvl <= verbosity && !s.empty())
             log(lvl, s + "...");
@@ -119,8 +141,7 @@ public:
         if (type == resBuildLogLine && printBuildLogs) {
             auto lastLine = fields[0].s;
             printError(lastLine);
-        }
-        else if (type == resPostBuildLogLine && printBuildLogs) {
+        } else if (type == resPostBuildLogLine && printBuildLogs) {
             auto lastLine = fields[0].s;
             printError("post-build-hook: " + lastLine);
         }
@@ -132,9 +153,7 @@ Verbosity verbosity = lvlInfo;
 void writeToStderr(std::string_view s)
 {
     try {
-        writeFull(
-            getStandardError(),
-            s, false);
+        writeFull(getStandardError(), s, false);
     } catch (SystemError & e) {
         /* Ignore failing writes to stderr.  We need to ignore write
            errors to ensure that cleanup code that logs to stderr runs
@@ -159,9 +178,15 @@ static uint64_t getPid()
 #endif
 }
 
-Activity::Activity(Logger & logger, Verbosity lvl, ActivityType type,
-    const std::string & s, const Logger::Fields & fields, ActivityId parent)
-    : logger(logger), id(nextId++ + (((uint64_t) getPid()) << 32))
+Activity::Activity(
+    Logger & logger,
+    Verbosity lvl,
+    ActivityType type,
+    const std::string & s,
+    const Logger::Fields & fields,
+    ActivityId parent)
+    : logger(logger)
+    , id(nextId++ + (((uint64_t) getPid()) << 32))
 {
     logger.startActivity(id, lvl, type, s, fields, parent);
 }
@@ -181,22 +206,26 @@ void to_json(nlohmann::json & json, std::shared_ptr<const Pos> pos)
     }
 }
 
-struct JSONLogger : Logger {
+struct JSONLogger : Logger
+{
     Descriptor fd;
     bool includeNixPrefix;
 
     JSONLogger(Descriptor fd, bool includeNixPrefix)
         : fd(fd)
         , includeNixPrefix(includeNixPrefix)
-    { }
+    {
+    }
 
-    bool isVerbose() override {
+    bool isVerbose() override
+    {
         return true;
     }
 
     void addFields(nlohmann::json & json, const Fields & fields)
     {
-        if (fields.empty()) return;
+        if (fields.empty())
+            return;
         auto & arr = json["fields"] = nlohmann::json::array();
         for (auto & f : fields)
             if (f.type == Logger::Field::tInt)
@@ -217,8 +246,7 @@ struct JSONLogger : Logger {
     void write(const nlohmann::json & json)
     {
         auto line =
-            (includeNixPrefix ? "@nix " : "") +
-            json.dump(-1, ' ', false, nlohmann::json::error_handler_t::replace);
+            (includeNixPrefix ? "@nix " : "") + json.dump(-1, ' ', false, nlohmann::json::error_handler_t::replace);
 
         /* Acquire a lock to prevent log messages from clobbering each
            other. */
@@ -272,8 +300,13 @@ struct JSONLogger : Logger {
         write(json);
     }
 
-    void startActivity(ActivityId act, Verbosity lvl, ActivityType type,
-        const std::string & s, const Fields & fields, ActivityId parent) override
+    void startActivity(
+        ActivityId act,
+        Verbosity lvl,
+        ActivityType type,
+        const std::string & s,
+        const Fields & fields,
+        ActivityId parent) override
     {
         nlohmann::json json;
         json["action"] = "start";
@@ -312,19 +345,20 @@ std::unique_ptr<Logger> makeJSONLogger(Descriptor fd, bool includeNixPrefix)
 
 std::unique_ptr<Logger> makeJSONLogger(const std::filesystem::path & path, bool includeNixPrefix)
 {
-    struct JSONFileLogger : JSONLogger {
+    struct JSONFileLogger : JSONLogger
+    {
         AutoCloseFD fd;
 
         JSONFileLogger(AutoCloseFD && fd, bool includeNixPrefix)
             : JSONLogger(fd.get(), includeNixPrefix)
             , fd(std::move(fd))
-        { }
+        {
+        }
     };
 
-    AutoCloseFD fd =
-        std::filesystem::is_socket(path)
-        ? connect(path)
-        : toDescriptor(open(path.string().c_str(), O_CREAT | O_APPEND | O_WRONLY, 0644));
+    AutoCloseFD fd = std::filesystem::is_socket(path)
+                         ? connect(path)
+                         : toDescriptor(open(path.string().c_str(), O_CREAT | O_APPEND | O_WRONLY, 0644));
     if (!fd)
         throw SysError("opening log file %1%", path);
 
@@ -346,7 +380,6 @@ void applyJSONLogger()
         } catch (...) {
             ignoreExceptionExceptInterrupt();
         }
-
     }
 }
 
@@ -358,27 +391,30 @@ static Logger::Fields getFields(nlohmann::json & json)
             fields.emplace_back(Logger::Field(f.get<uint64_t>()));
         else if (f.type() == nlohmann::json::value_t::string)
             fields.emplace_back(Logger::Field(f.get<std::string>()));
-        else throw Error("unsupported JSON type %d", (int) f.type());
+        else
+            throw Error("unsupported JSON type %d", (int) f.type());
     }
     return fields;
 }
 
 std::optional<nlohmann::json> parseJSONMessage(const std::string & msg, std::string_view source)
 {
-    if (!hasPrefix(msg, "@nix ")) return std::nullopt;
+    if (!hasPrefix(msg, "@nix "))
+        return std::nullopt;
     try {
         return nlohmann::json::parse(std::string(msg, 5));
     } catch (std::exception & e) {
-        printError("bad JSON log message from %s: %s",
-            Uncolored(source),
-            e.what());
+        printError("bad JSON log message from %s: %s", Uncolored(source), e.what());
     }
     return std::nullopt;
 }
 
-bool handleJSONLogMessage(nlohmann::json & json,
-    const Activity & act, std::map<ActivityId, Activity> & activities,
-    std::string_view source, bool trusted)
+bool handleJSONLogMessage(
+    nlohmann::json & json,
+    const Activity & act,
+    std::map<ActivityId, Activity> & activities,
+    std::string_view source,
+    bool trusted)
 {
     try {
         std::string action = json["action"];
@@ -386,10 +422,11 @@ bool handleJSONLogMessage(nlohmann::json & json,
         if (action == "start") {
             auto type = (ActivityType) json["type"];
             if (trusted || type == actFileTransfer)
-                activities.emplace(std::piecewise_construct,
+                activities.emplace(
+                    std::piecewise_construct,
                     std::forward_as_tuple(json["id"]),
-                    std::forward_as_tuple(*logger, (Verbosity) json["level"], type,
-                        json["text"], getFields(json["fields"]), act.id));
+                    std::forward_as_tuple(
+                        *logger, (Verbosity) json["level"], type, json["text"], getFields(json["fields"]), act.id));
         }
 
         else if (action == "stop")
@@ -412,21 +449,22 @@ bool handleJSONLogMessage(nlohmann::json & json,
         }
 
         return true;
-    } catch (const nlohmann::json::exception &e) {
-        warn(
-            "Unable to handle a JSON message from %s: %s",
-            Uncolored(source),
-            e.what()
-        );
+    } catch (const nlohmann::json::exception & e) {
+        warn("Unable to handle a JSON message from %s: %s", Uncolored(source), e.what());
         return false;
     }
 }
 
-bool handleJSONLogMessage(const std::string & msg,
-    const Activity & act, std::map<ActivityId, Activity> & activities, std::string_view source, bool trusted)
+bool handleJSONLogMessage(
+    const std::string & msg,
+    const Activity & act,
+    std::map<ActivityId, Activity> & activities,
+    std::string_view source,
+    bool trusted)
 {
     auto json = parseJSONMessage(msg, source);
-    if (!json) return false;
+    if (!json)
+        return false;
 
     return handleJSONLogMessage(*json, act, activities, source, trusted);
 }
@@ -440,4 +478,4 @@ Activity::~Activity()
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/memory-source-accessor.cc b/src/libutil/memory-source-accessor.cc
index 5612c9454..363f52a54 100644
--- a/src/libutil/memory-source-accessor.cc
+++ b/src/libutil/memory-source-accessor.cc
@@ -2,15 +2,13 @@
 
 namespace nix {
 
-MemorySourceAccessor::File *
-MemorySourceAccessor::open(const CanonPath & path, std::optional<File> create)
+MemorySourceAccessor::File * MemorySourceAccessor::open(const CanonPath & path, std::optional<File> create)
 {
     File * cur = &root;
 
     bool newF = false;
 
-    for (std::string_view name : path)
-    {
+    for (std::string_view name : path) {
         auto * curDirP = std::get_if<File::Directory>(&cur->raw);
         if (!curDirP)
             return nullptr;
@@ -22,16 +20,19 @@ MemorySourceAccessor::open(const CanonPath & path, std::optional<File> create)
                 return nullptr;
             else {
                 newF = true;
-                i = curDir.contents.insert(i, {
-                    std::string { name },
-                    File::Directory {},
-                });
+                i = curDir.contents.insert(
+                    i,
+                    {
+                        std::string{name},
+                        File::Directory{},
+                    });
             }
         }
         cur = &i->second;
     }
 
-    if (newF && create) *cur = std::move(*create);
+    if (newF && create)
+        *cur = std::move(*create);
 
     return cur;
 }
@@ -54,32 +55,33 @@ bool MemorySourceAccessor::pathExists(const CanonPath & path)
 
 MemorySourceAccessor::Stat MemorySourceAccessor::File::lstat() const
 {
-    return std::visit(overloaded {
-        [](const Regular & r) {
-            return Stat {
-                .type = tRegular,
-                .fileSize = r.contents.size(),
-                .isExecutable = r.executable,
-            };
+    return std::visit(
+        overloaded{
+            [](const Regular & r) {
+                return Stat{
+                    .type = tRegular,
+                    .fileSize = r.contents.size(),
+                    .isExecutable = r.executable,
+                };
+            },
+            [](const Directory &) {
+                return Stat{
+                    .type = tDirectory,
+                };
+            },
+            [](const Symlink &) {
+                return Stat{
+                    .type = tSymlink,
+                };
+            },
         },
-        [](const Directory &) {
-            return Stat {
-                .type = tDirectory,
-            };
-        },
-        [](const Symlink &) {
-            return Stat {
-                .type = tSymlink,
-            };
-        },
-    }, this->raw);
+        this->raw);
 }
 
-std::optional<MemorySourceAccessor::Stat>
-MemorySourceAccessor::maybeLstat(const CanonPath & path)
+std::optional<MemorySourceAccessor::Stat> MemorySourceAccessor::maybeLstat(const CanonPath & path)
 {
     const auto * f = open(path, std::nullopt);
-    return f ? std::optional { f->lstat() } : std::nullopt;
+    return f ? std::optional{f->lstat()} : std::nullopt;
 }
 
 MemorySourceAccessor::DirEntries MemorySourceAccessor::readDirectory(const CanonPath & path)
@@ -110,7 +112,7 @@ std::string MemorySourceAccessor::readLink(const CanonPath & path)
 
 SourcePath MemorySourceAccessor::addFile(CanonPath path, std::string && contents)
 {
-    auto * f = open(path, File { File::Regular {} });
+    auto * f = open(path, File{File::Regular{}});
     if (!f)
         throw Error("file '%s' cannot be made because some parent file is not a directory", path);
     if (auto * r = std::get_if<File::Regular>(&f->raw))
@@ -121,12 +123,11 @@ SourcePath MemorySourceAccessor::addFile(CanonPath path, std::string && contents
     return SourcePath{ref(shared_from_this()), path};
 }
 
-
 using File = MemorySourceAccessor::File;
 
 void MemorySink::createDirectory(const CanonPath & path)
 {
-    auto * f = dst.open(path, File { File::Directory { } });
+    auto * f = dst.open(path, File{File::Directory{}});
     if (!f)
         throw Error("file '%s' cannot be made because some parent file is not a directory", path);
 
@@ -134,25 +135,27 @@ void MemorySink::createDirectory(const CanonPath & path)
         throw Error("file '%s' is not a directory", path);
 };
 
-struct CreateMemoryRegularFile : CreateRegularFileSink {
+struct CreateMemoryRegularFile : CreateRegularFileSink
+{
     File::Regular & regularFile;
 
     CreateMemoryRegularFile(File::Regular & r)
         : regularFile(r)
-    { }
+    {
+    }
 
-    void operator () (std::string_view data) override;
+    void operator()(std::string_view data) override;
     void isExecutable() override;
     void preallocateContents(uint64_t size) override;
 };
 
 void MemorySink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
-    auto * f = dst.open(path, File { File::Regular {} });
+    auto * f = dst.open(path, File{File::Regular{}});
     if (!f)
         throw Error("file '%s' cannot be made because some parent file is not a directory", path);
     if (auto * rp = std::get_if<File::Regular>(&f->raw)) {
-        CreateMemoryRegularFile crf { *rp };
+        CreateMemoryRegularFile crf{*rp};
         func(crf);
     } else
         throw Error("file '%s' is not a regular file", path);
@@ -168,14 +171,14 @@ void CreateMemoryRegularFile::preallocateContents(uint64_t len)
     regularFile.contents.reserve(len);
 }
 
-void CreateMemoryRegularFile::operator () (std::string_view data)
+void CreateMemoryRegularFile::operator()(std::string_view data)
 {
     regularFile.contents += data;
 }
 
 void MemorySink::createSymlink(const CanonPath & path, const std::string & target)
 {
-    auto * f = dst.open(path, File { File::Symlink { } });
+    auto * f = dst.open(path, File{File::Symlink{}});
     if (!f)
         throw Error("file '%s' cannot be made because some parent file is not a directory", path);
     if (auto * s = std::get_if<File::Symlink>(&f->raw))
@@ -194,4 +197,4 @@ ref<SourceAccessor> makeEmptySourceAccessor()
     return empty;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index f5ad2b1f6..cdffc892a 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -1,7 +1,9 @@
-project('nix-util', 'cpp',
+project(
+  'nix-util',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -16,10 +18,8 @@ subdir('nix-meson-build-support/deps-lists')
 
 configdata = configuration_data()
 
-deps_private_maybe_subproject = [
-]
-deps_public_maybe_subproject = [
-]
+deps_private_maybe_subproject = []
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 # Check for each of these functions, and create a define like `#define
@@ -34,7 +34,7 @@ check_funcs = [
 foreach funcspec : check_funcs
   define_name = 'HAVE_' + funcspec[0].underscorify().to_upper()
   define_value = cxx.has_function(funcspec[0]).to_int()
-  configdata.set(define_name, define_value, description: funcspec[1])
+  configdata.set(define_name, define_value, description : funcspec[1])
 endforeach
 
 subdir('nix-meson-build-support/libatomic')
@@ -45,20 +45,26 @@ if host_machine.system() == 'windows'
 elif host_machine.system() == 'sunos'
   socket = cxx.find_library('socket')
   network_service_library = cxx.find_library('nsl')
-  deps_other += [socket, network_service_library]
+  deps_other += [ socket, network_service_library ]
 endif
 
 blake3 = dependency(
   'libblake3',
-  version: '>= 1.8.2',
+  version : '>= 1.8.2',
   method : 'pkg-config',
 )
 deps_private += blake3
 
 boost = dependency(
   'boost',
-  modules : ['context', 'coroutine', 'iostreams'],
-  include_type: 'system',
+  modules : [
+    'context',
+    'coroutine',
+    'iostreams',
+    'url',
+  ],
+  include_type : 'system',
+  version : '>=1.82.0',
 )
 # boost is a public dependency, but not a pkg-config dependency unfortunately, so we
 # put in `deps_other`.
@@ -92,7 +98,12 @@ cpuid_required = get_option('cpuid')
 if host_machine.cpu_family() != 'x86_64' and cpuid_required.enabled()
   warning('Force-enabling seccomp on non-x86_64 does not make sense')
 endif
-cpuid = dependency('libcpuid', 'cpuid', version : '>= 0.7.0', required : cpuid_required)
+cpuid = dependency(
+  'libcpuid',
+  'cpuid',
+  version : '>= 0.7.0',
+  required : cpuid_required,
+)
 configdata.set('HAVE_LIBCPUID', cpuid.found().to_int())
 deps_private += cpuid
 
@@ -108,14 +119,16 @@ config_priv_h = configure_file(
 
 subdir('nix-meson-build-support/common')
 
-sources = [config_priv_h] + files(
+sources = [ config_priv_h ] + files(
   'archive.cc',
   'args.cc',
+  'base-n.cc',
+  'base-nix-32.cc',
   'canon-path.cc',
   'compression.cc',
   'compute-levels.cc',
-  'configuration.cc',
   'config-global.cc',
+  'configuration.cc',
   'current-process.cc',
   'english.cc',
   'environment-variables.cc',
@@ -134,17 +147,16 @@ sources = [config_priv_h] + files(
   'logging.cc',
   'memory-source-accessor.cc',
   'mounted-source-accessor.cc',
-  'position.cc',
   'pos-table.cc',
+  'position.cc',
   'posix-source-accessor.cc',
-  'references.cc',
   'serialise.cc',
   'signature/local-keys.cc',
   'signature/signer.cc',
   'source-accessor.cc',
   'source-path.cc',
-  'subdir-source-accessor.cc',
   'strings.cc',
+  'subdir-source-accessor.cc',
   'suggestions.cc',
   'tarfile.cc',
   'tee-logger.cc',
@@ -187,9 +199,10 @@ this_library = library(
   sources,
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   prelink : true, # For C++ static initializers
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 install_headers(headers, subdir : 'nix/util', preserve_path : true)
@@ -198,7 +211,7 @@ libraries_private = []
 if host_machine.system() == 'windows'
   # `libraries_private` cannot contain ad-hoc dependencies (from
   # `find_library), so we need to do this manually
-  libraries_private += ['-lws2_32']
+  libraries_private += [ '-lws2_32' ]
 endif
 
 subdir('nix-meson-build-support/export')
diff --git a/src/libutil/meson.options b/src/libutil/meson.options
index 21883af01..a82806162 100644
--- a/src/libutil/meson.options
+++ b/src/libutil/meson.options
@@ -1,5 +1,7 @@
 # vim: filetype=meson
 
-option('cpuid', type : 'feature',
+option(
+  'cpuid',
+  type : 'feature',
   description : 'determine microarchitecture levels with libcpuid (only relevant on x86_64)',
 )
diff --git a/src/libutil/mounted-source-accessor.cc b/src/libutil/mounted-source-accessor.cc
index b7de2afbf..4c32147f9 100644
--- a/src/libutil/mounted-source-accessor.cc
+++ b/src/libutil/mounted-source-accessor.cc
@@ -76,4 +76,4 @@ ref<SourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAcce
     return make_ref<MountedSourceAccessor>(std::move(mounts));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index 46f56e07e..3deb7ba3a 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -52,7 +52,8 @@ mkMesonLibrary (finalAttrs: {
     libblake3
     libsodium
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;
+  ]
+  ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;
 
   propagatedBuildInputs = [
     boost
diff --git a/src/libutil/pch/precompiled-headers.hh b/src/libutil/pch/precompiled-headers.hh
new file mode 100644
index 000000000..75e905386
--- /dev/null
+++ b/src/libutil/pch/precompiled-headers.hh
@@ -0,0 +1,7 @@
+#include "nix/util/util.hh"
+#include "nix/util/file-system.hh"
+#include "nix/util/serialise.hh"
+#include "nix/util/signals.hh"
+#include "nix/util/source-accessor.hh"
+
+#include <nlohmann/json.hpp>
diff --git a/src/libutil/pos-table.cc b/src/libutil/pos-table.cc
index e50b12873..e24aff4b1 100644
--- a/src/libutil/pos-table.cc
+++ b/src/libutil/pos-table.cc
@@ -48,4 +48,4 @@ Pos PosTable::operator[](PosIdx p) const
     return result;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/position.cc b/src/libutil/position.cc
index a1d9460ed..049c95474 100644
--- a/src/libutil/position.cc
+++ b/src/libutil/position.cc
@@ -31,29 +31,27 @@ std::optional<LinesOfCode> Pos::getCodeLines() const
     return std::nullopt;
 }
 
-
 std::optional<std::string> Pos::getSource() const
 {
-    return std::visit(overloaded {
-        [](const std::monostate &) -> std::optional<std::string> {
-            return std::nullopt;
-        },
-        [](const Pos::Stdin & s) -> std::optional<std::string> {
-            // Get rid of the null terminators added by the parser.
-            return std::string(s.source->c_str());
-        },
-        [](const Pos::String & s) -> std::optional<std::string> {
-            // Get rid of the null terminators added by the parser.
-            return std::string(s.source->c_str());
-        },
-        [](const SourcePath & path) -> std::optional<std::string> {
-            try {
-                return path.readFile();
-            } catch (Error &) {
-                return std::nullopt;
-            }
-        }
-    }, origin);
+    return std::visit(
+        overloaded{
+            [](const std::monostate &) -> std::optional<std::string> { return std::nullopt; },
+            [](const Pos::Stdin & s) -> std::optional<std::string> {
+                // Get rid of the null terminators added by the parser.
+                return std::string(s.source->c_str());
+            },
+            [](const Pos::String & s) -> std::optional<std::string> {
+                // Get rid of the null terminators added by the parser.
+                return std::string(s.source->c_str());
+            },
+            [](const SourcePath & path) -> std::optional<std::string> {
+                try {
+                    return path.readFile();
+                } catch (Error &) {
+                    return std::nullopt;
+                }
+            }},
+        origin);
 }
 
 std::optional<SourcePath> Pos::getSourcePath() const
@@ -66,12 +64,13 @@ std::optional<SourcePath> Pos::getSourcePath() const
 void Pos::print(std::ostream & out, bool showOrigin) const
 {
     if (showOrigin) {
-        std::visit(overloaded {
-            [&](const std::monostate &) { out << "«none»"; },
-            [&](const Pos::Stdin &) { out << "«stdin»"; },
-            [&](const Pos::String & s) { out << "«string»"; },
-            [&](const SourcePath & path) { out << path; }
-        }, origin);
+        std::visit(
+            overloaded{
+                [&](const std::monostate &) { out << "«none»"; },
+                [&](const Pos::Stdin &) { out << "«stdin»"; },
+                [&](const Pos::String & s) { out << "«string»"; },
+                [&](const SourcePath & path) { out << path; }},
+            origin);
         out << ":";
     }
     out << line;
@@ -107,7 +106,8 @@ void Pos::LinesIterator::bump(bool atFirst)
     input.remove_prefix(eol);
 }
 
-std::optional<std::string> Pos::getSnippetUpTo(const Pos & end) const {
+std::optional<std::string> Pos::getSnippetUpTo(const Pos & end) const
+{
     assert(this->origin == end.origin);
 
     if (end.line < this->line)
@@ -152,5 +152,4 @@ std::optional<std::string> Pos::getSnippetUpTo(const Pos & end) const {
     return std::nullopt;
 }
 
-
-}
+} // namespace nix
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index 2ce7c88e4..877c63331 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -3,7 +3,7 @@
 #include "nix/util/signals.hh"
 #include "nix/util/sync.hh"
 
-#include <unordered_map>
+#include <boost/unordered/concurrent_flat_map.hpp>
 
 namespace nix {
 
@@ -15,43 +15,41 @@ PosixSourceAccessor::PosixSourceAccessor(std::filesystem::path && argRoot)
 }
 
 PosixSourceAccessor::PosixSourceAccessor()
-    : PosixSourceAccessor(std::filesystem::path {})
-{ }
+    : PosixSourceAccessor(std::filesystem::path{})
+{
+}
 
 SourcePath PosixSourceAccessor::createAtRoot(const std::filesystem::path & path)
 {
     std::filesystem::path path2 = absPath(path);
     return {
         make_ref<PosixSourceAccessor>(path2.root_path()),
-        CanonPath { path2.relative_path().string() },
+        CanonPath{path2.relative_path().string()},
     };
 }
 
 std::filesystem::path PosixSourceAccessor::makeAbsPath(const CanonPath & path)
 {
-    return root.empty()
-        ? (std::filesystem::path { path.abs() })
-        : path.isRoot()
-        ? /* Don't append a slash for the root of the accessor, since
-             it can be a non-directory (e.g. in the case of `fetchTree
-             { type = "file" }`). */
-          root
-        : root / path.rel();
+    return root.empty()    ? (std::filesystem::path{path.abs()})
+           : path.isRoot() ? /* Don't append a slash for the root of the accessor, since
+                                it can be a non-directory (e.g. in the case of `fetchTree
+                                { type = "file" }`). */
+               root
+                           : root / path.rel();
 }
 
-void PosixSourceAccessor::readFile(
-    const CanonPath & path,
-    Sink & sink,
-    std::function<void(uint64_t)> sizeCallback)
+void PosixSourceAccessor::readFile(const CanonPath & path, Sink & sink, std::function<void(uint64_t)> sizeCallback)
 {
     assertNoSymlinks(path);
 
     auto ap = makeAbsPath(path);
 
-    AutoCloseFD fd = toDescriptor(open(ap.string().c_str(), O_RDONLY
-    #ifndef _WIN32
-        | O_NOFOLLOW | O_CLOEXEC
-    #endif
+    AutoCloseFD fd = toDescriptor(open(
+        ap.string().c_str(),
+        O_RDONLY
+#ifndef _WIN32
+            | O_NOFOLLOW | O_CLOEXEC
+#endif
         ));
     if (!fd)
         throw SysError("opening file '%1%'", ap.string());
@@ -71,8 +69,7 @@ void PosixSourceAccessor::readFile(
         if (rd == -1) {
             if (errno != EINTR)
                 throw SysError("reading from file '%s'", showPath(path));
-        }
-        else if (rd == 0)
+        } else if (rd == 0)
             throw SysError("unexpected end-of-file reading '%s'", showPath(path));
         else {
             assert(rd <= left);
@@ -84,51 +81,55 @@ void PosixSourceAccessor::readFile(
 
 bool PosixSourceAccessor::pathExists(const CanonPath & path)
 {
-    if (auto parent = path.parent()) assertNoSymlinks(*parent);
+    if (auto parent = path.parent())
+        assertNoSymlinks(*parent);
     return nix::pathExists(makeAbsPath(path).string());
 }
 
 std::optional<struct stat> PosixSourceAccessor::cachedLstat(const CanonPath & path)
 {
-    static SharedSync<std::unordered_map<Path, std::optional<struct stat>>> _cache;
+    using Cache = boost::concurrent_flat_map<Path, std::optional<struct stat>>;
+    static Cache cache;
 
     // Note: we convert std::filesystem::path to Path because the
     // former is not hashable on libc++.
     Path absPath = makeAbsPath(path).string();
 
-    {
-        auto cache(_cache.readLock());
-        auto i = cache->find(absPath);
-        if (i != cache->end()) return i->second;
-    }
+    std::optional<Cache::mapped_type> res;
+    cache.cvisit(absPath, [&](auto & x) { res.emplace(x.second); });
+    if (res)
+        return *res;
 
     auto st = nix::maybeLstat(absPath.c_str());
 
-    auto cache(_cache.lock());
-    if (cache->size() >= 16384) cache->clear();
-    cache->emplace(absPath, st);
+    if (cache.size() >= 16384)
+        cache.clear();
+    cache.emplace(std::move(absPath), st);
 
     return st;
 }
 
 std::optional<SourceAccessor::Stat> PosixSourceAccessor::maybeLstat(const CanonPath & path)
 {
-    if (auto parent = path.parent()) assertNoSymlinks(*parent);
+    if (auto parent = path.parent())
+        assertNoSymlinks(*parent);
     auto st = cachedLstat(path);
-    if (!st) return std::nullopt;
+    if (!st)
+        return std::nullopt;
     mtime = std::max(mtime, st->st_mtime);
-    return Stat {
-        .type =
-            S_ISREG(st->st_mode) ? tRegular :
-            S_ISDIR(st->st_mode) ? tDirectory :
-            S_ISLNK(st->st_mode) ? tSymlink :
-            S_ISCHR(st->st_mode) ? tChar :
-            S_ISBLK(st->st_mode) ? tBlock :
+    return Stat{
+        .type = S_ISREG(st->st_mode)   ? tRegular
+                : S_ISDIR(st->st_mode) ? tDirectory
+                : S_ISLNK(st->st_mode) ? tSymlink
+                : S_ISCHR(st->st_mode) ? tChar
+                : S_ISBLK(st->st_mode) ? tBlock
+                :
 #ifdef S_ISSOCK
-            S_ISSOCK(st->st_mode) ? tSocket :
+                S_ISSOCK(st->st_mode) ? tSocket
+                :
 #endif
-            S_ISFIFO(st->st_mode) ? tFifo :
-            tUnknown,
+                S_ISFIFO(st->st_mode) ? tFifo
+                                      : tUnknown,
         .fileSize = S_ISREG(st->st_mode) ? std::optional<uint64_t>(st->st_size) : std::nullopt,
         .isExecutable = S_ISREG(st->st_mode) && st->st_mode & S_IXUSR,
     };
@@ -150,7 +151,8 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
                  * libstdc++ implementation [1] and the standard proposal
                  * about the caching variations of directory_entry [2].
 
-                 * [1]: https://github.com/gcc-mirror/gcc/blob/8ea555b7b4725dbc5d9286f729166cd54ce5b615/libstdc%2B%2B-v3/include/bits/fs_dir.h#L341-L348
+                 * [1]:
+                 https://github.com/gcc-mirror/gcc/blob/8ea555b7b4725dbc5d9286f729166cd54ce5b615/libstdc%2B%2B-v3/include/bits/fs_dir.h#L341-L348
                  * [2]: https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2016/p0317r1.html
                  */
 
@@ -187,7 +189,8 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
 
 std::string PosixSourceAccessor::readLink(const CanonPath & path)
 {
-    if (auto parent = path.parent()) assertNoSymlinks(*parent);
+    if (auto parent = path.parent())
+        assertNoSymlinks(*parent);
     return nix::readLink(makeAbsPath(path).string());
 }
 
@@ -216,4 +219,4 @@ ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root)
 {
     return make_ref<PosixSourceAccessor>(std::move(root));
 }
-}
+} // namespace nix
diff --git a/src/libutil/serialise.cc b/src/libutil/serialise.cc
index 55397c6d4..15629935e 100644
--- a/src/libutil/serialise.cc
+++ b/src/libutil/serialise.cc
@@ -9,20 +9,19 @@
 #include <boost/coroutine2/coroutine.hpp>
 
 #ifdef _WIN32
-# include <fileapi.h>
-# include <winsock2.h>
-# include "nix/util/windows-error.hh"
+#  include <fileapi.h>
+#  include <winsock2.h>
+#  include "nix/util/windows-error.hh"
 #else
-# include <poll.h>
+#  include <poll.h>
 #endif
 
-
 namespace nix {
 
-
-void BufferedSink::operator () (std::string_view data)
+void BufferedSink::operator()(std::string_view data)
 {
-    if (!buffer) buffer = decltype(buffer)(new char[bufSize]);
+    if (!buffer)
+        buffer = decltype(buffer)(new char[bufSize]);
 
     while (!data.empty()) {
         /* Optimisation: bypass the buffer if the data exceeds the
@@ -36,27 +35,31 @@ void BufferedSink::operator () (std::string_view data)
            when it's full. */
         size_t n = bufPos + data.size() > bufSize ? bufSize - bufPos : data.size();
         memcpy(buffer.get() + bufPos, data.data(), n);
-        data.remove_prefix(n); bufPos += n;
-        if (bufPos == bufSize) flush();
+        data.remove_prefix(n);
+        bufPos += n;
+        if (bufPos == bufSize)
+            flush();
     }
 }
 
-
 void BufferedSink::flush()
 {
-    if (bufPos == 0) return;
+    if (bufPos == 0)
+        return;
     size_t n = bufPos;
     bufPos = 0; // don't trigger the assert() in ~BufferedSink()
     writeUnbuffered({buffer.get(), n});
 }
 
-
 FdSink::~FdSink()
 {
-    try { flush(); } catch (...) { ignoreExceptionInDestructor(); }
+    try {
+        flush();
+    } catch (...) {
+        ignoreExceptionInDestructor();
+    }
 }
 
-
 void FdSink::writeUnbuffered(std::string_view data)
 {
     written += data.size();
@@ -68,24 +71,23 @@ void FdSink::writeUnbuffered(std::string_view data)
     }
 }
 
-
 bool FdSink::good()
 {
     return _good;
 }
 
-
-void Source::operator () (char * data, size_t len)
+void Source::operator()(char * data, size_t len)
 {
     while (len) {
         size_t n = read(data, len);
-        data += n; len -= n;
+        data += n;
+        len -= n;
     }
 }
 
-void Source::operator () (std::string_view data)
+void Source::operator()(std::string_view data)
 {
-    (*this)((char *)data.data(), data.size());
+    (*this)((char *) data.data(), data.size());
 }
 
 void Source::drainInto(Sink & sink)
@@ -102,7 +104,6 @@ void Source::drainInto(Sink & sink)
     }
 }
 
-
 std::string Source::drain()
 {
     StringSink s;
@@ -110,28 +111,28 @@ std::string Source::drain()
     return std::move(s.s);
 }
 
-
 size_t BufferedSource::read(char * data, size_t len)
 {
-    if (!buffer) buffer = decltype(buffer)(new char[bufSize]);
+    if (!buffer)
+        buffer = decltype(buffer)(new char[bufSize]);
 
-    if (!bufPosIn) bufPosIn = readUnbuffered(buffer.get(), bufSize);
+    if (!bufPosIn)
+        bufPosIn = readUnbuffered(buffer.get(), bufSize);
 
     /* Copy out the data in the buffer. */
     size_t n = len > bufPosIn - bufPosOut ? bufPosIn - bufPosOut : len;
     memcpy(data, buffer.get() + bufPosOut, n);
     bufPosOut += n;
-    if (bufPosIn == bufPosOut) bufPosIn = bufPosOut = 0;
+    if (bufPosIn == bufPosOut)
+        bufPosIn = bufPosOut = 0;
     return n;
 }
 
-
 bool BufferedSource::hasData()
 {
     return bufPosOut < bufPosIn;
 }
 
-
 size_t FdSource::readUnbuffered(char * data, size_t len)
 {
 #ifdef _WIN32
@@ -147,23 +148,28 @@ size_t FdSource::readUnbuffered(char * data, size_t len)
         checkInterrupt();
         n = ::read(fd, data, len);
     } while (n == -1 && errno == EINTR);
-    if (n == -1) { _good = false; throw SysError("reading from file"); }
-    if (n == 0) { _good = false; throw EndOfFile(std::string(*endOfFileError)); }
+    if (n == -1) {
+        _good = false;
+        throw SysError("reading from file");
+    }
+    if (n == 0) {
+        _good = false;
+        throw EndOfFile(std::string(*endOfFileError));
+    }
 #endif
     read += n;
     return n;
 }
 
-
 bool FdSource::good()
 {
     return _good;
 }
 
-
 bool FdSource::hasData()
 {
-    if (BufferedSource::hasData()) return true;
+    if (BufferedSource::hasData())
+        return true;
 
     while (true) {
         fd_set fds;
@@ -177,27 +183,23 @@ bool FdSource::hasData()
 
         auto n = select(fd_ + 1, &fds, nullptr, nullptr, &timeout);
         if (n < 0) {
-            if (errno == EINTR) continue;
+            if (errno == EINTR)
+                continue;
             throw SysError("polling file descriptor");
         }
         return FD_ISSET(fd, &fds);
     }
 }
 
-
 size_t StringSource::read(char * data, size_t len)
 {
-    if (pos == s.size()) throw EndOfFile("end of string reached");
+    if (pos == s.size())
+        throw EndOfFile("end of string reached");
     size_t n = s.copy(data, len, pos);
     pos += n;
     return n;
 }
 
-
-#if BOOST_VERSION >= 106300 && BOOST_VERSION < 106600
-#error Coroutines are broken in this version of Boost!
-#endif
-
 std::unique_ptr<FinishSink> sourceToSink(std::function<void(Source &)> fun)
 {
     struct SourceToSink : FinishSink
@@ -207,15 +209,17 @@ std::unique_ptr<FinishSink> sourceToSink(std::function<void(Source &)> fun)
         std::function<void(Source &)> fun;
         std::optional<coro_t::push_type> coro;
 
-        SourceToSink(std::function<void(Source &)> fun) : fun(fun)
+        SourceToSink(std::function<void(Source &)> fun)
+            : fun(fun)
         {
         }
 
         std::string_view cur;
 
-        void operator () (std::string_view in) override
+        void operator()(std::string_view in) override
         {
-            if (in.empty()) return;
+            if (in.empty())
+                return;
             cur = in;
 
             if (!coro) {
@@ -235,7 +239,9 @@ std::unique_ptr<FinishSink> sourceToSink(std::function<void(Source &)> fun)
                 });
             }
 
-            if (!*coro) { unreachable(); }
+            if (!*coro) {
+                unreachable();
+            }
 
             if (!cur.empty()) {
                 (*coro)(false);
@@ -252,10 +258,7 @@ std::unique_ptr<FinishSink> sourceToSink(std::function<void(Source &)> fun)
     return std::make_unique<SourceToSink>(fun);
 }
 
-
-std::unique_ptr<Source> sinkToSource(
-    std::function<void(Sink &)> fun,
-    std::function<void()> eof)
+std::unique_ptr<Source> sinkToSource(std::function<void(Sink &)> fun, std::function<void()> eof)
 {
     struct SinkToSource : Source
     {
@@ -266,7 +269,8 @@ std::unique_ptr<Source> sinkToSource(
         std::optional<coro_t::pull_type> coro;
 
         SinkToSource(std::function<void(Sink &)> fun, std::function<void()> eof)
-            : fun(fun), eof(eof)
+            : fun(fun)
+            , eof(eof)
         {
         }
 
@@ -309,7 +313,6 @@ std::unique_ptr<Source> sinkToSource(
     return std::make_unique<SinkToSource>(fun, eof);
 }
 
-
 void writePadding(size_t len, Sink & sink)
 {
     if (len % 8) {
@@ -319,7 +322,6 @@ void writePadding(size_t len, Sink & sink)
     }
 }
 
-
 void writeString(std::string_view data, Sink & sink)
 {
     sink << data.size();
@@ -327,43 +329,38 @@ void writeString(std::string_view data, Sink & sink)
     writePadding(data.size(), sink);
 }
 
-
-Sink & operator << (Sink & sink, std::string_view s)
+Sink & operator<<(Sink & sink, std::string_view s)
 {
     writeString(s, sink);
     return sink;
 }
 
-
-template<class T> void writeStrings(const T & ss, Sink & sink)
+template<class T>
+void writeStrings(const T & ss, Sink & sink)
 {
     sink << ss.size();
     for (auto & i : ss)
         sink << i;
 }
 
-Sink & operator << (Sink & sink, const Strings & s)
+Sink & operator<<(Sink & sink, const Strings & s)
 {
     writeStrings(s, sink);
     return sink;
 }
 
-Sink & operator << (Sink & sink, const StringSet & s)
+Sink & operator<<(Sink & sink, const StringSet & s)
 {
     writeStrings(s, sink);
     return sink;
 }
 
-Sink & operator << (Sink & sink, const Error & ex)
+Sink & operator<<(Sink & sink, const Error & ex)
 {
     auto & info = ex.info();
-    sink
-        << "Error"
-        << info.level
-        << "Error" // removed
-        << info.msg.str()
-        << 0 // FIXME: info.errPos
-        << info.traces.size();
+    sink << "Error" << info.level << "Error" // removed
+         << info.msg.str() << 0              // FIXME: info.errPos
+         << info.traces.size();
     for (auto & trace : info.traces) {
         sink << 0; // FIXME: trace.pos
         sink << trace.hint.str();
@@ -371,7 +368,6 @@ Sink & operator << (Sink & sink, const Error & ex)
     return sink;
 }
 
-
 void readPadding(size_t len, Source & source)
 {
     if (len % 8) {
@@ -379,39 +375,40 @@ void readPadding(size_t len, Source & source)
         size_t n = 8 - (len % 8);
         source(zero, n);
         for (unsigned int i = 0; i < n; i++)
-            if (zero[i]) throw SerialisationError("non-zero padding");
+            if (zero[i])
+                throw SerialisationError("non-zero padding");
     }
 }
 
-
 size_t readString(char * buf, size_t max, Source & source)
 {
     auto len = readNum<size_t>(source);
-    if (len > max) throw SerialisationError("string is too long");
+    if (len > max)
+        throw SerialisationError("string is too long");
     source(buf, len);
     readPadding(len, source);
     return len;
 }
 
-
 std::string readString(Source & source, size_t max)
 {
     auto len = readNum<size_t>(source);
-    if (len > max) throw SerialisationError("string is too long");
+    if (len > max)
+        throw SerialisationError("string is too long");
     std::string res(len, 0);
     source(res.data(), len);
     readPadding(len, source);
     return res;
 }
 
-Source & operator >> (Source & in, std::string & s)
+Source & operator>>(Source & in, std::string & s)
 {
     s = readString(in);
     return in;
 }
 
-
-template<class T> T readStrings(Source & source)
+template<class T>
+T readStrings(Source & source)
 {
     auto count = readNum<size_t>(source);
     T ss;
@@ -423,7 +420,6 @@ template<class T> T readStrings(Source & source)
 template Paths readStrings(Source & source);
 template PathSet readStrings(Source & source);
 
-
 Error readError(Source & source)
 {
     auto type = readString(source);
@@ -431,7 +427,7 @@ Error readError(Source & source)
     auto level = (Verbosity) readInt(source);
     [[maybe_unused]] auto name = readString(source); // removed
     auto msg = readString(source);
-    ErrorInfo info {
+    ErrorInfo info{
         .level = level,
         .msg = HintFmt(msg),
     };
@@ -441,15 +437,12 @@ Error readError(Source & source)
     for (size_t i = 0; i < nrTraces; ++i) {
         havePos = readNum<size_t>(source);
         assert(havePos == 0);
-        info.traces.push_back(Trace {
-            .hint = HintFmt(readString(source))
-        });
+        info.traces.push_back(Trace{.hint = HintFmt(readString(source))});
     }
     return Error(std::move(info));
 }
 
-
-void StringSink::operator () (std::string_view data)
+void StringSink::operator()(std::string_view data)
 {
     s.append(data);
 }
@@ -468,4 +461,4 @@ size_t ChainSource::read(char * data, size_t len)
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/signature/local-keys.cc b/src/libutil/signature/local-keys.cc
index 1f7f2c7de..7dcd92c72 100644
--- a/src/libutil/signature/local-keys.cc
+++ b/src/libutil/signature/local-keys.cc
@@ -1,6 +1,7 @@
 #include "nix/util/signature/local-keys.hh"
 
 #include "nix/util/file-system.hh"
+#include "nix/util/base-n.hh"
 #include "nix/util/util.hh"
 #include <sodium.h>
 
@@ -25,7 +26,7 @@ Key::Key(std::string_view s, bool sensitiveValue)
         if (name == "" || key == "")
             throw FormatError("key is corrupt");
 
-        key = base64Decode(key);
+        key = base64::decode(key);
     } catch (Error & e) {
         std::string extra;
         if (!sensitiveValue)
@@ -37,7 +38,7 @@ Key::Key(std::string_view s, bool sensitiveValue)
 
 std::string Key::to_string() const
 {
-    return name + ":" + base64Encode(key);
+    return name + ":" + base64::encode(std::as_bytes(std::span<const char>{key}));
 }
 
 SecretKey::SecretKey(std::string_view s)
@@ -51,9 +52,8 @@ std::string SecretKey::signDetached(std::string_view data) const
 {
     unsigned char sig[crypto_sign_BYTES];
     unsigned long long sigLen;
-    crypto_sign_detached(sig, &sigLen, (unsigned char *) data.data(), data.size(),
-        (unsigned char *) key.data());
-    return name + ":" + base64Encode(std::string((char *) sig, sigLen));
+    crypto_sign_detached(sig, &sigLen, (unsigned char *) data.data(), data.size(), (unsigned char *) key.data());
+    return name + ":" + base64::encode(std::as_bytes(std::span<const unsigned char>(sig, sigLen)));
 }
 
 PublicKey SecretKey::toPublicKey() const
@@ -84,7 +84,8 @@ bool PublicKey::verifyDetached(std::string_view data, std::string_view sig) cons
 {
     auto ss = BorrowedCryptoValue::parse(sig);
 
-    if (ss.name != std::string_view { name }) return false;
+    if (ss.name != std::string_view{name})
+        return false;
 
     return verifyDetachedAnon(data, ss.payload);
 }
@@ -93,16 +94,16 @@ bool PublicKey::verifyDetachedAnon(std::string_view data, std::string_view sig)
 {
     std::string sig2;
     try {
-        sig2 = base64Decode(sig);
+        sig2 = base64::decode(sig);
     } catch (Error & e) {
         e.addTrace({}, "while decoding signature '%s'", sig);
     }
     if (sig2.size() != crypto_sign_BYTES)
         throw Error("signature is not valid");
 
-    return crypto_sign_verify_detached((unsigned char *) sig2.data(),
-        (unsigned char *) data.data(), data.size(),
-        (unsigned char *) key.data()) == 0;
+    return crypto_sign_verify_detached(
+               (unsigned char *) sig2.data(), (unsigned char *) data.data(), data.size(), (unsigned char *) key.data())
+           == 0;
 }
 
 bool verifyDetached(std::string_view data, std::string_view sig, const PublicKeys & publicKeys)
@@ -110,9 +111,10 @@ bool verifyDetached(std::string_view data, std::string_view sig, const PublicKey
     auto ss = BorrowedCryptoValue::parse(sig);
 
     auto key = publicKeys.find(std::string(ss.name));
-    if (key == publicKeys.end()) return false;
+    if (key == publicKeys.end())
+        return false;
 
     return key->second.verifyDetachedAnon(data, ss.payload);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/signature/signer.cc b/src/libutil/signature/signer.cc
index 46445e9e9..9f6f663e9 100644
--- a/src/libutil/signature/signer.cc
+++ b/src/libutil/signature/signer.cc
@@ -8,7 +8,8 @@ namespace nix {
 LocalSigner::LocalSigner(SecretKey && privateKey)
     : privateKey(privateKey)
     , publicKey(privateKey.toPublicKey())
-{ }
+{
+}
 
 std::string LocalSigner::signDetached(std::string_view s) const
 {
@@ -20,4 +21,4 @@ const PublicKey & LocalSigner::getPublicKey()
     return publicKey;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/source-accessor.cc b/src/libutil/source-accessor.cc
index fc9752456..3c2d65829 100644
--- a/src/libutil/source-accessor.cc
+++ b/src/libutil/source-accessor.cc
@@ -10,17 +10,26 @@ bool SourceAccessor::Stat::isNotNARSerialisable()
     return this->type != tRegular && this->type != tSymlink && this->type != tDirectory;
 }
 
-std::string SourceAccessor::Stat::typeString() {
+std::string SourceAccessor::Stat::typeString()
+{
     switch (this->type) {
-        case tRegular: return "regular";
-        case tSymlink: return "symlink";
-        case tDirectory: return "directory";
-        case tChar: return "character device";
-        case tBlock: return "block device";
-        case tSocket: return "socket";
-        case tFifo: return "fifo";
-        case tUnknown:
-        default: return "unknown";
+    case tRegular:
+        return "regular";
+    case tSymlink:
+        return "symlink";
+    case tDirectory:
+        return "directory";
+    case tChar:
+        return "character device";
+    case tBlock:
+        return "block device";
+    case tSocket:
+        return "socket";
+    case tFifo:
+        return "fifo";
+    case tUnknown:
+    default:
+        return "unknown";
     }
     return "unknown";
 }
@@ -40,32 +49,23 @@ std::string SourceAccessor::readFile(const CanonPath & path)
 {
     StringSink sink;
     std::optional<uint64_t> size;
-    readFile(path, sink, [&](uint64_t _size)
-    {
-        size = _size;
-    });
+    readFile(path, sink, [&](uint64_t _size) { size = _size; });
     assert(size && *size == sink.s.size());
     return std::move(sink.s);
 }
 
-void SourceAccessor::readFile(
-    const CanonPath & path,
-    Sink & sink,
-    std::function<void(uint64_t)> sizeCallback)
+void SourceAccessor::readFile(const CanonPath & path, Sink & sink, std::function<void(uint64_t)> sizeCallback)
 {
     auto s = readFile(path);
     sizeCallback(s.size());
     sink(s);
 }
 
-Hash SourceAccessor::hashPath(
-    const CanonPath & path,
-    PathFilter & filter,
-    HashAlgorithm ha)
+Hash SourceAccessor::hashPath(const CanonPath & path, PathFilter & filter, HashAlgorithm ha)
 {
     HashSink sink(ha);
     dumpPath(path, sink, filter);
-    return sink.finish().first;
+    return sink.finish().hash;
 }
 
 SourceAccessor::Stat SourceAccessor::lstat(const CanonPath & path)
@@ -87,9 +87,7 @@ std::string SourceAccessor::showPath(const CanonPath & path)
     return displayPrefix + path.abs() + displaySuffix;
 }
 
-CanonPath SourceAccessor::resolveSymlinks(
-    const CanonPath & path,
-    SymlinkResolution mode)
+CanonPath SourceAccessor::resolveSymlinks(const CanonPath & path, SymlinkResolution mode)
 {
     auto res = CanonPath::root;
 
@@ -128,4 +126,4 @@ CanonPath SourceAccessor::resolveSymlinks(
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/source-path.cc b/src/libutil/source-path.cc
index 6d42fa95f..2f1f1096b 100644
--- a/src/libutil/source-path.cc
+++ b/src/libutil/source-path.cc
@@ -3,7 +3,9 @@
 namespace nix {
 
 std::string_view SourcePath::baseName() const
-{ return path.baseName().value_or("source"); }
+{
+    return path.baseName().value_or("source");
+}
 
 SourcePath SourcePath::parent() const
 {
@@ -13,39 +15,59 @@ SourcePath SourcePath::parent() const
 }
 
 std::string SourcePath::readFile() const
-{ return accessor->readFile(path); }
+{
+    return accessor->readFile(path);
+}
 
 bool SourcePath::pathExists() const
-{ return accessor->pathExists(path); }
+{
+    return accessor->pathExists(path);
+}
 
 SourceAccessor::Stat SourcePath::lstat() const
-{ return accessor->lstat(path); }
+{
+    return accessor->lstat(path);
+}
 
 std::optional<SourceAccessor::Stat> SourcePath::maybeLstat() const
-{ return accessor->maybeLstat(path); }
+{
+    return accessor->maybeLstat(path);
+}
 
 SourceAccessor::DirEntries SourcePath::readDirectory() const
-{ return accessor->readDirectory(path); }
+{
+    return accessor->readDirectory(path);
+}
 
 std::string SourcePath::readLink() const
-{ return accessor->readLink(path); }
+{
+    return accessor->readLink(path);
+}
 
-void SourcePath::dumpPath(
-    Sink & sink,
-    PathFilter & filter) const
-{ return accessor->dumpPath(path, sink, filter); }
+void SourcePath::dumpPath(Sink & sink, PathFilter & filter) const
+{
+    return accessor->dumpPath(path, sink, filter);
+}
 
 std::optional<std::filesystem::path> SourcePath::getPhysicalPath() const
-{ return accessor->getPhysicalPath(path); }
+{
+    return accessor->getPhysicalPath(path);
+}
 
 std::string SourcePath::to_string() const
-{ return accessor->showPath(path); }
+{
+    return accessor->showPath(path);
+}
 
-SourcePath SourcePath::operator / (const CanonPath & x) const
-{ return {accessor, path / x}; }
+SourcePath SourcePath::operator/(const CanonPath & x) const
+{
+    return {accessor, path / x};
+}
 
-SourcePath SourcePath::operator / (std::string_view c) const
-{ return {accessor, path / c}; }
+SourcePath SourcePath::operator/(std::string_view c) const
+{
+    return {accessor, path / c};
+}
 
 bool SourcePath::operator==(const SourcePath & x) const noexcept
 {
@@ -63,4 +85,4 @@ std::ostream & operator<<(std::ostream & str, const SourcePath & path)
     return str;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/subdir-source-accessor.cc b/src/libutil/subdir-source-accessor.cc
index 265836118..d4f57e2f7 100644
--- a/src/libutil/subdir-source-accessor.cc
+++ b/src/libutil/subdir-source-accessor.cc
@@ -56,4 +56,4 @@ ref<SourceAccessor> projectSubdirSourceAccessor(ref<SourceAccessor> parent, Cano
     return make_ref<SubdirSourceAccessor>(std::move(parent), std::move(subdirectory));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/suggestions.cc b/src/libutil/suggestions.cc
index aee23d45e..2367a12bf 100644
--- a/src/libutil/suggestions.cc
+++ b/src/libutil/suggestions.cc
@@ -15,20 +15,20 @@ int levenshteinDistance(std::string_view first, std::string_view second)
     int m = first.size();
     int n = second.size();
 
-    auto v0 = std::vector<int>(n+1);
-    auto v1 = std::vector<int>(n+1);
+    auto v0 = std::vector<int>(n + 1);
+    auto v1 = std::vector<int>(n + 1);
 
     for (auto i = 0; i <= n; i++)
         v0[i] = i;
 
     for (auto i = 0; i < m; i++) {
-        v1[0] = i+1;
+        v1[0] = i + 1;
 
         for (auto j = 0; j < n; j++) {
-            auto deletionCost = v0[j+1] + 1;
+            auto deletionCost = v0[j + 1] + 1;
             auto insertionCost = v1[j] + 1;
             auto substitutionCost = first[i] == second[j] ? v0[j] : v0[j] + 1;
-            v1[j+1] = std::min({deletionCost, insertionCost, substitutionCost});
+            v1[j + 1] = std::min({deletionCost, insertionCost, substitutionCost});
         }
 
         std::swap(v0, v1);
@@ -37,18 +37,17 @@ int levenshteinDistance(std::string_view first, std::string_view second)
     return v0[n];
 }
 
-Suggestions Suggestions::bestMatches (
-    const StringSet & allMatches,
-    std::string_view query)
+Suggestions Suggestions::bestMatches(const StringSet & allMatches, std::string_view query)
 {
     std::set<Suggestion> res;
     for (const auto & possibleMatch : allMatches) {
-        res.insert(Suggestion {
-            .distance = levenshteinDistance(query, possibleMatch),
-            .suggestion = possibleMatch,
-        });
+        res.insert(
+            Suggestion{
+                .distance = levenshteinDistance(query, possibleMatch),
+                .suggestion = possibleMatch,
+            });
     }
-    return Suggestions { res };
+    return Suggestions{res};
 }
 
 Suggestions Suggestions::trim(int limit, int maxDistance) const
@@ -75,31 +74,29 @@ std::string Suggestion::to_string() const
 std::string Suggestions::to_string() const
 {
     switch (suggestions.size()) {
-        case 0:
-            return "";
-        case 1:
-            return suggestions.begin()->to_string();
-        default: {
-            std::string res = "one of ";
-            auto iter = suggestions.begin();
-            res += iter->to_string(); // Iter can’t be end() because the container isn’t null
-            iter++;
-            auto last = suggestions.end(); last--;
-            for ( ; iter != suggestions.end() ; iter++) {
-                res += (iter == last) ? " or " : ", ";
-                res += iter->to_string();
-            }
-            return res;
+    case 0:
+        return "";
+    case 1:
+        return suggestions.begin()->to_string();
+    default: {
+        std::string res = "one of ";
+        auto iter = suggestions.begin();
+        res += iter->to_string(); // Iter can’t be end() because the container isn’t null
+        iter++;
+        auto last = suggestions.end();
+        last--;
+        for (; iter != suggestions.end(); iter++) {
+            res += (iter == last) ? " or " : ", ";
+            res += iter->to_string();
         }
+        return res;
+    }
     }
 }
 
 Suggestions & Suggestions::operator+=(const Suggestions & other)
 {
-    suggestions.insert(
-            other.suggestions.begin(),
-            other.suggestions.end()
-    );
+    suggestions.insert(other.suggestions.begin(), other.suggestions.end());
     return *this;
 }
 
@@ -113,4 +110,4 @@ std::ostream & operator<<(std::ostream & str, const Suggestions & suggestions)
     return str << suggestions.to_string();
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index 299847850..0757b3a81 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -44,7 +44,7 @@ void checkLibArchive(archive * archive, int err, const std::string & reason)
 }
 
 constexpr auto defaultBufferSize = std::size_t{65536};
-}
+} // namespace
 
 void TarArchive::check(int err, const std::string & reason)
 {
@@ -247,4 +247,4 @@ time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink &
     return lastModified;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/tee-logger.cc b/src/libutil/tee-logger.cc
index 55334a821..8433168a5 100644
--- a/src/libutil/tee-logger.cc
+++ b/src/libutil/tee-logger.cc
@@ -104,4 +104,4 @@ makeTeeLogger(std::unique_ptr<Logger> mainLogger, std::vector<std::unique_ptr<Lo
     return std::make_unique<TeeLogger>(std::move(allLoggers));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/terminal.cc b/src/libutil/terminal.cc
index 63473d1a9..b5765487c 100644
--- a/src/libutil/terminal.cc
+++ b/src/libutil/terminal.cc
@@ -3,12 +3,12 @@
 #include "nix/util/sync.hh"
 
 #ifdef _WIN32
-# include <io.h>
-# define WIN32_LEAN_AND_MEAN
-# include <windows.h>
-# define isatty _isatty
+#  include <io.h>
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
+#  define isatty _isatty
 #else
-# include <sys/ioctl.h>
+#  include <sys/ioctl.h>
 #endif
 #include <unistd.h>
 #include <widechar_width.h>
@@ -57,16 +57,14 @@ inline std::pair<int, size_t> charWidthUTF8Helper(std::string_view s)
     return {width, bytes};
 }
 
-}
+} // namespace
 
 namespace nix {
 
 bool isTTY()
 {
-    static const bool tty =
-        isatty(STDERR_FILENO)
-        && getEnv("TERM").value_or("dumb") != "dumb"
-        && !(getEnv("NO_COLOR").has_value() || getEnv("NOCOLOR").has_value());
+    static const bool tty = isatty(STDERR_FILENO) && getEnv("TERM").value_or("dumb") != "dumb"
+                            && !(getEnv("NO_COLOR").has_value() || getEnv("NOCOLOR").has_value());
 
     return tty;
 }
@@ -87,11 +85,14 @@ std::string filterANSIEscapes(std::string_view s, bool filterAll, unsigned int w
             if (i != s.end() && *i == '[') {
                 e += *i++;
                 // eat parameter bytes
-                while (i != s.end() && *i >= 0x30 && *i <= 0x3f) e += *i++;
+                while (i != s.end() && *i >= 0x30 && *i <= 0x3f)
+                    e += *i++;
                 // eat intermediate bytes
-                while (i != s.end() && *i >= 0x20 && *i <= 0x2f) e += *i++;
+                while (i != s.end() && *i >= 0x20 && *i <= 0x2f)
+                    e += *i++;
                 // eat final byte
-                if (i != s.end() && *i >= 0x40 && *i <= 0x7e) e += last = *i++;
+                if (i != s.end() && *i >= 0x40 && *i <= 0x7e)
+                    e += last = *i++;
             } else if (i != s.end() && *i == ']') {
                 // OSC
                 e += *i++;
@@ -101,15 +102,18 @@ std::string filterANSIEscapes(std::string_view s, bool filterAll, unsigned int w
                 // 2. BEL ('\a') (xterm-style, used by gcc)
 
                 // eat ESC or BEL
-                while (i != s.end() && *i != '\e' && *i != '\a') e += *i++;
+                while (i != s.end() && *i != '\e' && *i != '\a')
+                    e += *i++;
                 if (i != s.end()) {
-                  char v = *i;
-                  e += *i++;
-                  // eat backslash after ESC
-                  if (i != s.end() && v == '\e' && *i == '\\') e += last = *i++;
+                    char v = *i;
+                    e += *i++;
+                    // eat backslash after ESC
+                    if (i != s.end() && v == '\e' && *i == '\\')
+                        e += last = *i++;
                 }
             } else {
-                if (i != s.end() && *i >= 0x40 && *i <= 0x5f) e += *i++;
+                if (i != s.end() && *i >= 0x40 && *i <= 0x5f)
+                    e += *i++;
             }
 
             if (!filterAll && last == 'm')
@@ -146,17 +150,16 @@ std::string filterANSIEscapes(std::string_view s, bool filterAll, unsigned int w
 
 static Sync<std::pair<unsigned short, unsigned short>> windowSize{{0, 0}};
 
-
 void updateWindowSize()
 {
-    #ifndef _WIN32
+#ifndef _WIN32
     struct winsize ws;
     if (ioctl(2, TIOCGWINSZ, &ws) == 0) {
         auto windowSize_(windowSize.lock());
         windowSize_->first = ws.ws_row;
         windowSize_->second = ws.ws_col;
     }
-    #else
+#else
     CONSOLE_SCREEN_BUFFER_INFO info;
     // From https://stackoverflow.com/a/12642749
     if (GetConsoleScreenBufferInfo(GetStdHandle(STD_OUTPUT_HANDLE), &info) != 0) {
@@ -165,13 +168,12 @@ void updateWindowSize()
         windowSize_->first = info.srWindow.Bottom - info.srWindow.Top + 1;
         windowSize_->second = info.dwSize.X;
     }
-    #endif
+#endif
 }
 
-
 std::pair<unsigned short, unsigned short> getWindowSize()
 {
     return *windowSize.lock();
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/thread-pool.cc b/src/libutil/thread-pool.cc
index 8958bc550..b7740bc3e 100644
--- a/src/libutil/thread-pool.cc
+++ b/src/libutil/thread-pool.cc
@@ -9,7 +9,8 @@ ThreadPool::ThreadPool(size_t _maxThreads)
 {
     if (!maxThreads) {
         maxThreads = std::thread::hardware_concurrency();
-        if (!maxThreads) maxThreads = 1;
+        if (!maxThreads)
+            maxThreads = 1;
     }
 
     debug("starting pool of %d threads", maxThreads - 1);
@@ -29,7 +30,8 @@ void ThreadPool::shutdown()
         std::swap(workers, state->workers);
     }
 
-    if (workers.empty()) return;
+    if (workers.empty())
+        return;
 
     debug("reaping %d worker threads", workers.size());
 
@@ -127,9 +129,11 @@ void ThreadPool::doWork(bool mainThread)
             /* Wait until a work item is available or we're asked to
                quit. */
             while (true) {
-                if (quit) return;
+                if (quit)
+                    return;
 
-                if (!state->pending.empty()) break;
+                if (!state->pending.empty())
+                    break;
 
                 /* If there are no active or pending items, and the
                    main thread is running process(), then no new items
@@ -158,6 +162,4 @@ void ThreadPool::doWork(bool mainThread)
     }
 }
 
-}
-
-
+} // namespace nix
diff --git a/src/libutil/union-source-accessor.cc b/src/libutil/union-source-accessor.cc
index 9950f6049..96b6a643a 100644
--- a/src/libutil/union-source-accessor.cc
+++ b/src/libutil/union-source-accessor.cc
@@ -79,4 +79,4 @@ ref<SourceAccessor> makeUnionSourceAccessor(std::vector<ref<SourceAccessor>> &&
     return make_ref<UnionSourceAccessor>(std::move(accessors));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix-domain-socket.cc b/src/libutil/unix-domain-socket.cc
index 2422caf14..50df7438b 100644
--- a/src/libutil/unix-domain-socket.cc
+++ b/src/libutil/unix-domain-socket.cc
@@ -3,12 +3,12 @@
 #include "nix/util/util.hh"
 
 #ifdef _WIN32
-# include <winsock2.h>
-# include <afunix.h>
+#  include <winsock2.h>
+#  include <afunix.h>
 #else
-# include <sys/socket.h>
-# include <sys/un.h>
-# include "nix/util/processes.hh"
+#  include <sys/socket.h>
+#  include <sys/un.h>
+#  include "nix/util/processes.hh"
 #endif
 #include <unistd.h>
 
@@ -16,11 +16,14 @@ namespace nix {
 
 AutoCloseFD createUnixDomainSocket()
 {
-    AutoCloseFD fdSocket = toDescriptor(socket(PF_UNIX, SOCK_STREAM
-        #ifdef SOCK_CLOEXEC
-        | SOCK_CLOEXEC
-        #endif
-        , 0));
+    AutoCloseFD fdSocket = toDescriptor(socket(
+        PF_UNIX,
+        SOCK_STREAM
+#ifdef SOCK_CLOEXEC
+            | SOCK_CLOEXEC
+#endif
+        ,
+        0));
     if (!fdSocket)
         throw SysError("cannot create Unix domain socket");
 #ifndef _WIN32
@@ -44,9 +47,8 @@ AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode)
     return fdSocket;
 }
 
-static void bindConnectProcHelper(
-    std::string_view operationName, auto && operation,
-    Socket fd, const std::string & path)
+static void
+bindConnectProcHelper(std::string_view operationName, auto && operation, Socket fd, const std::string & path)
 {
     struct sockaddr_un addr;
     addr.sun_family = AF_UNIX;
@@ -118,4 +120,4 @@ AutoCloseFD connect(const std::filesystem::path & path)
     return fd;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/current-process.cc b/src/libutil/unix/current-process.cc
new file mode 100644
index 000000000..eaa2424ab
--- /dev/null
+++ b/src/libutil/unix/current-process.cc
@@ -0,0 +1,23 @@
+#include "nix/util/current-process.hh"
+#include "nix/util/error.hh"
+#include <cmath>
+
+#include <sys/resource.h>
+
+namespace nix {
+
+std::chrono::microseconds getCpuUserTime()
+{
+    struct rusage buf;
+
+    if (getrusage(RUSAGE_SELF, &buf) != 0) {
+        throw SysError("failed to get CPU time");
+    }
+
+    std::chrono::seconds seconds(buf.ru_utime.tv_sec);
+    std::chrono::microseconds microseconds(buf.ru_utime.tv_usec);
+
+    return seconds + microseconds;
+}
+
+} // namespace nix
diff --git a/src/libutil/unix/environment-variables.cc b/src/libutil/unix/environment-variables.cc
index 0e1ed2794..c68e3bcad 100644
--- a/src/libutil/unix/environment-variables.cc
+++ b/src/libutil/unix/environment-variables.cc
@@ -19,4 +19,4 @@ int setEnvOs(const OsString & name, const OsString & value)
     return setEnv(name.c_str(), value.c_str());
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/file-descriptor.cc b/src/libutil/unix/file-descriptor.cc
index 0051e8aa4..2b612e854 100644
--- a/src/libutil/unix/file-descriptor.cc
+++ b/src/libutil/unix/file-descriptor.cc
@@ -27,7 +27,7 @@ void pollFD(int fd, int events)
         throw SysError("poll on file descriptor failed");
     }
 }
-}
+} // namespace
 
 std::string readFile(int fd)
 {
@@ -45,28 +45,31 @@ void readFull(int fd, char * buf, size_t count)
         ssize_t res = read(fd, buf, count);
         if (res == -1) {
             switch (errno) {
-            case EINTR: continue;
+            case EINTR:
+                continue;
             case EAGAIN:
                 pollFD(fd, POLLIN);
                 continue;
             }
             throw SysError("reading from file");
         }
-        if (res == 0) throw EndOfFile("unexpected end-of-file");
+        if (res == 0)
+            throw EndOfFile("unexpected end-of-file");
         count -= res;
         buf += res;
     }
 }
 
-
 void writeFull(int fd, std::string_view s, bool allowInterrupts)
 {
     while (!s.empty()) {
-        if (allowInterrupts) checkInterrupt();
+        if (allowInterrupts)
+            checkInterrupt();
         ssize_t res = write(fd, s.data(), s.size());
         if (res == -1) {
             switch (errno) {
-            case EINTR: continue;
+            case EINTR:
+                continue;
             case EAGAIN:
                 pollFD(fd, POLLOUT);
                 continue;
@@ -78,7 +81,6 @@ void writeFull(int fd, std::string_view s, bool allowInterrupts)
     }
 }
 
-
 std::string readLine(int fd, bool eofOk)
 {
     std::string s;
@@ -89,7 +91,8 @@ std::string readLine(int fd, bool eofOk)
         ssize_t rd = read(fd, &ch, 1);
         if (rd == -1) {
             switch (errno) {
-            case EINTR: continue;
+            case EINTR:
+                continue;
             case EAGAIN: {
                 pollFD(fd, POLLIN);
                 continue;
@@ -102,15 +105,14 @@ std::string readLine(int fd, bool eofOk)
                 return s;
             else
                 throw EndOfFile("unexpected EOF reading a line");
-        }
-        else {
-            if (ch == '\n') return s;
+        } else {
+            if (ch == '\n')
+                return s;
             s += ch;
         }
     }
 }
 
-
 void drainFD(int fd, Sink & sink, bool block)
 {
     // silence GCC maybe-uninitialized warning in finally
@@ -138,9 +140,10 @@ void drainFD(int fd, Sink & sink, bool block)
                 break;
             if (errno != EINTR)
                 throw SysError("reading from file");
-        }
-        else if (rd == 0) break;
-        else sink({reinterpret_cast<char *>(buf.data()), (size_t) rd});
+        } else if (rd == 0)
+            break;
+        else
+            sink({reinterpret_cast<char *>(buf.data()), (size_t) rd});
     }
 }
 
@@ -150,9 +153,11 @@ void Pipe::create()
 {
     int fds[2];
 #if HAVE_PIPE2
-    if (pipe2(fds, O_CLOEXEC) != 0) throw SysError("creating pipe");
+    if (pipe2(fds, O_CLOEXEC) != 0)
+        throw SysError("creating pipe");
 #else
-    if (pipe(fds) != 0) throw SysError("creating pipe");
+    if (pipe(fds) != 0)
+        throw SysError("creating pipe");
     unix::closeOnExec(fds[0]);
     unix::closeOnExec(fds[1]);
 #endif
@@ -160,17 +165,16 @@ void Pipe::create()
     writeSide = fds[1];
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
 #if defined(__linux__) || defined(__FreeBSD__)
 static int unix_close_range(unsigned int first, unsigned int last, int flags)
 {
-#if !HAVE_CLOSE_RANGE
-    return syscall(SYS_close_range, first, last, (unsigned int)flags);
-#else
+#  if !HAVE_CLOSE_RANGE
+    return syscall(SYS_close_range, first, last, (unsigned int) flags);
+#  else
     return close_range(first, last, flags);
-#endif
+#  endif
 }
 #endif
 
@@ -212,13 +216,11 @@ void unix::closeExtraFDs()
         close(fd); /* ignore result */
 }
 
-
 void unix::closeOnExec(int fd)
 {
     int prev;
-    if ((prev = fcntl(fd, F_GETFD, 0)) == -1 ||
-        fcntl(fd, F_SETFD, prev | FD_CLOEXEC) == -1)
+    if ((prev = fcntl(fd, F_GETFD, 0)) == -1 || fcntl(fd, F_SETFD, prev | FD_CLOEXEC) == -1)
         throw SysError("setting close-on-exec flag");
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/file-path.cc b/src/libutil/unix/file-path.cc
index 0fb1f468c..53b1fca36 100644
--- a/src/libutil/unix/file-path.cc
+++ b/src/libutil/unix/file-path.cc
@@ -10,7 +10,7 @@ namespace nix {
 
 std::optional<std::filesystem::path> maybePath(PathView path)
 {
-    return { path };
+    return {path};
 }
 
 std::filesystem::path pathNG(PathView path)
@@ -18,4 +18,4 @@ std::filesystem::path pathNG(PathView path)
     return path;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/file-system.cc b/src/libutil/unix/file-system.cc
index 7865de2e9..8ff66328b 100644
--- a/src/libutil/unix/file-system.cc
+++ b/src/libutil/unix/file-system.cc
@@ -66,4 +66,4 @@ void setWriteTime(
 #endif
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/include/nix/util/monitor-fd.hh b/src/libutil/unix/include/nix/util/monitor-fd.hh
index c10ad96bd..b87bf5ca4 100644
--- a/src/libutil/unix/include/nix/util/monitor-fd.hh
+++ b/src/libutil/unix/include/nix/util/monitor-fd.hh
@@ -2,15 +2,18 @@
 ///@file
 
 #include <thread>
-#include <atomic>
+#include <cassert>
 
-#include <cstdlib>
 #include <poll.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include <signal.h>
+#include <errno.h>
+
+#ifdef __APPLE__
+#  include <sys/types.h>
+#  include <sys/event.h>
+#endif
 
 #include "nix/util/signals.hh"
+#include "nix/util/file-descriptor.hh"
 
 namespace nix {
 
@@ -20,111 +23,113 @@ private:
     std::thread thread;
     Pipe notifyPipe;
 
+    void runThread(int watchFd, int notifyFd);
+
 public:
-    MonitorFdHup(int fd)
-    {
-        notifyPipe.create();
-        thread = std::thread([this, fd]() {
-            while (true) {
-                // There is a POSIX violation on macOS: you have to listen for
-                // at least POLLHUP to receive HUP events for a FD. POSIX says
-                // this is not so, and you should just receive them regardless.
-                // However, as of our testing on macOS 14.5, the events do not
-                // get delivered if in the all-bits-unset case, but do get
-                // delivered if `POLLHUP` is set.
-                //
-                // This bug filed as rdar://37537852
-                // (https://openradar.appspot.com/37537852).
-                //
-                // macOS's own man page
-                // (https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man2/poll.2.html)
-                // additionally says that `POLLHUP` is ignored as an input. It
-                // seems the likely order of events here was
-                //
-                // 1. macOS did not follow the POSIX spec
-                //
-                // 2. Somebody ninja-fixed this other spec violation to make
-                // sure `POLLHUP` was not forgotten about, even though they
-                // "fixed" this issue in a spec-non-compliant way. Whatever,
-                // we'll use the fix.
-                //
-                // Relevant code, current version, which shows the :
-                // https://github.com/apple-oss-distributions/xnu/blob/94d3b452840153a99b38a3a9659680b2a006908e/bsd/kern/sys_generic.c#L1751-L1758
-                //
-                // The `POLLHUP` detection was added in
-                // https://github.com/apple-oss-distributions/xnu/commit/e13b1fa57645afc8a7b2e7d868fe9845c6b08c40#diff-a5aa0b0e7f4d866ca417f60702689fc797e9cdfe33b601b05ccf43086c35d395R1468
-                // That means added in 2007 or earlier. Should be good enough
-                // for us.
-                short hangup_events =
-#ifdef __APPLE__
-                    POLLHUP
-#else
-                    0
-#endif
-                    ;
-
-                /* Wait indefinitely until a POLLHUP occurs. */
-                constexpr size_t num_fds = 2;
-                struct pollfd fds[num_fds] = {
-                    {
-                        .fd = fd,
-                        .events = hangup_events,
-                    },
-                    {
-                        .fd = notifyPipe.readSide.get(),
-                        .events = hangup_events,
-                    },
-                };
-
-                auto count = poll(fds, num_fds, -1);
-                if (count == -1) {
-                    if (errno == EINTR || errno == EAGAIN)
-                        continue;
-                    throw SysError("failed to poll() in MonitorFdHup");
-                }
-                /* This shouldn't happen, but can on macOS due to a bug.
-                   See rdar://37550628.
-
-                   This may eventually need a delay or further
-                   coordination with the main thread if spinning proves
-                   too harmful.
-                */
-                if (count == 0)
-                    continue;
-                if (fds[0].revents & POLLHUP) {
-                    unix::triggerInterrupt();
-                    break;
-                }
-                if (fds[1].revents & POLLHUP) {
-                    break;
-                }
-                // On macOS, (jade thinks that) it is possible (although not
-                // observed on macOS 14.5) that in some limited cases on buggy
-                // kernel versions, all the non-POLLHUP events for the socket
-                // get delivered.
-                //
-                // We could sleep to avoid pointlessly spinning a thread on
-                // those, but this opens up a different problem, which is that
-                // if do sleep, it will be longer before the daemon fork for a
-                // client exits. Imagine a sequential shell script, running Nix
-                // commands, each of which talk to the daemon. If the previous
-                // command registered a temp root, exits, and then the next
-                // command issues a delete request before the temp root is
-                // cleaned up, that delete request might fail.
-                //
-                // Not sleeping doesn't actually fix the race condition --- we
-                // would need to block on the old connections' tempt roots being
-                // cleaned up in in the new connection --- but it does make it
-                // much less likely.
-            }
-        });
-    };
+    MonitorFdHup(int fd);
 
     ~MonitorFdHup()
     {
+        // Close the write side to signal termination via POLLHUP
         notifyPipe.writeSide.close();
         thread.join();
     }
 };
 
+#ifdef __APPLE__
+/* This custom kqueue usage exists because Apple's poll implementation is
+ * broken and loses event subscriptions if EVFILT_READ fires without matching
+ * the requested `events` in the pollfd.
+ *
+ * We use EVFILT_READ, which causes some spurious wakeups (at most one per write
+ * from the client, in addition to the socket lifecycle events), because the
+ * alternate API, EVFILT_SOCK, doesn't work on pipes, which this is also used
+ * to monitor in certain situations.
+ *
+ * See (EVFILT_SOCK):
+ * https://github.com/netty/netty/blob/64bd2f4eb62c2fb906bc443a2aabf894c8b7dce9/transport-classes-kqueue/src/main/java/io/netty/channel/kqueue/AbstractKQueueChannel.java#L434
+ *
+ * See: https://git.lix.systems/lix-project/lix/issues/729
+ * Apple bug in poll(2): FB17447257, available at https://openradar.appspot.com/FB17447257
+ */
+inline void MonitorFdHup::runThread(int watchFd, int notifyFd)
+{
+    int kqResult = kqueue();
+    if (kqResult < 0) {
+        throw SysError("MonitorFdHup kqueue");
+    }
+    AutoCloseFD kq{kqResult};
+
+    std::array<struct kevent, 2> kevs;
+
+    // kj uses EVFILT_WRITE for this, but it seems that it causes more spurious
+    // wakeups in our case of doing blocking IO from another thread compared to
+    // EVFILT_READ.
+    //
+    // EVFILT_WRITE and EVFILT_READ (for sockets at least, where I am familiar
+    // with the internals) both go through a common filter which catches EOFs
+    // and generates spurious wakeups for either readable/writable events.
+    EV_SET(&kevs[0], watchFd, EVFILT_READ, EV_ADD | EV_ENABLE | EV_CLEAR, 0, 0, nullptr);
+    EV_SET(&kevs[1], notifyFd, EVFILT_READ, EV_ADD | EV_ENABLE | EV_CLEAR, 0, 0, nullptr);
+
+    int result = kevent(kq.get(), kevs.data(), kevs.size(), nullptr, 0, nullptr);
+    if (result < 0) {
+        throw SysError("MonitorFdHup kevent add");
+    }
+
+    while (true) {
+        struct kevent event;
+        int numEvents = kevent(kq.get(), nullptr, 0, &event, 1, nullptr);
+        if (numEvents < 0) {
+            throw SysError("MonitorFdHup kevent watch");
+        }
+
+        if (numEvents > 0 && (event.flags & EV_EOF)) {
+            if (event.ident == uintptr_t(watchFd)) {
+                unix::triggerInterrupt();
+            }
+            // Either watched fd or notify fd closed, exit
+            return;
+        }
+    }
 }
+#else
+inline void MonitorFdHup::runThread(int watchFd, int notifyFd)
+{
+    while (true) {
+        struct pollfd fds[2];
+        fds[0].fd = watchFd;
+        fds[0].events = 0; // POSIX: POLLHUP is always reported
+        fds[1].fd = notifyFd;
+        fds[1].events = 0;
+
+        auto count = poll(fds, 2, -1);
+        if (count == -1) {
+            if (errno == EINTR || errno == EAGAIN) {
+                continue;
+            } else {
+                throw SysError("in MonitorFdHup poll()");
+            }
+        }
+
+        if (fds[0].revents & POLLHUP) {
+            unix::triggerInterrupt();
+            break;
+        }
+
+        if (fds[1].revents & POLLHUP) {
+            // Notify pipe closed, exit thread
+            break;
+        }
+    }
+}
+#endif
+
+inline MonitorFdHup::MonitorFdHup(int fd)
+{
+    notifyPipe.create();
+    int notifyFd = notifyPipe.readSide.get();
+    thread = std::thread([this, fd, notifyFd]() { this->runThread(fd, notifyFd); });
+};
+
+} // namespace nix
diff --git a/src/libutil/unix/include/nix/util/signals-impl.hh b/src/libutil/unix/include/nix/util/signals-impl.hh
index 7397744b2..2456119be 100644
--- a/src/libutil/unix/include/nix/util/signals-impl.hh
+++ b/src/libutil/unix/include/nix/util/signals-impl.hh
@@ -42,13 +42,6 @@ extern thread_local std::function<bool()> interruptCheck;
 
 void _interrupted();
 
-/**
- * Sets the signal mask. Like saveSignalMask() but for a signal set that doesn't
- * necessarily match the current thread's mask.
- * See saveSignalMask() to set the saved mask to the current mask.
- */
-void setChildSignalMask(sigset_t *sigs);
-
 /**
  * Start a thread that handles various signals. Also block those signals
  * on the current thread (and thus any threads created by it).
@@ -60,8 +53,6 @@ void startSignalHandlerThread();
 /**
  * Saves the signal mask, which is the signal mask that nix will restore
  * before creating child processes.
- * See setChildSignalMask() to set an arbitrary signal mask instead of the
- * current mask.
  */
 void saveSignalMask();
 
@@ -73,7 +64,7 @@ void restoreSignals();
 
 void triggerInterrupt();
 
-}
+} // namespace unix
 
 static inline void setInterrupted(bool isInterrupted)
 {
@@ -116,8 +107,8 @@ struct ReceiveInterrupts
     ReceiveInterrupts()
         : target(pthread_self())
         , callback(createInterruptCallback([&]() { pthread_kill(target, SIGUSR1); }))
-    { }
+    {
+    }
 };
 
-
-}
+} // namespace nix
diff --git a/src/libutil/unix/meson.build b/src/libutil/unix/meson.build
index ea2391d05..8f89b65ab 100644
--- a/src/libutil/unix/meson.build
+++ b/src/libutil/unix/meson.build
@@ -5,7 +5,7 @@ configdata_unix = configuration_data()
 configdata_unix.set(
   'HAVE_DECL_AT_SYMLINK_NOFOLLOW',
   cxx.has_header_symbol('fcntl.h', 'AT_SYMLINK_NOFOLLOW').to_int(),
-  description : 'Optionally used for changing the files and symlinks.'
+  description : 'Optionally used for changing the files and symlinks.',
 )
 
 # Check for each of these functions, and create a define like `#define
@@ -39,7 +39,7 @@ check_funcs_unix = [
 foreach funcspec : check_funcs_unix
   define_name = 'HAVE_' + funcspec[0].underscorify().to_upper()
   define_value = cxx.has_function(funcspec[0]).to_int()
-  configdata_unix.set(define_name, define_value, description: funcspec[1])
+  configdata_unix.set(define_name, define_value, description : funcspec[1])
 endforeach
 
 config_unix_priv_h = configure_file(
@@ -49,6 +49,7 @@ config_unix_priv_h = configure_file(
 sources += config_unix_priv_h
 
 sources += files(
+  'current-process.cc',
   'environment-variables.cc',
   'file-descriptor.cc',
   'file-path.cc',
diff --git a/src/libutil/unix/muxable-pipe.cc b/src/libutil/unix/muxable-pipe.cc
index 57bcdb0ad..1b8b09adc 100644
--- a/src/libutil/unix/muxable-pipe.cc
+++ b/src/libutil/unix/muxable-pipe.cc
@@ -44,4 +44,4 @@ void MuxablePipePollState::iterate(
     }
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/os-string.cc b/src/libutil/unix/os-string.cc
index 1a2be1554..08d275bc6 100644
--- a/src/libutil/unix/os-string.cc
+++ b/src/libutil/unix/os-string.cc
@@ -18,4 +18,4 @@ std::filesystem::path::string_type string_to_os_string(std::string_view s)
     return std::string{s};
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/processes.cc b/src/libutil/unix/processes.cc
index 0d50fc303..9582ff840 100644
--- a/src/libutil/unix/processes.cc
+++ b/src/libutil/unix/processes.cc
@@ -20,51 +20,45 @@
 #include <unistd.h>
 
 #ifdef __APPLE__
-# include <sys/syscall.h>
+#  include <sys/syscall.h>
 #endif
 
 #ifdef __linux__
-# include <sys/prctl.h>
-# include <sys/mman.h>
+#  include <sys/prctl.h>
+#  include <sys/mman.h>
 #endif
 
 #include "util-config-private.hh"
 #include "util-unix-config-private.hh"
 
-
 namespace nix {
 
-Pid::Pid()
-{
-}
-
+Pid::Pid() {}
 
 Pid::Pid(pid_t pid)
     : pid(pid)
 {
 }
 
-
 Pid::~Pid()
 {
-    if (pid != -1) kill();
+    if (pid != -1)
+        kill();
 }
 
-
-void Pid::operator =(pid_t pid)
+void Pid::operator=(pid_t pid)
 {
-    if (this->pid != -1 && this->pid != pid) kill();
+    if (this->pid != -1 && this->pid != pid)
+        kill();
     this->pid = pid;
     killSignal = SIGKILL; // reset signal to default
 }
 
-
 Pid::operator pid_t()
 {
     return pid;
 }
 
-
 int Pid::kill()
 {
     assert(pid != -1);
@@ -87,7 +81,6 @@ int Pid::kill()
     return wait();
 }
 
-
 int Pid::wait()
 {
     assert(pid != -1);
@@ -104,19 +97,16 @@ int Pid::wait()
     }
 }
 
-
 void Pid::setSeparatePG(bool separatePG)
 {
     this->separatePG = separatePG;
 }
 
-
 void Pid::setKillSignal(int signal)
 {
     this->killSignal = signal;
 }
 
-
 pid_t Pid::release()
 {
     pid_t p = pid;
@@ -124,7 +114,6 @@ pid_t Pid::release()
     return p;
 }
 
-
 void killUser(uid_t uid)
 {
     debug("killing all processes running under uid '%1%'", uid);
@@ -136,7 +125,6 @@ void killUser(uid_t uid)
        fork a process, switch to uid, and send a mass kill. */
 
     Pid pid = startProcess([&] {
-
         if (setuid(uid) == -1)
             throw SysError("setting uid");
 
@@ -147,11 +135,14 @@ void killUser(uid_t uid)
                calling process. In the OSX libc, it's set to true,
                which means "follow POSIX", which we don't want here
                  */
-            if (syscall(SYS_kill, -1, SIGKILL, false) == 0) break;
+            if (syscall(SYS_kill, -1, SIGKILL, false) == 0)
+                break;
 #else
-            if (kill(-1, SIGKILL) == 0) break;
+            if (kill(-1, SIGKILL) == 0)
+                break;
 #endif
-            if (errno == ESRCH || errno == EPERM) break; /* no more processes */
+            if (errno == ESRCH || errno == EPERM)
+                break; /* no more processes */
             if (errno != EINTR)
                 throw SysError("cannot kill processes for uid '%1%'", uid);
         }
@@ -169,7 +160,6 @@ void killUser(uid_t uid)
        uid | grep -q $uid'. */
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
 using ChildWrapperFunction = std::function<void()>;
@@ -177,6 +167,7 @@ using ChildWrapperFunction = std::function<void()>;
 /* Wrapper around vfork to prevent the child process from clobbering
    the caller's stack frame in the parent. */
 static pid_t doFork(bool allowVfork, ChildWrapperFunction & fun) __attribute__((noinline));
+
 static pid_t doFork(bool allowVfork, ChildWrapperFunction & fun)
 {
 #ifdef __linux__
@@ -184,22 +175,21 @@ static pid_t doFork(bool allowVfork, ChildWrapperFunction & fun)
 #else
     pid_t pid = fork();
 #endif
-    if (pid != 0) return pid;
+    if (pid != 0)
+        return pid;
     fun();
     unreachable();
 }
 
-
 #ifdef __linux__
 static int childEntry(void * arg)
 {
-    auto & fun = *reinterpret_cast<ChildWrapperFunction*>(arg);
+    auto & fun = *reinterpret_cast<ChildWrapperFunction *>(arg);
     fun();
     return 1;
 }
 #endif
 
-
 pid_t startProcess(std::function<void()> fun, const ProcessOptions & options)
 {
     auto newLogger = makeSimpleLogger();
@@ -222,8 +212,10 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options)
         } catch (std::exception & e) {
             try {
                 std::cerr << options.errorPrefix << e.what() << "\n";
-            } catch (...) { }
-        } catch (...) { }
+            } catch (...) {
+            }
+        } catch (...) {
+        }
         if (options.runExitHandlers)
             exit(1);
         else
@@ -233,34 +225,41 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options)
     pid_t pid = -1;
 
     if (options.cloneFlags) {
-        #ifdef __linux__
+#ifdef __linux__
         // Not supported, since then we don't know when to free the stack.
         assert(!(options.cloneFlags & CLONE_VM));
 
         size_t stackSize = 1 * 1024 * 1024;
-        auto stack = static_cast<char *>(mmap(0, stackSize,
-            PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0));
-        if (stack == MAP_FAILED) throw SysError("allocating stack");
+        auto stack = static_cast<char *>(
+            mmap(0, stackSize, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0));
+        if (stack == MAP_FAILED)
+            throw SysError("allocating stack");
 
         Finally freeStack([&] { munmap(stack, stackSize); });
 
         pid = clone(childEntry, stack + stackSize, options.cloneFlags | SIGCHLD, &wrapper);
-        #else
+#else
         throw Error("clone flags are only supported on Linux");
-        #endif
+#endif
     } else
         pid = doFork(options.allowVfork, wrapper);
 
-    if (pid == -1) throw SysError("unable to fork");
+    if (pid == -1)
+        throw SysError("unable to fork");
 
     return pid;
 }
 
-
-std::string runProgram(Path program, bool lookupPath, const Strings & args,
-    const std::optional<std::string> & input, bool isInteractive)
+std::string runProgram(
+    Path program, bool lookupPath, const Strings & args, const std::optional<std::string> & input, bool isInteractive)
 {
-    auto res = runProgram(RunOptions {.program = program, .lookupPath = lookupPath, .args = args, .input = input, .isInteractive = isInteractive});
+    auto res = runProgram(
+        RunOptions{
+            .program = program,
+            .lookupPath = lookupPath,
+            .args = args,
+            .input = input,
+            .isInteractive = isInteractive});
 
     if (!statusOk(res.first))
         throw ExecError(res.first, "program '%1%' %2%", program, statusToString(res.first));
@@ -301,8 +300,10 @@ void runProgram2(const RunOptions & options)
 
     /* Create a pipe. */
     Pipe out, in;
-    if (options.standardOut) out.create();
-    if (source) in.create();
+    if (options.standardOut)
+        out.create();
+    if (source)
+        in.create();
 
     ProcessOptions processOptions;
     // vfork implies that the environment of the main process and the fork will
@@ -313,41 +314,43 @@ void runProgram2(const RunOptions & options)
     auto suspension = logger->suspendIf(options.isInteractive);
 
     /* Fork. */
-    Pid pid = startProcess([&] {
-        if (options.environment)
-            replaceEnv(*options.environment);
-        if (options.standardOut && dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
-            throw SysError("dupping stdout");
-        if (options.mergeStderrToStdout)
-            if (dup2(STDOUT_FILENO, STDERR_FILENO) == -1)
-                throw SysError("cannot dup stdout into stderr");
-        if (source && dup2(in.readSide.get(), STDIN_FILENO) == -1)
-            throw SysError("dupping stdin");
+    Pid pid = startProcess(
+        [&] {
+            if (options.environment)
+                replaceEnv(*options.environment);
+            if (options.standardOut && dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
+                throw SysError("dupping stdout");
+            if (options.mergeStderrToStdout)
+                if (dup2(STDOUT_FILENO, STDERR_FILENO) == -1)
+                    throw SysError("cannot dup stdout into stderr");
+            if (source && dup2(in.readSide.get(), STDIN_FILENO) == -1)
+                throw SysError("dupping stdin");
 
-        if (options.chdir && chdir((*options.chdir).c_str()) == -1)
-            throw SysError("chdir failed");
-        if (options.gid && setgid(*options.gid) == -1)
-            throw SysError("setgid failed");
-        /* Drop all other groups if we're setgid. */
-        if (options.gid && setgroups(0, 0) == -1)
-            throw SysError("setgroups failed");
-        if (options.uid && setuid(*options.uid) == -1)
-            throw SysError("setuid failed");
+            if (options.chdir && chdir((*options.chdir).c_str()) == -1)
+                throw SysError("chdir failed");
+            if (options.gid && setgid(*options.gid) == -1)
+                throw SysError("setgid failed");
+            /* Drop all other groups if we're setgid. */
+            if (options.gid && setgroups(0, 0) == -1)
+                throw SysError("setgroups failed");
+            if (options.uid && setuid(*options.uid) == -1)
+                throw SysError("setuid failed");
 
-        Strings args_(options.args);
-        args_.push_front(options.program);
+            Strings args_(options.args);
+            args_.push_front(options.program);
 
-        restoreProcessContext();
+            restoreProcessContext();
 
-        if (options.lookupPath)
-            execvp(options.program.c_str(), stringsToCharPtrs(args_).data());
+            if (options.lookupPath)
+                execvp(options.program.c_str(), stringsToCharPtrs(args_).data());
             // This allows you to refer to a program with a pathname relative
             // to the PATH variable.
-        else
-            execv(options.program.c_str(), stringsToCharPtrs(args_).data());
+            else
+                execv(options.program.c_str(), stringsToCharPtrs(args_).data());
 
-        throw SysError("executing '%1%'", options.program);
-    }, processOptions);
+            throw SysError("executing '%1%'", options.program);
+        },
+        processOptions);
 
     out.writeSide.close();
 
@@ -360,7 +363,6 @@ void runProgram2(const RunOptions & options)
             writerThread.join();
     });
 
-
     if (source) {
         in.readSide.close();
         writerThread = std::thread([&] {
@@ -390,7 +392,8 @@ void runProgram2(const RunOptions & options)
     int status = pid.wait();
 
     /* Wait for the writer thread to finish. */
-    if (source) promise.get_future().get();
+    if (source)
+        promise.get_future().get();
 
     if (status)
         throw ExecError(status, "program '%1%' %2%", options.program, statusToString(status));
@@ -411,13 +414,12 @@ std::string statusToString(int status)
 #else
             return fmt("failed due to signal %1%", sig);
 #endif
-        }
-        else
+        } else
             return "died abnormally";
-    } else return "succeeded";
+    } else
+        return "succeeded";
 }
 
-
 bool statusOk(int status)
 {
     return WIFEXITED(status) && WEXITSTATUS(status) == 0;
@@ -428,7 +430,7 @@ int execvpe(const char * file0, const char * const argv[], const char * const en
     auto file = ExecutablePath::load().findPath(file0);
     // `const_cast` is safe. See the note in
     // https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html
-    return execve(file.c_str(), const_cast<char *const *>(argv), const_cast<char *const *>(envp));
+    return execve(file.c_str(), const_cast<char * const *>(argv), const_cast<char * const *>(envp));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/signals.cc b/src/libutil/unix/signals.cc
index 665b9b096..d6efd6aa7 100644
--- a/src/libutil/unix/signals.cc
+++ b/src/libutil/unix/signals.cc
@@ -34,15 +34,14 @@ void unix::_interrupted()
     }
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-
 /* We keep track of interrupt callbacks using integer tokens, so we can iterate
    safely without having to lock the data structure while executing arbitrary
    functions.
  */
-struct InterruptCallbacks {
+struct InterruptCallbacks
+{
     typedef int64_t Token;
 
     /* We use unique tokens so that we can't accidentally delete the wrong
@@ -97,30 +96,11 @@ void unix::triggerInterrupt()
     }
 }
 
-
 static sigset_t savedSignalMask;
 static bool savedSignalMaskIsSet = false;
 
-void unix::setChildSignalMask(sigset_t * sigs)
+void unix::saveSignalMask()
 {
-    assert(sigs); // C style function, but think of sigs as a reference
-
-#if (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 1) || (defined(_XOPEN_SOURCE) && _XOPEN_SOURCE) || (defined(_POSIX_SOURCE) && _POSIX_SOURCE)
-    sigemptyset(&savedSignalMask);
-    // There's no "assign" or "copy" function, so we rely on (math) idempotence
-    // of the or operator: a or a = a.
-    sigorset(&savedSignalMask, sigs, sigs);
-#else
-    // Without sigorset, our best bet is to assume that sigset_t is a type that
-    // can be assigned directly, such as is the case for a sigset_t defined as
-    // an integer type.
-    savedSignalMask = *sigs;
-#endif
-
-    savedSignalMaskIsSet = true;
-}
-
-void unix::saveSignalMask() {
     if (sigprocmask(SIG_BLOCK, nullptr, &savedSignalMask))
         throw SysError("querying signal mask");
 
@@ -166,11 +146,11 @@ void unix::restoreSignals()
         throw SysError("restoring signals");
 }
 
-
 /* RAII helper to automatically deregister a callback. */
 struct InterruptCallbackImpl : InterruptCallback
 {
     InterruptCallbacks::Token token;
+
     ~InterruptCallbackImpl() override
     {
         auto interruptCallbacks(_interruptCallbacks.lock());
@@ -184,10 +164,10 @@ std::unique_ptr<InterruptCallback> createInterruptCallback(std::function<void()>
     auto token = interruptCallbacks->nextToken++;
     interruptCallbacks->callbacks.emplace(token, callback);
 
-    std::unique_ptr<InterruptCallbackImpl> res {new InterruptCallbackImpl{}};
+    std::unique_ptr<InterruptCallbackImpl> res{new InterruptCallbackImpl{}};
     res->token = token;
 
     return std::unique_ptr<InterruptCallback>(res.release());
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/unix/users.cc b/src/libutil/unix/users.cc
index 5ac851e95..09b38be5e 100644
--- a/src/libutil/unix/users.cc
+++ b/src/libutil/unix/users.cc
@@ -23,16 +23,14 @@ Path getHomeOf(uid_t userId)
     std::vector<char> buf(16384);
     struct passwd pwbuf;
     struct passwd * pw;
-    if (getpwuid_r(userId, &pwbuf, buf.data(), buf.size(), &pw) != 0
-        || !pw || !pw->pw_dir || !pw->pw_dir[0])
+    if (getpwuid_r(userId, &pwbuf, buf.data(), buf.size(), &pw) != 0 || !pw || !pw->pw_dir || !pw->pw_dir[0])
         throw Error("cannot determine user's home directory");
     return pw->pw_dir;
 }
 
 Path getHome()
 {
-    static Path homeDir = []()
-    {
+    static Path homeDir = []() {
         std::optional<std::string> unownedUserHomeDir = {};
         auto homeDir = getEnv("HOME");
         if (homeDir) {
@@ -41,7 +39,10 @@ Path getHome()
             int result = stat(homeDir->c_str(), &st);
             if (result != 0) {
                 if (errno != ENOENT) {
-                    warn("couldn't stat $HOME ('%s') for reason other than not existing ('%d'), falling back to the one defined in the 'passwd' file", *homeDir, errno);
+                    warn(
+                        "couldn't stat $HOME ('%s') for reason other than not existing ('%d'), falling back to the one defined in the 'passwd' file",
+                        *homeDir,
+                        errno);
                     homeDir.reset();
                 }
             } else if (st.st_uid != geteuid()) {
@@ -51,7 +52,10 @@ Path getHome()
         if (!homeDir) {
             homeDir = getHomeOf(geteuid());
             if (unownedUserHomeDir.has_value() && unownedUserHomeDir != homeDir) {
-                warn("$HOME ('%s') is not owned by you, falling back to the one defined in the 'passwd' file ('%s')", *unownedUserHomeDir, *homeDir);
+                warn(
+                    "$HOME ('%s') is not owned by you, falling back to the one defined in the 'passwd' file ('%s')",
+                    *unownedUserHomeDir,
+                    *homeDir);
             }
         }
         return *homeDir;
@@ -59,8 +63,9 @@ Path getHome()
     return homeDir;
 }
 
-bool isRootUser() {
+bool isRootUser()
+{
     return getuid() == 0;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/url.cc b/src/libutil/url.cc
index b7286072d..1c7fd3f0f 100644
--- a/src/libutil/url.cc
+++ b/src/libutil/url.cc
@@ -3,109 +3,306 @@
 #include "nix/util/util.hh"
 #include "nix/util/split.hh"
 #include "nix/util/canon-path.hh"
+#include "nix/util/strings-inline.hh"
+
+#include <boost/url.hpp>
 
 namespace nix {
 
 std::regex refRegex(refRegexS, std::regex::ECMAScript);
-std::regex badGitRefRegex(badGitRefRegexS, std::regex::ECMAScript);
 std::regex revRegex(revRegexS, std::regex::ECMAScript);
 
-ParsedURL parseURL(const std::string & url)
+ParsedURL::Authority ParsedURL::Authority::parse(std::string_view encodedAuthority)
 {
-    static std::regex uriRegex(
-        "((" + schemeNameRegex + "):"
-        + "(?:(?://(" + authorityRegex + ")(" + absPathRegex + "))|(/?" + pathRegex + ")))"
-        + "(?:\\?(" + queryRegex + "))?"
-        + "(?:#(" + fragmentRegex + "))?",
-        std::regex::ECMAScript);
+    auto parsed = boost::urls::parse_authority(encodedAuthority);
+    if (!parsed)
+        throw BadURL("invalid URL authority: '%s': %s", encodedAuthority, parsed.error().message());
 
-    std::smatch match;
+    auto hostType = [&]() {
+        switch (parsed->host_type()) {
+        case boost::urls::host_type::ipv4:
+            return HostType::IPv4;
+        case boost::urls::host_type::ipv6:
+            return HostType::IPv6;
+        case boost::urls::host_type::ipvfuture:
+            return HostType::IPvFuture;
+        case boost::urls::host_type::none:
+        case boost::urls::host_type::name:
+            return HostType::Name;
+        }
+        unreachable();
+    }();
 
-    if (std::regex_match(url, match, uriRegex)) {
-        std::string scheme = match[2];
-        auto authority = match[3].matched
-            ? std::optional<std::string>(match[3]) : std::nullopt;
-        std::string path = match[4].matched ? match[4] : match[5];
-        auto & query = match[6];
-        auto & fragment = match[7];
+    auto port = [&]() -> std::optional<uint16_t> {
+        if (!parsed->has_port() || parsed->port() == "")
+            return std::nullopt;
+        /* If the port number is non-zero and representable. */
+        if (auto portNumber = parsed->port_number())
+            return portNumber;
+        throw BadURL("port '%s' is invalid", parsed->port());
+    }();
 
-        auto transportIsFile = parseUrlScheme(scheme).transport == "file";
+    return {
+        .hostType = hostType,
+        .host = parsed->host_address(),
+        .user = parsed->has_userinfo() ? parsed->user() : std::optional<std::string>{},
+        .password = parsed->has_password() ? parsed->password() : std::optional<std::string>{},
+        .port = port,
+    };
+}
 
-        if (authority && *authority != "" && transportIsFile)
-            throw BadURL("file:// URL '%s' has unexpected authority '%s'",
-                url, *authority);
-
-        if (transportIsFile && path.empty())
-            path = "/";
-
-        return ParsedURL{
-            .scheme = scheme,
-            .authority = authority,
-            .path = percentDecode(path),
-            .query = decodeQuery(query),
-            .fragment = percentDecode(std::string(fragment))
-        };
+std::ostream & operator<<(std::ostream & os, const ParsedURL::Authority & self)
+{
+    if (self.user) {
+        os << percentEncode(*self.user);
+        if (self.password)
+            os << ":" << percentEncode(*self.password);
+        os << "@";
     }
 
-    else
-        throw BadURL("'%s' is not a valid URL", url);
+    using HostType = ParsedURL::Authority::HostType;
+    switch (self.hostType) {
+    case HostType::Name:
+        os << percentEncode(self.host);
+        break;
+    case HostType::IPv4:
+        os << self.host;
+        break;
+    case HostType::IPv6:
+    case HostType::IPvFuture:
+        /* Reencode percent sign for RFC4007 ScopeId literals. */
+        os << "[" << percentEncode(self.host, ":") << "]";
+    }
+
+    if (self.port)
+        os << ":" << *self.port;
+
+    return os;
+}
+
+std::string ParsedURL::Authority::to_string() const
+{
+    std::ostringstream oss;
+    oss << *this;
+    return std::move(oss).str();
+}
+
+/**
+ * Additional characters that don't need URL encoding in the fragment.
+ */
+static constexpr boost::urls::grammar::lut_chars extraAllowedCharsInFragment = " \"^";
+
+/**
+ * Additional characters that don't need URL encoding in the query.
+ */
+static constexpr boost::urls::grammar::lut_chars extraAllowedCharsInQuery = " \"";
+
+static std::string percentEncodeCharSet(std::string_view s, auto charSet)
+{
+    std::string res;
+    for (auto c : s) {
+        if (charSet(c))
+            res += percentEncode(std::string_view{&c, &c + 1});
+        else
+            res += c;
+    }
+    return res;
+}
+
+static ParsedURL fromBoostUrlView(boost::urls::url_view url, bool lenient);
+
+ParsedURL parseURL(std::string_view url, bool lenient)
+try {
+    /* Account for several non-standard properties of nix urls (for back-compat):
+     *  - Allow unescaped spaces ' ' and '"' characters in queries.
+     *  - Allow '"', ' ' and '^' characters in the fragment component.
+     * We could write our own grammar for this, but fixing it up here seems
+     * more concise, since the deviation is rather minor.
+     *
+     * If `!lenient` don't bother initializing, because we can just
+     * parse `url` directly`.
+     */
+    std::string fixedEncodedUrl;
+
+    if (lenient) {
+        fixedEncodedUrl = [&] {
+            std::string fixed;
+            std::string_view view = url;
+
+            if (auto beforeQuery = splitPrefixTo(view, '?')) {
+                fixed += *beforeQuery;
+                fixed += '?';
+                auto fragmentStart = view.find('#');
+                auto queryView = view.substr(0, fragmentStart);
+                auto fixedQuery = percentEncodeCharSet(queryView, extraAllowedCharsInQuery);
+                fixed += fixedQuery;
+                view.remove_prefix(std::min(fragmentStart, view.size()));
+            }
+
+            if (auto beforeFragment = splitPrefixTo(view, '#')) {
+                fixed += *beforeFragment;
+                fixed += '#';
+                auto fixedFragment = percentEncodeCharSet(view, extraAllowedCharsInFragment);
+                fixed += fixedFragment;
+                return fixed;
+            }
+
+            fixed += view;
+            return fixed;
+        }();
+    }
+
+    return fromBoostUrlView(boost::urls::url_view(lenient ? fixedEncodedUrl : url), lenient);
+} catch (boost::system::system_error & e) {
+    throw BadURL("'%s' is not a valid URL: %s", url, e.code().message());
+}
+
+static ParsedURL fromBoostUrlView(boost::urls::url_view urlView, bool lenient)
+{
+    if (!urlView.has_scheme())
+        throw BadURL("'%s' doesn't have a scheme", urlView.buffer());
+
+    auto scheme = urlView.scheme();
+    auto authority = [&]() -> std::optional<ParsedURL::Authority> {
+        if (urlView.has_authority())
+            return ParsedURL::Authority::parse(urlView.authority().buffer());
+        return std::nullopt;
+    }();
+
+    /* 3.2.2. Host (RFC3986):
+     * If the URI scheme defines a default for host, then that default
+     * applies when the host subcomponent is undefined or when the
+     * registered name is empty (zero length).  For example, the "file" URI
+     * scheme is defined so that no authority, an empty host, and
+     * "localhost" all mean the end-user's machine, whereas the "http"
+     * scheme considers a missing authority or empty host invalid. */
+    auto transportIsFile = parseUrlScheme(scheme).transport == "file";
+    if (authority && authority->host.size() && transportIsFile)
+        throw BadURL("file:// URL '%s' has unexpected authority '%s'", urlView.buffer(), *authority);
+
+    auto fragment = urlView.fragment(); /* Does pct-decoding */
+
+    boost::core::string_view encodedPath = urlView.encoded_path();
+    if (transportIsFile && encodedPath.empty())
+        encodedPath = "/";
+
+    auto path = std::views::transform(splitString<std::vector<std::string_view>>(encodedPath, "/"), percentDecode)
+                | std::ranges::to<std::vector<std::string>>();
+
+    /* Get the raw query. Store URI supports smuggling doubly nested queries, where
+       the inner &/? are pct-encoded. */
+    auto query = std::string_view(urlView.encoded_query());
+
+    return ParsedURL{
+        .scheme = scheme,
+        .authority = authority,
+        .path = std::move(path),
+        .query = decodeQuery(query, lenient),
+        .fragment = fragment,
+    };
+}
+
+ParsedURL parseURLRelative(std::string_view urlS, const ParsedURL & base)
+try {
+
+    boost::urls::url resolved;
+
+    try {
+        resolved.set_scheme(base.scheme);
+        if (base.authority) {
+            auto & authority = *base.authority;
+            resolved.set_host_address(authority.host);
+            if (authority.user)
+                resolved.set_user(*authority.user);
+            if (authority.password)
+                resolved.set_password(*authority.password);
+            if (authority.port)
+                resolved.set_port_number(*authority.port);
+        }
+        resolved.set_encoded_path(encodeUrlPath(base.path));
+        resolved.set_encoded_query(encodeQuery(base.query));
+        resolved.set_fragment(base.fragment);
+    } catch (boost::system::system_error & e) {
+        throw BadURL("'%s' is not a valid URL: %s", base.to_string(), e.code().message());
+    }
+
+    boost::urls::url_view url;
+    try {
+        url = urlS;
+        resolved.resolve(url).value();
+    } catch (boost::system::system_error & e) {
+        throw BadURL("'%s' is not a valid URL: %s", urlS, e.code().message());
+    }
+
+    auto ret = fromBoostUrlView(resolved, /*lenient=*/false);
+
+    /* Hack: Boost `url_view` supports Zone IDs, but `url` does not.
+       Just manually take the authority from the original URL to work
+       around it. See https://github.com/boostorg/url/issues/919 for
+       details. */
+    if (!url.has_authority()) {
+        ret.authority = base.authority;
+    }
+
+    /* Hack, work around fragment of base URL improperly being preserved
+       https://github.com/boostorg/url/issues/920 */
+    ret.fragment = url.has_fragment() ? std::string{url.fragment()} : "";
+
+    return ret;
+} catch (BadURL & e) {
+    e.addTrace({}, "while resolving possibly-relative url '%s' against base URL '%s'", urlS, base);
+    throw;
 }
 
 std::string percentDecode(std::string_view in)
 {
-    std::string decoded;
-    for (size_t i = 0; i < in.size(); ) {
-        if (in[i] == '%') {
-            if (i + 2 >= in.size())
-                throw BadURL("invalid URI parameter '%s'", in);
-            try {
-                decoded += std::stoul(std::string(in, i + 1, 2), 0, 16);
-                i += 3;
-            } catch (...) {
-                throw BadURL("invalid URI parameter '%s'", in);
-            }
-        } else
-            decoded += in[i++];
-    }
-    return decoded;
+    auto pctView = boost::urls::make_pct_string_view(in);
+    if (pctView.has_value())
+        return pctView->decode();
+    auto error = pctView.error();
+    throw BadURL("invalid URI parameter '%s': %s", in, error.message());
 }
 
-StringMap decodeQuery(const std::string & query)
-{
-    StringMap result;
-
-    for (const auto & s : tokenizeString<Strings>(query, "&")) {
-        auto e = s.find('=');
-        if (e == std::string::npos) {
-            warn("dubious URI query '%s' is missing equal sign '%s', ignoring", s, "=");
-            continue;
-        }
-
-        result.emplace(
-            s.substr(0, e),
-            percentDecode(std::string_view(s).substr(e + 1)));
-    }
-
-    return result;
-}
-
-const static std::string allowedInQuery = ":@/?";
-const static std::string allowedInPath = ":@/";
-
 std::string percentEncode(std::string_view s, std::string_view keep)
 {
-    std::string res;
-    for (auto & c : s)
-        // unreserved + keep
-        if ((c >= 'a' && c <= 'z')
-            || (c >= 'A' && c <= 'Z')
-            || (c >= '0' && c <= '9')
-            || strchr("-._~", c)
-            || keep.find(c) != std::string::npos)
-            res += c;
-        else
-            res += fmt("%%%02X", c & 0xFF);
-    return res;
+    return boost::urls::encode(
+        s, [keep](char c) { return boost::urls::unreserved_chars(c) || keep.find(c) != keep.npos; });
+}
+
+StringMap decodeQuery(std::string_view query, bool lenient)
+try {
+    /* When `lenient = true`, for back-compat unescaped characters are allowed. */
+    std::string fixedEncodedQuery;
+    if (lenient) {
+        fixedEncodedQuery = percentEncodeCharSet(query, extraAllowedCharsInQuery);
+    }
+
+    StringMap result;
+
+    auto encodedQuery = boost::urls::params_encoded_view(lenient ? fixedEncodedQuery : query);
+    for (auto && [key, value, value_specified] : encodedQuery) {
+        if (!value_specified) {
+            warn("dubious URI query '%s' is missing equal sign '%s', ignoring", std::string_view(key), "=");
+            continue;
+        }
+
+        result.emplace(key.decode(), value.decode());
+    }
+
+    return result;
+} catch (boost::system::system_error & e) {
+    throw BadURL("invalid URI query '%s': %s", query, e.code().message());
+}
+
+const static std::string allowedInQuery = ":@/?";
+const static std::string allowedInPath = ":@";
+
+std::string encodeUrlPath(std::span<const std::string> urlPath)
+{
+    std::vector<std::string> encodedPath;
+    for (auto & p : urlPath)
+        encodedPath.push_back(percentEncode(p, allowedInPath));
+    return concatStringsSep("/", encodedPath);
 }
 
 std::string encodeQuery(const StringMap & ss)
@@ -113,7 +310,8 @@ std::string encodeQuery(const StringMap & ss)
     std::string res;
     bool first = true;
     for (auto & [name, value] : ss) {
-        if (!first) res += '&';
+        if (!first)
+            res += '&';
         first = false;
         res += percentEncode(name, allowedInQuery);
         res += '=';
@@ -122,37 +320,74 @@ std::string encodeQuery(const StringMap & ss)
     return res;
 }
 
-std::string ParsedURL::to_string() const
+Path renderUrlPathEnsureLegal(const std::vector<std::string> & urlPath)
 {
-    return
-        scheme
-        + ":"
-        + (authority ? "//" + *authority : "")
-        + percentEncode(path, allowedInPath)
-        + (query.empty() ? "" : "?" + encodeQuery(query))
-        + (fragment.empty() ? "" : "#" + percentEncode(fragment));
+    for (const auto & comp : urlPath) {
+        /* This is only really valid for UNIX. Windows has more restrictions. */
+        if (comp.contains('/'))
+            throw BadURL("URL path component '%s' contains '/', which is not allowed in file names", comp);
+        if (comp.contains(char(0)))
+            throw BadURL("URL path component '%s' contains NUL byte which is not allowed", comp);
+    }
+
+    return concatStringsSep("/", urlPath);
 }
 
-std::ostream & operator << (std::ostream & os, const ParsedURL & url)
+std::string ParsedURL::renderPath(bool encode) const
+{
+    if (encode)
+        return encodeUrlPath(path);
+    return concatStringsSep("/", path);
+}
+
+std::string ParsedURL::renderAuthorityAndPath() const
+{
+    std::string res;
+    /* The following assertions correspond to 3.3. Path [rfc3986]. URL parser
+       will never violate these properties, but hand-constructed ParsedURLs might. */
+    if (authority.has_value()) {
+        /* If a URI contains an authority component, then the path component
+           must either be empty or begin with a slash ("/") character. */
+        assert(path.empty() || path.front().empty());
+        res += authority->to_string();
+    } else if (std::ranges::equal(std::views::take(path, 2), std::views::repeat("", 2))) {
+        /* If a URI does not contain an authority component, then the path cannot begin
+           with two slash characters ("//") */
+        unreachable();
+    }
+    res += encodeUrlPath(path);
+    return res;
+}
+
+std::string ParsedURL::to_string() const
+{
+    std::string res;
+    res += scheme;
+    res += ":";
+    if (authority.has_value())
+        res += "//";
+    res += renderAuthorityAndPath();
+    if (!query.empty()) {
+        res += "?";
+        res += encodeQuery(query);
+    }
+    if (!fragment.empty()) {
+        res += "#";
+        res += percentEncode(fragment);
+    }
+    return res;
+}
+
+std::ostream & operator<<(std::ostream & os, const ParsedURL & url)
 {
     os << url.to_string();
     return os;
 }
 
-bool ParsedURL::operator ==(const ParsedURL & other) const noexcept
-{
-    return
-        scheme == other.scheme
-        && authority == other.authority
-        && path == other.path
-        && query == other.query
-        && fragment == other.fragment;
-}
-
 ParsedURL ParsedURL::canonicalise()
 {
     ParsedURL res(*this);
-    res.path = CanonPath(res.path).abs();
+    res.path = splitString<std::vector<std::string>>(CanonPath(renderPath()).abs(), "/");
     return res;
 }
 
@@ -167,35 +402,42 @@ ParsedUrlScheme parseUrlScheme(std::string_view scheme)
 {
     auto application = splitPrefixTo(scheme, '+');
     auto transport = scheme;
-    return ParsedUrlScheme {
+    return ParsedUrlScheme{
         .application = application,
         .transport = transport,
     };
 }
 
-std::string fixGitURL(const std::string & url)
+ParsedURL fixGitURL(const std::string & url)
 {
     std::regex scpRegex("([^/]*)@(.*):(.*)");
     if (!hasPrefix(url, "/") && std::regex_match(url, scpRegex))
-        return std::regex_replace(url, scpRegex, "ssh://$1@$2/$3");
+        return parseURL(std::regex_replace(url, scpRegex, "ssh://$1@$2/$3"));
     if (hasPrefix(url, "file:"))
-        return url;
+        return parseURL(url);
     if (url.find("://") == std::string::npos) {
-        return (ParsedURL {
+        return ParsedURL{
             .scheme = "file",
-            .authority = "",
-            .path = url
-        }).to_string();
+            .authority = ParsedURL::Authority{},
+            .path = splitString<std::vector<std::string>>(url, "/"),
+        };
     }
-    return url;
+    return parseURL(url);
 }
 
 // https://www.rfc-editor.org/rfc/rfc3986#section-3.1
 bool isValidSchemeName(std::string_view s)
 {
+    const static std::string schemeNameRegex = "(?:[a-z][a-z0-9+.-]*)";
     static std::regex regex(schemeNameRegex, std::regex::ECMAScript);
 
     return std::regex_match(s.begin(), s.end(), regex, std::regex_constants::match_default);
 }
 
+std::ostream & operator<<(std::ostream & os, const ValidURL & url)
+{
+    os << url.to_string();
+    return os;
 }
+
+} // namespace nix
diff --git a/src/libutil/users.cc b/src/libutil/users.cc
index 5a5d740c6..f19a5d39c 100644
--- a/src/libutil/users.cc
+++ b/src/libutil/users.cc
@@ -20,7 +20,6 @@ Path getCacheDir()
     }
 }
 
-
 Path getConfigDir()
 {
     auto dir = getEnv("NIX_CONFIG_HOME");
@@ -41,14 +40,13 @@ std::vector<Path> getConfigDirs()
     Path configHome = getConfigDir();
     auto configDirs = getEnv("XDG_CONFIG_DIRS").value_or("/etc/xdg");
     std::vector<Path> result = tokenizeString<std::vector<std::string>>(configDirs, ":");
-    for (auto& p : result) {
+    for (auto & p : result) {
         p += "/nix";
     }
     result.insert(result.begin(), configHome);
     return result;
 }
 
-
 Path getDataDir()
 {
     auto dir = getEnv("NIX_DATA_HOME");
@@ -86,7 +84,6 @@ Path createNixStateDir()
     return dir;
 }
 
-
 std::string expandTilde(std::string_view path)
 {
     // TODO: expand ~user ?
@@ -97,4 +94,4 @@ std::string expandTilde(std::string_view path)
         return std::string(path);
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index c9cc80fef..383a904ad 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -13,12 +13,13 @@
 #include <stdint.h>
 
 #ifdef NDEBUG
-#error "Nix may not be built with assertions disabled (i.e. with -DNDEBUG)."
+#  error "Nix may not be built with assertions disabled (i.e. with -DNDEBUG)."
 #endif
 
 namespace nix {
 
-void initLibUtil() {
+void initLibUtil()
+{
     // Check that exception handling works. Exception handling has been observed
     // not to work on darwin when the linker flags aren't quite right.
     // In this case we don't want to expose the user to some unrelated uncaught
@@ -27,7 +28,8 @@ void initLibUtil() {
     // When exception handling fails, the message tends to be printed by the
     // C++ runtime, followed by an abort.
     // For example on macOS we might see an error such as
-    // libc++abi: terminating with uncaught exception of type nix::SystemError: error: C++ exception handling is broken. This would appear to be a problem with the way Nix was compiled and/or linked and/or loaded.
+    // libc++abi: terminating with uncaught exception of type nix::SystemError: error: C++ exception handling is broken.
+    // This would appear to be a problem with the way Nix was compiled and/or linked and/or loaded.
     bool caught = false;
     try {
         throwExceptionSelfCheck();
@@ -46,37 +48,33 @@ void initLibUtil() {
 std::vector<char *> stringsToCharPtrs(const Strings & ss)
 {
     std::vector<char *> res;
-    for (auto & s : ss) res.push_back((char *) s.c_str());
+    for (auto & s : ss)
+        res.push_back((char *) s.c_str());
     res.push_back(0);
     return res;
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-
 std::string chomp(std::string_view s)
 {
     size_t i = s.find_last_not_of(" \n\r\t");
     return i == s.npos ? "" : std::string(s, 0, i + 1);
 }
 
-
 std::string trim(std::string_view s, std::string_view whitespace)
 {
     auto i = s.find_first_not_of(whitespace);
-    if (i == s.npos) return "";
+    if (i == s.npos)
+        return "";
     auto j = s.find_last_not_of(whitespace);
     return std::string(s, i, j == s.npos ? j : j - i + 1);
 }
 
-
-std::string replaceStrings(
-    std::string res,
-    std::string_view from,
-    std::string_view to)
+std::string replaceStrings(std::string res, std::string_view from, std::string_view to)
 {
-    if (from.empty()) return res;
+    if (from.empty())
+        return res;
     size_t pos = 0;
     while ((pos = res.find(from, pos)) != res.npos) {
         res.replace(pos, from.size(), to);
@@ -85,11 +83,11 @@ std::string replaceStrings(
     return res;
 }
 
-
 std::string rewriteStrings(std::string s, const StringMap & rewrites)
 {
     for (auto & i : rewrites) {
-        if (i.first == i.second) continue;
+        if (i.first == i.second)
+            continue;
         size_t j = 0;
         while ((j = s.find(i.first, j)) != s.npos)
             s.replace(j, i.first.size(), i.second);
@@ -110,7 +108,7 @@ std::optional<N> string2Int(const std::string_view s)
 }
 
 // Explicitly instantiated in one place for faster compilation
-template std::optional<unsigned char>  string2Int<unsigned char>(const std::string_view s);
+template std::optional<unsigned char> string2Int<unsigned char>(const std::string_view s);
 template std::optional<unsigned short> string2Int<unsigned short>(const std::string_view s);
 template std::optional<unsigned int> string2Int<unsigned int>(const std::string_view s);
 template std::optional<unsigned long> string2Int<unsigned long>(const std::string_view s);
@@ -134,12 +132,9 @@ std::optional<N> string2Float(const std::string_view s)
 template std::optional<double> string2Float<double>(const std::string_view s);
 template std::optional<float> string2Float<float>(const std::string_view s);
 
-
 std::string renderSize(uint64_t value, bool align)
 {
-    static const std::array<char, 9> prefixes{{
-        'K', 'K', 'M', 'G', 'T', 'P', 'E', 'Z', 'Y'
-    }};
+    static const std::array<char, 9> prefixes{{'K', 'K', 'M', 'G', 'T', 'P', 'E', 'Z', 'Y'}};
     size_t power = 0;
     double res = value;
     while (res > 1024 && power < prefixes.size()) {
@@ -149,20 +144,16 @@ std::string renderSize(uint64_t value, bool align)
     return fmt(align ? "%6.1f %ciB" : "%.1f %ciB", power == 0 ? res / 1024 : res, prefixes.at(power));
 }
 
-
 bool hasPrefix(std::string_view s, std::string_view prefix)
 {
     return s.compare(0, prefix.size(), prefix) == 0;
 }
 
-
 bool hasSuffix(std::string_view s, std::string_view suffix)
 {
-    return s.size() >= suffix.size()
-        && s.substr(s.size() - suffix.size()) == suffix;
+    return s.size() >= suffix.size() && s.substr(s.size() - suffix.size()) == suffix;
 }
 
-
 std::string toLower(std::string s)
 {
     for (auto & c : s)
@@ -170,19 +161,20 @@ std::string toLower(std::string s)
     return s;
 }
 
-
 std::string escapeShellArgAlways(const std::string_view s)
 {
     std::string r;
     r.reserve(s.size() + 2);
     r += '\'';
     for (auto & i : s)
-        if (i == '\'') r += "'\\''"; else r += i;
+        if (i == '\'')
+            r += "'\\''";
+        else
+            r += i;
     r += '\'';
     return r;
 }
 
-
 void ignoreExceptionInDestructor(Verbosity lvl)
 {
     /* Make sure no exceptions leave this function.
@@ -190,10 +182,13 @@ void ignoreExceptionInDestructor(Verbosity lvl)
     try {
         try {
             throw;
+        } catch (Error & e) {
+            printMsg(lvl, ANSI_RED "error (ignored):" ANSI_NORMAL " %s", e.info().msg);
         } catch (std::exception & e) {
-            printMsg(lvl, "error (ignored): %1%", e.what());
+            printMsg(lvl, ANSI_RED "error (ignored):" ANSI_NORMAL " %s", e.what());
         }
-    } catch (...) { }
+    } catch (...) {
+    }
 }
 
 void ignoreExceptionExceptInterrupt(Verbosity lvl)
@@ -202,74 +197,13 @@ void ignoreExceptionExceptInterrupt(Verbosity lvl)
         throw;
     } catch (const Interrupted & e) {
         throw;
+    } catch (Error & e) {
+        printMsg(lvl, ANSI_RED "error (ignored):" ANSI_NORMAL " %s", e.info().msg);
     } catch (std::exception & e) {
-        printMsg(lvl, "error (ignored): %1%", e.what());
+        printMsg(lvl, ANSI_RED "error (ignored):" ANSI_NORMAL " %s", e.what());
     }
 }
 
-
-constexpr char base64Chars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-
-std::string base64Encode(std::string_view s)
-{
-    std::string res;
-    res.reserve((s.size() + 2) / 3 * 4);
-    int data = 0, nbits = 0;
-
-    for (char c : s) {
-        data = data << 8 | (unsigned char) c;
-        nbits += 8;
-        while (nbits >= 6) {
-            nbits -= 6;
-            res.push_back(base64Chars[data >> nbits & 0x3f]);
-        }
-    }
-
-    if (nbits) res.push_back(base64Chars[data << (6 - nbits) & 0x3f]);
-    while (res.size() % 4) res.push_back('=');
-
-    return res;
-}
-
-
-std::string base64Decode(std::string_view s)
-{
-    constexpr char npos = -1;
-    constexpr std::array<char, 256> base64DecodeChars = [&] {
-        std::array<char, 256>  result{};
-        for (auto& c : result)
-            c = npos;
-        for (int i = 0; i < 64; i++)
-            result[base64Chars[i]] = i;
-        return result;
-    }();
-
-    std::string res;
-    // Some sequences are missing the padding consisting of up to two '='.
-    //                    vvv
-    res.reserve((s.size() + 2) / 4 * 3);
-    unsigned int d = 0, bits = 0;
-
-    for (char c : s) {
-        if (c == '=') break;
-        if (c == '\n') continue;
-
-        char digit = base64DecodeChars[(unsigned char) c];
-        if (digit == npos)
-            throw FormatError("invalid character in Base64 string: '%c'", c);
-
-        bits += 6;
-        d = d << 6 | digit;
-        if (bits >= 8) {
-            res.push_back(d >> (bits - 8) & 0xff);
-            bits -= 8;
-        }
-    }
-
-    return res;
-}
-
-
 std::string stripIndentation(std::string_view s)
 {
     size_t minIndent = 10000;
@@ -297,7 +231,8 @@ std::string stripIndentation(std::string_view s)
     size_t pos = 0;
     while (pos < s.size()) {
         auto eol = s.find('\n', pos);
-        if (eol == s.npos) eol = s.size();
+        if (eol == s.npos)
+            eol = s.size();
         if (eol - pos > minIndent)
             res.append(s.substr(pos + minIndent, eol - pos - minIndent));
         res.push_back('\n');
@@ -307,7 +242,6 @@ std::string stripIndentation(std::string_view s)
     return res;
 }
 
-
 std::pair<std::string_view, std::string_view> getLine(std::string_view s)
 {
     auto newline = s.find('\n');
@@ -322,10 +256,9 @@ std::pair<std::string_view, std::string_view> getLine(std::string_view s)
     }
 }
 
-
 std::string showBytes(uint64_t bytes)
 {
     return fmt("%.2f MiB", bytes / (1024.0 * 1024.0));
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/widecharwidth/widechar_width.h b/src/libutil/widecharwidth/widechar_width.h
index 92e63e913..d2416c04e 100644
--- a/src/libutil/widecharwidth/widechar_width.h
+++ b/src/libutil/widecharwidth/widechar_width.h
@@ -30,1406 +30,318 @@ namespace {
 
 /* Special width values */
 enum {
-  widechar_nonprint = -1,     // The character is not printable.
-  widechar_combining = -2,    // The character is a zero-width combiner.
-  widechar_ambiguous = -3,    // The character is East-Asian ambiguous width.
-  widechar_private_use = -4,  // The character is for private use.
-  widechar_unassigned = -5,   // The character is unassigned.
-  widechar_widened_in_9 = -6, // Width is 1 in Unicode 8, 2 in Unicode 9+.
-  widechar_non_character = -7 // The character is a noncharacter.
+    widechar_nonprint = -1,     // The character is not printable.
+    widechar_combining = -2,    // The character is a zero-width combiner.
+    widechar_ambiguous = -3,    // The character is East-Asian ambiguous width.
+    widechar_private_use = -4,  // The character is for private use.
+    widechar_unassigned = -5,   // The character is unassigned.
+    widechar_widened_in_9 = -6, // Width is 1 in Unicode 8, 2 in Unicode 9+.
+    widechar_non_character = -7 // The character is a noncharacter.
 };
 
 /* An inclusive range of characters. */
-struct widechar_range {
-  uint32_t lo;
-  uint32_t hi;
+struct widechar_range
+{
+    uint32_t lo;
+    uint32_t hi;
 };
 
 /* Simple ASCII characters - used a lot, so we check them first. */
-static const struct widechar_range widechar_ascii_table[] = {
-    {0x00020, 0x0007E}
-};
+static const struct widechar_range widechar_ascii_table[] = {{0x00020, 0x0007E}};
 
 /* Private usage range. */
 static const struct widechar_range widechar_private_table[] = {
-    {0x0E000, 0x0F8FF},
-    {0xF0000, 0xFFFFD},
-    {0x100000, 0x10FFFD}
-};
+    {0x0E000, 0x0F8FF}, {0xF0000, 0xFFFFD}, {0x100000, 0x10FFFD}};
 
 /* Nonprinting characters. */
 static const struct widechar_range widechar_nonprint_table[] = {
-    {0x00000, 0x0001F},
-    {0x0007F, 0x0009F},
-    {0x000AD, 0x000AD},
-    {0x00600, 0x00605},
-    {0x0061C, 0x0061C},
-    {0x006DD, 0x006DD},
-    {0x0070F, 0x0070F},
-    {0x00890, 0x00891},
-    {0x008E2, 0x008E2},
-    {0x0180E, 0x0180E},
-    {0x0200B, 0x0200F},
-    {0x02028, 0x0202E},
-    {0x02060, 0x02064},
-    {0x02066, 0x0206F},
-    {0x0D800, 0x0DFFF},
-    {0x0FEFF, 0x0FEFF},
-    {0x0FFF9, 0x0FFFB},
-    {0x110BD, 0x110BD},
-    {0x110CD, 0x110CD},
-    {0x13430, 0x1343F},
-    {0x1BCA0, 0x1BCA3},
-    {0x1D173, 0x1D17A},
-    {0xE0001, 0xE0001},
-    {0xE0020, 0xE007F}
-};
+    {0x00000, 0x0001F}, {0x0007F, 0x0009F}, {0x000AD, 0x000AD}, {0x00600, 0x00605}, {0x0061C, 0x0061C},
+    {0x006DD, 0x006DD}, {0x0070F, 0x0070F}, {0x00890, 0x00891}, {0x008E2, 0x008E2}, {0x0180E, 0x0180E},
+    {0x0200B, 0x0200F}, {0x02028, 0x0202E}, {0x02060, 0x02064}, {0x02066, 0x0206F}, {0x0D800, 0x0DFFF},
+    {0x0FEFF, 0x0FEFF}, {0x0FFF9, 0x0FFFB}, {0x110BD, 0x110BD}, {0x110CD, 0x110CD}, {0x13430, 0x1343F},
+    {0x1BCA0, 0x1BCA3}, {0x1D173, 0x1D17A}, {0xE0001, 0xE0001}, {0xE0020, 0xE007F}};
 
 /* Width 0 combining marks. */
 static const struct widechar_range widechar_combining_table[] = {
-    {0x00300, 0x0036F},
-    {0x00483, 0x00489},
-    {0x00591, 0x005BD},
-    {0x005BF, 0x005BF},
-    {0x005C1, 0x005C2},
-    {0x005C4, 0x005C5},
-    {0x005C7, 0x005C7},
-    {0x00610, 0x0061A},
-    {0x0064B, 0x0065F},
-    {0x00670, 0x00670},
-    {0x006D6, 0x006DC},
-    {0x006DF, 0x006E4},
-    {0x006E7, 0x006E8},
-    {0x006EA, 0x006ED},
-    {0x00711, 0x00711},
-    {0x00730, 0x0074A},
-    {0x007A6, 0x007B0},
-    {0x007EB, 0x007F3},
-    {0x007FD, 0x007FD},
-    {0x00816, 0x00819},
-    {0x0081B, 0x00823},
-    {0x00825, 0x00827},
-    {0x00829, 0x0082D},
-    {0x00859, 0x0085B},
-    {0x00897, 0x0089F},
-    {0x008CA, 0x008E1},
-    {0x008E3, 0x00903},
-    {0x0093A, 0x0093C},
-    {0x0093E, 0x0094F},
-    {0x00951, 0x00957},
-    {0x00962, 0x00963},
-    {0x00981, 0x00983},
-    {0x009BC, 0x009BC},
-    {0x009BE, 0x009C4},
-    {0x009C7, 0x009C8},
-    {0x009CB, 0x009CD},
-    {0x009D7, 0x009D7},
-    {0x009E2, 0x009E3},
-    {0x009FE, 0x009FE},
-    {0x00A01, 0x00A03},
-    {0x00A3C, 0x00A3C},
-    {0x00A3E, 0x00A42},
-    {0x00A47, 0x00A48},
-    {0x00A4B, 0x00A4D},
-    {0x00A51, 0x00A51},
-    {0x00A70, 0x00A71},
-    {0x00A75, 0x00A75},
-    {0x00A81, 0x00A83},
-    {0x00ABC, 0x00ABC},
-    {0x00ABE, 0x00AC5},
-    {0x00AC7, 0x00AC9},
-    {0x00ACB, 0x00ACD},
-    {0x00AE2, 0x00AE3},
-    {0x00AFA, 0x00AFF},
-    {0x00B01, 0x00B03},
-    {0x00B3C, 0x00B3C},
-    {0x00B3E, 0x00B44},
-    {0x00B47, 0x00B48},
-    {0x00B4B, 0x00B4D},
-    {0x00B55, 0x00B57},
-    {0x00B62, 0x00B63},
-    {0x00B82, 0x00B82},
-    {0x00BBE, 0x00BC2},
-    {0x00BC6, 0x00BC8},
-    {0x00BCA, 0x00BCD},
-    {0x00BD7, 0x00BD7},
-    {0x00C00, 0x00C04},
-    {0x00C3C, 0x00C3C},
-    {0x00C3E, 0x00C44},
-    {0x00C46, 0x00C48},
-    {0x00C4A, 0x00C4D},
-    {0x00C55, 0x00C56},
-    {0x00C62, 0x00C63},
-    {0x00C81, 0x00C83},
-    {0x00CBC, 0x00CBC},
-    {0x00CBE, 0x00CC4},
-    {0x00CC6, 0x00CC8},
-    {0x00CCA, 0x00CCD},
-    {0x00CD5, 0x00CD6},
-    {0x00CE2, 0x00CE3},
-    {0x00CF3, 0x00CF3},
-    {0x00D00, 0x00D03},
-    {0x00D3B, 0x00D3C},
-    {0x00D3E, 0x00D44},
-    {0x00D46, 0x00D48},
-    {0x00D4A, 0x00D4D},
-    {0x00D57, 0x00D57},
-    {0x00D62, 0x00D63},
-    {0x00D81, 0x00D83},
-    {0x00DCA, 0x00DCA},
-    {0x00DCF, 0x00DD4},
-    {0x00DD6, 0x00DD6},
-    {0x00DD8, 0x00DDF},
-    {0x00DF2, 0x00DF3},
-    {0x00E31, 0x00E31},
-    {0x00E34, 0x00E3A},
-    {0x00E47, 0x00E4E},
-    {0x00EB1, 0x00EB1},
-    {0x00EB4, 0x00EBC},
-    {0x00EC8, 0x00ECE},
-    {0x00F18, 0x00F19},
-    {0x00F35, 0x00F35},
-    {0x00F37, 0x00F37},
-    {0x00F39, 0x00F39},
-    {0x00F3E, 0x00F3F},
-    {0x00F71, 0x00F84},
-    {0x00F86, 0x00F87},
-    {0x00F8D, 0x00F97},
-    {0x00F99, 0x00FBC},
-    {0x00FC6, 0x00FC6},
-    {0x0102B, 0x0103E},
-    {0x01056, 0x01059},
-    {0x0105E, 0x01060},
-    {0x01062, 0x01064},
-    {0x01067, 0x0106D},
-    {0x01071, 0x01074},
-    {0x01082, 0x0108D},
-    {0x0108F, 0x0108F},
-    {0x0109A, 0x0109D},
-    {0x0135D, 0x0135F},
-    {0x01712, 0x01715},
-    {0x01732, 0x01734},
-    {0x01752, 0x01753},
-    {0x01772, 0x01773},
-    {0x017B4, 0x017D3},
-    {0x017DD, 0x017DD},
-    {0x0180B, 0x0180D},
-    {0x0180F, 0x0180F},
-    {0x01885, 0x01886},
-    {0x018A9, 0x018A9},
-    {0x01920, 0x0192B},
-    {0x01930, 0x0193B},
-    {0x01A17, 0x01A1B},
-    {0x01A55, 0x01A5E},
-    {0x01A60, 0x01A7C},
-    {0x01A7F, 0x01A7F},
-    {0x01AB0, 0x01ACE},
-    {0x01B00, 0x01B04},
-    {0x01B34, 0x01B44},
-    {0x01B6B, 0x01B73},
-    {0x01B80, 0x01B82},
-    {0x01BA1, 0x01BAD},
-    {0x01BE6, 0x01BF3},
-    {0x01C24, 0x01C37},
-    {0x01CD0, 0x01CD2},
-    {0x01CD4, 0x01CE8},
-    {0x01CED, 0x01CED},
-    {0x01CF4, 0x01CF4},
-    {0x01CF7, 0x01CF9},
-    {0x01DC0, 0x01DFF},
-    {0x020D0, 0x020F0},
-    {0x02CEF, 0x02CF1},
-    {0x02D7F, 0x02D7F},
-    {0x02DE0, 0x02DFF},
-    {0x0302A, 0x0302F},
-    {0x03099, 0x0309A},
-    {0x0A66F, 0x0A672},
-    {0x0A674, 0x0A67D},
-    {0x0A69E, 0x0A69F},
-    {0x0A6F0, 0x0A6F1},
-    {0x0A802, 0x0A802},
-    {0x0A806, 0x0A806},
-    {0x0A80B, 0x0A80B},
-    {0x0A823, 0x0A827},
-    {0x0A82C, 0x0A82C},
-    {0x0A880, 0x0A881},
-    {0x0A8B4, 0x0A8C5},
-    {0x0A8E0, 0x0A8F1},
-    {0x0A8FF, 0x0A8FF},
-    {0x0A926, 0x0A92D},
-    {0x0A947, 0x0A953},
-    {0x0A980, 0x0A983},
-    {0x0A9B3, 0x0A9C0},
-    {0x0A9E5, 0x0A9E5},
-    {0x0AA29, 0x0AA36},
-    {0x0AA43, 0x0AA43},
-    {0x0AA4C, 0x0AA4D},
-    {0x0AA7B, 0x0AA7D},
-    {0x0AAB0, 0x0AAB0},
-    {0x0AAB2, 0x0AAB4},
-    {0x0AAB7, 0x0AAB8},
-    {0x0AABE, 0x0AABF},
-    {0x0AAC1, 0x0AAC1},
-    {0x0AAEB, 0x0AAEF},
-    {0x0AAF5, 0x0AAF6},
-    {0x0ABE3, 0x0ABEA},
-    {0x0ABEC, 0x0ABED},
-    {0x0FB1E, 0x0FB1E},
-    {0x0FE00, 0x0FE0F},
-    {0x0FE20, 0x0FE2F},
-    {0x101FD, 0x101FD},
-    {0x102E0, 0x102E0},
-    {0x10376, 0x1037A},
-    {0x10A01, 0x10A03},
-    {0x10A05, 0x10A06},
-    {0x10A0C, 0x10A0F},
-    {0x10A38, 0x10A3A},
-    {0x10A3F, 0x10A3F},
-    {0x10AE5, 0x10AE6},
-    {0x10D24, 0x10D27},
-    {0x10D69, 0x10D6D},
-    {0x10EAB, 0x10EAC},
-    {0x10EFC, 0x10EFF},
-    {0x10F46, 0x10F50},
-    {0x10F82, 0x10F85},
-    {0x11000, 0x11002},
-    {0x11038, 0x11046},
-    {0x11070, 0x11070},
-    {0x11073, 0x11074},
-    {0x1107F, 0x11082},
-    {0x110B0, 0x110BA},
-    {0x110C2, 0x110C2},
-    {0x11100, 0x11102},
-    {0x11127, 0x11134},
-    {0x11145, 0x11146},
-    {0x11173, 0x11173},
-    {0x11180, 0x11182},
-    {0x111B3, 0x111C0},
-    {0x111C9, 0x111CC},
-    {0x111CE, 0x111CF},
-    {0x1122C, 0x11237},
-    {0x1123E, 0x1123E},
-    {0x11241, 0x11241},
-    {0x112DF, 0x112EA},
-    {0x11300, 0x11303},
-    {0x1133B, 0x1133C},
-    {0x1133E, 0x11344},
-    {0x11347, 0x11348},
-    {0x1134B, 0x1134D},
-    {0x11357, 0x11357},
-    {0x11362, 0x11363},
-    {0x11366, 0x1136C},
-    {0x11370, 0x11374},
-    {0x113B8, 0x113C0},
-    {0x113C2, 0x113C2},
-    {0x113C5, 0x113C5},
-    {0x113C7, 0x113CA},
-    {0x113CC, 0x113D0},
-    {0x113D2, 0x113D2},
-    {0x113E1, 0x113E2},
-    {0x11435, 0x11446},
-    {0x1145E, 0x1145E},
-    {0x114B0, 0x114C3},
-    {0x115AF, 0x115B5},
-    {0x115B8, 0x115C0},
-    {0x115DC, 0x115DD},
-    {0x11630, 0x11640},
-    {0x116AB, 0x116B7},
-    {0x1171D, 0x1172B},
-    {0x1182C, 0x1183A},
-    {0x11930, 0x11935},
-    {0x11937, 0x11938},
-    {0x1193B, 0x1193E},
-    {0x11940, 0x11940},
-    {0x11942, 0x11943},
-    {0x119D1, 0x119D7},
-    {0x119DA, 0x119E0},
-    {0x119E4, 0x119E4},
-    {0x11A01, 0x11A0A},
-    {0x11A33, 0x11A39},
-    {0x11A3B, 0x11A3E},
-    {0x11A47, 0x11A47},
-    {0x11A51, 0x11A5B},
-    {0x11A8A, 0x11A99},
-    {0x11C2F, 0x11C36},
-    {0x11C38, 0x11C3F},
-    {0x11C92, 0x11CA7},
-    {0x11CA9, 0x11CB6},
-    {0x11D31, 0x11D36},
-    {0x11D3A, 0x11D3A},
-    {0x11D3C, 0x11D3D},
-    {0x11D3F, 0x11D45},
-    {0x11D47, 0x11D47},
-    {0x11D8A, 0x11D8E},
-    {0x11D90, 0x11D91},
-    {0x11D93, 0x11D97},
-    {0x11EF3, 0x11EF6},
-    {0x11F00, 0x11F01},
-    {0x11F03, 0x11F03},
-    {0x11F34, 0x11F3A},
-    {0x11F3E, 0x11F42},
-    {0x11F5A, 0x11F5A},
-    {0x13440, 0x13440},
-    {0x13447, 0x13455},
-    {0x1611E, 0x1612F},
-    {0x16AF0, 0x16AF4},
-    {0x16B30, 0x16B36},
-    {0x16F4F, 0x16F4F},
-    {0x16F51, 0x16F87},
-    {0x16F8F, 0x16F92},
-    {0x16FE4, 0x16FE4},
-    {0x16FF0, 0x16FF1},
-    {0x1BC9D, 0x1BC9E},
-    {0x1CF00, 0x1CF2D},
-    {0x1CF30, 0x1CF46},
-    {0x1D165, 0x1D169},
-    {0x1D16D, 0x1D172},
-    {0x1D17B, 0x1D182},
-    {0x1D185, 0x1D18B},
-    {0x1D1AA, 0x1D1AD},
-    {0x1D242, 0x1D244},
-    {0x1DA00, 0x1DA36},
-    {0x1DA3B, 0x1DA6C},
-    {0x1DA75, 0x1DA75},
-    {0x1DA84, 0x1DA84},
-    {0x1DA9B, 0x1DA9F},
-    {0x1DAA1, 0x1DAAF},
-    {0x1E000, 0x1E006},
-    {0x1E008, 0x1E018},
-    {0x1E01B, 0x1E021},
-    {0x1E023, 0x1E024},
-    {0x1E026, 0x1E02A},
-    {0x1E08F, 0x1E08F},
-    {0x1E130, 0x1E136},
-    {0x1E2AE, 0x1E2AE},
-    {0x1E2EC, 0x1E2EF},
-    {0x1E4EC, 0x1E4EF},
-    {0x1E5EE, 0x1E5EF},
-    {0x1E8D0, 0x1E8D6},
-    {0x1E944, 0x1E94A},
-    {0xE0100, 0xE01EF}
-};
+    {0x00300, 0x0036F}, {0x00483, 0x00489}, {0x00591, 0x005BD}, {0x005BF, 0x005BF}, {0x005C1, 0x005C2},
+    {0x005C4, 0x005C5}, {0x005C7, 0x005C7}, {0x00610, 0x0061A}, {0x0064B, 0x0065F}, {0x00670, 0x00670},
+    {0x006D6, 0x006DC}, {0x006DF, 0x006E4}, {0x006E7, 0x006E8}, {0x006EA, 0x006ED}, {0x00711, 0x00711},
+    {0x00730, 0x0074A}, {0x007A6, 0x007B0}, {0x007EB, 0x007F3}, {0x007FD, 0x007FD}, {0x00816, 0x00819},
+    {0x0081B, 0x00823}, {0x00825, 0x00827}, {0x00829, 0x0082D}, {0x00859, 0x0085B}, {0x00897, 0x0089F},
+    {0x008CA, 0x008E1}, {0x008E3, 0x00903}, {0x0093A, 0x0093C}, {0x0093E, 0x0094F}, {0x00951, 0x00957},
+    {0x00962, 0x00963}, {0x00981, 0x00983}, {0x009BC, 0x009BC}, {0x009BE, 0x009C4}, {0x009C7, 0x009C8},
+    {0x009CB, 0x009CD}, {0x009D7, 0x009D7}, {0x009E2, 0x009E3}, {0x009FE, 0x009FE}, {0x00A01, 0x00A03},
+    {0x00A3C, 0x00A3C}, {0x00A3E, 0x00A42}, {0x00A47, 0x00A48}, {0x00A4B, 0x00A4D}, {0x00A51, 0x00A51},
+    {0x00A70, 0x00A71}, {0x00A75, 0x00A75}, {0x00A81, 0x00A83}, {0x00ABC, 0x00ABC}, {0x00ABE, 0x00AC5},
+    {0x00AC7, 0x00AC9}, {0x00ACB, 0x00ACD}, {0x00AE2, 0x00AE3}, {0x00AFA, 0x00AFF}, {0x00B01, 0x00B03},
+    {0x00B3C, 0x00B3C}, {0x00B3E, 0x00B44}, {0x00B47, 0x00B48}, {0x00B4B, 0x00B4D}, {0x00B55, 0x00B57},
+    {0x00B62, 0x00B63}, {0x00B82, 0x00B82}, {0x00BBE, 0x00BC2}, {0x00BC6, 0x00BC8}, {0x00BCA, 0x00BCD},
+    {0x00BD7, 0x00BD7}, {0x00C00, 0x00C04}, {0x00C3C, 0x00C3C}, {0x00C3E, 0x00C44}, {0x00C46, 0x00C48},
+    {0x00C4A, 0x00C4D}, {0x00C55, 0x00C56}, {0x00C62, 0x00C63}, {0x00C81, 0x00C83}, {0x00CBC, 0x00CBC},
+    {0x00CBE, 0x00CC4}, {0x00CC6, 0x00CC8}, {0x00CCA, 0x00CCD}, {0x00CD5, 0x00CD6}, {0x00CE2, 0x00CE3},
+    {0x00CF3, 0x00CF3}, {0x00D00, 0x00D03}, {0x00D3B, 0x00D3C}, {0x00D3E, 0x00D44}, {0x00D46, 0x00D48},
+    {0x00D4A, 0x00D4D}, {0x00D57, 0x00D57}, {0x00D62, 0x00D63}, {0x00D81, 0x00D83}, {0x00DCA, 0x00DCA},
+    {0x00DCF, 0x00DD4}, {0x00DD6, 0x00DD6}, {0x00DD8, 0x00DDF}, {0x00DF2, 0x00DF3}, {0x00E31, 0x00E31},
+    {0x00E34, 0x00E3A}, {0x00E47, 0x00E4E}, {0x00EB1, 0x00EB1}, {0x00EB4, 0x00EBC}, {0x00EC8, 0x00ECE},
+    {0x00F18, 0x00F19}, {0x00F35, 0x00F35}, {0x00F37, 0x00F37}, {0x00F39, 0x00F39}, {0x00F3E, 0x00F3F},
+    {0x00F71, 0x00F84}, {0x00F86, 0x00F87}, {0x00F8D, 0x00F97}, {0x00F99, 0x00FBC}, {0x00FC6, 0x00FC6},
+    {0x0102B, 0x0103E}, {0x01056, 0x01059}, {0x0105E, 0x01060}, {0x01062, 0x01064}, {0x01067, 0x0106D},
+    {0x01071, 0x01074}, {0x01082, 0x0108D}, {0x0108F, 0x0108F}, {0x0109A, 0x0109D}, {0x0135D, 0x0135F},
+    {0x01712, 0x01715}, {0x01732, 0x01734}, {0x01752, 0x01753}, {0x01772, 0x01773}, {0x017B4, 0x017D3},
+    {0x017DD, 0x017DD}, {0x0180B, 0x0180D}, {0x0180F, 0x0180F}, {0x01885, 0x01886}, {0x018A9, 0x018A9},
+    {0x01920, 0x0192B}, {0x01930, 0x0193B}, {0x01A17, 0x01A1B}, {0x01A55, 0x01A5E}, {0x01A60, 0x01A7C},
+    {0x01A7F, 0x01A7F}, {0x01AB0, 0x01ACE}, {0x01B00, 0x01B04}, {0x01B34, 0x01B44}, {0x01B6B, 0x01B73},
+    {0x01B80, 0x01B82}, {0x01BA1, 0x01BAD}, {0x01BE6, 0x01BF3}, {0x01C24, 0x01C37}, {0x01CD0, 0x01CD2},
+    {0x01CD4, 0x01CE8}, {0x01CED, 0x01CED}, {0x01CF4, 0x01CF4}, {0x01CF7, 0x01CF9}, {0x01DC0, 0x01DFF},
+    {0x020D0, 0x020F0}, {0x02CEF, 0x02CF1}, {0x02D7F, 0x02D7F}, {0x02DE0, 0x02DFF}, {0x0302A, 0x0302F},
+    {0x03099, 0x0309A}, {0x0A66F, 0x0A672}, {0x0A674, 0x0A67D}, {0x0A69E, 0x0A69F}, {0x0A6F0, 0x0A6F1},
+    {0x0A802, 0x0A802}, {0x0A806, 0x0A806}, {0x0A80B, 0x0A80B}, {0x0A823, 0x0A827}, {0x0A82C, 0x0A82C},
+    {0x0A880, 0x0A881}, {0x0A8B4, 0x0A8C5}, {0x0A8E0, 0x0A8F1}, {0x0A8FF, 0x0A8FF}, {0x0A926, 0x0A92D},
+    {0x0A947, 0x0A953}, {0x0A980, 0x0A983}, {0x0A9B3, 0x0A9C0}, {0x0A9E5, 0x0A9E5}, {0x0AA29, 0x0AA36},
+    {0x0AA43, 0x0AA43}, {0x0AA4C, 0x0AA4D}, {0x0AA7B, 0x0AA7D}, {0x0AAB0, 0x0AAB0}, {0x0AAB2, 0x0AAB4},
+    {0x0AAB7, 0x0AAB8}, {0x0AABE, 0x0AABF}, {0x0AAC1, 0x0AAC1}, {0x0AAEB, 0x0AAEF}, {0x0AAF5, 0x0AAF6},
+    {0x0ABE3, 0x0ABEA}, {0x0ABEC, 0x0ABED}, {0x0FB1E, 0x0FB1E}, {0x0FE00, 0x0FE0F}, {0x0FE20, 0x0FE2F},
+    {0x101FD, 0x101FD}, {0x102E0, 0x102E0}, {0x10376, 0x1037A}, {0x10A01, 0x10A03}, {0x10A05, 0x10A06},
+    {0x10A0C, 0x10A0F}, {0x10A38, 0x10A3A}, {0x10A3F, 0x10A3F}, {0x10AE5, 0x10AE6}, {0x10D24, 0x10D27},
+    {0x10D69, 0x10D6D}, {0x10EAB, 0x10EAC}, {0x10EFC, 0x10EFF}, {0x10F46, 0x10F50}, {0x10F82, 0x10F85},
+    {0x11000, 0x11002}, {0x11038, 0x11046}, {0x11070, 0x11070}, {0x11073, 0x11074}, {0x1107F, 0x11082},
+    {0x110B0, 0x110BA}, {0x110C2, 0x110C2}, {0x11100, 0x11102}, {0x11127, 0x11134}, {0x11145, 0x11146},
+    {0x11173, 0x11173}, {0x11180, 0x11182}, {0x111B3, 0x111C0}, {0x111C9, 0x111CC}, {0x111CE, 0x111CF},
+    {0x1122C, 0x11237}, {0x1123E, 0x1123E}, {0x11241, 0x11241}, {0x112DF, 0x112EA}, {0x11300, 0x11303},
+    {0x1133B, 0x1133C}, {0x1133E, 0x11344}, {0x11347, 0x11348}, {0x1134B, 0x1134D}, {0x11357, 0x11357},
+    {0x11362, 0x11363}, {0x11366, 0x1136C}, {0x11370, 0x11374}, {0x113B8, 0x113C0}, {0x113C2, 0x113C2},
+    {0x113C5, 0x113C5}, {0x113C7, 0x113CA}, {0x113CC, 0x113D0}, {0x113D2, 0x113D2}, {0x113E1, 0x113E2},
+    {0x11435, 0x11446}, {0x1145E, 0x1145E}, {0x114B0, 0x114C3}, {0x115AF, 0x115B5}, {0x115B8, 0x115C0},
+    {0x115DC, 0x115DD}, {0x11630, 0x11640}, {0x116AB, 0x116B7}, {0x1171D, 0x1172B}, {0x1182C, 0x1183A},
+    {0x11930, 0x11935}, {0x11937, 0x11938}, {0x1193B, 0x1193E}, {0x11940, 0x11940}, {0x11942, 0x11943},
+    {0x119D1, 0x119D7}, {0x119DA, 0x119E0}, {0x119E4, 0x119E4}, {0x11A01, 0x11A0A}, {0x11A33, 0x11A39},
+    {0x11A3B, 0x11A3E}, {0x11A47, 0x11A47}, {0x11A51, 0x11A5B}, {0x11A8A, 0x11A99}, {0x11C2F, 0x11C36},
+    {0x11C38, 0x11C3F}, {0x11C92, 0x11CA7}, {0x11CA9, 0x11CB6}, {0x11D31, 0x11D36}, {0x11D3A, 0x11D3A},
+    {0x11D3C, 0x11D3D}, {0x11D3F, 0x11D45}, {0x11D47, 0x11D47}, {0x11D8A, 0x11D8E}, {0x11D90, 0x11D91},
+    {0x11D93, 0x11D97}, {0x11EF3, 0x11EF6}, {0x11F00, 0x11F01}, {0x11F03, 0x11F03}, {0x11F34, 0x11F3A},
+    {0x11F3E, 0x11F42}, {0x11F5A, 0x11F5A}, {0x13440, 0x13440}, {0x13447, 0x13455}, {0x1611E, 0x1612F},
+    {0x16AF0, 0x16AF4}, {0x16B30, 0x16B36}, {0x16F4F, 0x16F4F}, {0x16F51, 0x16F87}, {0x16F8F, 0x16F92},
+    {0x16FE4, 0x16FE4}, {0x16FF0, 0x16FF1}, {0x1BC9D, 0x1BC9E}, {0x1CF00, 0x1CF2D}, {0x1CF30, 0x1CF46},
+    {0x1D165, 0x1D169}, {0x1D16D, 0x1D172}, {0x1D17B, 0x1D182}, {0x1D185, 0x1D18B}, {0x1D1AA, 0x1D1AD},
+    {0x1D242, 0x1D244}, {0x1DA00, 0x1DA36}, {0x1DA3B, 0x1DA6C}, {0x1DA75, 0x1DA75}, {0x1DA84, 0x1DA84},
+    {0x1DA9B, 0x1DA9F}, {0x1DAA1, 0x1DAAF}, {0x1E000, 0x1E006}, {0x1E008, 0x1E018}, {0x1E01B, 0x1E021},
+    {0x1E023, 0x1E024}, {0x1E026, 0x1E02A}, {0x1E08F, 0x1E08F}, {0x1E130, 0x1E136}, {0x1E2AE, 0x1E2AE},
+    {0x1E2EC, 0x1E2EF}, {0x1E4EC, 0x1E4EF}, {0x1E5EE, 0x1E5EF}, {0x1E8D0, 0x1E8D6}, {0x1E944, 0x1E94A},
+    {0xE0100, 0xE01EF}};
 
 /* Width 0 combining letters. */
-static const struct widechar_range widechar_combiningletters_table[] = {
-    {0x01160, 0x011FF},
-    {0x0D7B0, 0x0D7FF}
-};
+static const struct widechar_range widechar_combiningletters_table[] = {{0x01160, 0x011FF}, {0x0D7B0, 0x0D7FF}};
 
 /* Width 2 characters. */
 static const struct widechar_range widechar_doublewide_table[] = {
-    {0x01100, 0x0115F},
-    {0x02329, 0x0232A},
-    {0x02630, 0x02637},
-    {0x0268A, 0x0268F},
-    {0x02E80, 0x02E99},
-    {0x02E9B, 0x02EF3},
-    {0x02F00, 0x02FD5},
-    {0x02FF0, 0x0303E},
-    {0x03041, 0x03096},
-    {0x03099, 0x030FF},
-    {0x03105, 0x0312F},
-    {0x03131, 0x0318E},
-    {0x03190, 0x031E5},
-    {0x031EF, 0x0321E},
-    {0x03220, 0x03247},
-    {0x03250, 0x0A48C},
-    {0x0A490, 0x0A4C6},
-    {0x0A960, 0x0A97C},
-    {0x0AC00, 0x0D7A3},
-    {0x0F900, 0x0FAFF},
-    {0x0FE10, 0x0FE19},
-    {0x0FE30, 0x0FE52},
-    {0x0FE54, 0x0FE66},
-    {0x0FE68, 0x0FE6B},
-    {0x0FF01, 0x0FF60},
-    {0x0FFE0, 0x0FFE6},
-    {0x16FE0, 0x16FE4},
-    {0x16FF0, 0x16FF1},
-    {0x17000, 0x187F7},
-    {0x18800, 0x18CD5},
-    {0x18CFF, 0x18D08},
-    {0x1AFF0, 0x1AFF3},
-    {0x1AFF5, 0x1AFFB},
-    {0x1AFFD, 0x1AFFE},
-    {0x1B000, 0x1B122},
-    {0x1B132, 0x1B132},
-    {0x1B150, 0x1B152},
-    {0x1B155, 0x1B155},
-    {0x1B164, 0x1B167},
-    {0x1B170, 0x1B2FB},
-    {0x1D300, 0x1D356},
-    {0x1D360, 0x1D376},
-    {0x1F200, 0x1F200},
-    {0x1F202, 0x1F202},
-    {0x1F210, 0x1F219},
-    {0x1F21B, 0x1F22E},
-    {0x1F230, 0x1F231},
-    {0x1F237, 0x1F237},
-    {0x1F23B, 0x1F23B},
-    {0x1F240, 0x1F248},
-    {0x1F260, 0x1F265},
-    {0x1F57A, 0x1F57A},
-    {0x1F5A4, 0x1F5A4},
-    {0x1F6D1, 0x1F6D2},
-    {0x1F6D5, 0x1F6D7},
-    {0x1F6DC, 0x1F6DF},
-    {0x1F6F4, 0x1F6FC},
-    {0x1F7E0, 0x1F7EB},
-    {0x1F7F0, 0x1F7F0},
-    {0x1F90C, 0x1F90F},
-    {0x1F919, 0x1F93A},
-    {0x1F93C, 0x1F945},
-    {0x1F947, 0x1F97F},
-    {0x1F985, 0x1F9BF},
-    {0x1F9C1, 0x1F9FF},
-    {0x1FA70, 0x1FA7C},
-    {0x1FA80, 0x1FA89},
-    {0x1FA8F, 0x1FAC6},
-    {0x1FACE, 0x1FADC},
-    {0x1FADF, 0x1FAE9},
-    {0x1FAF0, 0x1FAF8},
-    {0x20000, 0x2FFFD},
-    {0x30000, 0x3FFFD}
-};
+    {0x01100, 0x0115F}, {0x02329, 0x0232A}, {0x02630, 0x02637}, {0x0268A, 0x0268F}, {0x02E80, 0x02E99},
+    {0x02E9B, 0x02EF3}, {0x02F00, 0x02FD5}, {0x02FF0, 0x0303E}, {0x03041, 0x03096}, {0x03099, 0x030FF},
+    {0x03105, 0x0312F}, {0x03131, 0x0318E}, {0x03190, 0x031E5}, {0x031EF, 0x0321E}, {0x03220, 0x03247},
+    {0x03250, 0x0A48C}, {0x0A490, 0x0A4C6}, {0x0A960, 0x0A97C}, {0x0AC00, 0x0D7A3}, {0x0F900, 0x0FAFF},
+    {0x0FE10, 0x0FE19}, {0x0FE30, 0x0FE52}, {0x0FE54, 0x0FE66}, {0x0FE68, 0x0FE6B}, {0x0FF01, 0x0FF60},
+    {0x0FFE0, 0x0FFE6}, {0x16FE0, 0x16FE4}, {0x16FF0, 0x16FF1}, {0x17000, 0x187F7}, {0x18800, 0x18CD5},
+    {0x18CFF, 0x18D08}, {0x1AFF0, 0x1AFF3}, {0x1AFF5, 0x1AFFB}, {0x1AFFD, 0x1AFFE}, {0x1B000, 0x1B122},
+    {0x1B132, 0x1B132}, {0x1B150, 0x1B152}, {0x1B155, 0x1B155}, {0x1B164, 0x1B167}, {0x1B170, 0x1B2FB},
+    {0x1D300, 0x1D356}, {0x1D360, 0x1D376}, {0x1F200, 0x1F200}, {0x1F202, 0x1F202}, {0x1F210, 0x1F219},
+    {0x1F21B, 0x1F22E}, {0x1F230, 0x1F231}, {0x1F237, 0x1F237}, {0x1F23B, 0x1F23B}, {0x1F240, 0x1F248},
+    {0x1F260, 0x1F265}, {0x1F57A, 0x1F57A}, {0x1F5A4, 0x1F5A4}, {0x1F6D1, 0x1F6D2}, {0x1F6D5, 0x1F6D7},
+    {0x1F6DC, 0x1F6DF}, {0x1F6F4, 0x1F6FC}, {0x1F7E0, 0x1F7EB}, {0x1F7F0, 0x1F7F0}, {0x1F90C, 0x1F90F},
+    {0x1F919, 0x1F93A}, {0x1F93C, 0x1F945}, {0x1F947, 0x1F97F}, {0x1F985, 0x1F9BF}, {0x1F9C1, 0x1F9FF},
+    {0x1FA70, 0x1FA7C}, {0x1FA80, 0x1FA89}, {0x1FA8F, 0x1FAC6}, {0x1FACE, 0x1FADC}, {0x1FADF, 0x1FAE9},
+    {0x1FAF0, 0x1FAF8}, {0x20000, 0x2FFFD}, {0x30000, 0x3FFFD}};
 
 /* Ambiguous-width characters. */
 static const struct widechar_range widechar_ambiguous_table[] = {
-    {0x000A1, 0x000A1},
-    {0x000A4, 0x000A4},
-    {0x000A7, 0x000A8},
-    {0x000AA, 0x000AA},
-    {0x000AD, 0x000AE},
-    {0x000B0, 0x000B4},
-    {0x000B6, 0x000BA},
-    {0x000BC, 0x000BF},
-    {0x000C6, 0x000C6},
-    {0x000D0, 0x000D0},
-    {0x000D7, 0x000D8},
-    {0x000DE, 0x000E1},
-    {0x000E6, 0x000E6},
-    {0x000E8, 0x000EA},
-    {0x000EC, 0x000ED},
-    {0x000F0, 0x000F0},
-    {0x000F2, 0x000F3},
-    {0x000F7, 0x000FA},
-    {0x000FC, 0x000FC},
-    {0x000FE, 0x000FE},
-    {0x00101, 0x00101},
-    {0x00111, 0x00111},
-    {0x00113, 0x00113},
-    {0x0011B, 0x0011B},
-    {0x00126, 0x00127},
-    {0x0012B, 0x0012B},
-    {0x00131, 0x00133},
-    {0x00138, 0x00138},
-    {0x0013F, 0x00142},
-    {0x00144, 0x00144},
-    {0x00148, 0x0014B},
-    {0x0014D, 0x0014D},
-    {0x00152, 0x00153},
-    {0x00166, 0x00167},
-    {0x0016B, 0x0016B},
-    {0x001CE, 0x001CE},
-    {0x001D0, 0x001D0},
-    {0x001D2, 0x001D2},
-    {0x001D4, 0x001D4},
-    {0x001D6, 0x001D6},
-    {0x001D8, 0x001D8},
-    {0x001DA, 0x001DA},
-    {0x001DC, 0x001DC},
-    {0x00251, 0x00251},
-    {0x00261, 0x00261},
-    {0x002C4, 0x002C4},
-    {0x002C7, 0x002C7},
-    {0x002C9, 0x002CB},
-    {0x002CD, 0x002CD},
-    {0x002D0, 0x002D0},
-    {0x002D8, 0x002DB},
-    {0x002DD, 0x002DD},
-    {0x002DF, 0x002DF},
-    {0x00300, 0x0036F},
-    {0x00391, 0x003A1},
-    {0x003A3, 0x003A9},
-    {0x003B1, 0x003C1},
-    {0x003C3, 0x003C9},
-    {0x00401, 0x00401},
-    {0x00410, 0x0044F},
-    {0x00451, 0x00451},
-    {0x02010, 0x02010},
-    {0x02013, 0x02016},
-    {0x02018, 0x02019},
-    {0x0201C, 0x0201D},
-    {0x02020, 0x02022},
-    {0x02024, 0x02027},
-    {0x02030, 0x02030},
-    {0x02032, 0x02033},
-    {0x02035, 0x02035},
-    {0x0203B, 0x0203B},
-    {0x0203E, 0x0203E},
-    {0x02074, 0x02074},
-    {0x0207F, 0x0207F},
-    {0x02081, 0x02084},
-    {0x020AC, 0x020AC},
-    {0x02103, 0x02103},
-    {0x02105, 0x02105},
-    {0x02109, 0x02109},
-    {0x02113, 0x02113},
-    {0x02116, 0x02116},
-    {0x02121, 0x02122},
-    {0x02126, 0x02126},
-    {0x0212B, 0x0212B},
-    {0x02153, 0x02154},
-    {0x0215B, 0x0215E},
-    {0x02160, 0x0216B},
-    {0x02170, 0x02179},
-    {0x02189, 0x02189},
-    {0x02190, 0x02199},
-    {0x021B8, 0x021B9},
-    {0x021D2, 0x021D2},
-    {0x021D4, 0x021D4},
-    {0x021E7, 0x021E7},
-    {0x02200, 0x02200},
-    {0x02202, 0x02203},
-    {0x02207, 0x02208},
-    {0x0220B, 0x0220B},
-    {0x0220F, 0x0220F},
-    {0x02211, 0x02211},
-    {0x02215, 0x02215},
-    {0x0221A, 0x0221A},
-    {0x0221D, 0x02220},
-    {0x02223, 0x02223},
-    {0x02225, 0x02225},
-    {0x02227, 0x0222C},
-    {0x0222E, 0x0222E},
-    {0x02234, 0x02237},
-    {0x0223C, 0x0223D},
-    {0x02248, 0x02248},
-    {0x0224C, 0x0224C},
-    {0x02252, 0x02252},
-    {0x02260, 0x02261},
-    {0x02264, 0x02267},
-    {0x0226A, 0x0226B},
-    {0x0226E, 0x0226F},
-    {0x02282, 0x02283},
-    {0x02286, 0x02287},
-    {0x02295, 0x02295},
-    {0x02299, 0x02299},
-    {0x022A5, 0x022A5},
-    {0x022BF, 0x022BF},
-    {0x02312, 0x02312},
-    {0x02460, 0x024E9},
-    {0x024EB, 0x0254B},
-    {0x02550, 0x02573},
-    {0x02580, 0x0258F},
-    {0x02592, 0x02595},
-    {0x025A0, 0x025A1},
-    {0x025A3, 0x025A9},
-    {0x025B2, 0x025B3},
-    {0x025B6, 0x025B7},
-    {0x025BC, 0x025BD},
-    {0x025C0, 0x025C1},
-    {0x025C6, 0x025C8},
-    {0x025CB, 0x025CB},
-    {0x025CE, 0x025D1},
-    {0x025E2, 0x025E5},
-    {0x025EF, 0x025EF},
-    {0x02605, 0x02606},
-    {0x02609, 0x02609},
-    {0x0260E, 0x0260F},
-    {0x0261C, 0x0261C},
-    {0x0261E, 0x0261E},
-    {0x02640, 0x02640},
-    {0x02642, 0x02642},
-    {0x02660, 0x02661},
-    {0x02663, 0x02665},
-    {0x02667, 0x0266A},
-    {0x0266C, 0x0266D},
-    {0x0266F, 0x0266F},
-    {0x0269E, 0x0269F},
-    {0x026BF, 0x026BF},
-    {0x026C6, 0x026CD},
-    {0x026CF, 0x026D3},
-    {0x026D5, 0x026E1},
-    {0x026E3, 0x026E3},
-    {0x026E8, 0x026E9},
-    {0x026EB, 0x026F1},
-    {0x026F4, 0x026F4},
-    {0x026F6, 0x026F9},
-    {0x026FB, 0x026FC},
-    {0x026FE, 0x026FF},
-    {0x0273D, 0x0273D},
-    {0x02776, 0x0277F},
-    {0x02B56, 0x02B59},
-    {0x03248, 0x0324F},
-    {0x0E000, 0x0F8FF},
-    {0x0FE00, 0x0FE0F},
-    {0x0FFFD, 0x0FFFD},
-    {0x1F100, 0x1F10A},
-    {0x1F110, 0x1F12D},
-    {0x1F130, 0x1F169},
-    {0x1F170, 0x1F18D},
-    {0x1F18F, 0x1F190},
-    {0x1F19B, 0x1F1AC},
-    {0xE0100, 0xE01EF},
-    {0xF0000, 0xFFFFD},
-    {0x100000, 0x10FFFD}
-};
+    {0x000A1, 0x000A1}, {0x000A4, 0x000A4}, {0x000A7, 0x000A8}, {0x000AA, 0x000AA},  {0x000AD, 0x000AE},
+    {0x000B0, 0x000B4}, {0x000B6, 0x000BA}, {0x000BC, 0x000BF}, {0x000C6, 0x000C6},  {0x000D0, 0x000D0},
+    {0x000D7, 0x000D8}, {0x000DE, 0x000E1}, {0x000E6, 0x000E6}, {0x000E8, 0x000EA},  {0x000EC, 0x000ED},
+    {0x000F0, 0x000F0}, {0x000F2, 0x000F3}, {0x000F7, 0x000FA}, {0x000FC, 0x000FC},  {0x000FE, 0x000FE},
+    {0x00101, 0x00101}, {0x00111, 0x00111}, {0x00113, 0x00113}, {0x0011B, 0x0011B},  {0x00126, 0x00127},
+    {0x0012B, 0x0012B}, {0x00131, 0x00133}, {0x00138, 0x00138}, {0x0013F, 0x00142},  {0x00144, 0x00144},
+    {0x00148, 0x0014B}, {0x0014D, 0x0014D}, {0x00152, 0x00153}, {0x00166, 0x00167},  {0x0016B, 0x0016B},
+    {0x001CE, 0x001CE}, {0x001D0, 0x001D0}, {0x001D2, 0x001D2}, {0x001D4, 0x001D4},  {0x001D6, 0x001D6},
+    {0x001D8, 0x001D8}, {0x001DA, 0x001DA}, {0x001DC, 0x001DC}, {0x00251, 0x00251},  {0x00261, 0x00261},
+    {0x002C4, 0x002C4}, {0x002C7, 0x002C7}, {0x002C9, 0x002CB}, {0x002CD, 0x002CD},  {0x002D0, 0x002D0},
+    {0x002D8, 0x002DB}, {0x002DD, 0x002DD}, {0x002DF, 0x002DF}, {0x00300, 0x0036F},  {0x00391, 0x003A1},
+    {0x003A3, 0x003A9}, {0x003B1, 0x003C1}, {0x003C3, 0x003C9}, {0x00401, 0x00401},  {0x00410, 0x0044F},
+    {0x00451, 0x00451}, {0x02010, 0x02010}, {0x02013, 0x02016}, {0x02018, 0x02019},  {0x0201C, 0x0201D},
+    {0x02020, 0x02022}, {0x02024, 0x02027}, {0x02030, 0x02030}, {0x02032, 0x02033},  {0x02035, 0x02035},
+    {0x0203B, 0x0203B}, {0x0203E, 0x0203E}, {0x02074, 0x02074}, {0x0207F, 0x0207F},  {0x02081, 0x02084},
+    {0x020AC, 0x020AC}, {0x02103, 0x02103}, {0x02105, 0x02105}, {0x02109, 0x02109},  {0x02113, 0x02113},
+    {0x02116, 0x02116}, {0x02121, 0x02122}, {0x02126, 0x02126}, {0x0212B, 0x0212B},  {0x02153, 0x02154},
+    {0x0215B, 0x0215E}, {0x02160, 0x0216B}, {0x02170, 0x02179}, {0x02189, 0x02189},  {0x02190, 0x02199},
+    {0x021B8, 0x021B9}, {0x021D2, 0x021D2}, {0x021D4, 0x021D4}, {0x021E7, 0x021E7},  {0x02200, 0x02200},
+    {0x02202, 0x02203}, {0x02207, 0x02208}, {0x0220B, 0x0220B}, {0x0220F, 0x0220F},  {0x02211, 0x02211},
+    {0x02215, 0x02215}, {0x0221A, 0x0221A}, {0x0221D, 0x02220}, {0x02223, 0x02223},  {0x02225, 0x02225},
+    {0x02227, 0x0222C}, {0x0222E, 0x0222E}, {0x02234, 0x02237}, {0x0223C, 0x0223D},  {0x02248, 0x02248},
+    {0x0224C, 0x0224C}, {0x02252, 0x02252}, {0x02260, 0x02261}, {0x02264, 0x02267},  {0x0226A, 0x0226B},
+    {0x0226E, 0x0226F}, {0x02282, 0x02283}, {0x02286, 0x02287}, {0x02295, 0x02295},  {0x02299, 0x02299},
+    {0x022A5, 0x022A5}, {0x022BF, 0x022BF}, {0x02312, 0x02312}, {0x02460, 0x024E9},  {0x024EB, 0x0254B},
+    {0x02550, 0x02573}, {0x02580, 0x0258F}, {0x02592, 0x02595}, {0x025A0, 0x025A1},  {0x025A3, 0x025A9},
+    {0x025B2, 0x025B3}, {0x025B6, 0x025B7}, {0x025BC, 0x025BD}, {0x025C0, 0x025C1},  {0x025C6, 0x025C8},
+    {0x025CB, 0x025CB}, {0x025CE, 0x025D1}, {0x025E2, 0x025E5}, {0x025EF, 0x025EF},  {0x02605, 0x02606},
+    {0x02609, 0x02609}, {0x0260E, 0x0260F}, {0x0261C, 0x0261C}, {0x0261E, 0x0261E},  {0x02640, 0x02640},
+    {0x02642, 0x02642}, {0x02660, 0x02661}, {0x02663, 0x02665}, {0x02667, 0x0266A},  {0x0266C, 0x0266D},
+    {0x0266F, 0x0266F}, {0x0269E, 0x0269F}, {0x026BF, 0x026BF}, {0x026C6, 0x026CD},  {0x026CF, 0x026D3},
+    {0x026D5, 0x026E1}, {0x026E3, 0x026E3}, {0x026E8, 0x026E9}, {0x026EB, 0x026F1},  {0x026F4, 0x026F4},
+    {0x026F6, 0x026F9}, {0x026FB, 0x026FC}, {0x026FE, 0x026FF}, {0x0273D, 0x0273D},  {0x02776, 0x0277F},
+    {0x02B56, 0x02B59}, {0x03248, 0x0324F}, {0x0E000, 0x0F8FF}, {0x0FE00, 0x0FE0F},  {0x0FFFD, 0x0FFFD},
+    {0x1F100, 0x1F10A}, {0x1F110, 0x1F12D}, {0x1F130, 0x1F169}, {0x1F170, 0x1F18D},  {0x1F18F, 0x1F190},
+    {0x1F19B, 0x1F1AC}, {0xE0100, 0xE01EF}, {0xF0000, 0xFFFFD}, {0x100000, 0x10FFFD}};
 
 /* Unassigned characters. */
 static const struct widechar_range widechar_unassigned_table[] = {
-    {0x00378, 0x00379},
-    {0x00380, 0x00383},
-    {0x0038B, 0x0038B},
-    {0x0038D, 0x0038D},
-    {0x003A2, 0x003A2},
-    {0x00530, 0x00530},
-    {0x00557, 0x00558},
-    {0x0058B, 0x0058C},
-    {0x00590, 0x00590},
-    {0x005C8, 0x005CF},
-    {0x005EB, 0x005EE},
-    {0x005F5, 0x005FF},
-    {0x0070E, 0x0070E},
-    {0x0074B, 0x0074C},
-    {0x007B2, 0x007BF},
-    {0x007FB, 0x007FC},
-    {0x0082E, 0x0082F},
-    {0x0083F, 0x0083F},
-    {0x0085C, 0x0085D},
-    {0x0085F, 0x0085F},
-    {0x0086B, 0x0086F},
-    {0x0088F, 0x0088F},
-    {0x00892, 0x00896},
-    {0x00984, 0x00984},
-    {0x0098D, 0x0098E},
-    {0x00991, 0x00992},
-    {0x009A9, 0x009A9},
-    {0x009B1, 0x009B1},
-    {0x009B3, 0x009B5},
-    {0x009BA, 0x009BB},
-    {0x009C5, 0x009C6},
-    {0x009C9, 0x009CA},
-    {0x009CF, 0x009D6},
-    {0x009D8, 0x009DB},
-    {0x009DE, 0x009DE},
-    {0x009E4, 0x009E5},
-    {0x009FF, 0x00A00},
-    {0x00A04, 0x00A04},
-    {0x00A0B, 0x00A0E},
-    {0x00A11, 0x00A12},
-    {0x00A29, 0x00A29},
-    {0x00A31, 0x00A31},
-    {0x00A34, 0x00A34},
-    {0x00A37, 0x00A37},
-    {0x00A3A, 0x00A3B},
-    {0x00A3D, 0x00A3D},
-    {0x00A43, 0x00A46},
-    {0x00A49, 0x00A4A},
-    {0x00A4E, 0x00A50},
-    {0x00A52, 0x00A58},
-    {0x00A5D, 0x00A5D},
-    {0x00A5F, 0x00A65},
-    {0x00A77, 0x00A80},
-    {0x00A84, 0x00A84},
-    {0x00A8E, 0x00A8E},
-    {0x00A92, 0x00A92},
-    {0x00AA9, 0x00AA9},
-    {0x00AB1, 0x00AB1},
-    {0x00AB4, 0x00AB4},
-    {0x00ABA, 0x00ABB},
-    {0x00AC6, 0x00AC6},
-    {0x00ACA, 0x00ACA},
-    {0x00ACE, 0x00ACF},
-    {0x00AD1, 0x00ADF},
-    {0x00AE4, 0x00AE5},
-    {0x00AF2, 0x00AF8},
-    {0x00B00, 0x00B00},
-    {0x00B04, 0x00B04},
-    {0x00B0D, 0x00B0E},
-    {0x00B11, 0x00B12},
-    {0x00B29, 0x00B29},
-    {0x00B31, 0x00B31},
-    {0x00B34, 0x00B34},
-    {0x00B3A, 0x00B3B},
-    {0x00B45, 0x00B46},
-    {0x00B49, 0x00B4A},
-    {0x00B4E, 0x00B54},
-    {0x00B58, 0x00B5B},
-    {0x00B5E, 0x00B5E},
-    {0x00B64, 0x00B65},
-    {0x00B78, 0x00B81},
-    {0x00B84, 0x00B84},
-    {0x00B8B, 0x00B8D},
-    {0x00B91, 0x00B91},
-    {0x00B96, 0x00B98},
-    {0x00B9B, 0x00B9B},
-    {0x00B9D, 0x00B9D},
-    {0x00BA0, 0x00BA2},
-    {0x00BA5, 0x00BA7},
-    {0x00BAB, 0x00BAD},
-    {0x00BBA, 0x00BBD},
-    {0x00BC3, 0x00BC5},
-    {0x00BC9, 0x00BC9},
-    {0x00BCE, 0x00BCF},
-    {0x00BD1, 0x00BD6},
-    {0x00BD8, 0x00BE5},
-    {0x00BFB, 0x00BFF},
-    {0x00C0D, 0x00C0D},
-    {0x00C11, 0x00C11},
-    {0x00C29, 0x00C29},
-    {0x00C3A, 0x00C3B},
-    {0x00C45, 0x00C45},
-    {0x00C49, 0x00C49},
-    {0x00C4E, 0x00C54},
-    {0x00C57, 0x00C57},
-    {0x00C5B, 0x00C5C},
-    {0x00C5E, 0x00C5F},
-    {0x00C64, 0x00C65},
-    {0x00C70, 0x00C76},
-    {0x00C8D, 0x00C8D},
-    {0x00C91, 0x00C91},
-    {0x00CA9, 0x00CA9},
-    {0x00CB4, 0x00CB4},
-    {0x00CBA, 0x00CBB},
-    {0x00CC5, 0x00CC5},
-    {0x00CC9, 0x00CC9},
-    {0x00CCE, 0x00CD4},
-    {0x00CD7, 0x00CDC},
-    {0x00CDF, 0x00CDF},
-    {0x00CE4, 0x00CE5},
-    {0x00CF0, 0x00CF0},
-    {0x00CF4, 0x00CFF},
-    {0x00D0D, 0x00D0D},
-    {0x00D11, 0x00D11},
-    {0x00D45, 0x00D45},
-    {0x00D49, 0x00D49},
-    {0x00D50, 0x00D53},
-    {0x00D64, 0x00D65},
-    {0x00D80, 0x00D80},
-    {0x00D84, 0x00D84},
-    {0x00D97, 0x00D99},
-    {0x00DB2, 0x00DB2},
-    {0x00DBC, 0x00DBC},
-    {0x00DBE, 0x00DBF},
-    {0x00DC7, 0x00DC9},
-    {0x00DCB, 0x00DCE},
-    {0x00DD5, 0x00DD5},
-    {0x00DD7, 0x00DD7},
-    {0x00DE0, 0x00DE5},
-    {0x00DF0, 0x00DF1},
-    {0x00DF5, 0x00E00},
-    {0x00E3B, 0x00E3E},
-    {0x00E5C, 0x00E80},
-    {0x00E83, 0x00E83},
-    {0x00E85, 0x00E85},
-    {0x00E8B, 0x00E8B},
-    {0x00EA4, 0x00EA4},
-    {0x00EA6, 0x00EA6},
-    {0x00EBE, 0x00EBF},
-    {0x00EC5, 0x00EC5},
-    {0x00EC7, 0x00EC7},
-    {0x00ECF, 0x00ECF},
-    {0x00EDA, 0x00EDB},
-    {0x00EE0, 0x00EFF},
-    {0x00F48, 0x00F48},
-    {0x00F6D, 0x00F70},
-    {0x00F98, 0x00F98},
-    {0x00FBD, 0x00FBD},
-    {0x00FCD, 0x00FCD},
-    {0x00FDB, 0x00FFF},
-    {0x010C6, 0x010C6},
-    {0x010C8, 0x010CC},
-    {0x010CE, 0x010CF},
-    {0x01249, 0x01249},
-    {0x0124E, 0x0124F},
-    {0x01257, 0x01257},
-    {0x01259, 0x01259},
-    {0x0125E, 0x0125F},
-    {0x01289, 0x01289},
-    {0x0128E, 0x0128F},
-    {0x012B1, 0x012B1},
-    {0x012B6, 0x012B7},
-    {0x012BF, 0x012BF},
-    {0x012C1, 0x012C1},
-    {0x012C6, 0x012C7},
-    {0x012D7, 0x012D7},
-    {0x01311, 0x01311},
-    {0x01316, 0x01317},
-    {0x0135B, 0x0135C},
-    {0x0137D, 0x0137F},
-    {0x0139A, 0x0139F},
-    {0x013F6, 0x013F7},
-    {0x013FE, 0x013FF},
-    {0x0169D, 0x0169F},
-    {0x016F9, 0x016FF},
-    {0x01716, 0x0171E},
-    {0x01737, 0x0173F},
-    {0x01754, 0x0175F},
-    {0x0176D, 0x0176D},
-    {0x01771, 0x01771},
-    {0x01774, 0x0177F},
-    {0x017DE, 0x017DF},
-    {0x017EA, 0x017EF},
-    {0x017FA, 0x017FF},
-    {0x0181A, 0x0181F},
-    {0x01879, 0x0187F},
-    {0x018AB, 0x018AF},
-    {0x018F6, 0x018FF},
-    {0x0191F, 0x0191F},
-    {0x0192C, 0x0192F},
-    {0x0193C, 0x0193F},
-    {0x01941, 0x01943},
-    {0x0196E, 0x0196F},
-    {0x01975, 0x0197F},
-    {0x019AC, 0x019AF},
-    {0x019CA, 0x019CF},
-    {0x019DB, 0x019DD},
-    {0x01A1C, 0x01A1D},
-    {0x01A5F, 0x01A5F},
-    {0x01A7D, 0x01A7E},
-    {0x01A8A, 0x01A8F},
-    {0x01A9A, 0x01A9F},
-    {0x01AAE, 0x01AAF},
-    {0x01ACF, 0x01AFF},
-    {0x01B4D, 0x01B4D},
-    {0x01BF4, 0x01BFB},
-    {0x01C38, 0x01C3A},
-    {0x01C4A, 0x01C4C},
-    {0x01C8B, 0x01C8F},
-    {0x01CBB, 0x01CBC},
-    {0x01CC8, 0x01CCF},
-    {0x01CFB, 0x01CFF},
-    {0x01F16, 0x01F17},
-    {0x01F1E, 0x01F1F},
-    {0x01F46, 0x01F47},
-    {0x01F4E, 0x01F4F},
-    {0x01F58, 0x01F58},
-    {0x01F5A, 0x01F5A},
-    {0x01F5C, 0x01F5C},
-    {0x01F5E, 0x01F5E},
-    {0x01F7E, 0x01F7F},
-    {0x01FB5, 0x01FB5},
-    {0x01FC5, 0x01FC5},
-    {0x01FD4, 0x01FD5},
-    {0x01FDC, 0x01FDC},
-    {0x01FF0, 0x01FF1},
-    {0x01FF5, 0x01FF5},
-    {0x01FFF, 0x01FFF},
-    {0x02065, 0x02065},
-    {0x02072, 0x02073},
-    {0x0208F, 0x0208F},
-    {0x0209D, 0x0209F},
-    {0x020C1, 0x020CF},
-    {0x020F1, 0x020FF},
-    {0x0218C, 0x0218F},
-    {0x0242A, 0x0243F},
-    {0x0244B, 0x0245F},
-    {0x02B74, 0x02B75},
-    {0x02B96, 0x02B96},
-    {0x02CF4, 0x02CF8},
-    {0x02D26, 0x02D26},
-    {0x02D28, 0x02D2C},
-    {0x02D2E, 0x02D2F},
-    {0x02D68, 0x02D6E},
-    {0x02D71, 0x02D7E},
-    {0x02D97, 0x02D9F},
-    {0x02DA7, 0x02DA7},
-    {0x02DAF, 0x02DAF},
-    {0x02DB7, 0x02DB7},
-    {0x02DBF, 0x02DBF},
-    {0x02DC7, 0x02DC7},
-    {0x02DCF, 0x02DCF},
-    {0x02DD7, 0x02DD7},
-    {0x02DDF, 0x02DDF},
-    {0x02E5E, 0x02E7F},
-    {0x02E9A, 0x02E9A},
-    {0x02EF4, 0x02EFF},
-    {0x02FD6, 0x02FEF},
-    {0x03040, 0x03040},
-    {0x03097, 0x03098},
-    {0x03100, 0x03104},
-    {0x03130, 0x03130},
-    {0x0318F, 0x0318F},
-    {0x031E6, 0x031EE},
-    {0x0321F, 0x0321F},
-    {0x03401, 0x04DBE},
-    {0x04E01, 0x09FFE},
-    {0x0A48D, 0x0A48F},
-    {0x0A4C7, 0x0A4CF},
-    {0x0A62C, 0x0A63F},
-    {0x0A6F8, 0x0A6FF},
-    {0x0A7CE, 0x0A7CF},
-    {0x0A7D2, 0x0A7D2},
-    {0x0A7D4, 0x0A7D4},
-    {0x0A7DD, 0x0A7F1},
-    {0x0A82D, 0x0A82F},
-    {0x0A83A, 0x0A83F},
-    {0x0A878, 0x0A87F},
-    {0x0A8C6, 0x0A8CD},
-    {0x0A8DA, 0x0A8DF},
-    {0x0A954, 0x0A95E},
-    {0x0A97D, 0x0A97F},
-    {0x0A9CE, 0x0A9CE},
-    {0x0A9DA, 0x0A9DD},
-    {0x0A9FF, 0x0A9FF},
-    {0x0AA37, 0x0AA3F},
-    {0x0AA4E, 0x0AA4F},
-    {0x0AA5A, 0x0AA5B},
-    {0x0AAC3, 0x0AADA},
-    {0x0AAF7, 0x0AB00},
-    {0x0AB07, 0x0AB08},
-    {0x0AB0F, 0x0AB10},
-    {0x0AB17, 0x0AB1F},
-    {0x0AB27, 0x0AB27},
-    {0x0AB2F, 0x0AB2F},
-    {0x0AB6C, 0x0AB6F},
-    {0x0ABEE, 0x0ABEF},
-    {0x0ABFA, 0x0ABFF},
-    {0x0AC01, 0x0D7A2},
-    {0x0D7A4, 0x0D7AF},
-    {0x0D7C7, 0x0D7CA},
-    {0x0D7FC, 0x0D7FF},
-    {0x0FA6E, 0x0FA6F},
-    {0x0FADA, 0x0FAFF},
-    {0x0FB07, 0x0FB12},
-    {0x0FB18, 0x0FB1C},
-    {0x0FB37, 0x0FB37},
-    {0x0FB3D, 0x0FB3D},
-    {0x0FB3F, 0x0FB3F},
-    {0x0FB42, 0x0FB42},
-    {0x0FB45, 0x0FB45},
-    {0x0FBC3, 0x0FBD2},
-    {0x0FD90, 0x0FD91},
-    {0x0FDC8, 0x0FDCE},
-    {0x0FE1A, 0x0FE1F},
-    {0x0FE53, 0x0FE53},
-    {0x0FE67, 0x0FE67},
-    {0x0FE6C, 0x0FE6F},
-    {0x0FE75, 0x0FE75},
-    {0x0FEFD, 0x0FEFE},
-    {0x0FF00, 0x0FF00},
-    {0x0FFBF, 0x0FFC1},
-    {0x0FFC8, 0x0FFC9},
-    {0x0FFD0, 0x0FFD1},
-    {0x0FFD8, 0x0FFD9},
-    {0x0FFDD, 0x0FFDF},
-    {0x0FFE7, 0x0FFE7},
-    {0x0FFEF, 0x0FFF8},
-    {0x1000C, 0x1000C},
-    {0x10027, 0x10027},
-    {0x1003B, 0x1003B},
-    {0x1003E, 0x1003E},
-    {0x1004E, 0x1004F},
-    {0x1005E, 0x1007F},
-    {0x100FB, 0x100FF},
-    {0x10103, 0x10106},
-    {0x10134, 0x10136},
-    {0x1018F, 0x1018F},
-    {0x1019D, 0x1019F},
-    {0x101A1, 0x101CF},
-    {0x101FE, 0x1027F},
-    {0x1029D, 0x1029F},
-    {0x102D1, 0x102DF},
-    {0x102FC, 0x102FF},
-    {0x10324, 0x1032C},
-    {0x1034B, 0x1034F},
-    {0x1037B, 0x1037F},
-    {0x1039E, 0x1039E},
-    {0x103C4, 0x103C7},
-    {0x103D6, 0x103FF},
-    {0x1049E, 0x1049F},
-    {0x104AA, 0x104AF},
-    {0x104D4, 0x104D7},
-    {0x104FC, 0x104FF},
-    {0x10528, 0x1052F},
-    {0x10564, 0x1056E},
-    {0x1057B, 0x1057B},
-    {0x1058B, 0x1058B},
-    {0x10593, 0x10593},
-    {0x10596, 0x10596},
-    {0x105A2, 0x105A2},
-    {0x105B2, 0x105B2},
-    {0x105BA, 0x105BA},
-    {0x105BD, 0x105BF},
-    {0x105F4, 0x105FF},
-    {0x10737, 0x1073F},
-    {0x10756, 0x1075F},
-    {0x10768, 0x1077F},
-    {0x10786, 0x10786},
-    {0x107B1, 0x107B1},
-    {0x107BB, 0x107FF},
-    {0x10806, 0x10807},
-    {0x10809, 0x10809},
-    {0x10836, 0x10836},
-    {0x10839, 0x1083B},
-    {0x1083D, 0x1083E},
-    {0x10856, 0x10856},
-    {0x1089F, 0x108A6},
-    {0x108B0, 0x108DF},
-    {0x108F3, 0x108F3},
-    {0x108F6, 0x108FA},
-    {0x1091C, 0x1091E},
-    {0x1093A, 0x1093E},
-    {0x10940, 0x1097F},
-    {0x109B8, 0x109BB},
-    {0x109D0, 0x109D1},
-    {0x10A04, 0x10A04},
-    {0x10A07, 0x10A0B},
-    {0x10A14, 0x10A14},
-    {0x10A18, 0x10A18},
-    {0x10A36, 0x10A37},
-    {0x10A3B, 0x10A3E},
-    {0x10A49, 0x10A4F},
-    {0x10A59, 0x10A5F},
-    {0x10AA0, 0x10ABF},
-    {0x10AE7, 0x10AEA},
-    {0x10AF7, 0x10AFF},
-    {0x10B36, 0x10B38},
-    {0x10B56, 0x10B57},
-    {0x10B73, 0x10B77},
-    {0x10B92, 0x10B98},
-    {0x10B9D, 0x10BA8},
-    {0x10BB0, 0x10BFF},
-    {0x10C49, 0x10C7F},
-    {0x10CB3, 0x10CBF},
-    {0x10CF3, 0x10CF9},
-    {0x10D28, 0x10D2F},
-    {0x10D3A, 0x10D3F},
-    {0x10D66, 0x10D68},
-    {0x10D86, 0x10D8D},
-    {0x10D90, 0x10E5F},
-    {0x10E7F, 0x10E7F},
-    {0x10EAA, 0x10EAA},
-    {0x10EAE, 0x10EAF},
-    {0x10EB2, 0x10EC1},
-    {0x10EC5, 0x10EFB},
-    {0x10F28, 0x10F2F},
-    {0x10F5A, 0x10F6F},
-    {0x10F8A, 0x10FAF},
-    {0x10FCC, 0x10FDF},
-    {0x10FF7, 0x10FFF},
-    {0x1104E, 0x11051},
-    {0x11076, 0x1107E},
-    {0x110C3, 0x110CC},
-    {0x110CE, 0x110CF},
-    {0x110E9, 0x110EF},
-    {0x110FA, 0x110FF},
-    {0x11135, 0x11135},
-    {0x11148, 0x1114F},
-    {0x11177, 0x1117F},
-    {0x111E0, 0x111E0},
-    {0x111F5, 0x111FF},
-    {0x11212, 0x11212},
-    {0x11242, 0x1127F},
-    {0x11287, 0x11287},
-    {0x11289, 0x11289},
-    {0x1128E, 0x1128E},
-    {0x1129E, 0x1129E},
-    {0x112AA, 0x112AF},
-    {0x112EB, 0x112EF},
-    {0x112FA, 0x112FF},
-    {0x11304, 0x11304},
-    {0x1130D, 0x1130E},
-    {0x11311, 0x11312},
-    {0x11329, 0x11329},
-    {0x11331, 0x11331},
-    {0x11334, 0x11334},
-    {0x1133A, 0x1133A},
-    {0x11345, 0x11346},
-    {0x11349, 0x1134A},
-    {0x1134E, 0x1134F},
-    {0x11351, 0x11356},
-    {0x11358, 0x1135C},
-    {0x11364, 0x11365},
-    {0x1136D, 0x1136F},
-    {0x11375, 0x1137F},
-    {0x1138A, 0x1138A},
-    {0x1138C, 0x1138D},
-    {0x1138F, 0x1138F},
-    {0x113B6, 0x113B6},
-    {0x113C1, 0x113C1},
-    {0x113C3, 0x113C4},
-    {0x113C6, 0x113C6},
-    {0x113CB, 0x113CB},
-    {0x113D6, 0x113D6},
-    {0x113D9, 0x113E0},
-    {0x113E3, 0x113FF},
-    {0x1145C, 0x1145C},
-    {0x11462, 0x1147F},
-    {0x114C8, 0x114CF},
-    {0x114DA, 0x1157F},
-    {0x115B6, 0x115B7},
-    {0x115DE, 0x115FF},
-    {0x11645, 0x1164F},
-    {0x1165A, 0x1165F},
-    {0x1166D, 0x1167F},
-    {0x116BA, 0x116BF},
-    {0x116CA, 0x116CF},
-    {0x116E4, 0x116FF},
-    {0x1171B, 0x1171C},
-    {0x1172C, 0x1172F},
-    {0x11747, 0x117FF},
-    {0x1183C, 0x1189F},
-    {0x118F3, 0x118FE},
-    {0x11907, 0x11908},
-    {0x1190A, 0x1190B},
-    {0x11914, 0x11914},
-    {0x11917, 0x11917},
-    {0x11936, 0x11936},
-    {0x11939, 0x1193A},
-    {0x11947, 0x1194F},
-    {0x1195A, 0x1199F},
-    {0x119A8, 0x119A9},
-    {0x119D8, 0x119D9},
-    {0x119E5, 0x119FF},
-    {0x11A48, 0x11A4F},
-    {0x11AA3, 0x11AAF},
-    {0x11AF9, 0x11AFF},
-    {0x11B0A, 0x11BBF},
-    {0x11BE2, 0x11BEF},
-    {0x11BFA, 0x11BFF},
-    {0x11C09, 0x11C09},
-    {0x11C37, 0x11C37},
-    {0x11C46, 0x11C4F},
-    {0x11C6D, 0x11C6F},
-    {0x11C90, 0x11C91},
-    {0x11CA8, 0x11CA8},
-    {0x11CB7, 0x11CFF},
-    {0x11D07, 0x11D07},
-    {0x11D0A, 0x11D0A},
-    {0x11D37, 0x11D39},
-    {0x11D3B, 0x11D3B},
-    {0x11D3E, 0x11D3E},
-    {0x11D48, 0x11D4F},
-    {0x11D5A, 0x11D5F},
-    {0x11D66, 0x11D66},
-    {0x11D69, 0x11D69},
-    {0x11D8F, 0x11D8F},
-    {0x11D92, 0x11D92},
-    {0x11D99, 0x11D9F},
-    {0x11DAA, 0x11EDF},
-    {0x11EF9, 0x11EFF},
-    {0x11F11, 0x11F11},
-    {0x11F3B, 0x11F3D},
-    {0x11F5B, 0x11FAF},
-    {0x11FB1, 0x11FBF},
-    {0x11FF2, 0x11FFE},
-    {0x1239A, 0x123FF},
-    {0x1246F, 0x1246F},
-    {0x12475, 0x1247F},
-    {0x12544, 0x12F8F},
-    {0x12FF3, 0x12FFF},
-    {0x13456, 0x1345F},
-    {0x143FB, 0x143FF},
-    {0x14647, 0x160FF},
-    {0x1613A, 0x167FF},
-    {0x16A39, 0x16A3F},
-    {0x16A5F, 0x16A5F},
-    {0x16A6A, 0x16A6D},
-    {0x16ABF, 0x16ABF},
-    {0x16ACA, 0x16ACF},
-    {0x16AEE, 0x16AEF},
-    {0x16AF6, 0x16AFF},
-    {0x16B46, 0x16B4F},
-    {0x16B5A, 0x16B5A},
-    {0x16B62, 0x16B62},
-    {0x16B78, 0x16B7C},
-    {0x16B90, 0x16D3F},
-    {0x16D7A, 0x16E3F},
-    {0x16E9B, 0x16EFF},
-    {0x16F4B, 0x16F4E},
-    {0x16F88, 0x16F8E},
-    {0x16FA0, 0x16FDF},
-    {0x16FE5, 0x16FEF},
-    {0x16FF2, 0x16FFF},
-    {0x17001, 0x187F6},
-    {0x187F8, 0x187FF},
-    {0x18CD6, 0x18CFE},
-    {0x18D01, 0x18D07},
-    {0x18D09, 0x1AFEF},
-    {0x1AFF4, 0x1AFF4},
-    {0x1AFFC, 0x1AFFC},
-    {0x1AFFF, 0x1AFFF},
-    {0x1B123, 0x1B131},
-    {0x1B133, 0x1B14F},
-    {0x1B153, 0x1B154},
-    {0x1B156, 0x1B163},
-    {0x1B168, 0x1B16F},
-    {0x1B2FC, 0x1BBFF},
-    {0x1BC6B, 0x1BC6F},
-    {0x1BC7D, 0x1BC7F},
-    {0x1BC89, 0x1BC8F},
-    {0x1BC9A, 0x1BC9B},
-    {0x1BCA4, 0x1CBFF},
-    {0x1CCFA, 0x1CCFF},
-    {0x1CEB4, 0x1CEFF},
-    {0x1CF2E, 0x1CF2F},
-    {0x1CF47, 0x1CF4F},
-    {0x1CFC4, 0x1CFFF},
-    {0x1D0F6, 0x1D0FF},
-    {0x1D127, 0x1D128},
-    {0x1D1EB, 0x1D1FF},
-    {0x1D246, 0x1D2BF},
-    {0x1D2D4, 0x1D2DF},
-    {0x1D2F4, 0x1D2FF},
-    {0x1D357, 0x1D35F},
-    {0x1D379, 0x1D3FF},
-    {0x1D455, 0x1D455},
-    {0x1D49D, 0x1D49D},
-    {0x1D4A0, 0x1D4A1},
-    {0x1D4A3, 0x1D4A4},
-    {0x1D4A7, 0x1D4A8},
-    {0x1D4AD, 0x1D4AD},
-    {0x1D4BA, 0x1D4BA},
-    {0x1D4BC, 0x1D4BC},
-    {0x1D4C4, 0x1D4C4},
-    {0x1D506, 0x1D506},
-    {0x1D50B, 0x1D50C},
-    {0x1D515, 0x1D515},
-    {0x1D51D, 0x1D51D},
-    {0x1D53A, 0x1D53A},
-    {0x1D53F, 0x1D53F},
-    {0x1D545, 0x1D545},
-    {0x1D547, 0x1D549},
-    {0x1D551, 0x1D551},
-    {0x1D6A6, 0x1D6A7},
-    {0x1D7CC, 0x1D7CD},
-    {0x1DA8C, 0x1DA9A},
-    {0x1DAA0, 0x1DAA0},
-    {0x1DAB0, 0x1DEFF},
-    {0x1DF1F, 0x1DF24},
-    {0x1DF2B, 0x1DFFF},
-    {0x1E007, 0x1E007},
-    {0x1E019, 0x1E01A},
-    {0x1E022, 0x1E022},
-    {0x1E025, 0x1E025},
-    {0x1E02B, 0x1E02F},
-    {0x1E06E, 0x1E08E},
-    {0x1E090, 0x1E0FF},
-    {0x1E12D, 0x1E12F},
-    {0x1E13E, 0x1E13F},
-    {0x1E14A, 0x1E14D},
-    {0x1E150, 0x1E28F},
-    {0x1E2AF, 0x1E2BF},
-    {0x1E2FA, 0x1E2FE},
-    {0x1E300, 0x1E4CF},
-    {0x1E4FA, 0x1E5CF},
-    {0x1E5FB, 0x1E5FE},
-    {0x1E600, 0x1E7DF},
-    {0x1E7E7, 0x1E7E7},
-    {0x1E7EC, 0x1E7EC},
-    {0x1E7EF, 0x1E7EF},
-    {0x1E7FF, 0x1E7FF},
-    {0x1E8C5, 0x1E8C6},
-    {0x1E8D7, 0x1E8FF},
-    {0x1E94C, 0x1E94F},
-    {0x1E95A, 0x1E95D},
-    {0x1E960, 0x1EC70},
-    {0x1ECB5, 0x1ED00},
-    {0x1ED3E, 0x1EDFF},
-    {0x1EE04, 0x1EE04},
-    {0x1EE20, 0x1EE20},
-    {0x1EE23, 0x1EE23},
-    {0x1EE25, 0x1EE26},
-    {0x1EE28, 0x1EE28},
-    {0x1EE33, 0x1EE33},
-    {0x1EE38, 0x1EE38},
-    {0x1EE3A, 0x1EE3A},
-    {0x1EE3C, 0x1EE41},
-    {0x1EE43, 0x1EE46},
-    {0x1EE48, 0x1EE48},
-    {0x1EE4A, 0x1EE4A},
-    {0x1EE4C, 0x1EE4C},
-    {0x1EE50, 0x1EE50},
-    {0x1EE53, 0x1EE53},
-    {0x1EE55, 0x1EE56},
-    {0x1EE58, 0x1EE58},
-    {0x1EE5A, 0x1EE5A},
-    {0x1EE5C, 0x1EE5C},
-    {0x1EE5E, 0x1EE5E},
-    {0x1EE60, 0x1EE60},
-    {0x1EE63, 0x1EE63},
-    {0x1EE65, 0x1EE66},
-    {0x1EE6B, 0x1EE6B},
-    {0x1EE73, 0x1EE73},
-    {0x1EE78, 0x1EE78},
-    {0x1EE7D, 0x1EE7D},
-    {0x1EE7F, 0x1EE7F},
-    {0x1EE8A, 0x1EE8A},
-    {0x1EE9C, 0x1EEA0},
-    {0x1EEA4, 0x1EEA4},
-    {0x1EEAA, 0x1EEAA},
-    {0x1EEBC, 0x1EEEF},
-    {0x1EEF2, 0x1EFFF},
-    {0x1F02C, 0x1F02F},
-    {0x1F094, 0x1F09F},
-    {0x1F0AF, 0x1F0B0},
-    {0x1F0C0, 0x1F0C0},
-    {0x1F0D0, 0x1F0D0},
-    {0x1F0F6, 0x1F0FF},
-    {0x1F1AE, 0x1F1E5},
-    {0x1F203, 0x1F20F},
-    {0x1F23C, 0x1F23F},
-    {0x1F249, 0x1F24F},
-    {0x1F252, 0x1F25F},
-    {0x1F266, 0x1F2FF},
-    {0x1F6D8, 0x1F6DB},
-    {0x1F6ED, 0x1F6EF},
-    {0x1F6FD, 0x1F6FF},
-    {0x1F777, 0x1F77A},
-    {0x1F7DA, 0x1F7DF},
-    {0x1F7EC, 0x1F7EF},
-    {0x1F7F1, 0x1F7FF},
-    {0x1F80C, 0x1F80F},
-    {0x1F848, 0x1F84F},
-    {0x1F85A, 0x1F85F},
-    {0x1F888, 0x1F88F},
-    {0x1F8AE, 0x1F8AF},
-    {0x1F8BC, 0x1F8BF},
-    {0x1F8C2, 0x1F8FF},
-    {0x1FA54, 0x1FA5F},
-    {0x1FA6E, 0x1FA6F},
-    {0x1FA7D, 0x1FA7F},
-    {0x1FA8A, 0x1FA8E},
-    {0x1FAC7, 0x1FACD},
-    {0x1FADD, 0x1FADE},
-    {0x1FAEA, 0x1FAEF},
-    {0x1FAF9, 0x1FAFF},
-    {0x1FB93, 0x1FB93},
-    {0x1FBFA, 0x1FFFD},
-    {0x20001, 0x2A6DE},
-    {0x2A6E0, 0x2A6FF},
-    {0x2A701, 0x2B738},
-    {0x2B73A, 0x2B73F},
-    {0x2B741, 0x2B81C},
-    {0x2B81E, 0x2B81F},
-    {0x2B821, 0x2CEA0},
-    {0x2CEA2, 0x2CEAF},
-    {0x2CEB1, 0x2EBDF},
-    {0x2EBE1, 0x2EBEF},
-    {0x2EBF1, 0x2EE5C},
-    {0x2EE5E, 0x2F7FF},
-    {0x2FA1E, 0x2FFFD},
-    {0x30001, 0x31349},
-    {0x3134B, 0x3134F},
-    {0x31351, 0x323AE},
-    {0x323B0, 0x3FFFD},
-    {0x40000, 0x4FFFD},
-    {0x50000, 0x5FFFD},
-    {0x60000, 0x6FFFD},
-    {0x70000, 0x7FFFD},
-    {0x80000, 0x8FFFD},
-    {0x90000, 0x9FFFD},
-    {0xA0000, 0xAFFFD},
-    {0xB0000, 0xBFFFD},
-    {0xC0000, 0xCFFFD},
-    {0xD0000, 0xDFFFD},
-    {0xE0000, 0xE0000},
-    {0xE0002, 0xE001F},
-    {0xE0080, 0xE00FF},
-    {0xE01F0, 0xEFFFD}
-};
+    {0x00378, 0x00379}, {0x00380, 0x00383}, {0x0038B, 0x0038B}, {0x0038D, 0x0038D}, {0x003A2, 0x003A2},
+    {0x00530, 0x00530}, {0x00557, 0x00558}, {0x0058B, 0x0058C}, {0x00590, 0x00590}, {0x005C8, 0x005CF},
+    {0x005EB, 0x005EE}, {0x005F5, 0x005FF}, {0x0070E, 0x0070E}, {0x0074B, 0x0074C}, {0x007B2, 0x007BF},
+    {0x007FB, 0x007FC}, {0x0082E, 0x0082F}, {0x0083F, 0x0083F}, {0x0085C, 0x0085D}, {0x0085F, 0x0085F},
+    {0x0086B, 0x0086F}, {0x0088F, 0x0088F}, {0x00892, 0x00896}, {0x00984, 0x00984}, {0x0098D, 0x0098E},
+    {0x00991, 0x00992}, {0x009A9, 0x009A9}, {0x009B1, 0x009B1}, {0x009B3, 0x009B5}, {0x009BA, 0x009BB},
+    {0x009C5, 0x009C6}, {0x009C9, 0x009CA}, {0x009CF, 0x009D6}, {0x009D8, 0x009DB}, {0x009DE, 0x009DE},
+    {0x009E4, 0x009E5}, {0x009FF, 0x00A00}, {0x00A04, 0x00A04}, {0x00A0B, 0x00A0E}, {0x00A11, 0x00A12},
+    {0x00A29, 0x00A29}, {0x00A31, 0x00A31}, {0x00A34, 0x00A34}, {0x00A37, 0x00A37}, {0x00A3A, 0x00A3B},
+    {0x00A3D, 0x00A3D}, {0x00A43, 0x00A46}, {0x00A49, 0x00A4A}, {0x00A4E, 0x00A50}, {0x00A52, 0x00A58},
+    {0x00A5D, 0x00A5D}, {0x00A5F, 0x00A65}, {0x00A77, 0x00A80}, {0x00A84, 0x00A84}, {0x00A8E, 0x00A8E},
+    {0x00A92, 0x00A92}, {0x00AA9, 0x00AA9}, {0x00AB1, 0x00AB1}, {0x00AB4, 0x00AB4}, {0x00ABA, 0x00ABB},
+    {0x00AC6, 0x00AC6}, {0x00ACA, 0x00ACA}, {0x00ACE, 0x00ACF}, {0x00AD1, 0x00ADF}, {0x00AE4, 0x00AE5},
+    {0x00AF2, 0x00AF8}, {0x00B00, 0x00B00}, {0x00B04, 0x00B04}, {0x00B0D, 0x00B0E}, {0x00B11, 0x00B12},
+    {0x00B29, 0x00B29}, {0x00B31, 0x00B31}, {0x00B34, 0x00B34}, {0x00B3A, 0x00B3B}, {0x00B45, 0x00B46},
+    {0x00B49, 0x00B4A}, {0x00B4E, 0x00B54}, {0x00B58, 0x00B5B}, {0x00B5E, 0x00B5E}, {0x00B64, 0x00B65},
+    {0x00B78, 0x00B81}, {0x00B84, 0x00B84}, {0x00B8B, 0x00B8D}, {0x00B91, 0x00B91}, {0x00B96, 0x00B98},
+    {0x00B9B, 0x00B9B}, {0x00B9D, 0x00B9D}, {0x00BA0, 0x00BA2}, {0x00BA5, 0x00BA7}, {0x00BAB, 0x00BAD},
+    {0x00BBA, 0x00BBD}, {0x00BC3, 0x00BC5}, {0x00BC9, 0x00BC9}, {0x00BCE, 0x00BCF}, {0x00BD1, 0x00BD6},
+    {0x00BD8, 0x00BE5}, {0x00BFB, 0x00BFF}, {0x00C0D, 0x00C0D}, {0x00C11, 0x00C11}, {0x00C29, 0x00C29},
+    {0x00C3A, 0x00C3B}, {0x00C45, 0x00C45}, {0x00C49, 0x00C49}, {0x00C4E, 0x00C54}, {0x00C57, 0x00C57},
+    {0x00C5B, 0x00C5C}, {0x00C5E, 0x00C5F}, {0x00C64, 0x00C65}, {0x00C70, 0x00C76}, {0x00C8D, 0x00C8D},
+    {0x00C91, 0x00C91}, {0x00CA9, 0x00CA9}, {0x00CB4, 0x00CB4}, {0x00CBA, 0x00CBB}, {0x00CC5, 0x00CC5},
+    {0x00CC9, 0x00CC9}, {0x00CCE, 0x00CD4}, {0x00CD7, 0x00CDC}, {0x00CDF, 0x00CDF}, {0x00CE4, 0x00CE5},
+    {0x00CF0, 0x00CF0}, {0x00CF4, 0x00CFF}, {0x00D0D, 0x00D0D}, {0x00D11, 0x00D11}, {0x00D45, 0x00D45},
+    {0x00D49, 0x00D49}, {0x00D50, 0x00D53}, {0x00D64, 0x00D65}, {0x00D80, 0x00D80}, {0x00D84, 0x00D84},
+    {0x00D97, 0x00D99}, {0x00DB2, 0x00DB2}, {0x00DBC, 0x00DBC}, {0x00DBE, 0x00DBF}, {0x00DC7, 0x00DC9},
+    {0x00DCB, 0x00DCE}, {0x00DD5, 0x00DD5}, {0x00DD7, 0x00DD7}, {0x00DE0, 0x00DE5}, {0x00DF0, 0x00DF1},
+    {0x00DF5, 0x00E00}, {0x00E3B, 0x00E3E}, {0x00E5C, 0x00E80}, {0x00E83, 0x00E83}, {0x00E85, 0x00E85},
+    {0x00E8B, 0x00E8B}, {0x00EA4, 0x00EA4}, {0x00EA6, 0x00EA6}, {0x00EBE, 0x00EBF}, {0x00EC5, 0x00EC5},
+    {0x00EC7, 0x00EC7}, {0x00ECF, 0x00ECF}, {0x00EDA, 0x00EDB}, {0x00EE0, 0x00EFF}, {0x00F48, 0x00F48},
+    {0x00F6D, 0x00F70}, {0x00F98, 0x00F98}, {0x00FBD, 0x00FBD}, {0x00FCD, 0x00FCD}, {0x00FDB, 0x00FFF},
+    {0x010C6, 0x010C6}, {0x010C8, 0x010CC}, {0x010CE, 0x010CF}, {0x01249, 0x01249}, {0x0124E, 0x0124F},
+    {0x01257, 0x01257}, {0x01259, 0x01259}, {0x0125E, 0x0125F}, {0x01289, 0x01289}, {0x0128E, 0x0128F},
+    {0x012B1, 0x012B1}, {0x012B6, 0x012B7}, {0x012BF, 0x012BF}, {0x012C1, 0x012C1}, {0x012C6, 0x012C7},
+    {0x012D7, 0x012D7}, {0x01311, 0x01311}, {0x01316, 0x01317}, {0x0135B, 0x0135C}, {0x0137D, 0x0137F},
+    {0x0139A, 0x0139F}, {0x013F6, 0x013F7}, {0x013FE, 0x013FF}, {0x0169D, 0x0169F}, {0x016F9, 0x016FF},
+    {0x01716, 0x0171E}, {0x01737, 0x0173F}, {0x01754, 0x0175F}, {0x0176D, 0x0176D}, {0x01771, 0x01771},
+    {0x01774, 0x0177F}, {0x017DE, 0x017DF}, {0x017EA, 0x017EF}, {0x017FA, 0x017FF}, {0x0181A, 0x0181F},
+    {0x01879, 0x0187F}, {0x018AB, 0x018AF}, {0x018F6, 0x018FF}, {0x0191F, 0x0191F}, {0x0192C, 0x0192F},
+    {0x0193C, 0x0193F}, {0x01941, 0x01943}, {0x0196E, 0x0196F}, {0x01975, 0x0197F}, {0x019AC, 0x019AF},
+    {0x019CA, 0x019CF}, {0x019DB, 0x019DD}, {0x01A1C, 0x01A1D}, {0x01A5F, 0x01A5F}, {0x01A7D, 0x01A7E},
+    {0x01A8A, 0x01A8F}, {0x01A9A, 0x01A9F}, {0x01AAE, 0x01AAF}, {0x01ACF, 0x01AFF}, {0x01B4D, 0x01B4D},
+    {0x01BF4, 0x01BFB}, {0x01C38, 0x01C3A}, {0x01C4A, 0x01C4C}, {0x01C8B, 0x01C8F}, {0x01CBB, 0x01CBC},
+    {0x01CC8, 0x01CCF}, {0x01CFB, 0x01CFF}, {0x01F16, 0x01F17}, {0x01F1E, 0x01F1F}, {0x01F46, 0x01F47},
+    {0x01F4E, 0x01F4F}, {0x01F58, 0x01F58}, {0x01F5A, 0x01F5A}, {0x01F5C, 0x01F5C}, {0x01F5E, 0x01F5E},
+    {0x01F7E, 0x01F7F}, {0x01FB5, 0x01FB5}, {0x01FC5, 0x01FC5}, {0x01FD4, 0x01FD5}, {0x01FDC, 0x01FDC},
+    {0x01FF0, 0x01FF1}, {0x01FF5, 0x01FF5}, {0x01FFF, 0x01FFF}, {0x02065, 0x02065}, {0x02072, 0x02073},
+    {0x0208F, 0x0208F}, {0x0209D, 0x0209F}, {0x020C1, 0x020CF}, {0x020F1, 0x020FF}, {0x0218C, 0x0218F},
+    {0x0242A, 0x0243F}, {0x0244B, 0x0245F}, {0x02B74, 0x02B75}, {0x02B96, 0x02B96}, {0x02CF4, 0x02CF8},
+    {0x02D26, 0x02D26}, {0x02D28, 0x02D2C}, {0x02D2E, 0x02D2F}, {0x02D68, 0x02D6E}, {0x02D71, 0x02D7E},
+    {0x02D97, 0x02D9F}, {0x02DA7, 0x02DA7}, {0x02DAF, 0x02DAF}, {0x02DB7, 0x02DB7}, {0x02DBF, 0x02DBF},
+    {0x02DC7, 0x02DC7}, {0x02DCF, 0x02DCF}, {0x02DD7, 0x02DD7}, {0x02DDF, 0x02DDF}, {0x02E5E, 0x02E7F},
+    {0x02E9A, 0x02E9A}, {0x02EF4, 0x02EFF}, {0x02FD6, 0x02FEF}, {0x03040, 0x03040}, {0x03097, 0x03098},
+    {0x03100, 0x03104}, {0x03130, 0x03130}, {0x0318F, 0x0318F}, {0x031E6, 0x031EE}, {0x0321F, 0x0321F},
+    {0x03401, 0x04DBE}, {0x04E01, 0x09FFE}, {0x0A48D, 0x0A48F}, {0x0A4C7, 0x0A4CF}, {0x0A62C, 0x0A63F},
+    {0x0A6F8, 0x0A6FF}, {0x0A7CE, 0x0A7CF}, {0x0A7D2, 0x0A7D2}, {0x0A7D4, 0x0A7D4}, {0x0A7DD, 0x0A7F1},
+    {0x0A82D, 0x0A82F}, {0x0A83A, 0x0A83F}, {0x0A878, 0x0A87F}, {0x0A8C6, 0x0A8CD}, {0x0A8DA, 0x0A8DF},
+    {0x0A954, 0x0A95E}, {0x0A97D, 0x0A97F}, {0x0A9CE, 0x0A9CE}, {0x0A9DA, 0x0A9DD}, {0x0A9FF, 0x0A9FF},
+    {0x0AA37, 0x0AA3F}, {0x0AA4E, 0x0AA4F}, {0x0AA5A, 0x0AA5B}, {0x0AAC3, 0x0AADA}, {0x0AAF7, 0x0AB00},
+    {0x0AB07, 0x0AB08}, {0x0AB0F, 0x0AB10}, {0x0AB17, 0x0AB1F}, {0x0AB27, 0x0AB27}, {0x0AB2F, 0x0AB2F},
+    {0x0AB6C, 0x0AB6F}, {0x0ABEE, 0x0ABEF}, {0x0ABFA, 0x0ABFF}, {0x0AC01, 0x0D7A2}, {0x0D7A4, 0x0D7AF},
+    {0x0D7C7, 0x0D7CA}, {0x0D7FC, 0x0D7FF}, {0x0FA6E, 0x0FA6F}, {0x0FADA, 0x0FAFF}, {0x0FB07, 0x0FB12},
+    {0x0FB18, 0x0FB1C}, {0x0FB37, 0x0FB37}, {0x0FB3D, 0x0FB3D}, {0x0FB3F, 0x0FB3F}, {0x0FB42, 0x0FB42},
+    {0x0FB45, 0x0FB45}, {0x0FBC3, 0x0FBD2}, {0x0FD90, 0x0FD91}, {0x0FDC8, 0x0FDCE}, {0x0FE1A, 0x0FE1F},
+    {0x0FE53, 0x0FE53}, {0x0FE67, 0x0FE67}, {0x0FE6C, 0x0FE6F}, {0x0FE75, 0x0FE75}, {0x0FEFD, 0x0FEFE},
+    {0x0FF00, 0x0FF00}, {0x0FFBF, 0x0FFC1}, {0x0FFC8, 0x0FFC9}, {0x0FFD0, 0x0FFD1}, {0x0FFD8, 0x0FFD9},
+    {0x0FFDD, 0x0FFDF}, {0x0FFE7, 0x0FFE7}, {0x0FFEF, 0x0FFF8}, {0x1000C, 0x1000C}, {0x10027, 0x10027},
+    {0x1003B, 0x1003B}, {0x1003E, 0x1003E}, {0x1004E, 0x1004F}, {0x1005E, 0x1007F}, {0x100FB, 0x100FF},
+    {0x10103, 0x10106}, {0x10134, 0x10136}, {0x1018F, 0x1018F}, {0x1019D, 0x1019F}, {0x101A1, 0x101CF},
+    {0x101FE, 0x1027F}, {0x1029D, 0x1029F}, {0x102D1, 0x102DF}, {0x102FC, 0x102FF}, {0x10324, 0x1032C},
+    {0x1034B, 0x1034F}, {0x1037B, 0x1037F}, {0x1039E, 0x1039E}, {0x103C4, 0x103C7}, {0x103D6, 0x103FF},
+    {0x1049E, 0x1049F}, {0x104AA, 0x104AF}, {0x104D4, 0x104D7}, {0x104FC, 0x104FF}, {0x10528, 0x1052F},
+    {0x10564, 0x1056E}, {0x1057B, 0x1057B}, {0x1058B, 0x1058B}, {0x10593, 0x10593}, {0x10596, 0x10596},
+    {0x105A2, 0x105A2}, {0x105B2, 0x105B2}, {0x105BA, 0x105BA}, {0x105BD, 0x105BF}, {0x105F4, 0x105FF},
+    {0x10737, 0x1073F}, {0x10756, 0x1075F}, {0x10768, 0x1077F}, {0x10786, 0x10786}, {0x107B1, 0x107B1},
+    {0x107BB, 0x107FF}, {0x10806, 0x10807}, {0x10809, 0x10809}, {0x10836, 0x10836}, {0x10839, 0x1083B},
+    {0x1083D, 0x1083E}, {0x10856, 0x10856}, {0x1089F, 0x108A6}, {0x108B0, 0x108DF}, {0x108F3, 0x108F3},
+    {0x108F6, 0x108FA}, {0x1091C, 0x1091E}, {0x1093A, 0x1093E}, {0x10940, 0x1097F}, {0x109B8, 0x109BB},
+    {0x109D0, 0x109D1}, {0x10A04, 0x10A04}, {0x10A07, 0x10A0B}, {0x10A14, 0x10A14}, {0x10A18, 0x10A18},
+    {0x10A36, 0x10A37}, {0x10A3B, 0x10A3E}, {0x10A49, 0x10A4F}, {0x10A59, 0x10A5F}, {0x10AA0, 0x10ABF},
+    {0x10AE7, 0x10AEA}, {0x10AF7, 0x10AFF}, {0x10B36, 0x10B38}, {0x10B56, 0x10B57}, {0x10B73, 0x10B77},
+    {0x10B92, 0x10B98}, {0x10B9D, 0x10BA8}, {0x10BB0, 0x10BFF}, {0x10C49, 0x10C7F}, {0x10CB3, 0x10CBF},
+    {0x10CF3, 0x10CF9}, {0x10D28, 0x10D2F}, {0x10D3A, 0x10D3F}, {0x10D66, 0x10D68}, {0x10D86, 0x10D8D},
+    {0x10D90, 0x10E5F}, {0x10E7F, 0x10E7F}, {0x10EAA, 0x10EAA}, {0x10EAE, 0x10EAF}, {0x10EB2, 0x10EC1},
+    {0x10EC5, 0x10EFB}, {0x10F28, 0x10F2F}, {0x10F5A, 0x10F6F}, {0x10F8A, 0x10FAF}, {0x10FCC, 0x10FDF},
+    {0x10FF7, 0x10FFF}, {0x1104E, 0x11051}, {0x11076, 0x1107E}, {0x110C3, 0x110CC}, {0x110CE, 0x110CF},
+    {0x110E9, 0x110EF}, {0x110FA, 0x110FF}, {0x11135, 0x11135}, {0x11148, 0x1114F}, {0x11177, 0x1117F},
+    {0x111E0, 0x111E0}, {0x111F5, 0x111FF}, {0x11212, 0x11212}, {0x11242, 0x1127F}, {0x11287, 0x11287},
+    {0x11289, 0x11289}, {0x1128E, 0x1128E}, {0x1129E, 0x1129E}, {0x112AA, 0x112AF}, {0x112EB, 0x112EF},
+    {0x112FA, 0x112FF}, {0x11304, 0x11304}, {0x1130D, 0x1130E}, {0x11311, 0x11312}, {0x11329, 0x11329},
+    {0x11331, 0x11331}, {0x11334, 0x11334}, {0x1133A, 0x1133A}, {0x11345, 0x11346}, {0x11349, 0x1134A},
+    {0x1134E, 0x1134F}, {0x11351, 0x11356}, {0x11358, 0x1135C}, {0x11364, 0x11365}, {0x1136D, 0x1136F},
+    {0x11375, 0x1137F}, {0x1138A, 0x1138A}, {0x1138C, 0x1138D}, {0x1138F, 0x1138F}, {0x113B6, 0x113B6},
+    {0x113C1, 0x113C1}, {0x113C3, 0x113C4}, {0x113C6, 0x113C6}, {0x113CB, 0x113CB}, {0x113D6, 0x113D6},
+    {0x113D9, 0x113E0}, {0x113E3, 0x113FF}, {0x1145C, 0x1145C}, {0x11462, 0x1147F}, {0x114C8, 0x114CF},
+    {0x114DA, 0x1157F}, {0x115B6, 0x115B7}, {0x115DE, 0x115FF}, {0x11645, 0x1164F}, {0x1165A, 0x1165F},
+    {0x1166D, 0x1167F}, {0x116BA, 0x116BF}, {0x116CA, 0x116CF}, {0x116E4, 0x116FF}, {0x1171B, 0x1171C},
+    {0x1172C, 0x1172F}, {0x11747, 0x117FF}, {0x1183C, 0x1189F}, {0x118F3, 0x118FE}, {0x11907, 0x11908},
+    {0x1190A, 0x1190B}, {0x11914, 0x11914}, {0x11917, 0x11917}, {0x11936, 0x11936}, {0x11939, 0x1193A},
+    {0x11947, 0x1194F}, {0x1195A, 0x1199F}, {0x119A8, 0x119A9}, {0x119D8, 0x119D9}, {0x119E5, 0x119FF},
+    {0x11A48, 0x11A4F}, {0x11AA3, 0x11AAF}, {0x11AF9, 0x11AFF}, {0x11B0A, 0x11BBF}, {0x11BE2, 0x11BEF},
+    {0x11BFA, 0x11BFF}, {0x11C09, 0x11C09}, {0x11C37, 0x11C37}, {0x11C46, 0x11C4F}, {0x11C6D, 0x11C6F},
+    {0x11C90, 0x11C91}, {0x11CA8, 0x11CA8}, {0x11CB7, 0x11CFF}, {0x11D07, 0x11D07}, {0x11D0A, 0x11D0A},
+    {0x11D37, 0x11D39}, {0x11D3B, 0x11D3B}, {0x11D3E, 0x11D3E}, {0x11D48, 0x11D4F}, {0x11D5A, 0x11D5F},
+    {0x11D66, 0x11D66}, {0x11D69, 0x11D69}, {0x11D8F, 0x11D8F}, {0x11D92, 0x11D92}, {0x11D99, 0x11D9F},
+    {0x11DAA, 0x11EDF}, {0x11EF9, 0x11EFF}, {0x11F11, 0x11F11}, {0x11F3B, 0x11F3D}, {0x11F5B, 0x11FAF},
+    {0x11FB1, 0x11FBF}, {0x11FF2, 0x11FFE}, {0x1239A, 0x123FF}, {0x1246F, 0x1246F}, {0x12475, 0x1247F},
+    {0x12544, 0x12F8F}, {0x12FF3, 0x12FFF}, {0x13456, 0x1345F}, {0x143FB, 0x143FF}, {0x14647, 0x160FF},
+    {0x1613A, 0x167FF}, {0x16A39, 0x16A3F}, {0x16A5F, 0x16A5F}, {0x16A6A, 0x16A6D}, {0x16ABF, 0x16ABF},
+    {0x16ACA, 0x16ACF}, {0x16AEE, 0x16AEF}, {0x16AF6, 0x16AFF}, {0x16B46, 0x16B4F}, {0x16B5A, 0x16B5A},
+    {0x16B62, 0x16B62}, {0x16B78, 0x16B7C}, {0x16B90, 0x16D3F}, {0x16D7A, 0x16E3F}, {0x16E9B, 0x16EFF},
+    {0x16F4B, 0x16F4E}, {0x16F88, 0x16F8E}, {0x16FA0, 0x16FDF}, {0x16FE5, 0x16FEF}, {0x16FF2, 0x16FFF},
+    {0x17001, 0x187F6}, {0x187F8, 0x187FF}, {0x18CD6, 0x18CFE}, {0x18D01, 0x18D07}, {0x18D09, 0x1AFEF},
+    {0x1AFF4, 0x1AFF4}, {0x1AFFC, 0x1AFFC}, {0x1AFFF, 0x1AFFF}, {0x1B123, 0x1B131}, {0x1B133, 0x1B14F},
+    {0x1B153, 0x1B154}, {0x1B156, 0x1B163}, {0x1B168, 0x1B16F}, {0x1B2FC, 0x1BBFF}, {0x1BC6B, 0x1BC6F},
+    {0x1BC7D, 0x1BC7F}, {0x1BC89, 0x1BC8F}, {0x1BC9A, 0x1BC9B}, {0x1BCA4, 0x1CBFF}, {0x1CCFA, 0x1CCFF},
+    {0x1CEB4, 0x1CEFF}, {0x1CF2E, 0x1CF2F}, {0x1CF47, 0x1CF4F}, {0x1CFC4, 0x1CFFF}, {0x1D0F6, 0x1D0FF},
+    {0x1D127, 0x1D128}, {0x1D1EB, 0x1D1FF}, {0x1D246, 0x1D2BF}, {0x1D2D4, 0x1D2DF}, {0x1D2F4, 0x1D2FF},
+    {0x1D357, 0x1D35F}, {0x1D379, 0x1D3FF}, {0x1D455, 0x1D455}, {0x1D49D, 0x1D49D}, {0x1D4A0, 0x1D4A1},
+    {0x1D4A3, 0x1D4A4}, {0x1D4A7, 0x1D4A8}, {0x1D4AD, 0x1D4AD}, {0x1D4BA, 0x1D4BA}, {0x1D4BC, 0x1D4BC},
+    {0x1D4C4, 0x1D4C4}, {0x1D506, 0x1D506}, {0x1D50B, 0x1D50C}, {0x1D515, 0x1D515}, {0x1D51D, 0x1D51D},
+    {0x1D53A, 0x1D53A}, {0x1D53F, 0x1D53F}, {0x1D545, 0x1D545}, {0x1D547, 0x1D549}, {0x1D551, 0x1D551},
+    {0x1D6A6, 0x1D6A7}, {0x1D7CC, 0x1D7CD}, {0x1DA8C, 0x1DA9A}, {0x1DAA0, 0x1DAA0}, {0x1DAB0, 0x1DEFF},
+    {0x1DF1F, 0x1DF24}, {0x1DF2B, 0x1DFFF}, {0x1E007, 0x1E007}, {0x1E019, 0x1E01A}, {0x1E022, 0x1E022},
+    {0x1E025, 0x1E025}, {0x1E02B, 0x1E02F}, {0x1E06E, 0x1E08E}, {0x1E090, 0x1E0FF}, {0x1E12D, 0x1E12F},
+    {0x1E13E, 0x1E13F}, {0x1E14A, 0x1E14D}, {0x1E150, 0x1E28F}, {0x1E2AF, 0x1E2BF}, {0x1E2FA, 0x1E2FE},
+    {0x1E300, 0x1E4CF}, {0x1E4FA, 0x1E5CF}, {0x1E5FB, 0x1E5FE}, {0x1E600, 0x1E7DF}, {0x1E7E7, 0x1E7E7},
+    {0x1E7EC, 0x1E7EC}, {0x1E7EF, 0x1E7EF}, {0x1E7FF, 0x1E7FF}, {0x1E8C5, 0x1E8C6}, {0x1E8D7, 0x1E8FF},
+    {0x1E94C, 0x1E94F}, {0x1E95A, 0x1E95D}, {0x1E960, 0x1EC70}, {0x1ECB5, 0x1ED00}, {0x1ED3E, 0x1EDFF},
+    {0x1EE04, 0x1EE04}, {0x1EE20, 0x1EE20}, {0x1EE23, 0x1EE23}, {0x1EE25, 0x1EE26}, {0x1EE28, 0x1EE28},
+    {0x1EE33, 0x1EE33}, {0x1EE38, 0x1EE38}, {0x1EE3A, 0x1EE3A}, {0x1EE3C, 0x1EE41}, {0x1EE43, 0x1EE46},
+    {0x1EE48, 0x1EE48}, {0x1EE4A, 0x1EE4A}, {0x1EE4C, 0x1EE4C}, {0x1EE50, 0x1EE50}, {0x1EE53, 0x1EE53},
+    {0x1EE55, 0x1EE56}, {0x1EE58, 0x1EE58}, {0x1EE5A, 0x1EE5A}, {0x1EE5C, 0x1EE5C}, {0x1EE5E, 0x1EE5E},
+    {0x1EE60, 0x1EE60}, {0x1EE63, 0x1EE63}, {0x1EE65, 0x1EE66}, {0x1EE6B, 0x1EE6B}, {0x1EE73, 0x1EE73},
+    {0x1EE78, 0x1EE78}, {0x1EE7D, 0x1EE7D}, {0x1EE7F, 0x1EE7F}, {0x1EE8A, 0x1EE8A}, {0x1EE9C, 0x1EEA0},
+    {0x1EEA4, 0x1EEA4}, {0x1EEAA, 0x1EEAA}, {0x1EEBC, 0x1EEEF}, {0x1EEF2, 0x1EFFF}, {0x1F02C, 0x1F02F},
+    {0x1F094, 0x1F09F}, {0x1F0AF, 0x1F0B0}, {0x1F0C0, 0x1F0C0}, {0x1F0D0, 0x1F0D0}, {0x1F0F6, 0x1F0FF},
+    {0x1F1AE, 0x1F1E5}, {0x1F203, 0x1F20F}, {0x1F23C, 0x1F23F}, {0x1F249, 0x1F24F}, {0x1F252, 0x1F25F},
+    {0x1F266, 0x1F2FF}, {0x1F6D8, 0x1F6DB}, {0x1F6ED, 0x1F6EF}, {0x1F6FD, 0x1F6FF}, {0x1F777, 0x1F77A},
+    {0x1F7DA, 0x1F7DF}, {0x1F7EC, 0x1F7EF}, {0x1F7F1, 0x1F7FF}, {0x1F80C, 0x1F80F}, {0x1F848, 0x1F84F},
+    {0x1F85A, 0x1F85F}, {0x1F888, 0x1F88F}, {0x1F8AE, 0x1F8AF}, {0x1F8BC, 0x1F8BF}, {0x1F8C2, 0x1F8FF},
+    {0x1FA54, 0x1FA5F}, {0x1FA6E, 0x1FA6F}, {0x1FA7D, 0x1FA7F}, {0x1FA8A, 0x1FA8E}, {0x1FAC7, 0x1FACD},
+    {0x1FADD, 0x1FADE}, {0x1FAEA, 0x1FAEF}, {0x1FAF9, 0x1FAFF}, {0x1FB93, 0x1FB93}, {0x1FBFA, 0x1FFFD},
+    {0x20001, 0x2A6DE}, {0x2A6E0, 0x2A6FF}, {0x2A701, 0x2B738}, {0x2B73A, 0x2B73F}, {0x2B741, 0x2B81C},
+    {0x2B81E, 0x2B81F}, {0x2B821, 0x2CEA0}, {0x2CEA2, 0x2CEAF}, {0x2CEB1, 0x2EBDF}, {0x2EBE1, 0x2EBEF},
+    {0x2EBF1, 0x2EE5C}, {0x2EE5E, 0x2F7FF}, {0x2FA1E, 0x2FFFD}, {0x30001, 0x31349}, {0x3134B, 0x3134F},
+    {0x31351, 0x323AE}, {0x323B0, 0x3FFFD}, {0x40000, 0x4FFFD}, {0x50000, 0x5FFFD}, {0x60000, 0x6FFFD},
+    {0x70000, 0x7FFFD}, {0x80000, 0x8FFFD}, {0x90000, 0x9FFFD}, {0xA0000, 0xAFFFD}, {0xB0000, 0xBFFFD},
+    {0xC0000, 0xCFFFD}, {0xD0000, 0xDFFFD}, {0xE0000, 0xE0000}, {0xE0002, 0xE001F}, {0xE0080, 0xE00FF},
+    {0xE01F0, 0xEFFFD}};
 
 /* Non-characters. */
 static const struct widechar_range widechar_nonchar_table[] = {
@@ -1450,88 +362,36 @@ static const struct widechar_range widechar_nonchar_table[] = {
     {0xDFFFE, 0xDFFFF},
     {0xEFFFE, 0xEFFFF},
     {0xFFFFE, 0xFFFFF},
-    {0x10FFFE, 0x10FFFF}
-};
+    {0x10FFFE, 0x10FFFF}};
 
 /* Characters that were widened from width 1 to 2 in Unicode 9. */
 static const struct widechar_range widechar_widened_table[] = {
-    {0x0231A, 0x0231B},
-    {0x023E9, 0x023EC},
-    {0x023F0, 0x023F0},
-    {0x023F3, 0x023F3},
-    {0x025FD, 0x025FE},
-    {0x02614, 0x02615},
-    {0x02648, 0x02653},
-    {0x0267F, 0x0267F},
-    {0x02693, 0x02693},
-    {0x026A1, 0x026A1},
-    {0x026AA, 0x026AB},
-    {0x026BD, 0x026BE},
-    {0x026C4, 0x026C5},
-    {0x026CE, 0x026CE},
-    {0x026D4, 0x026D4},
-    {0x026EA, 0x026EA},
-    {0x026F2, 0x026F3},
-    {0x026F5, 0x026F5},
-    {0x026FA, 0x026FA},
-    {0x026FD, 0x026FD},
-    {0x02705, 0x02705},
-    {0x0270A, 0x0270B},
-    {0x02728, 0x02728},
-    {0x0274C, 0x0274C},
-    {0x0274E, 0x0274E},
-    {0x02753, 0x02755},
-    {0x02757, 0x02757},
-    {0x02795, 0x02797},
-    {0x027B0, 0x027B0},
-    {0x027BF, 0x027BF},
-    {0x02B1B, 0x02B1C},
-    {0x02B50, 0x02B50},
-    {0x02B55, 0x02B55},
-    {0x1F004, 0x1F004},
-    {0x1F0CF, 0x1F0CF},
-    {0x1F18E, 0x1F18E},
-    {0x1F191, 0x1F19A},
-    {0x1F201, 0x1F201},
-    {0x1F21A, 0x1F21A},
-    {0x1F22F, 0x1F22F},
-    {0x1F232, 0x1F236},
-    {0x1F238, 0x1F23A},
-    {0x1F250, 0x1F251},
-    {0x1F300, 0x1F320},
-    {0x1F32D, 0x1F335},
-    {0x1F337, 0x1F37C},
-    {0x1F37E, 0x1F393},
-    {0x1F3A0, 0x1F3CA},
-    {0x1F3CF, 0x1F3D3},
-    {0x1F3E0, 0x1F3F0},
-    {0x1F3F4, 0x1F3F4},
-    {0x1F3F8, 0x1F43E},
-    {0x1F440, 0x1F440},
-    {0x1F442, 0x1F4FC},
-    {0x1F4FF, 0x1F53D},
-    {0x1F54B, 0x1F54E},
-    {0x1F550, 0x1F567},
-    {0x1F595, 0x1F596},
-    {0x1F5FB, 0x1F64F},
-    {0x1F680, 0x1F6C5},
-    {0x1F6CC, 0x1F6CC},
-    {0x1F6D0, 0x1F6D0},
-    {0x1F6EB, 0x1F6EC},
-    {0x1F910, 0x1F918},
-    {0x1F980, 0x1F984},
-    {0x1F9C0, 0x1F9C0}
-};
+    {0x0231A, 0x0231B}, {0x023E9, 0x023EC}, {0x023F0, 0x023F0}, {0x023F3, 0x023F3}, {0x025FD, 0x025FE},
+    {0x02614, 0x02615}, {0x02648, 0x02653}, {0x0267F, 0x0267F}, {0x02693, 0x02693}, {0x026A1, 0x026A1},
+    {0x026AA, 0x026AB}, {0x026BD, 0x026BE}, {0x026C4, 0x026C5}, {0x026CE, 0x026CE}, {0x026D4, 0x026D4},
+    {0x026EA, 0x026EA}, {0x026F2, 0x026F3}, {0x026F5, 0x026F5}, {0x026FA, 0x026FA}, {0x026FD, 0x026FD},
+    {0x02705, 0x02705}, {0x0270A, 0x0270B}, {0x02728, 0x02728}, {0x0274C, 0x0274C}, {0x0274E, 0x0274E},
+    {0x02753, 0x02755}, {0x02757, 0x02757}, {0x02795, 0x02797}, {0x027B0, 0x027B0}, {0x027BF, 0x027BF},
+    {0x02B1B, 0x02B1C}, {0x02B50, 0x02B50}, {0x02B55, 0x02B55}, {0x1F004, 0x1F004}, {0x1F0CF, 0x1F0CF},
+    {0x1F18E, 0x1F18E}, {0x1F191, 0x1F19A}, {0x1F201, 0x1F201}, {0x1F21A, 0x1F21A}, {0x1F22F, 0x1F22F},
+    {0x1F232, 0x1F236}, {0x1F238, 0x1F23A}, {0x1F250, 0x1F251}, {0x1F300, 0x1F320}, {0x1F32D, 0x1F335},
+    {0x1F337, 0x1F37C}, {0x1F37E, 0x1F393}, {0x1F3A0, 0x1F3CA}, {0x1F3CF, 0x1F3D3}, {0x1F3E0, 0x1F3F0},
+    {0x1F3F4, 0x1F3F4}, {0x1F3F8, 0x1F43E}, {0x1F440, 0x1F440}, {0x1F442, 0x1F4FC}, {0x1F4FF, 0x1F53D},
+    {0x1F54B, 0x1F54E}, {0x1F550, 0x1F567}, {0x1F595, 0x1F596}, {0x1F5FB, 0x1F64F}, {0x1F680, 0x1F6C5},
+    {0x1F6CC, 0x1F6CC}, {0x1F6D0, 0x1F6D0}, {0x1F6EB, 0x1F6EC}, {0x1F910, 0x1F918}, {0x1F980, 0x1F984},
+    {0x1F9C0, 0x1F9C0}};
 
 template<typename Collection>
-bool widechar_in_table(const Collection &arr, uint32_t c) {
-    auto where = std::lower_bound(std::begin(arr), std::end(arr), c,
-        [](widechar_range p, uint32_t c) { return p.hi < c; });
+bool widechar_in_table(const Collection & arr, uint32_t c)
+{
+    auto where =
+        std::lower_bound(std::begin(arr), std::end(arr), c, [](widechar_range p, uint32_t c) { return p.hi < c; });
     return where != std::end(arr) && where->lo <= c;
 }
 
 /* Return the width of character c, or a special negative value. */
-int widechar_wcwidth(uint32_t c) {
+int widechar_wcwidth(uint32_t c)
+{
     if (widechar_in_table(widechar_ascii_table, c))
         return 1;
     if (widechar_in_table(widechar_private_table, c))
diff --git a/src/libutil/windows/current-process.cc b/src/libutil/windows/current-process.cc
new file mode 100644
index 000000000..4bc866bb3
--- /dev/null
+++ b/src/libutil/windows/current-process.cc
@@ -0,0 +1,35 @@
+#include "nix/util/current-process.hh"
+#include "nix/util/windows-error.hh"
+#include <cmath>
+
+#ifdef _WIN32
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
+
+namespace nix {
+
+std::chrono::microseconds getCpuUserTime()
+{
+    FILETIME creationTime;
+    FILETIME exitTime;
+    FILETIME kernelTime;
+    FILETIME userTime;
+
+    if (!GetProcessTimes(GetCurrentProcess(), &creationTime, &exitTime, &kernelTime, &userTime)) {
+        auto lastError = GetLastError();
+        throw windows::WinError(lastError, "failed to get CPU time");
+    }
+
+    ULARGE_INTEGER uLargeInt;
+    uLargeInt.LowPart = userTime.dwLowDateTime;
+    uLargeInt.HighPart = userTime.dwHighDateTime;
+
+    // FILETIME stores units of 100 nanoseconds.
+    // Dividing by 10 gives microseconds.
+    std::chrono::microseconds microseconds(uLargeInt.QuadPart / 10);
+
+    return microseconds;
+}
+
+} // namespace nix
+#endif // ifdef _WIN32
diff --git a/src/libutil/windows/environment-variables.cc b/src/libutil/windows/environment-variables.cc
index d7cc7b488..c76c12345 100644
--- a/src/libutil/windows/environment-variables.cc
+++ b/src/libutil/windows/environment-variables.cc
@@ -45,5 +45,5 @@ int setEnvOs(const OsString & name, const OsString & value)
     return -SetEnvironmentVariableW(name.c_str(), value.c_str());
 }
 
-}
+} // namespace nix
 #endif
diff --git a/src/libutil/windows/file-descriptor.cc b/src/libutil/windows/file-descriptor.cc
index 03d68232c..3c3e7ea45 100644
--- a/src/libutil/windows/file-descriptor.cc
+++ b/src/libutil/windows/file-descriptor.cc
@@ -6,12 +6,12 @@
 #include "nix/util/file-path.hh"
 
 #ifdef _WIN32
-#include <fileapi.h>
-#include <error.h>
-#include <namedpipeapi.h>
-#include <namedpipeapi.h>
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
+#  include <fileapi.h>
+#  include <error.h>
+#  include <namedpipeapi.h>
+#  include <namedpipeapi.h>
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
 
 namespace nix {
 
@@ -26,7 +26,6 @@ std::string readFile(HANDLE handle)
     return drainFD(handle, true, li.QuadPart);
 }
 
-
 void readFull(HANDLE handle, char * buf, size_t count)
 {
     while (count) {
@@ -34,34 +33,34 @@ void readFull(HANDLE handle, char * buf, size_t count)
         DWORD res;
         if (!ReadFile(handle, (char *) buf, count, &res, NULL))
             throw WinError("%s:%d reading from file", __FILE__, __LINE__);
-        if (res == 0) throw EndOfFile("unexpected end-of-file");
+        if (res == 0)
+            throw EndOfFile("unexpected end-of-file");
         count -= res;
         buf += res;
     }
 }
 
-
 void writeFull(HANDLE handle, std::string_view s, bool allowInterrupts)
 {
     while (!s.empty()) {
-        if (allowInterrupts) checkInterrupt();
+        if (allowInterrupts)
+            checkInterrupt();
         DWORD res;
-#if _WIN32_WINNT >= 0x0600
+#  if _WIN32_WINNT >= 0x0600
         auto path = handleToPath(handle); // debug; do it before because handleToPath changes lasterror
         if (!WriteFile(handle, s.data(), s.size(), &res, NULL)) {
             throw WinError("writing to file %1%:%2%", handle, path);
         }
-#else
+#  else
         if (!WriteFile(handle, s.data(), s.size(), &res, NULL)) {
             throw WinError("writing to file %1%", handle);
         }
-#endif
+#  endif
         if (res > 0)
             s.remove_prefix(res);
     }
 }
 
-
 std::string readLine(HANDLE handle, bool eofOk)
 {
     std::string s;
@@ -77,16 +76,15 @@ std::string readLine(HANDLE handle, bool eofOk)
                 return s;
             else
                 throw EndOfFile("unexpected EOF reading a line");
-        }
-        else {
-            if (ch == '\n') return s;
+        } else {
+            if (ch == '\n')
+                return s;
             s += ch;
         }
     }
 }
 
-
-void drainFD(HANDLE handle, Sink & sink/*, bool block*/)
+void drainFD(HANDLE handle, Sink & sink /*, bool block*/)
 {
     std::vector<unsigned char> buf(64 * 1024);
     while (1) {
@@ -97,16 +95,14 @@ void drainFD(HANDLE handle, Sink & sink/*, bool block*/)
             if (winError.lastError == ERROR_BROKEN_PIPE)
                 break;
             throw winError;
-        }
-        else if (rd == 0) break;
+        } else if (rd == 0)
+            break;
         sink({(char *) buf.data(), (size_t) rd});
     }
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-
 void Pipe::create()
 {
     SECURITY_ATTRIBUTES saAttr = {0};
@@ -122,35 +118,38 @@ void Pipe::create()
     writeSide = hWritePipe;
 }
 
-
 //////////////////////////////////////////////////////////////////////
 
-#if _WIN32_WINNT >= 0x0600
+#  if _WIN32_WINNT >= 0x0600
 
-std::wstring windows::handleToFileName(HANDLE handle) {
+std::wstring windows::handleToFileName(HANDLE handle)
+{
     std::vector<wchar_t> buf(0x100);
     DWORD dw = GetFinalPathNameByHandleW(handle, buf.data(), buf.size(), FILE_NAME_OPENED);
     if (dw == 0) {
-        if (handle == GetStdHandle(STD_INPUT_HANDLE )) return L"<stdin>";
-        if (handle == GetStdHandle(STD_OUTPUT_HANDLE)) return L"<stdout>";
-        if (handle == GetStdHandle(STD_ERROR_HANDLE )) return L"<stderr>";
+        if (handle == GetStdHandle(STD_INPUT_HANDLE))
+            return L"<stdin>";
+        if (handle == GetStdHandle(STD_OUTPUT_HANDLE))
+            return L"<stdout>";
+        if (handle == GetStdHandle(STD_ERROR_HANDLE))
+            return L"<stderr>";
         return (boost::wformat(L"<unnnamed handle %X>") % handle).str();
     }
     if (dw > buf.size()) {
         buf.resize(dw);
-        if (GetFinalPathNameByHandleW(handle, buf.data(), buf.size(), FILE_NAME_OPENED) != dw-1)
+        if (GetFinalPathNameByHandleW(handle, buf.data(), buf.size(), FILE_NAME_OPENED) != dw - 1)
             throw WinError("GetFinalPathNameByHandleW");
         dw -= 1;
     }
     return std::wstring(buf.data(), dw);
 }
 
-
-Path windows::handleToPath(HANDLE handle) {
+Path windows::handleToPath(HANDLE handle)
+{
     return os_string_to_string(handleToFileName(handle));
 }
 
-#endif
+#  endif
 
-}
+} // namespace nix
 #endif
diff --git a/src/libutil/windows/file-path.cc b/src/libutil/windows/file-path.cc
index 03cc5afe5..7913b3d5d 100644
--- a/src/libutil/windows/file-path.cc
+++ b/src/libutil/windows/file-path.cc
@@ -11,14 +11,15 @@ namespace nix {
 
 std::optional<std::filesystem::path> maybePath(PathView path)
 {
-    if (path.length() >= 3 && (('A' <= path[0] && path[0] <= 'Z') || ('a' <= path[0] && path[0] <= 'z')) && path[1] == ':' && WindowsPathTrait<char>::isPathSep(path[2])) {
-        std::filesystem::path::string_type sw = string_to_os_string(
-            std::string { "\\\\?\\" } + path);
+    if (path.length() >= 3 && (('A' <= path[0] && path[0] <= 'Z') || ('a' <= path[0] && path[0] <= 'z'))
+        && path[1] == ':' && WindowsPathTrait<char>::isPathSep(path[2])) {
+        std::filesystem::path::string_type sw = string_to_os_string(std::string{"\\\\?\\"} + path);
         std::replace(sw.begin(), sw.end(), '/', '\\');
         return sw;
     }
-    if (path.length() >= 7 && path[0] == '\\' && path[1] == '\\' && (path[2] == '.' || path[2] == '?') && path[3] == '\\' &&
-               ('A' <= path[4] && path[4] <= 'Z') && path[5] == ':' && WindowsPathTrait<char>::isPathSep(path[6])) {
+    if (path.length() >= 7 && path[0] == '\\' && path[1] == '\\' && (path[2] == '.' || path[2] == '?')
+        && path[3] == '\\' && ('A' <= path[4] && path[4] <= 'Z') && path[5] == ':'
+        && WindowsPathTrait<char>::isPathSep(path[6])) {
         std::filesystem::path::string_type sw = string_to_os_string(path);
         std::replace(sw.begin(), sw.end(), '/', '\\');
         return sw;
@@ -31,10 +32,10 @@ std::filesystem::path pathNG(PathView path)
     std::optional<std::filesystem::path::string_type> sw = maybePath(path);
     if (!sw) {
         // FIXME why are we not using the regular error handling?
-        std::cerr << "invalid path for WinAPI call ["<<path<<"]"<<std::endl;
+        std::cerr << "invalid path for WinAPI call [" << path << "]" << std::endl;
         _exit(111);
     }
     return *sw;
 }
 
-}
+} // namespace nix
diff --git a/src/libutil/windows/file-system.cc b/src/libutil/windows/file-system.cc
index f31c913f1..22572772e 100644
--- a/src/libutil/windows/file-system.cc
+++ b/src/libutil/windows/file-system.cc
@@ -28,5 +28,5 @@ Descriptor openDirectory(const std::filesystem::path & path)
         NULL);
 }
 
-}
+} // namespace nix
 #endif
diff --git a/src/libutil/windows/include/nix/util/meson.build b/src/libutil/windows/include/nix/util/meson.build
index 5d0ace929..1bd56c4bd 100644
--- a/src/libutil/windows/include/nix/util/meson.build
+++ b/src/libutil/windows/include/nix/util/meson.build
@@ -6,5 +6,4 @@ headers += files(
   'signals-impl.hh',
   'windows-async-pipe.hh',
   'windows-error.hh',
-  # hack for trailing newline
 )
diff --git a/src/libutil/windows/include/nix/util/signals-impl.hh b/src/libutil/windows/include/nix/util/signals-impl.hh
index 55606debd..d1c79cab9 100644
--- a/src/libutil/windows/include/nix/util/signals-impl.hh
+++ b/src/libutil/windows/include/nix/util/signals-impl.hh
@@ -44,4 +44,4 @@ struct ReceiveInterrupts
     ~ReceiveInterrupts() {}
 };
 
-}
+} // namespace nix
diff --git a/src/libutil/windows/include/nix/util/windows-async-pipe.hh b/src/libutil/windows/include/nix/util/windows-async-pipe.hh
index 5bb0c3518..e700aa4f6 100644
--- a/src/libutil/windows/include/nix/util/windows-async-pipe.hh
+++ b/src/libutil/windows/include/nix/util/windows-async-pipe.hh
@@ -25,5 +25,5 @@ public:
     void close();
 };
 
-}
+} // namespace nix::windows
 #endif
diff --git a/src/libutil/windows/include/nix/util/windows-error.hh b/src/libutil/windows/include/nix/util/windows-error.hh
index abf979c6b..a45425ad4 100644
--- a/src/libutil/windows/include/nix/util/windows-error.hh
+++ b/src/libutil/windows/include/nix/util/windows-error.hh
@@ -2,9 +2,9 @@
 ///@file
 
 #ifdef _WIN32
-#include <errhandlingapi.h>
+#  include <errhandlingapi.h>
 
-#include "nix/util/error.hh"
+#  include "nix/util/error.hh"
 
 namespace nix::windows {
 
@@ -25,8 +25,9 @@ public:
      * information to the message.
      */
     template<typename... Args>
-    WinError(DWORD lastError, const Args & ... args)
-        : SystemError(""), lastError(lastError)
+    WinError(DWORD lastError, const Args &... args)
+        : SystemError("")
+        , lastError(lastError)
     {
         auto hf = HintFmt(args...);
         err.msg = HintFmt("%1%: %2%", Uncolored(hf.str()), renderError(lastError));
@@ -39,8 +40,8 @@ public:
      * before calling this constructor!
      */
     template<typename... Args>
-    WinError(const Args & ... args)
-        : WinError(GetLastError(), args ...)
+    WinError(const Args &... args)
+        : WinError(GetLastError(), args...)
     {
     }
 
@@ -49,5 +50,5 @@ private:
     std::string renderError(DWORD lastError);
 };
 
-}
+} // namespace nix::windows
 #endif
diff --git a/src/libutil/windows/meson.build b/src/libutil/windows/meson.build
index 0c1cec49c..fb4de2017 100644
--- a/src/libutil/windows/meson.build
+++ b/src/libutil/windows/meson.build
@@ -1,4 +1,5 @@
 sources += files(
+  'current-process.cc',
   'environment-variables.cc',
   'file-descriptor.cc',
   'file-path.cc',
diff --git a/src/libutil/windows/muxable-pipe.cc b/src/libutil/windows/muxable-pipe.cc
index 82ef40665..b2eff70e6 100644
--- a/src/libutil/windows/muxable-pipe.cc
+++ b/src/libutil/windows/muxable-pipe.cc
@@ -68,5 +68,5 @@ void MuxablePipePollState::iterate(
     }
 }
 
-}
+} // namespace nix
 #endif
diff --git a/src/libutil/windows/os-string.cc b/src/libutil/windows/os-string.cc
index 8c8a27a9f..d6f8e3670 100644
--- a/src/libutil/windows/os-string.cc
+++ b/src/libutil/windows/os-string.cc
@@ -23,6 +23,6 @@ std::filesystem::path::string_type string_to_os_string(std::string_view s)
     return converter.from_bytes(std::string{s});
 }
 
-}
+} // namespace nix
 
 #endif
diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index 099dff31b..f8f2900e5 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -25,8 +25,8 @@
 
 #ifdef _WIN32
 
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
 
 namespace nix {
 
@@ -84,8 +84,13 @@ int Pid::wait()
 std::string runProgram(
     Path program, bool lookupPath, const Strings & args, const std::optional<std::string> & input, bool isInteractive)
 {
-    auto res = runProgram(RunOptions{
-        .program = program, .lookupPath = lookupPath, .args = args, .input = input, .isInteractive = isInteractive});
+    auto res = runProgram(
+        RunOptions{
+            .program = program,
+            .lookupPath = lookupPath,
+            .args = args,
+            .input = input,
+            .isInteractive = isInteractive});
 
     if (!statusOk(res.first))
         throw ExecError(res.first, "program '%1%' %2%", program, statusToString(res.first));
@@ -383,6 +388,6 @@ int execvpe(const wchar_t * file0, const wchar_t * const argv[], const wchar_t *
     return _wexecve(file.c_str(), argv, envp);
 }
 
-}
+} // namespace nix
 
 #endif
diff --git a/src/libutil/windows/users.cc b/src/libutil/windows/users.cc
index 90da0281f..6cc753cec 100644
--- a/src/libutil/windows/users.cc
+++ b/src/libutil/windows/users.cc
@@ -5,8 +5,8 @@
 #include "nix/util/windows-error.hh"
 
 #ifdef _WIN32
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
 
 namespace nix {
 
@@ -37,8 +37,7 @@ std::string getUserName()
 
 Path getHome()
 {
-    static Path homeDir = []()
-    {
+    static Path homeDir = []() {
         Path homeDir = getEnv("USERPROFILE").value_or("C:\\Users\\Default");
         assert(!homeDir.empty());
         return canonPath(homeDir);
@@ -46,9 +45,10 @@ Path getHome()
     return homeDir;
 }
 
-bool isRootUser() {
+bool isRootUser()
+{
     return false;
 }
 
-}
+} // namespace nix
 #endif
diff --git a/src/libutil/windows/windows-async-pipe.cc b/src/libutil/windows/windows-async-pipe.cc
index d47930a1b..f6a82a139 100644
--- a/src/libutil/windows/windows-async-pipe.cc
+++ b/src/libutil/windows/windows-async-pipe.cc
@@ -1,7 +1,8 @@
-#include "nix/util/windows-async-pipe.hh"
-#include "nix/util/windows-error.hh"
+
 
 #ifdef _WIN32
+#  include "nix/util/windows-async-pipe.hh"
+#  include "nix/util/windows-error.hh"
 
 namespace nix::windows {
 
@@ -48,6 +49,6 @@ void AsyncPipe::close()
     writeSide.close();
 }
 
-}
+} // namespace nix::windows
 
 #endif
diff --git a/src/libutil/windows/windows-error.cc b/src/libutil/windows/windows-error.cc
index 1e7aff830..dd731dce2 100644
--- a/src/libutil/windows/windows-error.cc
+++ b/src/libutil/windows/windows-error.cc
@@ -1,9 +1,8 @@
-#include "nix/util/windows-error.hh"
-
 #ifdef _WIN32
-#include <error.h>
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
+#  include "nix/util/windows-error.hh"
+#  include <error.h>
+#  define WIN32_LEAN_AND_MEAN
+#  include <windows.h>
 
 namespace nix::windows {
 
@@ -11,23 +10,25 @@ std::string WinError::renderError(DWORD lastError)
 {
     LPSTR errorText = NULL;
 
-    FormatMessageA( FORMAT_MESSAGE_FROM_SYSTEM // use system message tables to retrieve error text
-                   |FORMAT_MESSAGE_ALLOCATE_BUFFER // allocate buffer on local heap for error text
-                   |FORMAT_MESSAGE_IGNORE_INSERTS,   // Important! will fail otherwise, since we're not  (and CANNOT) pass insertion parameters
-                    NULL,    // unused with FORMAT_MESSAGE_FROM_SYSTEM
-                    lastError,
-                    MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-                    (LPTSTR)&errorText,  // output
-                    0, // minimum size for output buffer
-                    NULL);   // arguments - see note
+    FormatMessageA(
+        FORMAT_MESSAGE_FROM_SYSTEM           // use system message tables to retrieve error text
+            | FORMAT_MESSAGE_ALLOCATE_BUFFER // allocate buffer on local heap for error text
+            | FORMAT_MESSAGE_IGNORE_INSERTS, // Important! will fail otherwise, since we're not  (and CANNOT) pass
+                                             // insertion parameters
+        NULL,                                // unused with FORMAT_MESSAGE_FROM_SYSTEM
+        lastError,
+        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+        (LPTSTR) &errorText, // output
+        0,                   // minimum size for output buffer
+        NULL);               // arguments - see note
 
-    if (NULL != errorText ) {
-        std::string s2 { errorText };
+    if (NULL != errorText) {
+        std::string s2{errorText};
         LocalFree(errorText);
         return s2;
     }
     return fmt("CODE=%d", lastError);
 }
 
-}
+} // namespace nix::windows
 #endif
diff --git a/src/libutil/xml-writer.cc b/src/libutil/xml-writer.cc
index e460dd169..9b7ca969d 100644
--- a/src/libutil/xml-writer.cc
+++ b/src/libutil/xml-writer.cc
@@ -2,95 +2,95 @@
 
 #include "nix/util/xml-writer.hh"
 
-
 namespace nix {
 
-
 XMLWriter::XMLWriter(bool indent, std::ostream & output)
-    : output(output), indent(indent)
+    : output(output)
+    , indent(indent)
 {
     output << "<?xml version='1.0' encoding='utf-8'?>" << std::endl;
     closed = false;
 }
 
-
 XMLWriter::~XMLWriter()
 {
     close();
 }
 
-
 void XMLWriter::close()
 {
-    if (closed) return;
-    while (!pendingElems.empty()) closeElement();
+    if (closed)
+        return;
+    while (!pendingElems.empty())
+        closeElement();
     closed = true;
 }
 
-
 void XMLWriter::indent_(size_t depth)
 {
-    if (!indent) return;
+    if (!indent)
+        return;
     output << std::string(depth * 2, ' ');
 }
 
-
-void XMLWriter::openElement(
-    std::string_view name,
-    const XMLAttrs & attrs)
+void XMLWriter::openElement(std::string_view name, const XMLAttrs & attrs)
 {
     assert(!closed);
     indent_(pendingElems.size());
     output << "<" << name;
     writeAttrs(attrs);
     output << ">";
-    if (indent) output << std::endl;
+    if (indent)
+        output << std::endl;
     pendingElems.push_back(std::string(name));
 }
 
-
 void XMLWriter::closeElement()
 {
     assert(!pendingElems.empty());
     indent_(pendingElems.size() - 1);
     output << "</" << pendingElems.back() << ">";
-    if (indent) output << std::endl;
+    if (indent)
+        output << std::endl;
     pendingElems.pop_back();
-    if (pendingElems.empty()) closed = true;
+    if (pendingElems.empty())
+        closed = true;
 }
 
-
-void XMLWriter::writeEmptyElement(
-    std::string_view name,
-    const XMLAttrs & attrs)
+void XMLWriter::writeEmptyElement(std::string_view name, const XMLAttrs & attrs)
 {
     assert(!closed);
     indent_(pendingElems.size());
     output << "<" << name;
     writeAttrs(attrs);
     output << " />";
-    if (indent) output << std::endl;
+    if (indent)
+        output << std::endl;
 }
 
-
 void XMLWriter::writeAttrs(const XMLAttrs & attrs)
 {
     for (auto & i : attrs) {
         output << " " << i.first << "=\"";
         for (size_t j = 0; j < i.second.size(); ++j) {
             char c = i.second[j];
-            if (c == '"') output << "&quot;";
-            else if (c == '<') output << "&lt;";
-            else if (c == '>') output << "&gt;";
-            else if (c == '&') output << "&amp;";
+            if (c == '"')
+                output << "&quot;";
+            else if (c == '<')
+                output << "&lt;";
+            else if (c == '>')
+                output << "&gt;";
+            else if (c == '&')
+                output << "&amp;";
             /* Escape newlines to prevent attribute normalisation (see
                XML spec, section 3.3.3. */
-            else if (c == '\n') output << "&#xA;";
-            else output << c;
+            else if (c == '\n')
+                output << "&#xA;";
+            else
+                output << c;
         }
         output << "\"";
     }
 }
 
-
-}
+} // namespace nix
diff --git a/src/nix-env/user-env.hh b/src/nix-env/user-env.hh
deleted file mode 100644
index 0a19b8f32..000000000
--- a/src/nix-env/user-env.hh
+++ /dev/null
@@ -1,14 +0,0 @@
-#pragma once
-///@file
-
-#include "nix/expr/get-drvs.hh"
-
-namespace nix {
-
-PackageInfos queryInstalled(EvalState & state, const Path & userEnv);
-
-bool createUserEnv(EvalState & state, PackageInfos & elems,
-    const Path & profile, bool keepDerivations,
-    const std::string & lockToken);
-
-}
diff --git a/src/nix/add-to-store.cc b/src/nix/add-to-store.cc
index 9b7306fdd..e87f49546 100644
--- a/src/nix/add-to-store.cc
+++ b/src/nix/add-to-store.cc
@@ -35,15 +35,13 @@ struct CmdAddToStore : MixDryRun, StoreCommand
 
     void run(ref<Store> store) override
     {
-        if (!namePart) namePart = baseNameOf(path);
+        if (!namePart)
+            namePart = baseNameOf(path);
 
         auto sourcePath = PosixSourceAccessor::createAtRoot(makeParentCanonical(path));
 
-        auto storePath = dryRun
-            ? store->computeStorePath(
-                *namePart, sourcePath, caMethod, hashAlgo, {}).first
-            : store->addToStoreSlow(
-                *namePart, sourcePath, caMethod, hashAlgo, {}).path;
+        auto storePath = dryRun ? store->computeStorePath(*namePart, sourcePath, caMethod, hashAlgo, {}).first
+                                : store->addToStoreSlow(*namePart, sourcePath, caMethod, hashAlgo, {}).path;
 
         logger->cout("%s", store->printStorePath(storePath));
     }
@@ -59,8 +57,8 @@ struct CmdAdd : CmdAddToStore
     std::string doc() override
     {
         return
-          #include "add.md"
-          ;
+#include "add.md"
+            ;
     }
 };
 
diff --git a/src/nix/app.cc b/src/nix/app.cc
index c9a9f9caf..f1937bc23 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -15,29 +15,27 @@ namespace nix {
  * Return the rewrites that are needed to resolve a string whose context is
  * included in `dependencies`.
  */
-StringPairs resolveRewrites(
-    Store & store,
-    const std::vector<BuiltPathWithResult> & dependencies)
+StringPairs resolveRewrites(Store & store, const std::vector<BuiltPathWithResult> & dependencies)
 {
     StringPairs res;
     if (!experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
         return res;
     }
-    for (auto &dep: dependencies) {
+    for (auto & dep : dependencies) {
         auto drvDep = std::get_if<BuiltPathBuilt>(&dep.path);
         if (!drvDep) {
             continue;
         }
 
-        for (const auto & [ outputName, outputPath ] : drvDep->outputs) {
+        for (const auto & [outputName, outputPath] : drvDep->outputs) {
             res.emplace(
                 DownstreamPlaceholder::fromSingleDerivedPathBuilt(
-                    SingleDerivedPath::Built {
+                    SingleDerivedPath::Built{
                         .drvPath = make_ref<SingleDerivedPath>(drvDep->drvPath->discardOutputPath()),
                         .output = outputName,
-                    }).render(),
-                store.printStorePath(outputPath)
-            );
+                    })
+                    .render(),
+                store.printStorePath(outputPath));
         }
     }
     return res;
@@ -46,10 +44,8 @@ StringPairs resolveRewrites(
 /**
  * Resolve the given string assuming the given context.
  */
-std::string resolveString(
-    Store & store,
-    const std::string & toResolve,
-    const std::vector<BuiltPathWithResult> & dependencies)
+std::string
+resolveString(Store & store, const std::string & toResolve, const std::vector<BuiltPathWithResult> & dependencies)
 {
     auto rewrites = resolveRewrites(store, dependencies);
     return rewriteStrings(toResolve, rewrites);
@@ -62,9 +58,10 @@ UnresolvedApp InstallableValue::toApp(EvalState & state)
 
     auto type = cursor->getAttr("type")->getString();
 
-    std::string expectedType = !attrPath.empty() &&
-        (state.symbols[attrPath[0]] == "apps" || state.symbols[attrPath[0]] == "defaultApp")
-        ? "app" : "derivation";
+    std::string expectedType =
+        !attrPath.empty() && (state.symbols[attrPath[0]] == "apps" || state.symbols[attrPath[0]] == "defaultApp")
+            ? "app"
+            : "derivation";
     if (type != expectedType)
         throw Error("attribute '%s' should have type '%s'", cursor->getAttrPathStr(), expectedType);
 
@@ -73,29 +70,32 @@ UnresolvedApp InstallableValue::toApp(EvalState & state)
 
         std::vector<DerivedPath> context2;
         for (auto & c : context) {
-            context2.emplace_back(std::visit(overloaded {
-                [&](const NixStringContextElem::DrvDeep & d) -> DerivedPath {
-                    /* We want all outputs of the drv */
-                    return DerivedPath::Built {
-                        .drvPath = makeConstantStorePathRef(d.drvPath),
-                        .outputs = OutputsSpec::All {},
-                    };
-                },
-                [&](const NixStringContextElem::Built & b) -> DerivedPath {
-                    return DerivedPath::Built {
-                        .drvPath = b.drvPath,
-                        .outputs = OutputsSpec::Names { b.output },
-                    };
-                },
-                [&](const NixStringContextElem::Opaque & o) -> DerivedPath {
-                    return DerivedPath::Opaque {
-                        .path = o.path,
-                    };
-                },
-            }, c.raw));
+            context2.emplace_back(
+                std::visit(
+                    overloaded{
+                        [&](const NixStringContextElem::DrvDeep & d) -> DerivedPath {
+                            /* We want all outputs of the drv */
+                            return DerivedPath::Built{
+                                .drvPath = makeConstantStorePathRef(d.drvPath),
+                                .outputs = OutputsSpec::All{},
+                            };
+                        },
+                        [&](const NixStringContextElem::Built & b) -> DerivedPath {
+                            return DerivedPath::Built{
+                                .drvPath = b.drvPath,
+                                .outputs = OutputsSpec::Names{b.output},
+                            };
+                        },
+                        [&](const NixStringContextElem::Opaque & o) -> DerivedPath {
+                            return DerivedPath::Opaque{
+                                .path = o.path,
+                            };
+                        },
+                    },
+                    c.raw));
         }
 
-        return UnresolvedApp { App {
+        return UnresolvedApp{App{
             .context = std::move(context2),
             .program = program,
         }};
@@ -103,24 +103,19 @@ UnresolvedApp InstallableValue::toApp(EvalState & state)
 
     else if (type == "derivation") {
         auto drvPath = cursor->forceDerivation();
-        auto outPath = cursor->getAttr(state.sOutPath)->getString();
-        auto outputName = cursor->getAttr(state.sOutputName)->getString();
-        auto name = cursor->getAttr(state.sName)->getString();
+        auto outPath = cursor->getAttr(state.s.outPath)->getString();
+        auto outputName = cursor->getAttr(state.s.outputName)->getString();
+        auto name = cursor->getAttr(state.s.name)->getString();
         auto aPname = cursor->maybeGetAttr("pname");
-        auto aMeta = cursor->maybeGetAttr(state.sMeta);
+        auto aMeta = cursor->maybeGetAttr(state.s.meta);
         auto aMainProgram = aMeta ? aMeta->maybeGetAttr("mainProgram") : nullptr;
-        auto mainProgram =
-            aMainProgram
-            ? aMainProgram->getString()
-            : aPname
-            ? aPname->getString()
-            : DrvName(name).name;
+        auto mainProgram = aMainProgram ? aMainProgram->getString() : aPname ? aPname->getString() : DrvName(name).name;
         auto program = outPath + "/bin/" + mainProgram;
-        return UnresolvedApp { App {
-            .context = { DerivedPath::Built {
+        return UnresolvedApp{App{
+            .context = {DerivedPath::Built{
                 .drvPath = makeConstantStorePathRef(drvPath),
-                .outputs = OutputsSpec::Names { outputName },
-            } },
+                .outputs = OutputsSpec::Names{outputName},
+            }},
             .program = program,
         }};
     }
@@ -134,8 +129,7 @@ std::vector<BuiltPathWithResult> UnresolvedApp::build(ref<Store> evalStore, ref<
     Installables installableContext;
 
     for (auto & ctxElt : unresolved.context)
-        installableContext.push_back(
-            make_ref<InstallableDerivedPath>(store, DerivedPath { ctxElt }));
+        installableContext.push_back(make_ref<InstallableDerivedPath>(store, DerivedPath{ctxElt}));
 
     return Installable::build(evalStore, store, Realise::Outputs, installableContext);
 }
@@ -153,4 +147,4 @@ App UnresolvedApp::resolve(ref<Store> evalStore, ref<Store> store)
     return res;
 }
 
-}
+} // namespace nix
diff --git a/src/nix/build-remote b/src/nix/build-remote
deleted file mode 120000
index 2cea44d46..000000000
--- a/src/nix/build-remote
+++ /dev/null
@@ -1 +0,0 @@
-../build-remote
\ No newline at end of file
diff --git a/src/build-remote/build-remote.cc b/src/nix/build-remote/build-remote.cc
similarity index 85%
rename from src/build-remote/build-remote.cc
rename to src/nix/build-remote/build-remote.cc
index cd13e6670..11df8cc5e 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/nix/build-remote/build-remote.cc
@@ -6,7 +6,7 @@
 #include <tuple>
 #include <iomanip>
 #ifdef __APPLE__
-#include <sys/time.h>
+#  include <sys/time.h>
 #endif
 
 #include "nix/store/machines.hh"
@@ -22,12 +22,12 @@
 #include "nix/store/local-store.hh"
 #include "nix/cmd/legacy.hh"
 #include "nix/util/experimental-features.hh"
+#include "nix/store/globals.hh"
 
 using namespace nix;
 using std::cin;
 
-static void handleAlarm(int sig) {
-}
+static void handleAlarm(int sig) {}
 
 std::string escapeUri(std::string uri)
 {
@@ -42,13 +42,15 @@ static AutoCloseFD openSlotLock(const Machine & m, uint64_t slot)
     return openLockFile(fmt("%s/%s-%d", currentLoad, escapeUri(m.storeUri.render()), slot), true);
 }
 
-static bool allSupportedLocally(Store & store, const StringSet& requiredFeatures) {
+static bool allSupportedLocally(Store & store, const StringSet & requiredFeatures)
+{
     for (auto & feature : requiredFeatures)
-        if (!store.config.systemFeatures.get().count(feature)) return false;
+        if (!store.config.systemFeatures.get().count(feature))
+            return false;
     return true;
 }
 
-static int main_build_remote(int argc, char * * argv)
+static int main_build_remote(int argc, char ** argv)
 {
     {
         logger = makeJSONLogger(getStandardError());
@@ -85,7 +87,7 @@ static int main_build_remote(int argc, char * * argv)
            that gets cleared on reboot, but it wouldn't work on macOS. */
         auto currentLoadName = "/current-load";
         if (auto localStore = store.dynamic_pointer_cast<LocalFSStore>())
-            currentLoad = std::string { localStore->config.stateDir } + currentLoadName;
+            currentLoad = std::string{localStore->config.stateDir} + currentLoadName;
         else
             currentLoad = settings.nixStateDir + currentLoadName;
 
@@ -107,8 +109,11 @@ static int main_build_remote(int argc, char * * argv)
 
             try {
                 auto s = readString(source);
-                if (s != "try") return 0;
-            } catch (EndOfFile &) { return 0; }
+                if (s != "try")
+                    return 0;
+            } catch (EndOfFile &) {
+                return 0;
+            }
 
             auto amWilling = readInt(source);
             auto neededSystem = readString(source);
@@ -117,10 +122,10 @@ static int main_build_remote(int argc, char * * argv)
 
             /* It would be possible to build locally after some builds clear out,
                so don't show the warning now: */
-            bool couldBuildLocally = maxBuildJobs > 0
-                 &&  (  neededSystem == settings.thisSystem
-                     || settings.extraPlatforms.get().count(neededSystem) > 0)
-                 &&  allSupportedLocally(*store, requiredFeatures);
+            bool couldBuildLocally =
+                maxBuildJobs > 0
+                && (neededSystem == settings.thisSystem || settings.extraPlatforms.get().count(neededSystem) > 0)
+                && allSupportedLocally(*store, requiredFeatures);
             /* It's possible to build this locally right now: */
             bool canBuildLocally = amWilling && couldBuildLocally;
 
@@ -139,11 +144,8 @@ static int main_build_remote(int argc, char * * argv)
                 for (auto & m : machines) {
                     debug("considering building on remote machine '%s'", m.storeUri.render());
 
-                    if (m.enabled &&
-                        m.systemSupported(neededSystem) &&
-                        m.allSupported(requiredFeatures) &&
-                        m.mandatoryMet(requiredFeatures))
-                    {
+                    if (m.enabled && m.systemSupported(neededSystem) && m.allSupported(requiredFeatures)
+                        && m.mandatoryMet(requiredFeatures)) {
                         rightType = true;
                         AutoCloseFD free;
                         uint64_t load = 0;
@@ -185,8 +187,7 @@ static int main_build_remote(int argc, char * * argv)
                 if (!bestSlotLock) {
                     if (rightType && !canBuildLocally)
                         std::cerr << "# postpone\n";
-                    else
-                    {
+                    else {
                         // build the hint template.
                         std::string errorText =
                             "Failed to find a machine for remote build!\n"
@@ -205,16 +206,11 @@ static int main_build_remote(int argc, char * * argv)
                             drvstr = "<unknown>";
 
                         auto error = HintFmt::fromFormatString(errorText);
-                        error
-                            % drvstr
-                            % neededSystem
-                            % concatStringsSep<StringSet>(", ", requiredFeatures)
+                        error % drvstr % neededSystem % concatStringsSep<StringSet>(", ", requiredFeatures)
                             % machines.size();
 
                         for (auto & m : machines)
-                            error
-                                % concatStringsSep<StringSet>(", ", m.systemTypes)
-                                % m.maxJobs
+                            error % concatStringsSep<StringSet>(", ", m.systemTypes) % m.maxJobs
                                 % concatStringsSep<StringSet>(", ", m.supportedFeatures)
                                 % concatStringsSep<StringSet>(", ", m.mandatoryFeatures);
 
@@ -242,9 +238,7 @@ static int main_build_remote(int argc, char * * argv)
                     sshStore->connect();
                 } catch (std::exception & e) {
                     auto msg = chomp(drainFD(5, false));
-                    printError("cannot build on '%s': %s%s",
-                        storeUri, e.what(),
-                        msg.empty() ? "" : ": " + msg);
+                    printError("cannot build on '%s': %s%s", storeUri, e.what(), msg.empty() ? "" : ": " + msg);
                     bestMachine->enabled = false;
                     continue;
                 }
@@ -253,7 +247,7 @@ static int main_build_remote(int argc, char * * argv)
             }
         }
 
-connected:
+    connected:
         close(5);
 
         assert(sshStore);
@@ -265,13 +259,14 @@ connected:
 
         AutoCloseFD uploadLock;
         {
-            auto setUpdateLock = [&](auto && fileName){
+            auto setUpdateLock = [&](auto && fileName) {
                 uploadLock = openLockFile(currentLoad + "/" + escapeUri(fileName) + ".upload-lock", true);
             };
             try {
                 setUpdateLock(storeUri);
             } catch (SysError & e) {
-                if (e.errNo != ENAMETOOLONG) throw;
+                if (e.errNo != ENAMETOOLONG)
+                    throw;
                 // Try again hashing the store URL so we have a shorter path
                 auto h = hashString(HashAlgorithm::MD5, storeUri);
                 setUpdateLock(h.to_string(HashFormat::Base64, false));
@@ -315,7 +310,7 @@ connected:
         //
         // This condition mirrors that: that code enforces the "rules" outlined there;
         // we do the best we can given those "rules".
-        if (trustedOrLegacy || drv.type().isCA())  {
+        if (trustedOrLegacy || drv.type().isCA()) {
             // Hijack the inputs paths of the derivation to include all
             // the paths that come from the `inputDrvs` set. We don’t do
             // that for the derivations whose `inputDrvs` is empty
@@ -335,32 +330,29 @@ connected:
                         "The failed build directory was kept on the remote builder due to `--keep-failed`.%s",
                         (settings.thisSystem == drv.platform || settings.extraPlatforms.get().count(drv.platform) > 0)
                             ? " You can re-run the command with `--builders ''` to disable remote building for this invocation."
-                            : ""
-                    );
+                            : "");
                 }
-                throw Error("build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri, result.errorMsg);
+                throw Error(
+                    "build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri, result.errorMsg);
             }
         } else {
-            copyClosure(*store, *sshStore, StorePathSet {*drvPath}, NoRepair, NoCheckSigs, substitute);
-            auto res = sshStore->buildPathsWithResults({
-                DerivedPath::Built {
-                    .drvPath = makeConstantStorePathRef(*drvPath),
-                    .outputs = OutputsSpec::All {},
-                }
-            });
+            copyClosure(*store, *sshStore, StorePathSet{*drvPath}, NoRepair, NoCheckSigs, substitute);
+            auto res = sshStore->buildPathsWithResults({DerivedPath::Built{
+                .drvPath = makeConstantStorePathRef(*drvPath),
+                .outputs = OutputsSpec::All{},
+            }});
             // One path to build should produce exactly one build result
             assert(res.size() == 1);
             optResult = std::move(res[0]);
         }
 
-
         auto outputHashes = staticOutputHashes(*store, drv);
         std::set<Realisation> missingRealisations;
         StorePathSet missingPaths;
         if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations) && !drv.type().hasKnownOutputPaths()) {
             for (auto & outputName : wantedOutputs) {
                 auto thisOutputHash = outputHashes.at(outputName);
-                auto thisOutputId = DrvOutput{ thisOutputHash, outputName };
+                auto thisOutputId = DrvOutput{thisOutputHash, outputName};
                 if (!store->queryRealisation(thisOutputId)) {
                     debug("missing output %s", outputName);
                     assert(optResult);
diff --git a/src/nix/build.cc b/src/nix/build.cc
index bd0c8862b..eb47c3133 100644
--- a/src/nix/build.cc
+++ b/src/nix/build.cc
@@ -12,31 +12,32 @@ static nlohmann::json derivedPathsToJSON(const DerivedPaths & paths, Store & sto
 {
     auto res = nlohmann::json::array();
     for (auto & t : paths) {
-        std::visit([&](const auto & t) {
-            res.push_back(t.toJSON(store));
-        }, t.raw());
+        std::visit([&](const auto & t) { res.push_back(t.toJSON(store)); }, t.raw());
     }
     return res;
 }
 
-static nlohmann::json builtPathsWithResultToJSON(const std::vector<BuiltPathWithResult> & buildables, const Store & store)
+static nlohmann::json
+builtPathsWithResultToJSON(const std::vector<BuiltPathWithResult> & buildables, const Store & store)
 {
     auto res = nlohmann::json::array();
     for (auto & b : buildables) {
-        std::visit([&](const auto & t) {
-            auto j = t.toJSON(store);
-            if (b.result) {
-                if (b.result->startTime)
-                    j["startTime"] = b.result->startTime;
-                if (b.result->stopTime)
-                    j["stopTime"] = b.result->stopTime;
-                if (b.result->cpuUser)
-                    j["cpuUser"] = ((double) b.result->cpuUser->count()) / 1000000;
-                if (b.result->cpuSystem)
-                    j["cpuSystem"] = ((double) b.result->cpuSystem->count()) / 1000000;
-            }
-            res.push_back(j);
-        }, b.path.raw());
+        std::visit(
+            [&](const auto & t) {
+                auto j = t.toJSON(store);
+                if (b.result) {
+                    if (b.result->startTime)
+                        j["startTime"] = b.result->startTime;
+                    if (b.result->stopTime)
+                        j["stopTime"] = b.result->stopTime;
+                    if (b.result->cpuUser)
+                        j["cpuUser"] = ((double) b.result->cpuUser->count()) / 1000000;
+                    if (b.result->cpuSystem)
+                        j["cpuSystem"] = ((double) b.result->cpuSystem->count()) / 1000000;
+                }
+                res.push_back(j);
+            },
+            b.path.raw());
     }
     return res;
 }
@@ -69,8 +70,8 @@ struct CmdBuild : InstallablesCommand, MixOutLinkByDefault, MixDryRun, MixJSON,
     std::string doc() override
     {
         return
-          #include "build.md"
-          ;
+#include "build.md"
+            ;
     }
 
     void run(ref<Store> store, Installables && installables) override
@@ -90,29 +91,27 @@ struct CmdBuild : InstallablesCommand, MixOutLinkByDefault, MixDryRun, MixJSON,
             return;
         }
 
-        auto buildables = Installable::build(
-            getEvalStore(), store,
-            Realise::Outputs,
-            installables,
-            repair ? bmRepair : buildMode);
+        auto buildables =
+            Installable::build(getEvalStore(), store, Realise::Outputs, installables, repair ? bmRepair : buildMode);
 
-        if (json) logger->cout("%s", builtPathsWithResultToJSON(buildables, *store).dump());
+        if (json)
+            logger->cout("%s", builtPathsWithResultToJSON(buildables, *store).dump());
 
         createOutLinksMaybe(buildables, store);
 
         if (printOutputPaths) {
             logger->stop();
             for (auto & buildable : buildables) {
-                std::visit(overloaded {
-                    [&](const BuiltPath::Opaque & bo) {
-                        logger->cout(store->printStorePath(bo.path));
+                std::visit(
+                    overloaded{
+                        [&](const BuiltPath::Opaque & bo) { logger->cout(store->printStorePath(bo.path)); },
+                        [&](const BuiltPath::Built & bfd) {
+                            for (auto & output : bfd.outputs) {
+                                logger->cout(store->printStorePath(output.second));
+                            }
+                        },
                     },
-                    [&](const BuiltPath::Built & bfd) {
-                        for (auto & output : bfd.outputs) {
-                            logger->cout(store->printStorePath(output.second));
-                        }
-                    },
-                }, buildable.path.raw());
+                    buildable.path.raw());
             }
         }
 
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 50d7bf6a3..e11f37b84 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -5,8 +5,11 @@
 #include "nix/store/store-api.hh"
 #include "nix/store/local-fs-store.hh"
 #include "nix/expr/eval-inline.hh"
+#include "nix/store/globals.hh"
 
-namespace nix::fs { using namespace std::filesystem; }
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 using namespace nix;
 
@@ -30,12 +33,12 @@ struct CmdBundle : InstallableValueCommand
         addFlag({
             .longName = "out-link",
             .shortName = 'o',
-            .description = "Override the name of the symlink to the build result. It defaults to the base name of the app.",
+            .description =
+                "Override the name of the symlink to the build result. It defaults to the base name of the app.",
             .labels = {"path"},
             .handler = {&outLink},
             .completer = completePath,
         });
-
     }
 
     std::string description() override
@@ -46,19 +49,19 @@ struct CmdBundle : InstallableValueCommand
     std::string doc() override
     {
         return
-          #include "bundle.md"
-          ;
+#include "bundle.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     // FIXME: cut&paste from CmdRun.
     Strings getDefaultFlakeAttrPaths() override
     {
-        Strings res{
-            "apps." + settings.thisSystem.get() + ".default",
-            "defaultApp." + settings.thisSystem.get()
-        };
+        Strings res{"apps." + settings.thisSystem.get() + ".default", "defaultApp." + settings.thisSystem.get()};
         for (auto & s : SourceExprCommand::getDefaultFlakeAttrPaths())
             res.push_back(s);
         return res;
@@ -78,18 +81,18 @@ struct CmdBundle : InstallableValueCommand
 
         auto val = installable->toValue(*evalState).first;
 
-        auto [bundlerFlakeRef, bundlerName, extendedOutputsSpec] =
-            parseFlakeRefWithFragmentAndExtendedOutputsSpec(
-                fetchSettings, bundler, std::filesystem::current_path().string());
-        const flake::LockFlags lockFlags{ .writeLockFile = false };
-        InstallableFlake bundler{this,
-            evalState, std::move(bundlerFlakeRef), bundlerName, std::move(extendedOutputsSpec),
-            {"bundlers." + settings.thisSystem.get() + ".default",
-             "defaultBundler." + settings.thisSystem.get()
-            },
+        auto [bundlerFlakeRef, bundlerName, extendedOutputsSpec] = parseFlakeRefWithFragmentAndExtendedOutputsSpec(
+            fetchSettings, bundler, std::filesystem::current_path().string());
+        const flake::LockFlags lockFlags{.writeLockFile = false};
+        InstallableFlake bundler{
+            this,
+            evalState,
+            std::move(bundlerFlakeRef),
+            bundlerName,
+            std::move(extendedOutputsSpec),
+            {"bundlers." + settings.thisSystem.get() + ".default", "defaultBundler." + settings.thisSystem.get()},
             {"bundlers." + settings.thisSystem.get() + "."},
-            lockFlags
-        };
+            lockFlags};
 
         auto vRes = evalState->allocValue();
         evalState->callFunction(*bundler.toValue(*evalState).first, *val, *vRes, noPos);
@@ -97,7 +100,7 @@ struct CmdBundle : InstallableValueCommand
         if (!evalState->isDerivation(*vRes))
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
 
-        auto attr1 = vRes->attrs()->get(evalState->sDrvPath);
+        auto attr1 = vRes->attrs()->get(evalState->s.drvPath);
         if (!attr1)
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
 
@@ -106,21 +109,21 @@ struct CmdBundle : InstallableValueCommand
 
         drvPath.requireDerivation();
 
-        auto attr2 = vRes->attrs()->get(evalState->sOutPath);
+        auto attr2 = vRes->attrs()->get(evalState->s.outPath);
         if (!attr2)
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
 
         auto outPath = evalState->coerceToStorePath(attr2->pos, *attr2->value, context2, "");
 
         store->buildPaths({
-            DerivedPath::Built {
+            DerivedPath::Built{
                 .drvPath = makeConstantStorePathRef(drvPath),
-                .outputs = OutputsSpec::All { },
+                .outputs = OutputsSpec::All{},
             },
         });
 
         if (!outLink) {
-            auto * attr = vRes->attrs()->get(evalState->sName);
+            auto * attr = vRes->attrs()->get(evalState->s.name);
             if (!attr)
                 throw Error("attribute 'name' missing");
             outLink = evalState->forceStringNoCtx(*attr->value, attr->pos, "");
diff --git a/src/nix/cat.cc b/src/nix/cat.cc
index aa27446d2..276e01f5d 100644
--- a/src/nix/cat.cc
+++ b/src/nix/cat.cc
@@ -23,11 +23,7 @@ struct CmdCatStore : StoreCommand, MixCat
 
     CmdCatStore()
     {
-        expectArgs({
-            .label = "path",
-            .handler = {&path},
-            .completer = completePath
-        });
+        expectArgs({.label = "path", .handler = {&path}, .completer = completePath});
     }
 
     std::string description() override
@@ -38,8 +34,8 @@ struct CmdCatStore : StoreCommand, MixCat
     std::string doc() override
     {
         return
-          #include "store-cat.md"
-          ;
+#include "store-cat.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -57,11 +53,7 @@ struct CmdCatNar : StoreCommand, MixCat
 
     CmdCatNar()
     {
-        expectArgs({
-            .label = "nar",
-            .handler = {&narPath},
-            .completer = completePath
-        });
+        expectArgs({.label = "nar", .handler = {&narPath}, .completer = completePath});
         expectArg("path", &path);
     }
 
@@ -73,8 +65,8 @@ struct CmdCatNar : StoreCommand, MixCat
     std::string doc() override
     {
         return
-          #include "nar-cat.md"
-          ;
+#include "nar-cat.md"
+            ;
     }
 
     void run(ref<Store> store) override
diff --git a/src/nix/config-check.cc b/src/nix/config-check.cc
index 27d053b9f..c04943eab 100644
--- a/src/nix/config-check.cc
+++ b/src/nix/config-check.cc
@@ -9,8 +9,11 @@
 #include "nix/store/local-fs-store.hh"
 #include "nix/store/worker-protocol.hh"
 #include "nix/util/executable-path.hh"
+#include "nix/store/globals.hh"
 
-namespace nix::fs { using namespace std::filesystem; }
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 using namespace nix;
 
@@ -26,21 +29,24 @@ std::string formatProtocol(unsigned int proto)
     return "unknown";
 }
 
-bool checkPass(std::string_view msg) {
+bool checkPass(std::string_view msg)
+{
     notice(ANSI_GREEN "[PASS] " ANSI_NORMAL + msg);
     return true;
 }
 
-bool checkFail(std::string_view msg) {
+bool checkFail(std::string_view msg)
+{
     notice(ANSI_RED "[FAIL] " ANSI_NORMAL + msg);
     return false;
 }
 
-void checkInfo(std::string_view msg) {
+void checkInfo(std::string_view msg)
+{
     notice(ANSI_BLUE "[INFO] " ANSI_NORMAL + msg);
 }
 
-}
+} // namespace
 
 struct CmdConfigCheck : StoreCommand
 {
@@ -59,11 +65,14 @@ struct CmdConfigCheck : StoreCommand
         return "check your system for potential problems and print a PASS or FAIL for each check";
     }
 
-    Category category() override { return catNixInstallation; }
+    Category category() override
+    {
+        return catNixInstallation;
+    }
 
     void run(ref<Store> store) override
     {
-        logger->log("Running checks against store uri: " + store->getUri());
+        logger->log("Running checks against store uri: " + store->config.getHumanReadableURI());
 
         if (store.dynamic_pointer_cast<LocalFSStore>()) {
             success &= checkNixInPath();
@@ -83,7 +92,7 @@ struct CmdConfigCheck : StoreCommand
         for (auto & dir : ExecutablePath::load().directories) {
             auto candidate = dir / "nix-env";
             if (std::filesystem::exists(candidate))
-                dirs.insert(std::filesystem::canonical(candidate).parent_path() );
+                dirs.insert(std::filesystem::canonical(candidate).parent_path());
         }
 
         if (dirs.size() != 1) {
@@ -106,9 +115,10 @@ struct CmdConfigCheck : StoreCommand
             try {
                 auto userEnv = std::filesystem::weakly_canonical(profileDir);
 
-                auto noContainsProfiles = [&]{
+                auto noContainsProfiles = [&] {
                     for (auto && part : profileDir)
-                        if (part == "profiles") return false;
+                        if (part == "profiles")
+                            return false;
                     return true;
                 };
 
@@ -121,7 +131,8 @@ struct CmdConfigCheck : StoreCommand
                         dirs.insert(dir);
                 }
             } catch (SystemError &) {
-            } catch (std::filesystem::filesystem_error &) {}
+            } catch (std::filesystem::filesystem_error &) {
+            }
         }
 
         if (!dirs.empty()) {
@@ -141,8 +152,8 @@ struct CmdConfigCheck : StoreCommand
     bool checkStoreProtocol(unsigned int storeProto)
     {
         unsigned int clientProto = GET_PROTOCOL_MAJOR(SERVE_PROTOCOL_VERSION) == GET_PROTOCOL_MAJOR(storeProto)
-            ? SERVE_PROTOCOL_VERSION
-            : PROTOCOL_VERSION;
+                                       ? SERVE_PROTOCOL_VERSION
+                                       : PROTOCOL_VERSION;
 
         if (clientProto != storeProto) {
             std::ostringstream ss;
@@ -160,14 +171,12 @@ struct CmdConfigCheck : StoreCommand
     void checkTrustedUser(ref<Store> store)
     {
         if (auto trustedMay = store->isTrustedClient()) {
-            std::string_view trusted = trustedMay.value()
-                ? "trusted"
-                : "not trusted";
-            checkInfo(fmt("You are %s by store uri: %s", trusted, store->getUri()));
+            std::string_view trusted = trustedMay.value() ? "trusted" : "not trusted";
+            checkInfo(fmt("You are %s by store uri: %s", trusted, store->config.getHumanReadableURI()));
         } else {
-            checkInfo(fmt("Store uri: %s doesn't have a notion of trusted user", store->getUri()));
+            checkInfo(fmt("Store uri: %s doesn't have a notion of trusted user", store->config.getHumanReadableURI()));
         }
     }
 };
 
-static auto rCmdConfigCheck = registerCommand2<CmdConfigCheck>({ "config", "check" });
+static auto rCmdConfigCheck = registerCommand2<CmdConfigCheck>({"config", "check"});
diff --git a/src/nix/config.cc b/src/nix/config.cc
index cd82b08a6..c2a9fd8e2 100644
--- a/src/nix/config.cc
+++ b/src/nix/config.cc
@@ -10,22 +10,28 @@ using namespace nix;
 
 struct CmdConfig : NixMultiCommand
 {
-    CmdConfig() : NixMultiCommand("config", RegisterCommand::getCommandsFor({"config"}))
-    { }
+    CmdConfig()
+        : NixMultiCommand("config", RegisterCommand::getCommandsFor({"config"}))
+    {
+    }
 
     std::string description() override
     {
         return "manipulate the Nix configuration";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 struct CmdConfigShow : Command, MixJSON
 {
     std::optional<std::string> name;
 
-    CmdConfigShow() {
+    CmdConfigShow()
+    {
         expectArgs({
             .label = {"name"},
             .optional = true,
@@ -38,7 +44,10 @@ struct CmdConfigShow : Command, MixJSON
         return "show the Nix configuration or the value of a specific setting";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 
     void run() override
     {
diff --git a/src/nix/copy.cc b/src/nix/copy.cc
index 013f2a7e3..62e8b64f5 100644
--- a/src/nix/copy.cc
+++ b/src/nix/copy.cc
@@ -18,7 +18,8 @@ struct CmdCopy : virtual CopyCommand, virtual BuiltPathsCommand, MixProfile
         addFlag({
             .longName = "out-link",
             .shortName = 'o',
-            .description = "Create symlinks prefixed with *path* to the top-level store paths fetched from the source store.",
+            .description =
+                "Create symlinks prefixed with *path* to the top-level store paths fetched from the source store.",
             .labels = {"path"},
             .handler = {&outLink},
             .completer = completePath,
@@ -48,11 +49,14 @@ struct CmdCopy : virtual CopyCommand, virtual BuiltPathsCommand, MixProfile
     std::string doc() override
     {
         return
-          #include "copy.md"
-          ;
+#include "copy.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     void run(ref<Store> srcStore, BuiltPaths && allPaths, BuiltPaths && rootPaths) override
     {
@@ -65,8 +69,7 @@ struct CmdCopy : virtual CopyCommand, virtual BuiltPathsCommand, MixProfile
             stuffToCopy.insert(theseRealisations.begin(), theseRealisations.end());
         }
 
-        copyPaths(
-            *srcStore, *dstStore, stuffToCopy, NoRepair, checkSigs, substitute);
+        copyPaths(*srcStore, *dstStore, stuffToCopy, NoRepair, checkSigs, substitute);
 
         updateProfile(rootPaths);
 
diff --git a/src/nix/crash-handler.cc b/src/nix/crash-handler.cc
index d65773fa0..17c948dab 100644
--- a/src/nix/crash-handler.cc
+++ b/src/nix/crash-handler.cc
@@ -55,7 +55,7 @@ void onTerminate()
 
     std::abort();
 }
-}
+} // namespace
 
 void registerCrashHandler()
 {
@@ -65,4 +65,4 @@ void registerCrashHandler()
     // If you want signals, set up a minidump system and do it out-of-process.
     std::set_terminate(onTerminate);
 }
-}
+} // namespace nix
diff --git a/src/nix/crash-handler.hh b/src/nix/crash-handler.hh
index 018e86747..06404a4b3 100644
--- a/src/nix/crash-handler.hh
+++ b/src/nix/crash-handler.hh
@@ -1,4 +1,5 @@
 #pragma once
+
 /// @file Crash handler for Nix that prints back traces (hopefully in instances where it is not just going to crash the
 /// process itself).
 
@@ -8,4 +9,4 @@ namespace nix {
  * detectStackOverflow().  */
 void registerCrashHandler();
 
-}
+} // namespace nix
diff --git a/src/nix/derivation-add.cc b/src/nix/derivation-add.cc
index e99c44deb..0f797bb20 100644
--- a/src/nix/derivation-add.cc
+++ b/src/nix/derivation-add.cc
@@ -20,11 +20,14 @@ struct CmdAddDerivation : MixDryRun, StoreCommand
     std::string doc() override
     {
         return
-          #include "derivation-add.md"
-          ;
+#include "derivation-add.md"
+            ;
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 
     void run(ref<Store> store) override
     {
diff --git a/src/nix/derivation-show.cc b/src/nix/derivation-show.cc
index 26108b8b8..1a61ccd5c 100644
--- a/src/nix/derivation-show.cc
+++ b/src/nix/derivation-show.cc
@@ -33,11 +33,14 @@ struct CmdShowDerivation : InstallablesCommand, MixPrintJSON
     std::string doc() override
     {
         return
-          #include "derivation-show.md"
-          ;
+#include "derivation-show.md"
+            ;
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 
     void run(ref<Store> store, Installables && installables) override
     {
@@ -52,10 +55,10 @@ struct CmdShowDerivation : InstallablesCommand, MixPrintJSON
         json jsonRoot = json::object();
 
         for (auto & drvPath : drvPaths) {
-            if (!drvPath.isDerivation()) continue;
+            if (!drvPath.isDerivation())
+                continue;
 
-            jsonRoot[store->printStorePath(drvPath)] =
-                store->readDerivation(drvPath).toJSON(*store);
+            jsonRoot[store->printStorePath(drvPath)] = store->readDerivation(drvPath).toJSON(*store);
         }
         printJSON(jsonRoot);
     }
diff --git a/src/nix/derivation.cc b/src/nix/derivation.cc
index ee62ab4dc..2634048ac 100644
--- a/src/nix/derivation.cc
+++ b/src/nix/derivation.cc
@@ -4,15 +4,20 @@ using namespace nix;
 
 struct CmdDerivation : NixMultiCommand
 {
-    CmdDerivation() : NixMultiCommand("derivation", RegisterCommand::getCommandsFor({"derivation"}))
-    { }
+    CmdDerivation()
+        : NixMultiCommand("derivation", RegisterCommand::getCommandsFor({"derivation"}))
+    {
+    }
 
     std::string description() override
     {
         return "Work with derivations, Nix's notion of a build plan.";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 static auto rCmdDerivation = registerCommand<CmdDerivation>("derivation");
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 37bce6ca0..f78eee59a 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -5,11 +5,12 @@
 #include "nix/main/common-args.hh"
 #include "nix/main/shared.hh"
 #include "nix/store/store-api.hh"
+#include "nix/store/globals.hh"
 #include "nix/store/outputs-spec.hh"
 #include "nix/store/derivations.hh"
 
 #ifndef _WIN32 // TODO re-enable on Windows
-# include "run.hh"
+#  include "run.hh"
 #endif
 
 #include <iterator>
@@ -20,20 +21,21 @@
 
 #include "nix/util/strings.hh"
 
-namespace nix::fs { using namespace std::filesystem; }
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 using namespace nix;
 
 struct DevelopSettings : Config
 {
-    Setting<std::string> bashPrompt{this, "", "bash-prompt",
-        "The bash prompt (`PS1`) in `nix develop` shells."};
+    Setting<std::string> bashPrompt{this, "", "bash-prompt", "The bash prompt (`PS1`) in `nix develop` shells."};
 
-    Setting<std::string> bashPromptPrefix{this, "", "bash-prompt-prefix",
-        "Prefix prepended to the `PS1` environment variable in `nix develop` shells."};
+    Setting<std::string> bashPromptPrefix{
+        this, "", "bash-prompt-prefix", "Prefix prepended to the `PS1` environment variable in `nix develop` shells."};
 
-    Setting<std::string> bashPromptSuffix{this, "", "bash-prompt-suffix",
-        "Suffix appended to the `PS1` environment variable in `nix develop` shells."};
+    Setting<std::string> bashPromptSuffix{
+        this, "", "bash-prompt-suffix", "Suffix appended to the `PS1` environment variable in `nix develop` shells."};
 };
 
 static DevelopSettings developSettings;
@@ -47,7 +49,7 @@ struct BuildEnvironment
         bool exported;
         std::string value;
 
-        bool operator == (const String & other) const
+        bool operator==(const String & other) const
         {
             return exported == other.exported && value == other.value;
         }
@@ -72,7 +74,8 @@ struct BuildEnvironment
         for (auto & [name, info] : json["variables"].items()) {
             std::string type = info["type"];
             if (type == "var" || type == "exported")
-                res.vars.insert({name, BuildEnvironment::String { .exported = type == "exported", .value = info["value"] }});
+                res.vars.insert(
+                    {name, BuildEnvironment::String{.exported = type == "exported", .value = info["value"]}});
             else if (type == "array")
                 res.vars.insert({name, (Array) info["value"]});
             else if (type == "associative")
@@ -107,12 +110,10 @@ struct BuildEnvironment
             if (auto str = std::get_if<String>(&value)) {
                 info["type"] = str->exported ? "exported" : "var";
                 info["value"] = str->value;
-            }
-            else if (auto arr = std::get_if<Array>(&value)) {
+            } else if (auto arr = std::get_if<Array>(&value)) {
                 info["type"] = "array";
                 info["value"] = *arr;
-            }
-            else if (auto arr = std::get_if<Associative>(&value)) {
+            } else if (auto arr = std::get_if<Associative>(&value)) {
                 info["type"] = "associative";
                 info["value"] = *arr;
             }
@@ -159,14 +160,12 @@ struct BuildEnvironment
                     out << fmt("%s=%s\n", name, escapeShellArgAlways(str->value));
                     if (str->exported)
                         out << fmt("export %s\n", name);
-                }
-                else if (auto arr = std::get_if<Array>(&value)) {
+                } else if (auto arr = std::get_if<Array>(&value)) {
                     out << "declare -a " << name << "=(";
                     for (auto & s : *arr)
                         out << escapeShellArgAlways(s) << " ";
                     out << ")\n";
-                }
-                else if (auto arr = std::get_if<Associative>(&value)) {
+                } else if (auto arr = std::get_if<Associative>(&value)) {
                     out << "declare -A " << name << "=(";
                     for (auto & [n, v] : *arr)
                         out << "[" << escapeShellArgAlways(n) << "]=" << escapeShellArgAlways(v) << " ";
@@ -206,12 +205,11 @@ struct BuildEnvironment
             Array assocKeys;
             std::for_each(assoc->begin(), assoc->end(), [&](auto & n) { assocKeys.push_back(n.first); });
             return assocKeys;
-        }
-        else
+        } else
             throw Error("bash variable is not a string or array");
     }
 
-    bool operator == (const BuildEnvironment & other) const
+    bool operator==(const BuildEnvironment & other) const
     {
         return vars == other.vars && bashFunctions == other.bashFunctions;
     }
@@ -226,7 +224,7 @@ struct BuildEnvironment
 };
 
 const static std::string getEnvSh =
-    #include "get-env.sh.gen.hh"
+#include "get-env.sh.gen.hh"
     ;
 
 /* Given an existing derivation, return the shell environment as
@@ -243,9 +241,14 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
         throw Error("'nix develop' only works on derivations that use 'bash' as their builder");
 
     auto getEnvShPath = ({
-        StringSource source { getEnvSh };
+        StringSource source{getEnvSh};
         evalStore->addToStoreFromDump(
-            source, "get-env.sh", FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, {});
+            source,
+            "get-env.sh",
+            FileSerialisationMethod::Flat,
+            ContentAddressMethod::Raw::Text,
+            HashAlgorithm::SHA256,
+            {});
     });
 
     drv.args = {store->printStorePath(getEnvShPath)};
@@ -264,12 +267,11 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
     drv.inputSrcs.insert(std::move(getEnvShPath));
     if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
         for (auto & output : drv.outputs) {
-            output.second = DerivationOutput::Deferred {},
-            drv.env[output.first] = hashPlaceholder(output.first);
+            output.second = DerivationOutput::Deferred{}, drv.env[output.first] = hashPlaceholder(output.first);
         }
     } else {
         for (auto & output : drv.outputs) {
-            output.second = DerivationOutput::Deferred { };
+            output.second = DerivationOutput::Deferred{};
             drv.env[output.first] = "";
         }
         auto hashesModulo = hashDerivationModulo(*evalStore, drv, true);
@@ -277,7 +279,7 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
         for (auto & output : drv.outputs) {
             Hash h = hashesModulo.hashes.at(output.first);
             auto outPath = store->makeOutputPath(output.first, h, drv.name);
-            output.second = DerivationOutput::InputAddressed {
+            output.second = DerivationOutput::InputAddressed{
                 .path = outPath,
             };
             drv.env[output.first] = store->printStorePath(outPath);
@@ -288,11 +290,12 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
 
     /* Build the derivation. */
     store->buildPaths(
-        { DerivedPath::Built {
+        {DerivedPath::Built{
             .drvPath = makeConstantStorePathRef(shellDrvPath),
-            .outputs = OutputsSpec::All { },
+            .outputs = OutputsSpec::All{},
         }},
-        bmNormal, evalStore);
+        bmNormal,
+        evalStore);
 
     for (auto & [_0, optPath] : evalStore->queryPartialDerivationOutputMap(shellDrvPath)) {
         assert(optPath);
@@ -345,7 +348,7 @@ struct Common : InstallableCommand, MixProfile
         ref<Store> store,
         const BuildEnvironment & buildEnvironment,
         const std::filesystem::path & tmpDir,
-        const std::filesystem::path & outputsDir = std::filesystem::path { std::filesystem::current_path() } / "outputs")
+        const std::filesystem::path & outputsDir = std::filesystem::path{std::filesystem::current_path()} / "outputs")
     {
         // A list of colon-separated environment variables that should be
         // prepended to, rather than overwritten, in order to keep the shell usable.
@@ -384,10 +387,7 @@ struct Common : InstallableCommand, MixProfile
         StringMap rewrites;
         if (buildEnvironment.providesStructuredAttrs()) {
             for (auto & [outputName, from] : BuildEnvironment::getAssociative(outputs->second)) {
-                rewrites.insert({
-                    from,
-                    (outputsDir / outputName).string()
-                });
+                rewrites.insert({from, (outputsDir / outputName).string()});
             }
         } else {
             for (auto & outputName : BuildEnvironment::getStrings(outputs->second)) {
@@ -404,9 +404,9 @@ struct Common : InstallableCommand, MixProfile
         for (auto & [installable_, dir_] : redirects) {
             auto dir = absPath(dir_);
             auto installable = parseInstallable(store, installable_);
-            auto builtPaths = Installable::toStorePathSet(
-                getEvalStore(), store, Realise::Nothing, OperateOn::Output, {installable});
-            for (auto & path: builtPaths) {
+            auto builtPaths =
+                Installable::toStorePathSet(getEvalStore(), store, Realise::Nothing, OperateOn::Output, {installable});
+            for (auto & path : builtPaths) {
                 auto from = store->printStorePath(path);
                 if (script.find(from) == std::string::npos)
                     warn("'%s' (path '%s') is not used by this build environment", installable->what(), from);
@@ -419,21 +419,14 @@ struct Common : InstallableCommand, MixProfile
 
         if (buildEnvironment.providesStructuredAttrs()) {
             fixupStructuredAttrs(
-                OS_STR("sh"),
-                "NIX_ATTRS_SH_FILE",
-                buildEnvironment.getAttrsSH(),
-                rewrites,
-                buildEnvironment,
-                tmpDir
-            );
+                OS_STR("sh"), "NIX_ATTRS_SH_FILE", buildEnvironment.getAttrsSH(), rewrites, buildEnvironment, tmpDir);
             fixupStructuredAttrs(
                 OS_STR("json"),
                 "NIX_ATTRS_JSON_FILE",
                 buildEnvironment.getAttrsJSON(),
                 rewrites,
                 buildEnvironment,
-                tmpDir
-            );
+                tmpDir);
         }
 
         return rewriteStrings(script, rewrites);
@@ -488,8 +481,10 @@ struct Common : InstallableCommand, MixProfile
             auto drvs = Installable::toDerivations(store, {installable});
 
             if (drvs.size() != 1)
-                throw Error("'%s' needs to evaluate to a single derivation, but it evaluated to %d derivations",
-                    installable->what(), drvs.size());
+                throw Error(
+                    "'%s' needs to evaluate to a single derivation, but it evaluated to %d derivations",
+                    installable->what(),
+                    drvs.size());
 
             auto & drvPath = *drvs.begin();
 
@@ -497,8 +492,7 @@ struct Common : InstallableCommand, MixProfile
         }
     }
 
-    std::pair<BuildEnvironment, std::string>
-    getBuildEnvironment(ref<Store> store, ref<Installable> installable)
+    std::pair<BuildEnvironment, std::string> getBuildEnvironment(ref<Store> store, ref<Installable> installable)
     {
         auto shellOutPath = getShellOutPath(store, installable);
 
@@ -525,7 +519,8 @@ struct CmdDevelop : Common, MixEnvironment
             .description = "Instead of starting an interactive shell, start the specified command and arguments.",
             .labels = {"command", "args"},
             .handler = {[&](std::vector<std::string> ss) {
-                if (ss.empty()) throw UsageError("--command requires at least one argument");
+                if (ss.empty())
+                    throw UsageError("--command requires at least one argument");
                 command = ss;
             }},
         });
@@ -582,8 +577,8 @@ struct CmdDevelop : Common, MixEnvironment
     std::string doc() override
     {
         return
-          #include "develop.md"
-          ;
+#include "develop.md"
+            ;
     }
 
     void run(ref<Store> store, ref<Installable> installable) override
@@ -619,25 +614,25 @@ struct CmdDevelop : Common, MixEnvironment
         }
 
         else {
-            script = "[ -n \"$PS1\" ] && [ -e ~/.bashrc ] && source ~/.bashrc;\nshopt -u expand_aliases\n" + script + "\nshopt -s expand_aliases\n";
+            script = "[ -n \"$PS1\" ] && [ -e ~/.bashrc ] && source ~/.bashrc;\nshopt -u expand_aliases\n" + script
+                     + "\nshopt -s expand_aliases\n";
             if (developSettings.bashPrompt != "")
-                script += fmt("[ -n \"$PS1\" ] && PS1=%s;\n",
-                    escapeShellArgAlways(developSettings.bashPrompt.get()));
+                script += fmt("[ -n \"$PS1\" ] && PS1=%s;\n", escapeShellArgAlways(developSettings.bashPrompt.get()));
             if (developSettings.bashPromptPrefix != "")
-                script += fmt("[ -n \"$PS1\" ] && PS1=%s\"$PS1\";\n",
-                    escapeShellArgAlways(developSettings.bashPromptPrefix.get()));
+                script +=
+                    fmt("[ -n \"$PS1\" ] && PS1=%s\"$PS1\";\n",
+                        escapeShellArgAlways(developSettings.bashPromptPrefix.get()));
             if (developSettings.bashPromptSuffix != "")
-                script += fmt("[ -n \"$PS1\" ] && PS1+=%s;\n",
-                    escapeShellArgAlways(developSettings.bashPromptSuffix.get()));
+                script +=
+                    fmt("[ -n \"$PS1\" ] && PS1+=%s;\n", escapeShellArgAlways(developSettings.bashPromptSuffix.get()));
         }
 
-        writeFull(rcFileFd.get(), script);
-
         setEnviron();
         // prevent garbage collection until shell exits
         setEnv("NIX_GCROOT", gcroot.c_str());
 
         Path shell = "bash";
+        bool foundInteractive = false;
 
         try {
             auto state = getEvalState();
@@ -651,7 +646,7 @@ struct CmdDevelop : Common, MixEnvironment
                 nixpkgs = i->nixpkgsFlakeRef();
 
             auto bashInstallable = make_ref<InstallableFlake>(
-                this,
+                nullptr, //< Don't barf when the command is run with --arg/--argstr
                 state,
                 std::move(nixpkgs),
                 "bashInteractive",
@@ -660,18 +655,17 @@ struct CmdDevelop : Common, MixEnvironment
                 Strings{"legacyPackages." + settings.thisSystem.get() + "."},
                 nixpkgsLockFlags);
 
-            bool found = false;
-
-            for (auto & path : Installable::toStorePathSet(getEvalStore(), store, Realise::Outputs, OperateOn::Output, {bashInstallable})) {
+            for (auto & path : Installable::toStorePathSet(
+                     getEvalStore(), store, Realise::Outputs, OperateOn::Output, {bashInstallable})) {
                 auto s = store->printStorePath(path) + "/bin/bash";
                 if (pathExists(s)) {
                     shell = s;
-                    found = true;
+                    foundInteractive = true;
                     break;
                 }
             }
 
-            if (!found)
+            if (!foundInteractive)
                 throw Error("package 'nixpkgs#bashInteractive' does not provide a 'bin/bash'");
 
         } catch (Error &) {
@@ -681,6 +675,11 @@ struct CmdDevelop : Common, MixEnvironment
         // Override SHELL with the one chosen for this environment.
         // This is to make sure the system shell doesn't leak into the build environment.
         setEnv("SHELL", shell.c_str());
+        // https://github.com/NixOS/nix/issues/5873
+        script += fmt("SHELL=\"%s\"\n", shell);
+        if (foundInteractive)
+            script += fmt("PATH=\"%s${PATH:+:$PATH}\"\n", std::filesystem::path(shell).parent_path());
+        writeFull(rcFileFd.get(), script);
 
 #ifdef _WIN32 // TODO re-enable on Windows
         throw UnimplementedError("Cannot yet spawn processes on Windows");
@@ -688,7 +687,7 @@ struct CmdDevelop : Common, MixEnvironment
         // If running a phase or single command, don't want an interactive shell running after
         // Ctrl-C, so don't pass --rcfile
         auto args = phase || !command.empty() ? Strings{std::string(baseNameOf(shell)), rcFilePath}
-            : Strings{std::string(baseNameOf(shell)), "--rcfile", rcFilePath};
+                                              : Strings{std::string(baseNameOf(shell)), "--rcfile", rcFilePath};
 
         // Need to chdir since phases assume in flake directory
         if (phase) {
@@ -723,11 +722,14 @@ struct CmdPrintDevEnv : Common, MixJSON
     std::string doc() override
     {
         return
-          #include "print-dev-env.md"
-          ;
+#include "print-dev-env.md"
+            ;
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 
     void run(ref<Store> store, ref<Installable> installable) override
     {
diff --git a/src/nix/diff-closures.cc b/src/nix/diff-closures.cc
index ff9f9db40..cbf842e5c 100644
--- a/src/nix/diff-closures.cc
+++ b/src/nix/diff-closures.cc
@@ -10,11 +10,15 @@
 
 namespace nix {
 
+namespace {
+
 struct Info
 {
     std::string outputName;
 };
 
+} // namespace
+
 // name -> version -> store paths
 typedef std::map<std::string, std::map<std::string, std::map<StorePath, Info>>> GroupedPaths;
 
@@ -41,7 +45,7 @@ GroupedPaths getClosureInfo(ref<Store> store, const StorePath & toplevel)
         }
 
         DrvName drvName(name);
-        groupedPaths[drvName.name][drvName.version].emplace(path, Info { .outputName = outputName });
+        groupedPaths[drvName.name][drvName.version].emplace(path, Info{.outputName = outputName});
     }
 
     return groupedPaths;
@@ -49,7 +53,8 @@ GroupedPaths getClosureInfo(ref<Store> store, const StorePath & toplevel)
 
 std::string showVersions(const StringSet & versions)
 {
-    if (versions.empty()) return "∅";
+    if (versions.empty())
+        return "∅";
     StringSet versions2;
     for (auto & version : versions)
         versions2.insert(version.empty() ? "ε" : version);
@@ -57,24 +62,22 @@ std::string showVersions(const StringSet & versions)
 }
 
 void printClosureDiff(
-    ref<Store> store,
-    const StorePath & beforePath,
-    const StorePath & afterPath,
-    std::string_view indent)
+    ref<Store> store, const StorePath & beforePath, const StorePath & afterPath, std::string_view indent)
 {
     auto beforeClosure = getClosureInfo(store, beforePath);
     auto afterClosure = getClosureInfo(store, afterPath);
 
     StringSet allNames;
-    for (auto & [name, _] : beforeClosure) allNames.insert(name);
-    for (auto & [name, _] : afterClosure) allNames.insert(name);
+    for (auto & [name, _] : beforeClosure)
+        allNames.insert(name);
+    for (auto & [name, _] : afterClosure)
+        allNames.insert(name);
 
     for (auto & name : allNames) {
         auto & beforeVersions = beforeClosure[name];
         auto & afterVersions = afterClosure[name];
 
-        auto totalSize = [&](const std::map<std::string, std::map<StorePath, Info>> & versions)
-        {
+        auto totalSize = [&](const std::map<std::string, std::map<StorePath, Info>> & versions) {
             uint64_t sum = 0;
             for (auto & [_, paths] : versions)
                 for (auto & [path, _] : paths)
@@ -89,24 +92,29 @@ void printClosureDiff(
 
         StringSet removed, unchanged;
         for (auto & [version, _] : beforeVersions)
-            if (!afterVersions.count(version)) removed.insert(version); else unchanged.insert(version);
+            if (!afterVersions.count(version))
+                removed.insert(version);
+            else
+                unchanged.insert(version);
 
         StringSet added;
         for (auto & [version, _] : afterVersions)
-            if (!beforeVersions.count(version)) added.insert(version);
+            if (!beforeVersions.count(version))
+                added.insert(version);
 
         if (showDelta || !removed.empty() || !added.empty()) {
             std::vector<std::string> items;
             if (!removed.empty() || !added.empty())
                 items.push_back(fmt("%s → %s", showVersions(removed), showVersions(added)));
             if (showDelta)
-                items.push_back(fmt("%s%+.1f KiB" ANSI_NORMAL, sizeDelta > 0 ? ANSI_RED : ANSI_GREEN, sizeDelta / 1024.0));
+                items.push_back(
+                    fmt("%s%+.1f KiB" ANSI_NORMAL, sizeDelta > 0 ? ANSI_RED : ANSI_GREEN, sizeDelta / 1024.0));
             logger->cout("%s%s: %s", indent, name, concatStringsSep(", ", items));
         }
     }
 }
 
-}
+} // namespace nix
 
 using namespace nix;
 
@@ -128,8 +136,8 @@ struct CmdDiffClosures : SourceExprCommand, MixOperateOnOptions
     std::string doc() override
     {
         return
-          #include "diff-closures.md"
-          ;
+#include "diff-closures.md"
+            ;
     }
 
     void run(ref<Store> store) override
diff --git a/src/nix/dump-path.cc b/src/nix/dump-path.cc
index c883630b1..8475655e9 100644
--- a/src/nix/dump-path.cc
+++ b/src/nix/dump-path.cc
@@ -14,8 +14,8 @@ struct CmdDumpPath : StorePathCommand
     std::string doc() override
     {
         return
-          #include "store-dump-path.md"
-          ;
+#include "store-dump-path.md"
+            ;
     }
 
     void run(ref<Store> store, const StorePath & storePath) override
@@ -34,11 +34,7 @@ struct CmdDumpPath2 : Command
 
     CmdDumpPath2()
     {
-        expectArgs({
-            .label = "path",
-            .handler = {&path},
-            .completer = completePath
-        });
+        expectArgs({.label = "path", .handler = {&path}, .completer = completePath});
     }
 
     std::string description() override
@@ -49,8 +45,8 @@ struct CmdDumpPath2 : Command
     std::string doc() override
     {
         return
-          #include "nar-dump-path.md"
-          ;
+#include "nar-dump-path.md"
+            ;
     }
 
     void run() override
@@ -61,8 +57,10 @@ struct CmdDumpPath2 : Command
     }
 };
 
-struct CmdNarDumpPath : CmdDumpPath2 {
-    void run() override {
+struct CmdNarDumpPath : CmdDumpPath2
+{
+    void run() override
+    {
         warn("'nix nar dump-path' is a deprecated alias for 'nix nar pack'");
         CmdDumpPath2::run();
     }
diff --git a/src/nix/edit.cc b/src/nix/edit.cc
index cfb9eb74a..0657301f3 100644
--- a/src/nix/edit.cc
+++ b/src/nix/edit.cc
@@ -19,11 +19,14 @@ struct CmdEdit : InstallableValueCommand
     std::string doc() override
     {
         return
-          #include "edit.md"
-          ;
+#include "edit.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     void run(ref<Store> store, ref<InstallableValue> installable) override
     {
@@ -48,7 +51,8 @@ struct CmdEdit : InstallableValueCommand
         execvp(args.front().c_str(), stringsToCharPtrs(args).data());
 
         std::string command;
-        for (const auto &arg : args) command += " '" + arg + "'";
+        for (const auto & arg : args)
+            command += " '" + arg + "'";
         throw SysError("cannot run command%s", command);
     }
 };
diff --git a/src/nix/env.cc b/src/nix/env.cc
index 277bd0fdd..c8fb5bee0 100644
--- a/src/nix/env.cc
+++ b/src/nix/env.cc
@@ -6,6 +6,7 @@
 #include "run.hh"
 #include "nix/util/strings.hh"
 #include "nix/util/executable-path.hh"
+#include "nix/util/environment-variables.hh"
 
 using namespace nix;
 
@@ -70,7 +71,7 @@ struct CmdShell : InstallablesCommand, MixEnvironment
         auto outPaths =
             Installable::toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
 
-        std::unordered_set<StorePath> done;
+        boost::unordered_flat_set<StorePath, std::hash<StorePath>> done;
         std::queue<StorePath> todo;
         for (auto & path : outPaths)
             todo.push(path);
diff --git a/src/nix/eval.cc b/src/nix/eval.cc
index be064e552..10d0a1841 100644
--- a/src/nix/eval.cc
+++ b/src/nix/eval.cc
@@ -10,7 +10,9 @@
 
 using namespace nix;
 
-namespace nix::fs { using namespace std::filesystem; }
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
 {
@@ -18,7 +20,8 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
     std::optional<std::string> apply;
     std::optional<std::filesystem::path> writeTo;
 
-    CmdEval() : InstallableValueCommand()
+    CmdEval()
+        : InstallableValueCommand()
     {
         addFlag({
             .longName = "raw",
@@ -49,11 +52,14 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
     std::string doc() override
     {
         return
-          #include "eval.md"
-          ;
+#include "eval.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     void run(ref<Store> store, ref<InstallableValue> installable) override
     {
@@ -81,8 +87,7 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
 
             std::function<void(Value & v, const PosIdx pos, const std::filesystem::path & path)> recurse;
 
-            recurse = [&](Value & v, const PosIdx pos, const std::filesystem::path & path)
-            {
+            recurse = [&](Value & v, const PosIdx pos, const std::filesystem::path & path) {
                 state->forceValue(v, pos);
                 if (v.type() == nString)
                     // FIXME: disallow strings with contexts?
@@ -99,14 +104,13 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
                             recurse(*attr.value, attr.pos, path / name);
                         } catch (Error & e) {
                             e.addTrace(
-                                state->positions[attr.pos],
-                                HintFmt("while evaluating the attribute '%s'", name));
+                                state->positions[attr.pos], HintFmt("while evaluating the attribute '%s'", name));
                             throw;
                         }
                     }
-                }
-                else
-                    state->error<TypeError>("value at '%s' is not a string or an attribute set", state->positions[pos]).debugThrow();
+                } else
+                    state->error<TypeError>("value at '%s' is not a string or an attribute set", state->positions[pos])
+                        .debugThrow();
             };
 
             recurse(*v, pos, *writeTo);
@@ -114,7 +118,9 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
 
         else if (raw) {
             logger->stop();
-            writeFull(getStandardOutput(), *state->coerceToString(noPos, *v, context, "while generating the eval command output"));
+            writeFull(
+                getStandardOutput(),
+                *state->coerceToString(noPos, *v, context, "while generating the eval command output"));
         }
 
         else if (json) {
@@ -122,17 +128,7 @@ struct CmdEval : MixJSON, InstallableValueCommand, MixReadOnlyOption
         }
 
         else {
-            logger->cout(
-                "%s",
-                ValuePrinter(
-                    *state,
-                    *v,
-                    PrintOptions {
-                        .force = true,
-                        .derivationPaths = true
-                    }
-                )
-            );
+            logger->cout("%s", ValuePrinter(*state, *v, PrintOptions{.force = true, .derivationPaths = true}));
         }
     }
 };
diff --git a/src/nix/flake-command.hh b/src/nix/flake-command.hh
index 36dfe44c6..3636bd525 100644
--- a/src/nix/flake-command.hh
+++ b/src/nix/flake-command.hh
@@ -24,4 +24,4 @@ public:
     std::vector<FlakeRef> getFlakeRefsForCompletion() override;
 };
 
-}
+} // namespace nix
diff --git a/src/nix/flake-prefetch-inputs.cc b/src/nix/flake-prefetch-inputs.cc
new file mode 100644
index 000000000..096eaf539
--- /dev/null
+++ b/src/nix/flake-prefetch-inputs.cc
@@ -0,0 +1,72 @@
+#include "flake-command.hh"
+#include "nix/fetchers/fetch-to-store.hh"
+#include "nix/util/thread-pool.hh"
+#include "nix/store/filetransfer.hh"
+#include "nix/util/exit.hh"
+
+#include <nlohmann/json.hpp>
+
+using namespace nix;
+using namespace nix::flake;
+
+struct CmdFlakePrefetchInputs : FlakeCommand
+{
+    std::string description() override
+    {
+        return "fetch the inputs of a flake";
+    }
+
+    std::string doc() override
+    {
+        return
+#include "flake-prefetch-inputs.md"
+            ;
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        auto flake = lockFlake();
+
+        ThreadPool pool{fileTransferSettings.httpConnections};
+
+        struct State
+        {
+            std::set<const Node *> done;
+        };
+
+        Sync<State> state_;
+
+        std::atomic<size_t> nrFailed{0};
+
+        std::function<void(const Node & node)> visit;
+        visit = [&](const Node & node) {
+            if (!state_.lock()->done.insert(&node).second)
+                return;
+
+            if (auto lockedNode = dynamic_cast<const LockedNode *>(&node)) {
+                try {
+                    Activity act(*logger, lvlInfo, actUnknown, fmt("fetching '%s'", lockedNode->lockedRef));
+                    auto accessor = lockedNode->lockedRef.input.getAccessor(store).first;
+                    fetchToStore(
+                        fetchSettings, *store, accessor, FetchMode::Copy, lockedNode->lockedRef.input.getName());
+                } catch (Error & e) {
+                    printError("%s", e.what());
+                    nrFailed++;
+                }
+            }
+
+            for (auto & [inputName, input] : node.inputs) {
+                if (auto inputNode = std::get_if<0>(&input))
+                    pool.enqueue(std::bind(visit, **inputNode));
+            }
+        };
+
+        pool.enqueue(std::bind(visit, *flake.lockFile.root));
+
+        pool.process();
+
+        throw Exit(nrFailed ? 1 : 0);
+    }
+};
+
+static auto rCmdFlakePrefetchInputs = registerCommand2<CmdFlakePrefetchInputs>({"flake", "prefetch-inputs"});
diff --git a/src/nix/flake-prefetch-inputs.md b/src/nix/flake-prefetch-inputs.md
new file mode 100644
index 000000000..a69f7d367
--- /dev/null
+++ b/src/nix/flake-prefetch-inputs.md
@@ -0,0 +1,17 @@
+R""(
+
+# Examples
+
+* Fetch the inputs of the `hydra` flake:
+
+  ```console
+  # nix flake prefetch-inputs github:NixOS/hydra
+  ```
+
+# Description
+
+Fetch the inputs of a flake. This ensures that they are already available for any subsequent evaluation of the flake.
+
+This operation is recursive: it will fetch not just the direct inputs of the top-level flake, but also transitive inputs.
+
+)""
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 1d20add02..3b1e2f5e4 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -1,4 +1,3 @@
-#include "flake-command.hh"
 #include "nix/main/common-args.hh"
 #include "nix/main/shared.hh"
 #include "nix/expr/eval.hh"
@@ -17,6 +16,7 @@
 #include "nix/util/users.hh"
 #include "nix/fetchers/fetch-to-store.hh"
 #include "nix/store/local-fs-store.hh"
+#include "nix/store/globals.hh"
 
 #include <filesystem>
 #include <nlohmann/json.hpp>
@@ -24,7 +24,12 @@
 
 #include "nix/util/strings-inline.hh"
 
-namespace nix::fs { using namespace std::filesystem; }
+// FIXME is this supposed to be private or not?
+#include "flake-command.hh"
+
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 using namespace nix;
 using namespace nix::flake;
@@ -34,19 +39,18 @@ struct CmdFlakeUpdate;
 
 FlakeCommand::FlakeCommand()
 {
-    expectArgs({
-        .label = "flake-url",
-        .optional = true,
-        .handler = {&flakeUrl},
-        .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
-            completeFlakeRef(completions, getStore(), prefix);
-        }}
-    });
+    expectArgs(
+        {.label = "flake-url",
+         .optional = true,
+         .handler = {&flakeUrl},
+         .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
+             completeFlakeRef(completions, getStore(), prefix);
+         }}});
 }
 
 FlakeRef FlakeCommand::getFlakeRef()
 {
-    return parseFlakeRef(fetchSettings, flakeUrl, std::filesystem::current_path().string()); //FIXME
+    return parseFlakeRef(fetchSettings, flakeUrl, std::filesystem::current_path().string()); // FIXME
 }
 
 LockedFlake FlakeCommand::lockFlake()
@@ -56,10 +60,8 @@ LockedFlake FlakeCommand::lockFlake()
 
 std::vector<FlakeRef> FlakeCommand::getFlakeRefsForCompletion()
 {
-    return {
-        // Like getFlakeRef but with expandTilde called first
-        parseFlakeRef(fetchSettings, expandTilde(flakeUrl), std::filesystem::current_path().string())
-    };
+    return {// Like getFlakeRef but with expandTilde called first
+            parseFlakeRef(fetchSettings, expandTilde(flakeUrl), std::filesystem::current_path().string())};
 }
 
 struct CmdFlakeUpdate : FlakeCommand
@@ -75,28 +77,33 @@ public:
     {
         expectedArgs.clear();
         addFlag({
-            .longName="flake",
-            .description="The flake to operate on. Default is the current directory.",
-            .labels={"flake-url"},
-            .handler={&flakeUrl},
+            .longName = "flake",
+            .description = "The flake to operate on. Default is the current directory.",
+            .labels = {"flake-url"},
+            .handler = {&flakeUrl},
             .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
                 completeFlakeRef(completions, getStore(), prefix);
             }},
         });
         expectArgs({
-            .label="inputs",
-            .optional=true,
-            .handler={[&](std::vector<std::string> inputsToUpdate){
+            .label = "inputs",
+            .optional = true,
+            .handler = {[&](std::vector<std::string> inputsToUpdate) {
                 for (const auto & inputToUpdate : inputsToUpdate) {
                     InputAttrPath inputAttrPath;
                     try {
                         inputAttrPath = flake::parseInputAttrPath(inputToUpdate);
                     } catch (Error & e) {
-                        warn("Invalid flake input '%s'. To update a specific flake, use 'nix flake update --flake %s' instead.", inputToUpdate, inputToUpdate);
+                        warn(
+                            "Invalid flake input '%s'. To update a specific flake, use 'nix flake update --flake %s' instead.",
+                            inputToUpdate,
+                            inputToUpdate);
                         throw e;
                     }
                     if (lockFlags.inputUpdates.contains(inputAttrPath))
-                        warn("Input '%s' was specified multiple times. You may have done this by accident.", printInputAttrPath(inputAttrPath));
+                        warn(
+                            "Input '%s' was specified multiple times. You may have done this by accident.",
+                            printInputAttrPath(inputAttrPath));
                     lockFlags.inputUpdates.insert(inputAttrPath);
                 }
             }},
@@ -113,8 +120,8 @@ public:
     std::string doc() override
     {
         return
-          #include "flake-update.md"
-          ;
+#include "flake-update.md"
+            ;
     }
 
     void run(nix::ref<nix::Store> store) override
@@ -146,8 +153,8 @@ struct CmdFlakeLock : FlakeCommand
     std::string doc() override
     {
         return
-          #include "flake-lock.md"
-          ;
+#include "flake-lock.md"
+            ;
     }
 
     void run(nix::ref<nix::Store> store) override
@@ -162,7 +169,9 @@ struct CmdFlakeLock : FlakeCommand
     }
 };
 
-static void enumerateOutputs(EvalState & state, Value & vFlake,
+static void enumerateOutputs(
+    EvalState & state,
+    Value & vFlake,
     std::function<void(std::string_view name, Value & vProvide, const PosIdx pos)> callback)
 {
     auto pos = vFlake.determinePos(noPos);
@@ -197,8 +206,8 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "flake-metadata.md"
-          ;
+#include "flake-metadata.md"
+            ;
     }
 
     void run(nix::ref<nix::Store> store) override
@@ -235,40 +244,25 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 j["fingerprint"] = fingerprint->to_string(HashFormat::Base16, false);
             printJSON(j);
         } else {
-            logger->cout(
-                ANSI_BOLD "Resolved URL:" ANSI_NORMAL "  %s",
-                flake.resolvedRef.to_string());
+            logger->cout(ANSI_BOLD "Resolved URL:" ANSI_NORMAL "  %s", flake.resolvedRef.to_string());
             if (flake.lockedRef.input.isLocked())
-                logger->cout(
-                    ANSI_BOLD "Locked URL:" ANSI_NORMAL "    %s",
-                    flake.lockedRef.to_string());
+                logger->cout(ANSI_BOLD "Locked URL:" ANSI_NORMAL "    %s", flake.lockedRef.to_string());
             if (flake.description)
-                logger->cout(
-                    ANSI_BOLD "Description:" ANSI_NORMAL "   %s",
-                    *flake.description);
-            logger->cout(
-                ANSI_BOLD "Path:" ANSI_NORMAL "          %s",
-                storePath);
+                logger->cout(ANSI_BOLD "Description:" ANSI_NORMAL "   %s", *flake.description);
+            logger->cout(ANSI_BOLD "Path:" ANSI_NORMAL "          %s", storePath);
             if (auto rev = flake.lockedRef.input.getRev())
-                logger->cout(
-                    ANSI_BOLD "Revision:" ANSI_NORMAL "      %s",
-                    rev->to_string(HashFormat::Base16, false));
+                logger->cout(ANSI_BOLD "Revision:" ANSI_NORMAL "      %s", rev->to_string(HashFormat::Base16, false));
             if (auto dirtyRev = fetchers::maybeGetStrAttr(flake.lockedRef.toAttrs(), "dirtyRev"))
-                logger->cout(
-                    ANSI_BOLD "Revision:" ANSI_NORMAL "      %s",
-                    *dirtyRev);
+                logger->cout(ANSI_BOLD "Revision:" ANSI_NORMAL "      %s", *dirtyRev);
             if (auto revCount = flake.lockedRef.input.getRevCount())
-                logger->cout(
-                    ANSI_BOLD "Revisions:" ANSI_NORMAL "     %s",
-                    *revCount);
+                logger->cout(ANSI_BOLD "Revisions:" ANSI_NORMAL "     %s", *revCount);
             if (auto lastModified = flake.lockedRef.input.getLastModified())
                 logger->cout(
                     ANSI_BOLD "Last modified:" ANSI_NORMAL " %s",
                     std::put_time(std::localtime(&*lastModified), "%F %T"));
             if (auto fingerprint = lockedFlake.getFingerprint(store, fetchSettings))
                 logger->cout(
-                    ANSI_BOLD "Fingerprint:" ANSI_NORMAL "   %s",
-                    fingerprint->to_string(HashFormat::Base16, false));
+                    ANSI_BOLD "Fingerprint:" ANSI_NORMAL "   %s", fingerprint->to_string(HashFormat::Base16, false));
 
             if (!lockedFlake.lockFile.root->inputs.empty())
                 logger->cout(ANSI_BOLD "Inputs:" ANSI_NORMAL);
@@ -277,8 +271,7 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
 
             std::function<void(const Node & node, const std::string & prefix)> recurse;
 
-            recurse = [&](const Node & node, const std::string & prefix)
-            {
+            recurse = [&](const Node & node, const std::string & prefix) {
                 for (const auto & [i, input] : enumerate(node.inputs)) {
                     bool last = i + 1 == node.inputs.size();
 
@@ -286,17 +279,22 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                         std::string lastModifiedStr = "";
                         if (auto lastModified = (*lockedNode)->lockedRef.input.getLastModified())
                             lastModifiedStr = fmt(" (%s)", std::put_time(std::gmtime(&*lastModified), "%F %T"));
-                        logger->cout("%s" ANSI_BOLD "%s" ANSI_NORMAL ": %s%s",
-                            prefix + (last ? treeLast : treeConn), input.first,
+                        logger->cout(
+                            "%s" ANSI_BOLD "%s" ANSI_NORMAL ": %s%s",
+                            prefix + (last ? treeLast : treeConn),
+                            input.first,
                             (*lockedNode)->lockedRef,
                             lastModifiedStr);
 
                         bool firstVisit = visited.insert(*lockedNode).second;
 
-                        if (firstVisit) recurse(**lockedNode, prefix + (last ? treeNull : treeLine));
+                        if (firstVisit)
+                            recurse(**lockedNode, prefix + (last ? treeNull : treeLine));
                     } else if (auto follows = std::get_if<1>(&input.second)) {
-                        logger->cout("%s" ANSI_BOLD "%s" ANSI_NORMAL " follows input '%s'",
-                            prefix + (last ? treeLast : treeConn), input.first,
+                        logger->cout(
+                            "%s" ANSI_BOLD "%s" ANSI_NORMAL " follows input '%s'",
+                            prefix + (last ? treeLast : treeConn),
+                            input.first,
                             printInputAttrPath(*follows));
                     }
                 }
@@ -344,8 +342,8 @@ struct CmdFlakeCheck : FlakeCommand
     std::string doc() override
     {
         return
-          #include "flake-check.md"
-          ;
+#include "flake-check.md"
+            ;
     }
 
     void run(nix::ref<nix::Store> store) override
@@ -371,8 +369,7 @@ struct CmdFlakeCheck : FlakeCommand
                 if (settings.keepGoing) {
                     ignoreExceptionExceptInterrupt();
                     hasErrors = true;
-                }
-                else
+                } else
                     throw;
             }
         };
@@ -381,16 +378,11 @@ struct CmdFlakeCheck : FlakeCommand
 
         // FIXME: rewrite to use EvalCache.
 
-        auto resolve = [&] (PosIdx p) {
-            return state->positions[p];
-        };
+        auto resolve = [&](PosIdx p) { return state->positions[p]; };
 
-        auto argHasName = [&] (Symbol arg, std::string_view expected) {
+        auto argHasName = [&](Symbol arg, std::string_view expected) {
             std::string_view name = state->symbols[arg];
-            return
-                name == expected
-                || name == "_"
-                || (hasPrefix(name, "_") && name.substr(1) == expected);
+            return name == expected || name == "_" || (hasPrefix(name, "_") && name.substr(1) == expected);
         };
 
         auto checkSystemName = [&](std::string_view system, const PosIdx pos) {
@@ -408,10 +400,10 @@ struct CmdFlakeCheck : FlakeCommand
             }
         };
 
-        auto checkDerivation = [&](const std::string & attrPath, Value & v, const PosIdx pos) -> std::optional<StorePath> {
+        auto checkDerivation =
+            [&](const std::string & attrPath, Value & v, const PosIdx pos) -> std::optional<StorePath> {
             try {
-                Activity act(*logger, lvlInfo, actUnknown,
-                    fmt("checking derivation %s", attrPath));
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking derivation %s", attrPath));
                 auto packageInfo = getDerivation(*state, v, false);
                 if (!packageInfo)
                     throw Error("flake attribute '%s' is not a derivation", attrPath);
@@ -419,9 +411,8 @@ struct CmdFlakeCheck : FlakeCommand
                     // FIXME: check meta attributes
                     auto storePath = packageInfo->queryDrvPath();
                     if (storePath) {
-                        logger->log(lvlInfo,
-                            fmt("derivation evaluated to %s",
-                                store->printStorePath(storePath.value())));
+                        logger->log(
+                            lvlInfo, fmt("derivation evaluated to %s", store->printStorePath(storePath.value())));
                     }
                     return storePath;
                 }
@@ -477,14 +468,12 @@ struct CmdFlakeCheck : FlakeCommand
 
         auto checkOverlay = [&](std::string_view attrPath, Value & v, const PosIdx pos) {
             try {
-                Activity act(*logger, lvlInfo, actUnknown,
-                    fmt("checking overlay '%s'", attrPath));
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking overlay '%s'", attrPath));
                 state->forceValue(v, pos);
                 if (!v.isLambda()) {
                     throw Error("overlay is not a function, but %s instead", showType(v));
                 }
-                if (v.lambda().fun->hasFormals()
-                    || !argHasName(v.lambda().fun->arg, "final"))
+                if (v.lambda().fun->hasFormals() || !argHasName(v.lambda().fun->arg, "final"))
                     throw Error("overlay does not take an argument named 'final'");
                 // FIXME: if we have a 'nixpkgs' input, use it to
                 // evaluate the overlay.
@@ -496,8 +485,7 @@ struct CmdFlakeCheck : FlakeCommand
 
         auto checkModule = [&](std::string_view attrPath, Value & v, const PosIdx pos) {
             try {
-                Activity act(*logger, lvlInfo, actUnknown,
-                    fmt("checking NixOS module '%s'", attrPath));
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking NixOS module '%s'", attrPath));
                 state->forceValue(v, pos);
             } catch (Error & e) {
                 e.addTrace(resolve(pos), HintFmt("while checking the NixOS module '%s'", attrPath));
@@ -509,8 +497,7 @@ struct CmdFlakeCheck : FlakeCommand
 
         checkHydraJobs = [&](std::string_view attrPath, Value & v, const PosIdx pos) {
             try {
-                Activity act(*logger, lvlInfo, actUnknown,
-                    fmt("checking Hydra job '%s'", attrPath));
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking Hydra job '%s'", attrPath));
                 state->forceAttrs(v, pos, "");
 
                 if (state->isDerivation(v))
@@ -520,8 +507,7 @@ struct CmdFlakeCheck : FlakeCommand
                     state->forceAttrs(*attr.value, attr.pos, "");
                     auto attrPath2 = concatStrings(attrPath, ".", state->symbols[attr.name]);
                     if (state->isDerivation(*attr.value)) {
-                        Activity act(*logger, lvlInfo, actUnknown,
-                            fmt("checking Hydra job '%s'", attrPath2));
+                        Activity act(*logger, lvlInfo, actUnknown, fmt("checking Hydra job '%s'", attrPath2));
                         checkDerivation(attrPath2, *attr.value, attr.pos);
                     } else
                         checkHydraJobs(attrPath2, *attr.value, attr.pos);
@@ -535,9 +521,8 @@ struct CmdFlakeCheck : FlakeCommand
 
         auto checkNixOSConfiguration = [&](const std::string & attrPath, Value & v, const PosIdx pos) {
             try {
-                Activity act(*logger, lvlInfo, actUnknown,
-                    fmt("checking NixOS configuration '%s'", attrPath));
-                Bindings & bindings(*state->allocBindings(0));
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking NixOS configuration '%s'", attrPath));
+                Bindings & bindings = Bindings::emptyBindings;
                 auto vToplevel = findAlongAttrPath(*state, "config.system.build.toplevel", bindings, v).first;
                 state->forceValue(*vToplevel, pos);
                 if (!state->isDerivation(*vToplevel))
@@ -550,8 +535,7 @@ struct CmdFlakeCheck : FlakeCommand
 
         auto checkTemplate = [&](std::string_view attrPath, Value & v, const PosIdx pos) {
             try {
-                Activity act(*logger, lvlInfo, actUnknown,
-                    fmt("checking template '%s'", attrPath));
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking template '%s'", attrPath));
 
                 state->forceAttrs(v, pos, "");
 
@@ -584,8 +568,7 @@ struct CmdFlakeCheck : FlakeCommand
 
         auto checkBundler = [&](const std::string & attrPath, Value & v, const PosIdx pos) {
             try {
-                Activity act(*logger, lvlInfo, actUnknown,
-                    fmt("checking bundler '%s'", attrPath));
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking bundler '%s'", attrPath));
                 state->forceValue(v, pos);
                 if (!v.isLambda())
                     throw Error("bundler must be a function");
@@ -602,227 +585,208 @@ struct CmdFlakeCheck : FlakeCommand
             auto vFlake = state->allocValue();
             flake::callFlake(*state, flake, *vFlake);
 
-            enumerateOutputs(*state,
-                *vFlake,
-                [&](std::string_view name, Value & vOutput, const PosIdx pos) {
-                    Activity act(*logger, lvlInfo, actUnknown,
-                        fmt("checking flake output '%s'", name));
+            enumerateOutputs(*state, *vFlake, [&](std::string_view name, Value & vOutput, const PosIdx pos) {
+                Activity act(*logger, lvlInfo, actUnknown, fmt("checking flake output '%s'", name));
 
-                    try {
-                        evalSettings.enableImportFromDerivation.setDefault(name != "hydraJobs");
+                try {
+                    evalSettings.enableImportFromDerivation.setDefault(name != "hydraJobs");
 
-                        state->forceValue(vOutput, pos);
+                    state->forceValue(vOutput, pos);
 
-                        std::string_view replacement =
-                            name == "defaultPackage" ? "packages.<system>.default" :
-                            name == "defaultApp" ? "apps.<system>.default" :
-                            name == "defaultTemplate" ? "templates.default" :
-                            name == "defaultBundler" ? "bundlers.<system>.default" :
-                            name == "overlay" ? "overlays.default" :
-                            name == "devShell" ? "devShells.<system>.default" :
-                            name == "nixosModule" ? "nixosModules.default" :
-                            "";
-                        if (replacement != "")
-                            warn("flake output attribute '%s' is deprecated; use '%s' instead", name, replacement);
+                    std::string_view replacement = name == "defaultPackage"    ? "packages.<system>.default"
+                                                   : name == "defaultApp"      ? "apps.<system>.default"
+                                                   : name == "defaultTemplate" ? "templates.default"
+                                                   : name == "defaultBundler"  ? "bundlers.<system>.default"
+                                                   : name == "overlay"         ? "overlays.default"
+                                                   : name == "devShell"        ? "devShells.<system>.default"
+                                                   : name == "nixosModule"     ? "nixosModules.default"
+                                                                               : "";
+                    if (replacement != "")
+                        warn("flake output attribute '%s' is deprecated; use '%s' instead", name, replacement);
 
-                        if (name == "checks") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                std::string_view attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos)) {
-                                    state->forceAttrs(*attr.value, attr.pos, "");
-                                    for (auto & attr2 : *attr.value->attrs()) {
-                                        auto drvPath = checkDerivation(
-                                            fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
-                                            *attr2.value, attr2.pos);
-                                        if (drvPath && attr_name == settings.thisSystem.get()) {
-                                            auto path = DerivedPath::Built {
-                                                .drvPath = makeConstantStorePathRef(*drvPath),
-                                                .outputs = OutputsSpec::All { },
-                                            };
-                                            drvPaths.push_back(std::move(path));
-                                        }
+                    if (name == "checks") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            std::string_view attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                state->forceAttrs(*attr.value, attr.pos, "");
+                                for (auto & attr2 : *attr.value->attrs()) {
+                                    auto drvPath = checkDerivation(
+                                        fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
+                                        *attr2.value,
+                                        attr2.pos);
+                                    if (drvPath && attr_name == settings.thisSystem.get()) {
+                                        auto path = DerivedPath::Built{
+                                            .drvPath = makeConstantStorePathRef(*drvPath),
+                                            .outputs = OutputsSpec::All{},
+                                        };
+                                        drvPaths.push_back(std::move(path));
                                     }
                                 }
                             }
                         }
-
-                        else if (name == "formatter") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                const auto & attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos)) {
-                                    checkDerivation(
-                                        fmt("%s.%s", name, attr_name),
-                                        *attr.value, attr.pos);
-                                };
-                            }
-                        }
-
-                        else if (name == "packages" || name == "devShells") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                const auto & attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos)) {
-                                    state->forceAttrs(*attr.value, attr.pos, "");
-                                    for (auto & attr2 : *attr.value->attrs())
-                                        checkDerivation(
-                                            fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
-                                            *attr2.value, attr2.pos);
-                                };
-                            }
-                        }
-
-                        else if (name == "apps") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                const auto & attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos)) {
-                                    state->forceAttrs(*attr.value, attr.pos, "");
-                                    for (auto & attr2 : *attr.value->attrs())
-                                        checkApp(
-                                            fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
-                                            *attr2.value, attr2.pos);
-                                };
-                            }
-                        }
-
-                        else if (name == "defaultPackage" || name == "devShell") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                const auto & attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos)) {
-                                    checkDerivation(
-                                        fmt("%s.%s", name, attr_name),
-                                        *attr.value, attr.pos);
-                                };
-                            }
-                        }
-
-                        else if (name == "defaultApp") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                const auto & attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos) ) {
-                                    checkApp(
-                                        fmt("%s.%s", name, attr_name),
-                                        *attr.value, attr.pos);
-                                };
-                            }
-                        }
-
-                        else if (name == "legacyPackages") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                checkSystemName(state->symbols[attr.name], attr.pos);
-                                checkSystemType(state->symbols[attr.name], attr.pos);
-                                // FIXME: do getDerivations?
-                            }
-                        }
-
-                        else if (name == "overlay")
-                            checkOverlay(name, vOutput, pos);
-
-                        else if (name == "overlays") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs())
-                                checkOverlay(fmt("%s.%s", name, state->symbols[attr.name]),
-                                    *attr.value, attr.pos);
-                        }
-
-                        else if (name == "nixosModule")
-                            checkModule(name, vOutput, pos);
-
-                        else if (name == "nixosModules") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs())
-                                checkModule(fmt("%s.%s", name, state->symbols[attr.name]),
-                                    *attr.value, attr.pos);
-                        }
-
-                        else if (name == "nixosConfigurations") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs())
-                                checkNixOSConfiguration(fmt("%s.%s", name, state->symbols[attr.name]),
-                                    *attr.value, attr.pos);
-                        }
-
-                        else if (name == "hydraJobs")
-                            checkHydraJobs(name, vOutput, pos);
-
-                        else if (name == "defaultTemplate")
-                            checkTemplate(name, vOutput, pos);
-
-                        else if (name == "templates") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs())
-                                checkTemplate(fmt("%s.%s", name, state->symbols[attr.name]),
-                                    *attr.value, attr.pos);
-                        }
-
-                        else if (name == "defaultBundler") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                const auto & attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos)) {
-                                    checkBundler(
-                                        fmt("%s.%s", name, attr_name),
-                                        *attr.value, attr.pos);
-                                };
-                            }
-                        }
-
-                        else if (name == "bundlers") {
-                            state->forceAttrs(vOutput, pos, "");
-                            for (auto & attr : *vOutput.attrs()) {
-                                const auto & attr_name = state->symbols[attr.name];
-                                checkSystemName(attr_name, attr.pos);
-                                if (checkSystemType(attr_name, attr.pos)) {
-                                    state->forceAttrs(*attr.value, attr.pos, "");
-                                    for (auto & attr2 : *attr.value->attrs()) {
-                                        checkBundler(
-                                            fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
-                                            *attr2.value, attr2.pos);
-                                    }
-                                };
-                            }
-                        }
-
-                        else if (
-                            name == "lib"
-                            || name == "darwinConfigurations"
-                            || name == "darwinModules"
-                            || name == "flakeModule"
-                            || name == "flakeModules"
-                            || name == "herculesCI"
-                            || name == "homeConfigurations"
-                            || name == "homeModule"
-                            || name == "homeModules"
-                            || name == "nixopsConfigurations"
-                            )
-                            // Known but unchecked community attribute
-                            ;
-
-                        else
-                            warn("unknown flake output '%s'", name);
-
-                    } catch (Error & e) {
-                        e.addTrace(resolve(pos), HintFmt("while checking flake output '%s'", name));
-                        reportError(e);
                     }
-                });
+
+                    else if (name == "formatter") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            const auto & attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                checkDerivation(fmt("%s.%s", name, attr_name), *attr.value, attr.pos);
+                            };
+                        }
+                    }
+
+                    else if (name == "packages" || name == "devShells") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            const auto & attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                state->forceAttrs(*attr.value, attr.pos, "");
+                                for (auto & attr2 : *attr.value->attrs())
+                                    checkDerivation(
+                                        fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
+                                        *attr2.value,
+                                        attr2.pos);
+                            };
+                        }
+                    }
+
+                    else if (name == "apps") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            const auto & attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                state->forceAttrs(*attr.value, attr.pos, "");
+                                for (auto & attr2 : *attr.value->attrs())
+                                    checkApp(
+                                        fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
+                                        *attr2.value,
+                                        attr2.pos);
+                            };
+                        }
+                    }
+
+                    else if (name == "defaultPackage" || name == "devShell") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            const auto & attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                checkDerivation(fmt("%s.%s", name, attr_name), *attr.value, attr.pos);
+                            };
+                        }
+                    }
+
+                    else if (name == "defaultApp") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            const auto & attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                checkApp(fmt("%s.%s", name, attr_name), *attr.value, attr.pos);
+                            };
+                        }
+                    }
+
+                    else if (name == "legacyPackages") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            checkSystemName(state->symbols[attr.name], attr.pos);
+                            checkSystemType(state->symbols[attr.name], attr.pos);
+                            // FIXME: do getDerivations?
+                        }
+                    }
+
+                    else if (name == "overlay")
+                        checkOverlay(name, vOutput, pos);
+
+                    else if (name == "overlays") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs())
+                            checkOverlay(fmt("%s.%s", name, state->symbols[attr.name]), *attr.value, attr.pos);
+                    }
+
+                    else if (name == "nixosModule")
+                        checkModule(name, vOutput, pos);
+
+                    else if (name == "nixosModules") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs())
+                            checkModule(fmt("%s.%s", name, state->symbols[attr.name]), *attr.value, attr.pos);
+                    }
+
+                    else if (name == "nixosConfigurations") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs())
+                            checkNixOSConfiguration(
+                                fmt("%s.%s", name, state->symbols[attr.name]), *attr.value, attr.pos);
+                    }
+
+                    else if (name == "hydraJobs")
+                        checkHydraJobs(name, vOutput, pos);
+
+                    else if (name == "defaultTemplate")
+                        checkTemplate(name, vOutput, pos);
+
+                    else if (name == "templates") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs())
+                            checkTemplate(fmt("%s.%s", name, state->symbols[attr.name]), *attr.value, attr.pos);
+                    }
+
+                    else if (name == "defaultBundler") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            const auto & attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                checkBundler(fmt("%s.%s", name, attr_name), *attr.value, attr.pos);
+                            };
+                        }
+                    }
+
+                    else if (name == "bundlers") {
+                        state->forceAttrs(vOutput, pos, "");
+                        for (auto & attr : *vOutput.attrs()) {
+                            const auto & attr_name = state->symbols[attr.name];
+                            checkSystemName(attr_name, attr.pos);
+                            if (checkSystemType(attr_name, attr.pos)) {
+                                state->forceAttrs(*attr.value, attr.pos, "");
+                                for (auto & attr2 : *attr.value->attrs()) {
+                                    checkBundler(
+                                        fmt("%s.%s.%s", name, attr_name, state->symbols[attr2.name]),
+                                        *attr2.value,
+                                        attr2.pos);
+                                }
+                            };
+                        }
+                    }
+
+                    else if (
+                        name == "lib" || name == "darwinConfigurations" || name == "darwinModules"
+                        || name == "flakeModule" || name == "flakeModules" || name == "herculesCI"
+                        || name == "homeConfigurations" || name == "homeModule" || name == "homeModules"
+                        || name == "nixopsConfigurations")
+                        // Known but unchecked community attribute
+                        ;
+
+                    else
+                        warn("unknown flake output '%s'", name);
+
+                } catch (Error & e) {
+                    e.addTrace(resolve(pos), HintFmt("while checking flake output '%s'", name));
+                    reportError(e);
+                }
+            });
         }
 
         if (build && !drvPaths.empty()) {
-            Activity act(*logger, lvlInfo, actUnknown,
-                fmt("running %d flake checks", drvPaths.size()));
+            Activity act(*logger, lvlInfo, actUnknown, fmt("running %d flake checks", drvPaths.size()));
             store->buildPaths(drvPaths);
         }
         if (hasErrors)
@@ -833,8 +797,7 @@ struct CmdFlakeCheck : FlakeCommand
             warn(
                 "The check omitted these incompatible systems: %s\n"
                 "Use '--all-systems' to check all.",
-                concatStringsSep(", ", omittedSystems)
-            );
+                concatStringsSep(", ", omittedSystems));
         };
     };
 };
@@ -847,7 +810,7 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
     std::string templateUrl = "templates";
     Path destDir;
 
-    const LockFlags lockFlags{ .writeLockFile = false };
+    const LockFlags lockFlags{.writeLockFile = false};
 
     CmdFlakeInitCommon()
     {
@@ -875,11 +838,15 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
 
         auto evalState = getEvalState();
 
-        auto [templateFlakeRef, templateName] = parseFlakeRefWithFragment(
-            fetchSettings, templateUrl, std::filesystem::current_path().string());
+        auto [templateFlakeRef, templateName] =
+            parseFlakeRefWithFragment(fetchSettings, templateUrl, std::filesystem::current_path().string());
 
-        auto installable = InstallableFlake(nullptr,
-            evalState, std::move(templateFlakeRef), templateName, ExtendedOutputsSpec::Default(),
+        auto installable = InstallableFlake(
+            nullptr,
+            evalState,
+            std::move(templateFlakeRef),
+            templateName,
+            ExtendedOutputsSpec::Default(),
             defaultTemplateAttrPaths,
             defaultTemplateAttrPathsPrefixes,
             lockFlags);
@@ -894,8 +861,7 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
         std::vector<std::filesystem::path> conflictedFiles;
 
         std::function<void(const SourcePath & from, const std::filesystem::path & to)> copyDir;
-        copyDir = [&](const SourcePath & from, const std::filesystem::path & to)
-        {
+        copyDir = [&](const SourcePath & from, const std::filesystem::path & to) {
             createDirs(to);
 
             for (auto & [name, entry] : from.readDirectory()) {
@@ -911,7 +877,10 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
                     if (std::filesystem::exists(to_st)) {
                         auto contents2 = readFile(to2.string());
                         if (contents != contents2) {
-                            printError("refusing to overwrite existing file '%s'\n please merge it manually with '%s'", to2.string(), from2);
+                            printError(
+                                "refusing to overwrite existing file '%s'\n please merge it manually with '%s'",
+                                to2.string(),
+                                from2);
                             conflictedFiles.push_back(to2);
                         } else {
                             notice("skipping identical file: %s", from2);
@@ -919,22 +888,26 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
                         continue;
                     } else
                         writeFile(to2, contents);
-                }
-                else if (st.type == SourceAccessor::tSymlink) {
+                } else if (st.type == SourceAccessor::tSymlink) {
                     auto target = from2.readLink();
                     if (std::filesystem::exists(to_st)) {
                         if (std::filesystem::read_symlink(to2) != target) {
-                            printError("refusing to overwrite existing file '%s'\n please merge it manually with '%s'", to2.string(), from2);
+                            printError(
+                                "refusing to overwrite existing file '%s'\n please merge it manually with '%s'",
+                                to2.string(),
+                                from2);
                             conflictedFiles.push_back(to2);
                         } else {
                             notice("skipping identical file: %s", from2);
                         }
                         continue;
                     } else
-                        createSymlink(target, os_string_to_string(PathViewNG { to2 }));
-                }
-                else
-                    throw Error("path '%s' needs to be a symlink, file, or directory but instead is a %s", from2, st.typeString());
+                        createSymlink(target, os_string_to_string(PathViewNG{to2}));
+                } else
+                    throw Error(
+                        "path '%s' needs to be a symlink, file, or directory but instead is a %s",
+                        from2,
+                        st.typeString());
                 changedFiles.push_back(to2);
                 notice("wrote: %s", to2);
             }
@@ -943,8 +916,9 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
         copyDir(templateDir, flakeDir);
 
         if (!changedFiles.empty() && std::filesystem::exists(std::filesystem::path{flakeDir} / ".git")) {
-            Strings args = { "-C", flakeDir, "add", "--intent-to-add", "--force", "--" };
-            for (auto & s : changedFiles) args.emplace_back(s.string());
+            Strings args = {"-C", flakeDir, "add", "--intent-to-add", "--force", "--"};
+            for (auto & s : changedFiles)
+                args.emplace_back(s.string());
             runProgram("git", true, args);
         }
 
@@ -968,8 +942,8 @@ struct CmdFlakeInit : CmdFlakeInitCommon
     std::string doc() override
     {
         return
-          #include "flake-init.md"
-          ;
+#include "flake-init.md"
+            ;
     }
 
     CmdFlakeInit()
@@ -988,17 +962,13 @@ struct CmdFlakeNew : CmdFlakeInitCommon
     std::string doc() override
     {
         return
-          #include "flake-new.md"
-          ;
+#include "flake-new.md"
+            ;
     }
 
     CmdFlakeNew()
     {
-        expectArgs({
-            .label = "dest-dir",
-            .handler = {&destDir},
-            .completer = completePath
-        });
+        expectArgs({.label = "dest-dir", .handler = {&destDir}, .completer = completePath});
     }
 };
 
@@ -1014,8 +984,8 @@ struct CmdFlakeClone : FlakeCommand
     std::string doc() override
     {
         return
-          #include "flake-clone.md"
-          ;
+#include "flake-clone.md"
+            ;
     }
 
     CmdFlakeClone()
@@ -1069,8 +1039,8 @@ struct CmdFlakeArchive : FlakeCommand, MixJSON, MixDryRun
     std::string doc() override
     {
         return
-          #include "flake-archive.md"
-          ;
+#include "flake-archive.md"
+            ;
     }
 
     void run(nix::ref<nix::Store> store) override
@@ -1085,17 +1055,14 @@ struct CmdFlakeArchive : FlakeCommand, MixJSON, MixDryRun
 
         // FIXME: use graph output, handle cycles.
         std::function<nlohmann::json(const Node & node)> traverse;
-        traverse = [&](const Node & node)
-        {
+        traverse = [&](const Node & node) {
             nlohmann::json jsonObj2 = json ? json::object() : nlohmann::json(nullptr);
             for (auto & [inputName, input] : node.inputs) {
                 if (auto inputNode = std::get_if<0>(&input)) {
                     std::optional<StorePath> storePath;
                     if (!(*inputNode)->lockedRef.input.isRelative()) {
-                        storePath =
-                            dryRun
-                            ? (*inputNode)->lockedRef.input.computeStorePath(*store)
-                            : (*inputNode)->lockedRef.input.fetchToStore(store).first;
+                        storePath = dryRun ? (*inputNode)->lockedRef.input.computeStorePath(*store)
+                                           : (*inputNode)->lockedRef.input.fetchToStore(store).first;
                         sources.insert(*storePath);
                     }
                     if (json) {
@@ -1155,8 +1122,8 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "flake-show.md"
-          ;
+#include "flake-show.md"
+            ;
     }
 
     void run(nix::ref<nix::Store> store) override
@@ -1167,10 +1134,8 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
         auto flake = std::make_shared<LockedFlake>(lockFlake());
         auto localSystem = std::string(settings.thisSystem.get());
 
-        std::function<bool(
-            eval_cache::AttrCursor & visitor,
-            const std::vector<Symbol> &attrPath,
-            const Symbol &attr)> hasContent;
+        std::function<bool(eval_cache::AttrCursor & visitor, const std::vector<Symbol> & attrPath, const Symbol & attr)>
+            hasContent;
 
         // For frameworks it's important that structures are as lazy as possible
         // to prevent infinite recursions, performance issues and errors that
@@ -1178,11 +1143,8 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
         // to emit more attributes than strictly (sic) necessary.
         // However, these attributes with empty values are not useful to the user
         // so we omit them.
-        hasContent = [&](
-            eval_cache::AttrCursor & visitor,
-            const std::vector<Symbol> &attrPath,
-            const Symbol &attr) -> bool
-        {
+        hasContent =
+            [&](eval_cache::AttrCursor & visitor, const std::vector<Symbol> & attrPath, const Symbol & attr) -> bool {
             auto attrPath2(attrPath);
             attrPath2.push_back(attr);
             auto attrPathS = state->symbols.resolve(attrPath2);
@@ -1191,13 +1153,10 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
             auto visitor2 = visitor.getAttr(attrName);
 
             try {
-                if ((attrPathS[0] == "apps"
-                        || attrPathS[0] == "checks"
-                        || attrPathS[0] == "devShells"
-                        || attrPathS[0] == "legacyPackages"
-                        || attrPathS[0] == "packages")
+                if ((attrPathS[0] == "apps" || attrPathS[0] == "checks" || attrPathS[0] == "devShells"
+                     || attrPathS[0] == "legacyPackages" || attrPathS[0] == "packages")
                     && (attrPathS.size() == 1 || attrPathS.size() == 2)) {
-                    for (const auto &subAttr : visitor2->getAttrs()) {
+                    for (const auto & subAttr : visitor2->getAttrs()) {
                         if (hasContent(*visitor2, attrPath2, subAttr)) {
                             return true;
                         }
@@ -1206,12 +1165,9 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                 }
 
                 if ((attrPathS.size() == 1)
-                    && (attrPathS[0] == "formatter"
-                        || attrPathS[0] == "nixosConfigurations"
-                        || attrPathS[0] == "nixosModules"
-                        || attrPathS[0] == "overlays"
-                        )) {
-                    for (const auto &subAttr : visitor2->getAttrs()) {
+                    && (attrPathS[0] == "formatter" || attrPathS[0] == "nixosConfigurations"
+                        || attrPathS[0] == "nixosModules" || attrPathS[0] == "overlays")) {
+                    for (const auto & subAttr : visitor2->getAttrs()) {
                         if (hasContent(*visitor2, attrPath2, subAttr)) {
                             return true;
                         }
@@ -1233,29 +1189,25 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
             eval_cache::AttrCursor & visitor,
             const std::vector<Symbol> & attrPath,
             const std::string & headerPrefix,
-            const std::string & nextPrefix)> visit;
+            const std::string & nextPrefix)>
+            visit;
 
-        visit = [&](
-            eval_cache::AttrCursor & visitor,
-            const std::vector<Symbol> & attrPath,
-            const std::string & headerPrefix,
-            const std::string & nextPrefix)
-            -> nlohmann::json
-        {
+        visit = [&](eval_cache::AttrCursor & visitor,
+                    const std::vector<Symbol> & attrPath,
+                    const std::string & headerPrefix,
+                    const std::string & nextPrefix) -> nlohmann::json {
             auto j = nlohmann::json::object();
 
             auto attrPathS = state->symbols.resolve(attrPath);
 
-            Activity act(*logger, lvlInfo, actUnknown,
-                fmt("evaluating '%s'", concatStringsSep(".", attrPathS)));
+            Activity act(*logger, lvlInfo, actUnknown, fmt("evaluating '%s'", concatStringsSep(".", attrPathS)));
 
             try {
-                auto recurse = [&]()
-                {
+                auto recurse = [&]() {
                     if (!json)
                         logger->cout("%s", headerPrefix);
                     std::vector<Symbol> attrs;
-                    for (const auto &attr : visitor.getAttrs()) {
+                    for (const auto & attr : visitor.getAttrs()) {
                         if (hasContent(visitor, attrPath, attr))
                             attrs.push_back(attr);
                     }
@@ -1266,68 +1218,69 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                         auto visitor2 = visitor.getAttr(attrName);
                         auto attrPath2(attrPath);
                         attrPath2.push_back(attr);
-                        auto j2 = visit(*visitor2, attrPath2,
-                            fmt(ANSI_GREEN "%s%s" ANSI_NORMAL ANSI_BOLD "%s" ANSI_NORMAL, nextPrefix, last ? treeLast : treeConn, attrName),
+                        auto j2 = visit(
+                            *visitor2,
+                            attrPath2,
+                            fmt(ANSI_GREEN "%s%s" ANSI_NORMAL ANSI_BOLD "%s" ANSI_NORMAL,
+                                nextPrefix,
+                                last ? treeLast : treeConn,
+                                attrName),
                             nextPrefix + (last ? treeNull : treeLine));
-                        if (json) j.emplace(attrName, std::move(j2));
+                        if (json)
+                            j.emplace(attrName, std::move(j2));
                     }
                 };
 
-                auto showDerivation = [&]()
-                {
-                    auto name = visitor.getAttr(state->sName)->getString();
+                auto showDerivation = [&]() {
+                    auto name = visitor.getAttr(state->s.name)->getString();
 
                     if (json) {
                         std::optional<std::string> description;
-                        if (auto aMeta = visitor.maybeGetAttr(state->sMeta)) {
-                            if (auto aDescription = aMeta->maybeGetAttr(state->sDescription))
+                        if (auto aMeta = visitor.maybeGetAttr(state->s.meta)) {
+                            if (auto aDescription = aMeta->maybeGetAttr(state->s.description))
                                 description = aDescription->getString();
                         }
                         j.emplace("type", "derivation");
                         j.emplace("name", name);
                         j.emplace("description", description ? *description : "");
                     } else {
-                        logger->cout("%s: %s '%s'",
+                        logger->cout(
+                            "%s: %s '%s'",
                             headerPrefix,
-                            attrPath.size() == 2 && attrPathS[0] == "devShell" ? "development environment" :
-                            attrPath.size() >= 2 && attrPathS[0] == "devShells" ? "development environment" :
-                            attrPath.size() == 3 && attrPathS[0] == "checks" ? "derivation" :
-                            attrPath.size() >= 1 && attrPathS[0] == "hydraJobs" ? "derivation" :
-                            "package",
+                            attrPath.size() == 2 && attrPathS[0] == "devShell"    ? "development environment"
+                            : attrPath.size() >= 2 && attrPathS[0] == "devShells" ? "development environment"
+                            : attrPath.size() == 3 && attrPathS[0] == "checks"    ? "derivation"
+                            : attrPath.size() >= 1 && attrPathS[0] == "hydraJobs" ? "derivation"
+                                                                                  : "package",
                             name);
                     }
                 };
 
                 if (attrPath.size() == 0
-                    || (attrPath.size() == 1 && (
-                            attrPathS[0] == "defaultPackage"
-                            || attrPathS[0] == "devShell"
-                            || attrPathS[0] == "formatter"
-                            || attrPathS[0] == "nixosConfigurations"
-                            || attrPathS[0] == "nixosModules"
-                            || attrPathS[0] == "defaultApp"
-                            || attrPathS[0] == "templates"
-                            || attrPathS[0] == "overlays"))
+                    || (attrPath.size() == 1
+                        && (attrPathS[0] == "defaultPackage" || attrPathS[0] == "devShell"
+                            || attrPathS[0] == "formatter" || attrPathS[0] == "nixosConfigurations"
+                            || attrPathS[0] == "nixosModules" || attrPathS[0] == "defaultApp"
+                            || attrPathS[0] == "templates" || attrPathS[0] == "overlays"))
                     || ((attrPath.size() == 1 || attrPath.size() == 2)
-                        && (attrPathS[0] == "checks"
-                            || attrPathS[0] == "packages"
-                            || attrPathS[0] == "devShells"
-                            || attrPathS[0] == "apps"))
-                    )
-                {
+                        && (attrPathS[0] == "checks" || attrPathS[0] == "packages" || attrPathS[0] == "devShells"
+                            || attrPathS[0] == "apps"))) {
                     recurse();
                 }
 
                 else if (
-                    (attrPath.size() == 2 && (attrPathS[0] == "defaultPackage" || attrPathS[0] == "devShell" || attrPathS[0] == "formatter"))
-                    || (attrPath.size() == 3 && (attrPathS[0] == "checks" || attrPathS[0] == "packages" || attrPathS[0] == "devShells"))
-                    )
-                {
+                    (attrPath.size() == 2
+                     && (attrPathS[0] == "defaultPackage" || attrPathS[0] == "devShell" || attrPathS[0] == "formatter"))
+                    || (attrPath.size() == 3
+                        && (attrPathS[0] == "checks" || attrPathS[0] == "packages" || attrPathS[0] == "devShells"))) {
                     if (!showAllSystems && std::string(attrPathS[1]) != localSystem) {
                         if (!json)
-                            logger->cout(fmt("%s " ANSI_WARNING "omitted" ANSI_NORMAL " (use '--all-systems' to show)", headerPrefix));
+                            logger->cout(
+                                fmt("%s " ANSI_WARNING "omitted" ANSI_NORMAL " (use '--all-systems' to show)",
+                                    headerPrefix));
                         else {
-                            logger->warn(fmt("%s omitted (use '--all-systems' to show)", concatStringsSep(".", attrPathS)));
+                            logger->warn(
+                                fmt("%s omitted (use '--all-systems' to show)", concatStringsSep(".", attrPathS)));
                         }
                     } else {
                         try {
@@ -1337,9 +1290,13 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                                 throw Error("expected a derivation");
                         } catch (IFDError & e) {
                             if (!json) {
-                                logger->cout(fmt("%s " ANSI_WARNING "omitted due to use of import from derivation" ANSI_NORMAL, headerPrefix));
+                                logger->cout(
+                                    fmt("%s " ANSI_WARNING "omitted due to use of import from derivation" ANSI_NORMAL,
+                                        headerPrefix));
                             } else {
-                                logger->warn(fmt("%s omitted due to use of import from derivation", concatStringsSep(".", attrPathS)));
+                                logger->warn(
+                                    fmt("%s omitted due to use of import from derivation",
+                                        concatStringsSep(".", attrPathS)));
                             }
                         }
                     }
@@ -1353,9 +1310,12 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                             recurse();
                     } catch (IFDError & e) {
                         if (!json) {
-                            logger->cout(fmt("%s " ANSI_WARNING "omitted due to use of import from derivation" ANSI_NORMAL, headerPrefix));
+                            logger->cout(
+                                fmt("%s " ANSI_WARNING "omitted due to use of import from derivation" ANSI_NORMAL,
+                                    headerPrefix));
                         } else {
-                            logger->warn(fmt("%s omitted due to use of import from derivation", concatStringsSep(".", attrPathS)));
+                            logger->warn(fmt(
+                                "%s omitted due to use of import from derivation", concatStringsSep(".", attrPathS)));
                         }
                     }
                 }
@@ -1363,17 +1323,21 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                 else if (attrPath.size() > 0 && attrPathS[0] == "legacyPackages") {
                     if (attrPath.size() == 1)
                         recurse();
-                    else if (!showLegacy){
+                    else if (!showLegacy) {
                         if (!json)
-                            logger->cout(fmt("%s " ANSI_WARNING "omitted" ANSI_NORMAL " (use '--legacy' to show)", headerPrefix));
+                            logger->cout(fmt(
+                                "%s " ANSI_WARNING "omitted" ANSI_NORMAL " (use '--legacy' to show)", headerPrefix));
                         else {
                             logger->warn(fmt("%s omitted (use '--legacy' to show)", concatStringsSep(".", attrPathS)));
                         }
                     } else if (!showAllSystems && std::string(attrPathS[1]) != localSystem) {
                         if (!json)
-                            logger->cout(fmt("%s " ANSI_WARNING "omitted" ANSI_NORMAL " (use '--all-systems' to show)", headerPrefix));
+                            logger->cout(
+                                fmt("%s " ANSI_WARNING "omitted" ANSI_NORMAL " (use '--all-systems' to show)",
+                                    headerPrefix));
                         else {
-                            logger->warn(fmt("%s omitted (use '--all-systems' to show)", concatStringsSep(".", attrPathS)));
+                            logger->warn(
+                                fmt("%s omitted (use '--all-systems' to show)", concatStringsSep(".", attrPathS)));
                         }
                     } else {
                         try {
@@ -1384,22 +1348,25 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                                 recurse();
                         } catch (IFDError & e) {
                             if (!json) {
-                                logger->cout(fmt("%s " ANSI_WARNING "omitted due to use of import from derivation" ANSI_NORMAL, headerPrefix));
+                                logger->cout(
+                                    fmt("%s " ANSI_WARNING "omitted due to use of import from derivation" ANSI_NORMAL,
+                                        headerPrefix));
                             } else {
-                                logger->warn(fmt("%s omitted due to use of import from derivation", concatStringsSep(".", attrPathS)));
+                                logger->warn(
+                                    fmt("%s omitted due to use of import from derivation",
+                                        concatStringsSep(".", attrPathS)));
                             }
                         }
                     }
                 }
 
                 else if (
-                    (attrPath.size() == 2 && attrPathS[0] == "defaultApp") ||
-                    (attrPath.size() == 3 && attrPathS[0] == "apps"))
-                {
+                    (attrPath.size() == 2 && attrPathS[0] == "defaultApp")
+                    || (attrPath.size() == 3 && attrPathS[0] == "apps")) {
                     auto aType = visitor.maybeGetAttr("type");
                     std::optional<std::string> description;
-                    if (auto aMeta = visitor.maybeGetAttr(state->sMeta)) {
-                        if (auto aDescription = aMeta->maybeGetAttr(state->sDescription))
+                    if (auto aMeta = visitor.maybeGetAttr(state->s.meta)) {
+                        if (auto aDescription = aMeta->maybeGetAttr(state->s.description))
                             description = aDescription->getString();
                     }
                     if (!aType || aType->getString() != "app")
@@ -1409,14 +1376,16 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                         if (description)
                             j.emplace("description", *description);
                     } else {
-                        logger->cout("%s: app: " ANSI_BOLD "%s" ANSI_NORMAL, headerPrefix, description ? *description : "no description");
+                        logger->cout(
+                            "%s: app: " ANSI_BOLD "%s" ANSI_NORMAL,
+                            headerPrefix,
+                            description ? *description : "no description");
                     }
                 }
 
                 else if (
-                    (attrPath.size() == 1 && attrPathS[0] == "defaultTemplate") ||
-                    (attrPath.size() == 2 && attrPathS[0] == "templates"))
-                {
+                    (attrPath.size() == 1 && attrPathS[0] == "defaultTemplate")
+                    || (attrPath.size() == 2 && attrPathS[0] == "templates")) {
                     auto description = visitor.getAttr("description")->getString();
                     if (json) {
                         j.emplace("type", "template");
@@ -1427,13 +1396,15 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                 }
 
                 else {
-                    auto [type, description] =
-                        (attrPath.size() == 1 && attrPathS[0] == "overlay")
-                        || (attrPath.size() == 2 && attrPathS[0] == "overlays") ? std::make_pair("nixpkgs-overlay", "Nixpkgs overlay") :
-                        attrPath.size() == 2 && attrPathS[0] == "nixosConfigurations" ? std::make_pair("nixos-configuration", "NixOS configuration") :
-                        (attrPath.size() == 1 && attrPathS[0] == "nixosModule")
-                        || (attrPath.size() == 2 && attrPathS[0] == "nixosModules") ? std::make_pair("nixos-module", "NixOS module") :
-                        std::make_pair("unknown", "unknown");
+                    auto [type, description] = (attrPath.size() == 1 && attrPathS[0] == "overlay")
+                                                       || (attrPath.size() == 2 && attrPathS[0] == "overlays")
+                                                   ? std::make_pair("nixpkgs-overlay", "Nixpkgs overlay")
+                                               : attrPath.size() == 2 && attrPathS[0] == "nixosConfigurations"
+                                                   ? std::make_pair("nixos-configuration", "NixOS configuration")
+                                               : (attrPath.size() == 1 && attrPathS[0] == "nixosModule")
+                                                       || (attrPath.size() == 2 && attrPathS[0] == "nixosModules")
+                                                   ? std::make_pair("nixos-module", "NixOS module")
+                                                   : std::make_pair("unknown", "unknown");
                     if (json) {
                         j.emplace("type", type);
                     } else {
@@ -1480,8 +1451,8 @@ struct CmdFlakePrefetch : FlakeCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "flake-prefetch.md"
-          ;
+#include "flake-prefetch.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -1489,7 +1460,8 @@ struct CmdFlakePrefetch : FlakeCommand, MixJSON
         auto originalRef = getFlakeRef();
         auto resolvedRef = originalRef.resolve(store);
         auto [accessor, lockedRef] = resolvedRef.lazyFetch(store);
-        auto storePath = fetchToStore(getEvalState()->fetchSettings, *store, accessor, FetchMode::Copy, lockedRef.input.getName());
+        auto storePath =
+            fetchToStore(getEvalState()->fetchSettings, *store, accessor, FetchMode::Copy, lockedRef.input.getName());
         auto hash = store->queryPathInfo(storePath)->narHash;
 
         if (json) {
@@ -1501,7 +1473,8 @@ struct CmdFlakePrefetch : FlakeCommand, MixJSON
             res["locked"].erase("__final"); // internal for now
             printJSON(res);
         } else {
-            notice("Downloaded '%s' to '%s' (hash '%s').",
+            notice(
+                "Downloaded '%s' to '%s' (hash '%s').",
                 lockedRef.to_string(),
                 store->printStorePath(storePath),
                 hash.to_string(HashFormat::SRI, true));
@@ -1531,8 +1504,8 @@ struct CmdFlake : NixMultiCommand
     std::string doc() override
     {
         return
-          #include "flake.md"
-          ;
+#include "flake.md"
+            ;
     }
 
     void run() override
diff --git a/src/nix/flake.md b/src/nix/flake.md
index 6cb39fd5f..950b9fa4f 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -573,6 +573,27 @@ The value of the `follows` attribute is a `/`-separated sequence of
 input names denoting the path of inputs to be followed from the root
 flake.
 
+## Self-attributes
+
+Flakes can declare attributes about themselves that affect how they are fetched.
+These attributes are specified using the special `self` input and are retroactively
+applied to it:
+
+```nix
+{
+  inputs.self.submodules = true;
+  inputs.self.lfs = true;
+}
+```
+
+The following self-attributes are supported:
+
+* `submodules`: A Boolean denoting whether Git submodules should be fetched when this flake is used as an input. When set to `true`, Git submodules will be automatically fetched without requiring callers to specify `submodules=1` in the flake reference URL. Defaults to `false`.
+
+* `lfs`: A Boolean denoting whether Git LFS (Large File Storage) files should be fetched when this flake is used as an input. When set to `true`, Git LFS files will be automatically fetched. Defaults to `false`.
+
+These self-attributes eliminate the need for consumers of your flake to manually specify fetching options in their flake references.
+
 Overrides and `follows` can be combined, e.g.
 
 ```nix
diff --git a/src/nix/formatter.cc b/src/nix/formatter.cc
index 212bb8d70..f5eb966d6 100644
--- a/src/nix/formatter.cc
+++ b/src/nix/formatter.cc
@@ -5,6 +5,8 @@
 #include "nix/store/local-fs-store.hh"
 #include "nix/cmd/installable-derived-path.hh"
 #include "nix/util/environment-variables.hh"
+#include "nix/store/globals.hh"
+
 #include "run.hh"
 
 using namespace nix;
diff --git a/src/nix/hash.cc b/src/nix/hash.cc
index 510cfa592..d3c9ccb66 100644
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@@ -3,7 +3,7 @@
 #include "nix/store/content-address.hh"
 #include "nix/cmd/legacy.hh"
 #include "nix/main/shared.hh"
-#include "nix/util/references.hh"
+#include "nix/store/references.hh"
 #include "nix/util/archive.hh"
 #include "nix/util/git.hh"
 #include "nix/util/posix-source-accessor.hh"
@@ -26,13 +26,10 @@ struct CmdHashBase : Command
     std::vector<std::string> paths;
     std::optional<std::string> modulus;
 
-    explicit CmdHashBase(FileIngestionMethod mode) : mode(mode)
+    explicit CmdHashBase(FileIngestionMethod mode)
+        : mode(mode)
     {
-        expectArgs({
-            .label = "paths",
-            .handler = {&paths},
-            .completer = completePath
-        });
+        expectArgs({.label = "paths", .handler = {&paths}, .completer = completePath});
 
         // FIXME The following flags should be deprecated, but we don't
         // yet have a mechanism for that.
@@ -92,10 +89,9 @@ struct CmdHashBase : Command
                 return PosixSourceAccessor::createAtRoot(makeParentCanonical(path));
             };
 
-            Hash h { HashAlgorithm::SHA256 }; // throwaway def to appease C++
+            Hash h{HashAlgorithm::SHA256}; // throwaway def to appease C++
             switch (mode) {
-            case FileIngestionMethod::Flat:
-            {
+            case FileIngestionMethod::Flat: {
                 // While usually we could use the some code as for NixArchive,
                 // the Flat method needs to support FIFOs, such as those
                 // produced by bash process substitution, e.g.:
@@ -104,15 +100,14 @@ struct CmdHashBase : Command
                 // so we don't need to go low-level, or reject symlink `path`s.
                 auto hashSink = makeSink();
                 readFile(path, *hashSink);
-                h = hashSink->finish().first;
+                h = hashSink->finish().hash;
                 break;
             }
-            case FileIngestionMethod::NixArchive:
-            {
+            case FileIngestionMethod::NixArchive: {
                 auto sourcePath = makeSourcePath();
                 auto hashSink = makeSink();
                 dumpPath(sourcePath, *hashSink, (FileSerialisationMethod) mode);
-                h = hashSink->finish().first;
+                h = hashSink->finish().hash;
                 break;
             }
             case FileIngestionMethod::Git: {
@@ -121,7 +116,7 @@ struct CmdHashBase : Command
                 hook = [&](const SourcePath & path) -> git::TreeEntry {
                     auto hashSink = makeSink();
                     auto mode = dump(path, *hashSink, hook);
-                    auto hash = hashSink->finish().first;
+                    auto hash = hashSink->finish().hash;
                     return {
                         .mode = mode,
                         .hash = hash,
@@ -132,7 +127,8 @@ struct CmdHashBase : Command
             }
             }
 
-            if (truncate && h.hashSize > 20) h = compressHash(h, 20);
+            if (truncate && h.hashSize > 20)
+                h = compressHash(h, 20);
             logger->cout(h.to_string(hashFormat, hashFormat == HashFormat::SRI));
         }
     }
@@ -149,14 +145,14 @@ struct CmdHashPath : CmdHashBase
         addFlag(flag::hashAlgo("algo", &hashAlgo));
         addFlag(flag::fileIngestionMethod(&mode));
         addFlag(flag::hashFormatWithDefault("format", &hashFormat));
-        #if 0
+#if 0
         addFlag({
             .longName = "modulo",
             .description = "Compute the hash modulo the specified string.",
             .labels = {"modulus"},
             .handler = {&modulus},
         });
-        #endif
+#endif
     }
 };
 
@@ -193,11 +189,12 @@ struct CmdToBase : Command
 
     std::string description() override
     {
-        return fmt("convert a hash to %s representation (deprecated, use `nix hash convert` instead)",
-            hashFormat == HashFormat::Base16 ? "base-16" :
-            hashFormat == HashFormat::Nix32 ? "base-32" :
-            hashFormat == HashFormat::Base64 ? "base-64" :
-            "SRI");
+        return fmt(
+            "convert a hash to %s representation (deprecated, use `nix hash convert` instead)",
+            hashFormat == HashFormat::Base16   ? "base-16"
+            : hashFormat == HashFormat::Nix32  ? "base-32"
+            : hashFormat == HashFormat::Base64 ? "base-64"
+                                               : "SRI");
     }
 
     void run() override
@@ -219,13 +216,15 @@ struct CmdHashConvert : Command
     std::optional<HashAlgorithm> algo;
     std::vector<std::string> hashStrings;
 
-    CmdHashConvert(): to(HashFormat::SRI) {
+    CmdHashConvert()
+        : to(HashFormat::SRI)
+    {
         addFlag(flag::hashFormatOpt("from", &from));
         addFlag(flag::hashFormatWithDefault("to", &to));
         addFlag(flag::hashAlgoOpt(&algo));
         expectArgs({
-           .label = "hashes",
-           .handler = {&hashStrings},
+            .label = "hashes",
+            .handler = {&hashStrings},
         });
     }
 
@@ -237,23 +236,21 @@ struct CmdHashConvert : Command
     std::string doc() override
     {
         return
-          #include "hash-convert.md"
-          ;
+#include "hash-convert.md"
+            ;
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 
-    void run() override {
+    void run() override
+    {
         for (const auto & s : hashStrings) {
-            Hash h =
-                from == HashFormat::SRI
-                ? Hash::parseSRI(s)
-                : Hash::parseAny(s, algo);
-            if (from
-                && from != HashFormat::SRI
-                && h.to_string(*from, false) !=
-                    (from == HashFormat::Base16 ? toLower(s) : s))
-            {
+            Hash h = from == HashFormat::SRI ? Hash::parseSRI(s) : Hash::parseAny(s, algo);
+            if (from && from != HashFormat::SRI
+                && h.to_string(*from, false) != (from == HashFormat::Base16 ? toLower(s) : s)) {
                 auto from_as_string = printHashFormat(*from);
                 throw BadHash("input hash '%s' does not have the expected format for '--from %s'", s, from_as_string);
             }
@@ -266,30 +263,34 @@ struct CmdHash : NixMultiCommand
 {
     CmdHash()
         : NixMultiCommand(
-            "hash",
-            {
-                {"convert", []() { return make_ref<CmdHashConvert>();}},
-                {"path", []() { return make_ref<CmdHashPath>(); }},
-                {"file", []() { return make_ref<CmdHashFile>(); }},
-                {"to-base16", []() { return make_ref<CmdToBase>(HashFormat::Base16); }},
-                {"to-base32", []() { return make_ref<CmdToBase>(HashFormat::Nix32); }},
-                {"to-base64", []() { return make_ref<CmdToBase>(HashFormat::Base64); }},
-                {"to-sri", []() { return make_ref<CmdToBase>(HashFormat::SRI); }},
-          })
-    { }
+              "hash",
+              {
+                  {"convert", []() { return make_ref<CmdHashConvert>(); }},
+                  {"path", []() { return make_ref<CmdHashPath>(); }},
+                  {"file", []() { return make_ref<CmdHashFile>(); }},
+                  {"to-base16", []() { return make_ref<CmdToBase>(HashFormat::Base16); }},
+                  {"to-base32", []() { return make_ref<CmdToBase>(HashFormat::Nix32); }},
+                  {"to-base64", []() { return make_ref<CmdToBase>(HashFormat::Base64); }},
+                  {"to-sri", []() { return make_ref<CmdToBase>(HashFormat::SRI); }},
+              })
+    {
+    }
 
     std::string description() override
     {
         return "compute and convert cryptographic hashes";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 static auto rCmdHash = registerCommand<CmdHash>("hash");
 
 /* Legacy nix-hash command. */
-static int compatNixHash(int argc, char * * argv)
+static int compatNixHash(int argc, char ** argv)
 {
     // Wait until `nix hash convert` is not hidden behind experimental flags anymore.
     // warn("`nix-hash` has been deprecated in favor of `nix hash convert`.");
@@ -298,7 +299,9 @@ static int compatNixHash(int argc, char * * argv)
     bool flat = false;
     HashFormat hashFormat = HashFormat::Base16;
     bool truncate = false;
+
     enum { opHash, opTo } op = opHash;
+
     std::vector<std::string> ss;
 
     parseCmdLine(argc, argv, [&](Strings::iterator & arg, const Strings::iterator & end) {
@@ -306,33 +309,34 @@ static int compatNixHash(int argc, char * * argv)
             showManPage("nix-hash");
         else if (*arg == "--version")
             printVersion("nix-hash");
-        else if (*arg == "--flat") flat = true;
-        else if (*arg == "--base16") hashFormat = HashFormat::Base16;
-        else if (*arg == "--base32") hashFormat = HashFormat::Nix32;
-        else if (*arg == "--base64") hashFormat = HashFormat::Base64;
-        else if (*arg == "--sri") hashFormat = HashFormat::SRI;
-        else if (*arg == "--truncate") truncate = true;
+        else if (*arg == "--flat")
+            flat = true;
+        else if (*arg == "--base16")
+            hashFormat = HashFormat::Base16;
+        else if (*arg == "--base32")
+            hashFormat = HashFormat::Nix32;
+        else if (*arg == "--base64")
+            hashFormat = HashFormat::Base64;
+        else if (*arg == "--sri")
+            hashFormat = HashFormat::SRI;
+        else if (*arg == "--truncate")
+            truncate = true;
         else if (*arg == "--type") {
             std::string s = getArg(*arg, arg, end);
             hashAlgo = parseHashAlgo(s);
-        }
-        else if (*arg == "--to-base16") {
+        } else if (*arg == "--to-base16") {
             op = opTo;
             hashFormat = HashFormat::Base16;
-        }
-        else if (*arg == "--to-base32") {
+        } else if (*arg == "--to-base32") {
             op = opTo;
             hashFormat = HashFormat::Nix32;
-        }
-        else if (*arg == "--to-base64") {
+        } else if (*arg == "--to-base64") {
             op = opTo;
             hashFormat = HashFormat::Base64;
-        }
-        else if (*arg == "--to-sri") {
+        } else if (*arg == "--to-sri") {
             op = opTo;
             hashFormat = HashFormat::SRI;
-        }
-        else if (*arg != "" && arg->at(0) == '-')
+        } else if (*arg != "" && arg->at(0) == '-')
             return false;
         else
             ss.push_back(*arg);
@@ -341,7 +345,8 @@ static int compatNixHash(int argc, char * * argv)
 
     if (op == opHash) {
         CmdHashBase cmd(flat ? FileIngestionMethod::Flat : FileIngestionMethod::NixArchive);
-        if (!hashAlgo.has_value()) hashAlgo = HashAlgorithm::MD5;
+        if (!hashAlgo.has_value())
+            hashAlgo = HashAlgorithm::MD5;
         cmd.hashAlgo = hashAlgo.value();
         cmd.hashFormat = hashFormat;
         cmd.truncate = truncate;
@@ -352,7 +357,8 @@ static int compatNixHash(int argc, char * * argv)
     else {
         CmdToBase cmd(hashFormat, true);
         cmd.args = ss;
-        if (hashAlgo.has_value()) cmd.hashAlgo = hashAlgo;
+        if (hashAlgo.has_value())
+            cmd.hashAlgo = hashAlgo;
         cmd.run();
     }
 
diff --git a/src/nix/log.cc b/src/nix/log.cc
index 78f1dd570..150b4b371 100644
--- a/src/nix/log.cc
+++ b/src/nix/log.cc
@@ -1,6 +1,7 @@
 #include "nix/cmd/command.hh"
 #include "nix/main/common-args.hh"
 #include "nix/main/shared.hh"
+#include "nix/store/globals.hh"
 #include "nix/store/store-open.hh"
 #include "nix/store/log-store.hh"
 
@@ -16,11 +17,14 @@ struct CmdLog : InstallableCommand
     std::string doc() override
     {
         return
-          #include "log.md"
-          ;
+#include "log.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     void run(ref<Store> store, ref<Installable> installable) override
     {
@@ -33,29 +37,29 @@ struct CmdLog : InstallableCommand
         auto b = installable->toDerivedPath();
 
         // For compat with CLI today, TODO revisit
-        auto oneUp = std::visit(overloaded {
-            [&](const DerivedPath::Opaque & bo) {
-                return make_ref<const SingleDerivedPath>(bo);
+        auto oneUp = std::visit(
+            overloaded{
+                [&](const DerivedPath::Opaque & bo) { return make_ref<const SingleDerivedPath>(bo); },
+                [&](const DerivedPath::Built & bfd) { return bfd.drvPath; },
             },
-            [&](const DerivedPath::Built & bfd) {
-                return bfd.drvPath;
-            },
-        }, b.path.raw());
+            b.path.raw());
         auto path = resolveDerivedPath(*store, *oneUp);
 
         RunPager pager;
         for (auto & sub : subs) {
             auto * logSubP = dynamic_cast<LogStore *>(&*sub);
             if (!logSubP) {
-                printInfo("Skipped '%s' which does not support retrieving build logs", sub->getUri());
+                printInfo(
+                    "Skipped '%s' which does not support retrieving build logs", sub->config.getHumanReadableURI());
                 continue;
             }
             auto & logSub = *logSubP;
 
             auto log = logSub.getBuildLog(path);
-            if (!log) continue;
+            if (!log)
+                continue;
             logger->stop();
-            printInfo("got build log for '%s' from '%s'", installable->what(), logSub.getUri());
+            printInfo("got build log for '%s' from '%s'", installable->what(), logSub.config.getHumanReadableURI());
             writeFull(getStandardOutput(), *log);
             return;
         }
diff --git a/src/nix/ls.cc b/src/nix/ls.cc
index 4b282bc43..dcc46fa14 100644
--- a/src/nix/ls.cc
+++ b/src/nix/ls.cc
@@ -43,11 +43,10 @@ struct MixLs : virtual Args, MixJSON
         auto showFile = [&](const CanonPath & curPath, std::string_view relPath) {
             if (verbose) {
                 auto st = accessor->lstat(curPath);
-                std::string tp =
-                    st.type == SourceAccessor::Type::tRegular ?
-                        (st.isExecutable ? "-r-xr-xr-x" : "-r--r--r--") :
-                    st.type == SourceAccessor::Type::tSymlink ? "lrwxrwxrwx" :
-                    "dr-xr-xr-x";
+                std::string tp = st.type == SourceAccessor::Type::tRegular
+                                     ? (st.isExecutable ? "-r-xr-xr-x" : "-r--r--r--")
+                                 : st.type == SourceAccessor::Type::tSymlink ? "lrwxrwxrwx"
+                                                                             : "dr-xr-xr-x";
                 auto line = fmt("%s %20d %s", tp, st.fileSize.value_or(0), relPath);
                 if (st.type == SourceAccessor::Type::tSymlink)
                     line += " -> " + accessor->readLink(curPath);
@@ -64,9 +63,10 @@ struct MixLs : virtual Args, MixJSON
             }
         };
 
-        doPath = [&](const SourceAccessor::Stat & st, const CanonPath & curPath,
-            std::string_view relPath, bool showDirectory)
-        {
+        doPath = [&](const SourceAccessor::Stat & st,
+                     const CanonPath & curPath,
+                     std::string_view relPath,
+                     bool showDirectory) {
             if (st.type == SourceAccessor::Type::tDirectory && !showDirectory) {
                 auto names = accessor->readDirectory(curPath);
                 for (auto & [name, type] : names)
@@ -76,9 +76,8 @@ struct MixLs : virtual Args, MixJSON
         };
 
         auto st = accessor->lstat(path);
-        doPath(st, path,
-            st.type == SourceAccessor::Type::tDirectory ? "." : path.baseName().value_or(""),
-            showDirectory);
+        doPath(
+            st, path, st.type == SourceAccessor::Type::tDirectory ? "." : path.baseName().value_or(""), showDirectory);
     }
 
     void list(ref<SourceAccessor> accessor, CanonPath path)
@@ -98,11 +97,7 @@ struct CmdLsStore : StoreCommand, MixLs
 
     CmdLsStore()
     {
-        expectArgs({
-            .label = "path",
-            .handler = {&path},
-            .completer = completePath
-        });
+        expectArgs({.label = "path", .handler = {&path}, .completer = completePath});
     }
 
     std::string description() override
@@ -113,8 +108,8 @@ struct CmdLsStore : StoreCommand, MixLs
     std::string doc() override
     {
         return
-          #include "store-ls.md"
-          ;
+#include "store-ls.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -132,19 +127,15 @@ struct CmdLsNar : Command, MixLs
 
     CmdLsNar()
     {
-        expectArgs({
-            .label = "nar",
-            .handler = {&narPath},
-            .completer = completePath
-        });
+        expectArgs({.label = "nar", .handler = {&narPath}, .completer = completePath});
         expectArg("path", &path);
     }
 
     std::string doc() override
     {
         return
-          #include "nar-ls.md"
-          ;
+#include "nar-ls.md"
+            ;
     }
 
     std::string description() override
diff --git a/src/nix/main.cc b/src/nix/main.cc
index 6144f746f..a6077f5e9 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -31,20 +31,20 @@
 #include <nlohmann/json.hpp>
 
 #ifndef _WIN32
-# include <sys/socket.h>
-# include <ifaddrs.h>
-# include <netdb.h>
-# include <netinet/in.h>
+#  include <sys/socket.h>
+#  include <ifaddrs.h>
+#  include <netdb.h>
+#  include <netinet/in.h>
 #endif
 
 #ifdef __linux__
-# include "nix/util/linux-namespaces.hh"
+#  include "nix/util/linux-namespaces.hh"
 #endif
 
 #ifndef _WIN32
 extern std::string chrootHelperName;
 
-void chrootHelper(int argc, char * * argv);
+void chrootHelper(int argc, char ** argv);
 #endif
 
 #include "nix/util/strings.hh"
@@ -63,19 +63,21 @@ static bool haveInternet()
     Finally free([&]() { freeifaddrs(addrs); });
 
     for (auto i = addrs; i; i = i->ifa_next) {
-        if (!i->ifa_addr) continue;
+        if (!i->ifa_addr)
+            continue;
         if (i->ifa_addr->sa_family == AF_INET) {
             if (ntohl(((sockaddr_in *) i->ifa_addr)->sin_addr.s_addr) != INADDR_LOOPBACK) {
                 return true;
             }
         } else if (i->ifa_addr->sa_family == AF_INET6) {
-            if (!IN6_IS_ADDR_LOOPBACK(&((sockaddr_in6 *) i->ifa_addr)->sin6_addr) &&
-                !IN6_IS_ADDR_LINKLOCAL(&((sockaddr_in6 *) i->ifa_addr)->sin6_addr))
+            if (!IN6_IS_ADDR_LOOPBACK(&((sockaddr_in6 *) i->ifa_addr)->sin6_addr)
+                && !IN6_IS_ADDR_LINKLOCAL(&((sockaddr_in6 *) i->ifa_addr)->sin6_addr))
                 return true;
         }
     }
 
-    if (haveNetworkProxyConnection()) return true;
+    if (haveNetworkProxyConnection())
+        return true;
 
     return false;
 #else
@@ -93,7 +95,9 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
     bool helpRequested = false;
     bool showVersion = false;
 
-    NixArgs() : MultiCommand("", RegisterCommand::getCommandsFor({})), MixCommonArgs("nix")
+    NixArgs()
+        : MultiCommand("", RegisterCommand::getCommandsFor({}))
+        , MixCommonArgs("nix")
     {
         categories.clear();
         categories[catHelp] = "Help commands";
@@ -143,29 +147,29 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
         });
 
         aliases = {
-            {"add-to-store", { AliasStatus::Deprecated, {"store", "add-path"}}},
-            {"cat-nar", { AliasStatus::Deprecated, {"nar", "cat"}}},
-            {"cat-store", { AliasStatus::Deprecated, {"store", "cat"}}},
-            {"copy-sigs", { AliasStatus::Deprecated, {"store", "copy-sigs"}}},
-            {"dev-shell", { AliasStatus::Deprecated, {"develop"}}},
-            {"diff-closures", { AliasStatus::Deprecated, {"store", "diff-closures"}}},
-            {"dump-path", { AliasStatus::Deprecated, {"store", "dump-path"}}},
-            {"hash-file", { AliasStatus::Deprecated, {"hash", "file"}}},
-            {"hash-path", { AliasStatus::Deprecated, {"hash", "path"}}},
-            {"ls-nar", { AliasStatus::Deprecated, {"nar", "ls"}}},
-            {"ls-store", { AliasStatus::Deprecated, {"store", "ls"}}},
-            {"make-content-addressable", { AliasStatus::Deprecated, {"store", "make-content-addressed"}}},
-            {"optimise-store", { AliasStatus::Deprecated, {"store", "optimise"}}},
-            {"ping-store", { AliasStatus::Deprecated, {"store", "info"}}},
-            {"sign-paths", { AliasStatus::Deprecated, {"store", "sign"}}},
-            {"shell", { AliasStatus::AcceptedShorthand, {"env", "shell"}}},
-            {"show-derivation", { AliasStatus::Deprecated, {"derivation", "show"}}},
-            {"show-config", { AliasStatus::Deprecated, {"config", "show"}}},
-            {"to-base16", { AliasStatus::Deprecated, {"hash", "to-base16"}}},
-            {"to-base32", { AliasStatus::Deprecated, {"hash", "to-base32"}}},
-            {"to-base64", { AliasStatus::Deprecated, {"hash", "to-base64"}}},
-            {"verify", { AliasStatus::Deprecated, {"store", "verify"}}},
-            {"doctor", { AliasStatus::Deprecated, {"config", "check"}}},
+            {"add-to-store", {AliasStatus::Deprecated, {"store", "add-path"}}},
+            {"cat-nar", {AliasStatus::Deprecated, {"nar", "cat"}}},
+            {"cat-store", {AliasStatus::Deprecated, {"store", "cat"}}},
+            {"copy-sigs", {AliasStatus::Deprecated, {"store", "copy-sigs"}}},
+            {"dev-shell", {AliasStatus::Deprecated, {"develop"}}},
+            {"diff-closures", {AliasStatus::Deprecated, {"store", "diff-closures"}}},
+            {"dump-path", {AliasStatus::Deprecated, {"store", "dump-path"}}},
+            {"hash-file", {AliasStatus::Deprecated, {"hash", "file"}}},
+            {"hash-path", {AliasStatus::Deprecated, {"hash", "path"}}},
+            {"ls-nar", {AliasStatus::Deprecated, {"nar", "ls"}}},
+            {"ls-store", {AliasStatus::Deprecated, {"store", "ls"}}},
+            {"make-content-addressable", {AliasStatus::Deprecated, {"store", "make-content-addressed"}}},
+            {"optimise-store", {AliasStatus::Deprecated, {"store", "optimise"}}},
+            {"ping-store", {AliasStatus::Deprecated, {"store", "info"}}},
+            {"sign-paths", {AliasStatus::Deprecated, {"store", "sign"}}},
+            {"shell", {AliasStatus::AcceptedShorthand, {"env", "shell"}}},
+            {"show-derivation", {AliasStatus::Deprecated, {"derivation", "show"}}},
+            {"show-config", {AliasStatus::Deprecated, {"config", "show"}}},
+            {"to-base16", {AliasStatus::Deprecated, {"hash", "to-base16"}}},
+            {"to-base32", {AliasStatus::Deprecated, {"hash", "to-base32"}}},
+            {"to-base64", {AliasStatus::Deprecated, {"hash", "to-base64"}}},
+            {"verify", {AliasStatus::Deprecated, {"store", "verify"}}},
+            {"doctor", {AliasStatus::Deprecated, {"config", "check"}}},
         };
     };
 
@@ -177,8 +181,8 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
     std::string doc() override
     {
         return
-          #include "nix.md"
-          ;
+#include "nix.md"
+            ;
     }
 
     // Plugins may add new subcommands.
@@ -212,6 +216,14 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
    lowdown. */
 static void showHelp(std::vector<std::string> subcommand, NixArgs & toplevel)
 {
+    // Check for aliases if subcommand has exactly one element
+    if (subcommand.size() == 1) {
+        auto alias = toplevel.aliases.find(subcommand[0]);
+        if (alias != toplevel.aliases.end()) {
+            subcommand = alias->second.replacement;
+        }
+    }
+
     auto mdName = subcommand.empty() ? "nix" : fmt("nix3-%s", concatStringsSep("-", subcommand));
 
     evalSettings.restrictEval = false;
@@ -219,24 +231,26 @@ static void showHelp(std::vector<std::string> subcommand, NixArgs & toplevel)
     EvalState state({}, openStore("dummy://"), fetchSettings, evalSettings);
 
     auto vGenerateManpage = state.allocValue();
-    state.eval(state.parseExprFromString(
-        #include "generate-manpage.nix.gen.hh"
-        , state.rootPath(CanonPath::root)), *vGenerateManpage);
+    state.eval(
+        state.parseExprFromString(
+#include "generate-manpage.nix.gen.hh"
+            , state.rootPath(CanonPath::root)),
+        *vGenerateManpage);
 
     state.corepkgsFS->addFile(
         CanonPath("utils.nix"),
-        #include "utils.nix.gen.hh"
-        );
+#include "utils.nix.gen.hh"
+    );
 
     state.corepkgsFS->addFile(
         CanonPath("/generate-settings.nix"),
-        #include "generate-settings.nix.gen.hh"
-        );
+#include "generate-settings.nix.gen.hh"
+    );
 
     state.corepkgsFS->addFile(
         CanonPath("/generate-store-info.nix"),
-        #include "generate-store-info.nix.gen.hh"
-        );
+#include "generate-store-info.nix.gen.hh"
+    );
 
     auto vDump = state.allocValue();
     vDump->mkString(toplevel.dumpCli());
@@ -280,17 +294,21 @@ struct CmdHelp : Command
     std::string doc() override
     {
         return
-          #include "help.md"
-          ;
+#include "help.md"
+            ;
     }
 
-    Category category() override { return catHelp; }
+    Category category() override
+    {
+        return catHelp;
+    }
 
     void run() override
     {
         assert(parent);
         MultiCommand * toplevel = parent;
-        while (toplevel->parent) toplevel = toplevel->parent;
+        while (toplevel->parent)
+            toplevel = toplevel->parent;
         showHelp(subcommand, getNixArgs(*this));
     }
 };
@@ -307,11 +325,14 @@ struct CmdHelpStores : Command
     std::string doc() override
     {
         return
-          #include "help-stores.md.gen.hh"
-          ;
+#include "help-stores.md.gen.hh"
+            ;
     }
 
-    Category category() override { return catHelp; }
+    Category category() override
+    {
+        return catHelp;
+    }
 
     void run() override
     {
@@ -321,7 +342,7 @@ struct CmdHelpStores : Command
 
 static auto rCmdHelpStores = registerCommand<CmdHelpStores>("help-stores");
 
-void mainWrapped(int argc, char * * argv)
+void mainWrapped(int argc, char ** argv)
 {
     savedArgv = argv;
 
@@ -346,20 +367,22 @@ void mainWrapped(int argc, char * * argv)
        self-aware. That is, it has to know where it is installed. We
        don't think it's sentient.
      */
-    settings.buildHook.setDefault(Strings {
-        getNixBin({}).string(),
-        "__build-remote",
-    });
+    settings.buildHook.setDefault(
+        Strings{
+            getNixBin({}).string(),
+            "__build-remote",
+        });
 
-    #ifdef __linux__
+#ifdef __linux__
     if (isRootUser()) {
         try {
             saveMountNamespace();
             if (unshare(CLONE_NEWNS) == -1)
                 throw SysError("setting up a private mount namespace");
-        } catch (Error & e) { }
+        } catch (Error & e) {
+        }
     }
-    #endif
+#endif
 
     programPath = argv[0];
     auto programName = std::string(baseNameOf(programPath));
@@ -369,12 +392,14 @@ void mainWrapped(int argc, char * * argv)
 
     if (argc > 1 && std::string_view(argv[1]) == "__build-remote") {
         programName = "build-remote";
-        argv++; argc--;
+        argv++;
+        argc--;
     }
 
     {
         auto legacy = RegisterLegacyCommand::commands()[programName];
-        if (legacy) return legacy(argc, argv);
+        if (legacy)
+            return legacy(argc, argv);
     }
 
     evalSettings.pureEval = true;
@@ -409,9 +434,11 @@ void mainWrapped(int argc, char * * argv)
         for (auto & builtinPtr : state.getBuiltins().attrs()->lexicographicOrder(state.symbols)) {
             auto & builtin = *builtinPtr;
             auto b = nlohmann::json::object();
-            if (!builtin.value->isPrimOp()) continue;
+            if (!builtin.value->isPrimOp())
+                continue;
             auto primOp = builtin.value->primOp();
-            if (!primOp->doc) continue;
+            if (!primOp->doc)
+                continue;
             b["args"] = primOp->args;
             b["doc"] = trim(stripIndentation(primOp->doc));
             if (primOp->experimentalFeature)
@@ -420,7 +447,8 @@ void mainWrapped(int argc, char * * argv)
         }
         for (auto & [name, info] : state.constantInfos) {
             auto b = nlohmann::json::object();
-            if (!info.doc) continue;
+            if (!info.doc)
+                continue;
             b["doc"] = trim(stripIndentation(info.doc));
             b["type"] = showType(info.type, false);
             if (info.impureOnly)
@@ -436,16 +464,18 @@ void mainWrapped(int argc, char * * argv)
         return;
     }
 
-    Finally printCompletions([&]()
-    {
+    Finally printCompletions([&]() {
         if (args.completions) {
             switch (args.completions->type) {
             case Completions::Type::Normal:
-                logger->cout("normal"); break;
+                logger->cout("normal");
+                break;
             case Completions::Type::Filenames:
-                logger->cout("filenames"); break;
+                logger->cout("filenames");
+                break;
             case Completions::Type::Attrs:
-                logger->cout("attrs"); break;
+                logger->cout("attrs");
+                break;
             }
             for (auto & s : args.completions->completions)
                 logger->cout(s.completion + "\t" + trim(s.description));
@@ -455,9 +485,10 @@ void mainWrapped(int argc, char * * argv)
     try {
         auto isNixCommand = std::regex_search(programName, std::regex("nix$"));
         auto allowShebang = isNixCommand && argc > 1;
-        args.parseCmdline(argvToStrings(argc, argv),allowShebang);
+        args.parseCmdline(argvToStrings(argc, argv), allowShebang);
     } catch (UsageError &) {
-        if (!args.helpRequested && !args.completions) throw;
+        if (!args.helpRequested && !args.completions)
+            throw;
     }
 
     applyJSONLogger();
@@ -476,7 +507,8 @@ void mainWrapped(int argc, char * * argv)
         return;
     }
 
-    if (args.completions) return;
+    if (args.completions)
+        return;
 
     if (args.showVersion) {
         printVersion(programName);
@@ -486,8 +518,7 @@ void mainWrapped(int argc, char * * argv)
     if (!args.command)
         throw UsageError("no subcommand specified");
 
-    experimentalFeatureSettings.require(
-        args.command->second->experimentalFeature());
+    experimentalFeatureSettings.require(args.command->second->experimentalFeature());
 
     if (args.useNet && !haveInternet()) {
         warn("you don't have Internet access; disabling some network-dependent features");
@@ -526,9 +557,9 @@ void mainWrapped(int argc, char * * argv)
     }
 }
 
-}
+} // namespace nix
 
-int main(int argc, char * * argv)
+int main(int argc, char ** argv)
 {
     // The CLI has a more detailed version than the libraries; see nixVersion.
     nix::nixVersion = NIX_CLI_VERSION;
@@ -538,7 +569,5 @@ int main(int argc, char * * argv)
     nix::setStackSize(64 * 1024 * 1024);
 #endif
 
-    return nix::handleExceptions(argv[0], [&]() {
-        nix::mainWrapped(argc, argv);
-    });
+    return nix::handleExceptions(argv[0], [&]() { nix::mainWrapped(argc, argv); });
 }
diff --git a/src/nix/make-content-addressed.cc b/src/nix/make-content-addressed.cc
index 5523ae279..a54729c45 100644
--- a/src/nix/make-content-addressed.cc
+++ b/src/nix/make-content-addressed.cc
@@ -24,16 +24,16 @@ struct CmdMakeContentAddressed : virtual CopyCommand, virtual StorePathsCommand,
     std::string doc() override
     {
         return
-          #include "make-content-addressed.md"
-          ;
+#include "make-content-addressed.md"
+            ;
     }
 
     void run(ref<Store> srcStore, StorePaths && storePaths) override
     {
         auto dstStore = dstUri.empty() ? openStore() : openStore(dstUri);
 
-        auto remappings = makeContentAddressed(*srcStore, *dstStore,
-            StorePathSet(storePaths.begin(), storePaths.end()));
+        auto remappings =
+            makeContentAddressed(*srcStore, *dstStore, StorePathSet(storePaths.begin(), storePaths.end()));
 
         if (json) {
             auto jsonRewrites = json::object();
@@ -49,9 +49,7 @@ struct CmdMakeContentAddressed : virtual CopyCommand, virtual StorePathsCommand,
             for (auto & path : storePaths) {
                 auto i = remappings.find(path);
                 assert(i != remappings.end());
-                notice("rewrote '%s' to '%s'",
-                    srcStore->printStorePath(path),
-                    srcStore->printStorePath(i->second));
+                notice("rewrote '%s' to '%s'", srcStore->printStorePath(path), srcStore->printStorePath(i->second));
             }
         }
     }
diff --git a/src/nix/man-pages.cc b/src/nix/man-pages.cc
index 8585c164c..7ab8a0eeb 100644
--- a/src/nix/man-pages.cc
+++ b/src/nix/man-pages.cc
@@ -27,4 +27,4 @@ void showManPage(const std::string & name)
     throw SysError("command 'man %1%' failed", name.c_str());
 }
 
-}
+} // namespace nix
diff --git a/src/nix/man-pages.hh b/src/nix/man-pages.hh
index 9ba035af8..7a71f98e8 100644
--- a/src/nix/man-pages.hh
+++ b/src/nix/man-pages.hh
@@ -25,4 +25,4 @@ std::filesystem::path getNixManDir();
  */
 void showManPage(const std::string & name);
 
-}
+} // namespace nix
diff --git a/src/nix/meson.build b/src/nix/meson.build
index 0ba8bdd46..e989e8016 100644
--- a/src/nix/meson.build
+++ b/src/nix/meson.build
@@ -1,7 +1,9 @@
-project('nix', 'cpp',
+project(
+  'nix',
+  'cpp',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -26,8 +28,7 @@ deps_private_maybe_subproject = [
   dependency('nix-main'),
   dependency('nix-cmd'),
 ]
-deps_public_maybe_subproject = [
-]
+deps_public_maybe_subproject = []
 subdir('nix-meson-build-support/subprojects')
 
 subdir('nix-meson-build-support/export-all-symbols')
@@ -57,10 +58,9 @@ config_priv_h = configure_file(
 subdir('nix-meson-build-support/common')
 subdir('nix-meson-build-support/generate-header')
 
-nix_sources = [config_priv_h] + files(
+nix_sources = [ config_priv_h ] + files(
   'add-to-store.cc',
   'app.cc',
-  'self-exe.cc',
   'build.cc',
   'bundle.cc',
   'cat.cc',
@@ -77,6 +77,7 @@ nix_sources = [config_priv_h] + files(
   'edit.cc',
   'env.cc',
   'eval.cc',
+  'flake-prefetch-inputs.cc',
   'flake.cc',
   'formatter.cc',
   'hash.cc',
@@ -96,6 +97,7 @@ nix_sources = [config_priv_h] + files(
   'repl.cc',
   'run.cc',
   'search.cc',
+  'self-exe.cc',
   'sigs.cc',
   'store-copy-log.cc',
   'store-delete.cc',
@@ -177,15 +179,16 @@ if host_machine.system() != 'windows'
   ]
 endif
 
-include_dirs = [include_directories('.')]
+include_dirs = [ include_directories('.') ]
 
 this_exe = executable(
   meson.project_name(),
   sources,
   dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
-  link_args: linker_export_flags,
+  link_args : linker_export_flags,
   install : true,
+  cpp_pch : do_pch ? [ 'pch/precompiled-headers.hh' ] : [],
 )
 
 meson.override_find_program('nix', this_exe)
@@ -209,6 +212,7 @@ if host_machine.system() == 'windows'
   executable_suffix = '.exe'
 endif
 
+nix_symlinks_targets = []
 foreach linkname : nix_symlinks
   install_symlink(
     linkname + executable_suffix,
@@ -216,35 +220,36 @@ foreach linkname : nix_symlinks
     pointing_to : fs.name(this_exe),
     install_dir : get_option('bindir'),
     # The 'runtime' tag is what executables default to, which we want to emulate here.
-    install_tag : 'runtime'
+    install_tag : 'runtime',
   )
-  custom_target(
-    command: ['ln', '-sf', fs.name(this_exe), '@OUTPUT@'],
-    output: linkname + executable_suffix,
+  symlink_target = custom_target(
+    command : [ 'ln', '-sf', fs.name(this_exe), '@OUTPUT@' ],
+    output : linkname + executable_suffix,
     # native doesn't allow dangling symlinks, but the target executable often doesn't exist at this time
-    env : { 'MSYS' : 'winsymlinks:lnk' },
+    env : {'MSYS' : 'winsymlinks:lnk'},
     # TODO(Ericson2314): Don't do this once we have the `meson.override_find_program` working)
-    build_by_default: true
+    build_by_default : true,
   )
   # TODO(Ericson3214): Doesn't yet work
   #meson.override_find_program(linkname, t)
+  nix_symlinks_targets += symlink_target
 endforeach
 
 install_symlink(
   'build-remote',
-  pointing_to : '..' / '..'/ get_option('bindir') / fs.name(this_exe),
+  pointing_to : '..' / '..' / get_option('bindir') / fs.name(this_exe),
   install_dir : get_option('libexecdir') / fs.name(this_exe),
   # The 'runtime' tag is what executables default to, which we want to emulate here.
-  install_tag : 'runtime'
+  install_tag : 'runtime',
 )
 
 custom_target(
-  command: ['ln', '-sf', fs.name(this_exe), '@OUTPUT@'],
-  output: 'build-remote' + executable_suffix,
+  command : [ 'ln', '-sf', fs.name(this_exe), '@OUTPUT@' ],
+  output : 'build-remote' + executable_suffix,
   # native doesn't allow dangling symlinks, but the target executable often doesn't exist at this time
-  env : { 'MSYS' : 'winsymlinks:lnk' },
+  env : {'MSYS' : 'winsymlinks:lnk'},
   # TODO(Ericson2314): Don't do this once we have the `meson.override_find_program` working)
-  build_by_default: true
+  build_by_default : true,
 )
 # TODO(Ericson3214): Doesn't yet work
 #meson.override_find_program(linkname, t)
diff --git a/src/nix/meson.options b/src/nix/meson.options
index 8430dd669..0fc680cfe 100644
--- a/src/nix/meson.options
+++ b/src/nix/meson.options
@@ -1,6 +1,9 @@
 # vim: filetype=meson
 
 # A relative path means it gets appended to prefix.
-option('profile-dir', type : 'string', value : 'etc/profile.d',
+option(
+  'profile-dir',
+  type : 'string',
+  value : 'etc/profile.d',
   description : 'the path to install shell profile files',
 )
diff --git a/src/nix/nar.cc b/src/nix/nar.cc
index debb6b95e..bae77b6cc 100644
--- a/src/nix/nar.cc
+++ b/src/nix/nar.cc
@@ -4,8 +4,10 @@ using namespace nix;
 
 struct CmdNar : NixMultiCommand
 {
-    CmdNar() : NixMultiCommand("nar", RegisterCommand::getCommandsFor({"nar"}))
-    { }
+    CmdNar()
+        : NixMultiCommand("nar", RegisterCommand::getCommandsFor({"nar"}))
+    {
+    }
 
     std::string description() override
     {
@@ -15,11 +17,14 @@ struct CmdNar : NixMultiCommand
     std::string doc() override
     {
         return
-          #include "nar.md"
-          ;
+#include "nar.md"
+            ;
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 static auto rCmdNar = registerCommand<CmdNar>("nar");
diff --git a/src/nix/nix-build b/src/nix/nix-build
deleted file mode 120000
index 2954d8ac7..000000000
--- a/src/nix/nix-build
+++ /dev/null
@@ -1 +0,0 @@
-../nix-build
\ No newline at end of file
diff --git a/src/nix-build/nix-build.cc b/src/nix/nix-build/nix-build.cc
similarity index 80%
rename from src/nix-build/nix-build.cc
rename to src/nix/nix-build/nix-build.cc
index 7e0b40252..d3902f2a6 100644
--- a/src/nix-build/nix-build.cc
+++ b/src/nix/nix-build/nix-build.cc
@@ -33,7 +33,7 @@
 using namespace nix;
 using namespace std::string_literals;
 
-extern char * * environ __attribute__((weak));
+extern char ** environ __attribute__((weak));
 
 /* Recreate the effect of the perl shellwords function, breaking up a
  * string into arguments like a shell word, including escapes
@@ -44,11 +44,9 @@ static std::vector<std::string> shellwords(std::string_view s)
     auto begin = s.cbegin();
     std::vector<std::string> res;
     std::string cur;
-    enum state {
-        sBegin,
-        sSingleQuote,
-        sDoubleQuote
-    };
+
+    enum state { sBegin, sSingleQuote, sDoubleQuote };
+
     state st = sBegin;
     auto it = begin;
     for (; it != s.cend(); ++it) {
@@ -58,36 +56,38 @@ static std::vector<std::string> shellwords(std::string_view s)
                 cur.append(begin, it);
                 res.push_back(cur);
                 it = match[0].second;
-                if (it == s.cend()) return res;
+                if (it == s.cend())
+                    return res;
                 begin = it;
                 cur.clear();
             }
         }
         switch (*it) {
-            case '\'':
-                if (st != sDoubleQuote) {
-                    cur.append(begin, it);
-                    begin = it + 1;
-                    st = st == sBegin ? sSingleQuote : sBegin;
-                }
-                break;
-            case '"':
-                if (st != sSingleQuote) {
-                    cur.append(begin, it);
-                    begin = it + 1;
-                    st = st == sBegin ? sDoubleQuote : sBegin;
-                }
-                break;
-            case '\\':
-                if (st != sSingleQuote) {
-                    /* perl shellwords mostly just treats the next char as part of the string with no special processing */
-                    cur.append(begin, it);
-                    begin = ++it;
-                }
-                break;
+        case '\'':
+            if (st != sDoubleQuote) {
+                cur.append(begin, it);
+                begin = it + 1;
+                st = st == sBegin ? sSingleQuote : sBegin;
+            }
+            break;
+        case '"':
+            if (st != sSingleQuote) {
+                cur.append(begin, it);
+                begin = it + 1;
+                st = st == sBegin ? sDoubleQuote : sBegin;
+            }
+            break;
+        case '\\':
+            if (st != sSingleQuote) {
+                /* perl shellwords mostly just treats the next char as part of the string with no special processing */
+                cur.append(begin, it);
+                begin = ++it;
+            }
+            break;
         }
     }
-    if (st != sBegin) throw Error("unterminated quote in shebang line");
+    if (st != sBegin)
+        throw Error("unterminated quote in shebang line");
     cur.append(begin, it);
     res.push_back(cur);
     return res;
@@ -106,7 +106,8 @@ static SourcePath resolveShellExprPath(SourcePath path)
             if (compatibilitySettings.nixShellAlwaysLooksForShellNix) {
                 return resolvedOrDir / "shell.nix";
             } else {
-                warn("Skipping '%1%', because the setting '%2%' is disabled. This is a deprecated behavior. Consider enabling '%2%'.",
+                warn(
+                    "Skipping '%1%', because the setting '%2%' is disabled. This is a deprecated behavior. Consider enabling '%2%'.",
                     resolvedOrDir / "shell.nix",
                     "nix-shell-always-looks-for-shell-nix");
             }
@@ -119,7 +120,7 @@ static SourcePath resolveShellExprPath(SourcePath path)
     return resolvedOrDir;
 }
 
-static void main_nix_build(int argc, char * * argv)
+static void main_nix_build(int argc, char ** argv)
 {
     auto dryRun = false;
     auto isNixShell = std::regex_search(argv[0], std::regex("nix-shell$"));
@@ -148,9 +149,21 @@ static void main_nix_build(int argc, char * * argv)
 
     // List of environment variables kept for --pure
     StringSet keepVars{
-        "HOME", "XDG_RUNTIME_DIR", "USER", "LOGNAME", "DISPLAY",
-        "WAYLAND_DISPLAY", "WAYLAND_SOCKET", "PATH", "TERM", "IN_NIX_SHELL",
-        "NIX_SHELL_PRESERVE_PROMPT", "TZ", "PAGER", "NIX_BUILD_SHELL", "SHLVL",
+        "HOME",
+        "XDG_RUNTIME_DIR",
+        "USER",
+        "LOGNAME",
+        "DISPLAY",
+        "WAYLAND_DISPLAY",
+        "WAYLAND_SOCKET",
+        "PATH",
+        "TERM",
+        "IN_NIX_SHELL",
+        "NIX_SHELL_PRESERVE_PROMPT",
+        "TZ",
+        "PAGER",
+        "NIX_BUILD_SHELL",
+        "SHLVL",
     };
     keepVars.insert(networkProxyVariables.begin(), networkProxyVariables.end());
 
@@ -179,13 +192,16 @@ static void main_nix_build(int argc, char * * argv)
                             args.push_back(word);
                 }
             }
-        } catch (SystemError &) { }
+        } catch (SystemError &) {
+        }
     }
 
     struct MyArgs : LegacyArgs, MixEvalArgs
     {
         using LegacyArgs::LegacyArgs;
-        void setBaseDir(Path baseDir) {
+
+        void setBaseDir(Path baseDir)
+        {
             commandBaseDir = baseDir;
         }
     };
@@ -235,8 +251,10 @@ static void main_nix_build(int argc, char * * argv)
         else if (*arg == "--expr" || *arg == "-E")
             fromArgs = true;
 
-        else if (*arg == "--pure") pure = true;
-        else if (*arg == "--impure") pure = false;
+        else if (*arg == "--pure")
+            pure = true;
+        else if (*arg == "--impure")
+            pure = false;
 
         else if (isNixShell && (*arg == "--packages" || *arg == "-p"))
             packages = true;
@@ -262,9 +280,15 @@ static void main_nix_build(int argc, char * * argv)
                 // read the shebang to understand which packages to read from. Since
                 // this is handled via nix-shell -p, we wrap our ruby script execution
                 // in ruby -e 'load' which ignores the shebangs.
-                envCommand = fmt("exec %1% %2% -e 'load(ARGV.shift)' -- %3% %4%", execArgs, interpreter, escapeShellArgAlways(script), toView(joined));
+                envCommand =
+                    fmt("exec %1% %2% -e 'load(ARGV.shift)' -- %3% %4%",
+                        execArgs,
+                        interpreter,
+                        escapeShellArgAlways(script),
+                        toView(joined));
             } else {
-                envCommand = fmt("exec %1% %2% %3% %4%", execArgs, interpreter, escapeShellArgAlways(script), toView(joined));
+                envCommand =
+                    fmt("exec %1% %2% %3% %4%", execArgs, interpreter, escapeShellArgAlways(script), toView(joined));
             }
         }
 
@@ -293,7 +317,8 @@ static void main_nix_build(int argc, char * * argv)
 
     auto state = std::make_unique<EvalState>(myArgs.lookupPath, evalStore, fetchSettings, evalSettings, store);
     state->repair = myArgs.repair;
-    if (myArgs.repair) buildMode = bmRepair;
+    if (myArgs.repair)
+        buildMode = bmRepair;
 
     if (inShebang && compatibilitySettings.nixShellShebangArgumentsRelativeToScript) {
         myArgs.setBaseDir(absPath(dirOf(script)));
@@ -304,20 +329,23 @@ static void main_nix_build(int argc, char * * argv)
     if (isNixShell) {
         auto newArgs = state->buildBindings(autoArgsWithInNixShell->size() + 1);
         newArgs.alloc("inNixShell").mkBool(true);
-        for (auto & i : *autoArgs) newArgs.insert(i);
+        for (auto & i : *autoArgs)
+            newArgs.insert(i);
         autoArgsWithInNixShell = newArgs.finish();
     }
 
     if (packages) {
         std::ostringstream joined;
-        joined << "{...}@args: with import <nixpkgs> args; (pkgs.runCommandCC or pkgs.runCommand) \"shell\" { buildInputs = [ ";
+        joined
+            << "{...}@args: with import <nixpkgs> args; (pkgs.runCommandCC or pkgs.runCommand) \"shell\" { buildInputs = [ ";
         for (const auto & i : remainingArgs)
             joined << '(' << i << ") ";
         joined << "]; } \"\"";
         fromArgs = true;
         remainingArgs = {joined.str()};
     } else if (!fromArgs && remainingArgs.empty()) {
-        if (isNixShell && !compatibilitySettings.nixShellAlwaysLooksForShellNix && std::filesystem::exists("shell.nix")) {
+        if (isNixShell && !compatibilitySettings.nixShellAlwaysLooksForShellNix
+            && std::filesystem::exists("shell.nix")) {
             // If we're in 2.3 compatibility mode, we need to look for shell.nix
             // now, because it won't be done later.
             remainingArgs = {"shell.nix"};
@@ -326,7 +354,10 @@ static void main_nix_build(int argc, char * * argv)
 
             // Instead of letting it throw later, we throw here to give a more relevant error message
             if (isNixShell && !std::filesystem::exists("shell.nix") && !std::filesystem::exists("default.nix"))
-                throw Error("no argument specified and no '%s' or '%s' file found in the working directory", "shell.nix", "default.nix");
+                throw Error(
+                    "no argument specified and no '%s' or '%s' file found in the working directory",
+                    "shell.nix",
+                    "default.nix");
         }
     }
 
@@ -348,14 +379,13 @@ static void main_nix_build(int argc, char * * argv)
                     std::move(i),
                     (inShebang && compatibilitySettings.nixShellShebangArgumentsRelativeToScript)
                         ? lookupFileArg(*state, shebangBaseDir)
-                        : state->rootPath(".")
-                ));
-            }
-            else {
+                        : state->rootPath(".")));
+            } else {
                 auto absolute = i;
                 try {
                     absolute = canonPath(absPath(i), true);
-                } catch (Error & e) {};
+                } catch (Error & e) {
+                };
                 auto [path, outputNames] = parsePathWithOutputs(absolute);
                 if (evalStore->isStorePath(path) && hasSuffix(path, ".drv"))
                     drvs.push_back(PackageInfo(*state, evalStore, absolute));
@@ -364,10 +394,8 @@ static void main_nix_build(int argc, char * * argv)
                        relative to the script. */
                     auto baseDir = inShebang && !packages ? absPath(i, absPath(dirOf(script))) : i;
 
-                    auto sourcePath = lookupFileArg(*state,
-                                    baseDir);
-                    auto resolvedPath =
-                        isNixShell ? resolveShellExprPath(sourcePath) : resolveExprPath(sourcePath);
+                    auto sourcePath = lookupFileArg(*state, baseDir);
+                    auto resolvedPath = isNixShell ? resolveShellExprPath(sourcePath) : resolveExprPath(sourcePath);
 
                     exprs.push_back(state->parseExprFromFile(resolvedPath));
                 }
@@ -375,7 +403,8 @@ static void main_nix_build(int argc, char * * argv)
         }
 
     /* Evaluate them into derivations. */
-    if (attrPaths.empty()) attrPaths = {""};
+    if (attrPaths.empty())
+        attrPaths = {""};
 
     for (auto e : exprs) {
         Value vRoot;
@@ -399,21 +428,11 @@ static void main_nix_build(int argc, char * * argv)
         };
 
         for (auto & i : attrPaths) {
-            Value & v(*findAlongAttrPath(
-                *state,
-                i,
-                takesNixShellAttr(vRoot) ? *autoArgsWithInNixShell : *autoArgs,
-                vRoot
-            ).first);
+            Value & v(
+                *findAlongAttrPath(*state, i, takesNixShellAttr(vRoot) ? *autoArgsWithInNixShell : *autoArgs, vRoot)
+                     .first);
             state->forceValue(v, v.determinePos(noPos));
-            getDerivations(
-                *state,
-                v,
-                "",
-                takesNixShellAttr(v) ? *autoArgsWithInNixShell : *autoArgs,
-                drvs,
-                false
-            );
+            getDerivations(*state, v, "", takesNixShellAttr(v) ? *autoArgsWithInNixShell : *autoArgs, drvs, false);
         }
     }
 
@@ -446,9 +465,7 @@ static void main_nix_build(int argc, char * * argv)
         if (!shell) {
 
             try {
-                auto expr = state->parseExprFromString(
-                    "(import <nixpkgs> {}).bashInteractive",
-                    state->rootPath("."));
+                auto expr = state->parseExprFromString("(import <nixpkgs> {}).bashInteractive", state->rootPath("."));
 
                 Value v;
                 state->eval(expr, v);
@@ -458,10 +475,11 @@ static void main_nix_build(int argc, char * * argv)
                     throw Error("the 'bashInteractive' attribute in <nixpkgs> did not evaluate to a derivation");
 
                 auto bashDrv = drv->requireDrvPath();
-                pathsToBuild.push_back(DerivedPath::Built {
-                    .drvPath = makeConstantStorePathRef(bashDrv),
-                    .outputs = OutputsSpec::Names {"out"},
-                });
+                pathsToBuild.push_back(
+                    DerivedPath::Built{
+                        .drvPath = makeConstantStorePathRef(bashDrv),
+                        .outputs = OutputsSpec::Names{"out"},
+                    });
                 pathsToCopy.insert(bashDrv);
                 shellDrv = bashDrv;
 
@@ -474,16 +492,17 @@ static void main_nix_build(int argc, char * * argv)
 
         std::function<void(ref<SingleDerivedPath>, const DerivedPathMap<StringSet>::ChildNode &)> accumDerivedPath;
 
-        accumDerivedPath = [&](ref<SingleDerivedPath> inputDrv, const DerivedPathMap<StringSet>::ChildNode & inputNode) {
+        accumDerivedPath = [&](ref<SingleDerivedPath> inputDrv,
+                               const DerivedPathMap<StringSet>::ChildNode & inputNode) {
             if (!inputNode.value.empty())
-                pathsToBuild.push_back(DerivedPath::Built {
-                    .drvPath = inputDrv,
-                    .outputs = OutputsSpec::Names { inputNode.value },
-                });
+                pathsToBuild.push_back(
+                    DerivedPath::Built{
+                        .drvPath = inputDrv,
+                        .outputs = OutputsSpec::Names{inputNode.value},
+                    });
             for (const auto & [outputName, childNode] : inputNode.childMap)
                 accumDerivedPath(
-                    make_ref<SingleDerivedPath>(SingleDerivedPath::Built { inputDrv, outputName }),
-                    childNode);
+                    make_ref<SingleDerivedPath>(SingleDerivedPath::Built{inputDrv, outputName}), childNode);
         };
 
         // Build or fetch all dependencies of the derivation.
@@ -491,11 +510,9 @@ static void main_nix_build(int argc, char * * argv)
             // To get around lambda capturing restrictions in the
             // standard.
             const auto & inputDrv = inputDrv0;
-            if (std::all_of(envExclude.cbegin(), envExclude.cend(),
-                    [&](const std::string & exclude) {
-                        return !std::regex_search(store->printStorePath(inputDrv), std::regex(exclude));
-                    }))
-            {
+            if (std::all_of(envExclude.cbegin(), envExclude.cend(), [&](const std::string & exclude) {
+                    return !std::regex_search(store->printStorePath(inputDrv), std::regex(exclude));
+                })) {
                 accumDerivedPath(makeConstantStorePathRef(inputDrv), inputNode);
                 pathsToCopy.insert(inputDrv);
             }
@@ -507,7 +524,8 @@ static void main_nix_build(int argc, char * * argv)
 
         buildPaths(pathsToBuild);
 
-        if (dryRun) return;
+        if (dryRun)
+            return;
 
         if (shellDrv) {
             auto shellDrvOutputs = store->queryPartialDerivationOutputMap(shellDrv.value(), &*evalStore);
@@ -535,14 +553,11 @@ static void main_nix_build(int argc, char * * argv)
 
         env["NIX_BUILD_TOP"] = env["TMPDIR"] = env["TEMPDIR"] = env["TMP"] = env["TEMP"] = tmpDir.path().string();
         env["NIX_STORE"] = store->storeDir;
-        env["NIX_BUILD_CORES"] = std::to_string(settings.buildCores);
+        env["NIX_BUILD_CORES"] = fmt("%d", settings.buildCores ? settings.buildCores : settings.getDefaultCores());
 
-        auto parsedDrv = StructuredAttrs::tryParse(drv.env);
         DerivationOptions drvOptions;
         try {
-            drvOptions = DerivationOptions::fromStructuredAttrs(
-                drv.env,
-                parsedDrv ? &*parsedDrv : nullptr);
+            drvOptions = DerivationOptions::fromStructuredAttrs(drv.env, drv.structuredAttrs);
         } catch (Error & e) {
             e.addTrace({}, "while parsing derivation '%s'", store->printStorePath(packageInfo.requireDrvPath()));
             throw;
@@ -561,12 +576,13 @@ static void main_nix_build(int argc, char * * argv)
 
         std::string structuredAttrsRC;
 
-        if (parsedDrv) {
+        if (drv.structuredAttrs) {
             StorePathSet inputs;
 
             std::function<void(const StorePath &, const DerivedPathMap<StringSet>::ChildNode &)> accumInputClosure;
 
-            accumInputClosure = [&](const StorePath & inputDrv, const DerivedPathMap<StringSet>::ChildNode & inputNode) {
+            accumInputClosure = [&](const StorePath & inputDrv,
+                                    const DerivedPathMap<StringSet>::ChildNode & inputNode) {
                 auto outputs = store->queryPartialDerivationOutputMap(inputDrv, &*evalStore);
                 for (auto & i : inputNode.value) {
                     auto o = outputs.at(i);
@@ -579,11 +595,7 @@ static void main_nix_build(int argc, char * * argv)
             for (const auto & [inputDrv, inputNode] : drv.inputDrvs.map)
                 accumInputClosure(inputDrv, inputNode);
 
-            auto json = parsedDrv->prepareStructuredAttrs(
-                *store,
-                drvOptions,
-                inputs,
-                drv.outputs);
+            auto json = drv.structuredAttrs->prepareStructuredAttrs(*store, drvOptions, inputs, drv.outputs);
 
             structuredAttrsRC = StructuredAttrs::writeShell(json);
 
@@ -644,9 +656,7 @@ static void main_nix_build(int argc, char * * argv)
         for (auto & i : env)
             envStrs.push_back(i.first + "=" + i.second);
 
-        auto args = interactive
-            ? Strings{"bash", "--rcfile", rcfile}
-            : Strings{"bash", rcfile};
+        auto args = interactive ? Strings{"bash", "--rcfile", rcfile} : Strings{"bash", rcfile};
 
         auto envPtrs = stringsToCharPtrs(envStrs);
 
@@ -678,10 +688,11 @@ static void main_nix_build(int argc, char * * argv)
             if (outputName == "")
                 throw Error("derivation '%s' lacks an 'outputName' attribute", store->printStorePath(drvPath));
 
-            pathsToBuild.push_back(DerivedPath::Built{
-                .drvPath = makeConstantStorePathRef(drvPath),
-                .outputs = OutputsSpec::Names{outputName},
-            });
+            pathsToBuild.push_back(
+                DerivedPath::Built{
+                    .drvPath = makeConstantStorePathRef(drvPath),
+                    .outputs = OutputsSpec::Names{outputName},
+                });
             pathsToBuildOrdered.push_back({drvPath, {outputName}});
             drvsToCopy.insert(drvPath);
 
@@ -694,7 +705,8 @@ static void main_nix_build(int argc, char * * argv)
 
         buildPaths(pathsToBuild);
 
-        if (dryRun) return;
+        if (dryRun)
+            return;
 
         std::vector<StorePath> outPaths;
 
@@ -712,7 +724,8 @@ static void main_nix_build(int argc, char * * argv)
 
             if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>()) {
                 std::string symlink = drvPrefix;
-                if (outputName != "out") symlink += "-" + outputName;
+                if (outputName != "out")
+                    symlink += "-" + outputName;
                 store2->addPermRoot(outputPath, absPath(symlink));
             }
 
diff --git a/src/nix/nix-channel b/src/nix/nix-channel
deleted file mode 120000
index 29b759473..000000000
--- a/src/nix/nix-channel
+++ /dev/null
@@ -1 +0,0 @@
-../nix-channel
\ No newline at end of file
diff --git a/src/nix-channel/nix-channel.cc b/src/nix/nix-channel/nix-channel.cc
similarity index 68%
rename from src/nix-channel/nix-channel.cc
rename to src/nix/nix-channel/nix-channel.cc
index c4a058658..f047dce8f 100644
--- a/src/nix-channel/nix-channel.cc
+++ b/src/nix/nix-channel/nix-channel.cc
@@ -26,7 +26,8 @@ static std::filesystem::path channelsList;
 // Reads the list of channels.
 static void readChannels()
 {
-    if (!pathExists(channelsList)) return;
+    if (!pathExists(channelsList))
+        return;
     auto channelsFile = readFile(channelsList);
 
     for (const auto & line : tokenizeString<std::vector<std::string>>(channelsFile, "\n")) {
@@ -71,7 +72,7 @@ static void removeChannel(const std::string & name)
     channels.erase(name);
     writeChannels();
 
-    runProgram(getNixBin("nix-env").string(), true, { "--profile", profile, "--uninstall", name });
+    runProgram(getNixBin("nix-env").string(), true, {"--profile", profile, "--uninstall", name});
 }
 
 static Path nixDefExpr;
@@ -84,9 +85,10 @@ static void update(const StringSet & channelNames)
     auto store = openStore();
 
     auto [fd, unpackChannelPath] = createTempFile();
-    writeFull(fd.get(),
-        #include "unpack-channel.nix.gen.hh"
-        );
+    writeFull(
+        fd.get(),
+#include "unpack-channel.nix.gen.hh"
+    );
     fd = -1;
     AutoDelete del(unpackChannelPath, false);
 
@@ -111,7 +113,10 @@ static void update(const StringSet & channelNames)
             // no need to update this channel, reuse the existing store path
             Path symlink = profile + "/" + name;
             Path storepath = dirOf(readLink(symlink));
-            exprs.push_back("f: rec { name = \"" + cname + "\"; type = \"derivation\"; outputs = [\"out\"]; system = \"builtin\"; outPath = builtins.storePath \"" + storepath + "\"; out = { inherit outPath; };}");
+            exprs.push_back(
+                "f: rec { name = \"" + cname
+                + "\"; type = \"derivation\"; outputs = [\"out\"]; system = \"builtin\"; outPath = builtins.storePath \""
+                + storepath + "\"; out = { inherit outPath; };}");
         } else {
             // We want to download the url to a file to see if it's a tarball while also checking if we
             // got redirected in the process, so that we can grab the various parts of a nix channel
@@ -122,28 +127,40 @@ static void update(const StringSet & channelNames)
 
             bool unpacked = false;
             if (std::regex_search(filename, std::regex("\\.tar\\.(gz|bz2|xz)$"))) {
-                runProgram(getNixBin("nix-build").string(), false, { "--no-out-link", "--expr", "import " + unpackChannelPath +
-                            "{ name = \"" + cname + "\"; channelName = \"" + name + "\"; src = builtins.storePath \"" + filename + "\"; }" });
+                runProgram(
+                    getNixBin("nix-build").string(),
+                    false,
+                    {"--no-out-link",
+                     "--expr",
+                     "import " + unpackChannelPath + "{ name = \"" + cname + "\"; channelName = \"" + name
+                         + "\"; src = builtins.storePath \"" + filename + "\"; }"});
                 unpacked = true;
             }
 
             if (!unpacked) {
                 // Download the channel tarball.
                 try {
-                    filename = store->toRealPath(fetchers::downloadFile(store, fetchSettings, url + "/nixexprs.tar.xz", "nixexprs.tar.xz").storePath);
+                    filename = store->toRealPath(
+                        fetchers::downloadFile(store, fetchSettings, url + "/nixexprs.tar.xz", "nixexprs.tar.xz")
+                            .storePath);
                 } catch (FileTransferError & e) {
-                    filename = store->toRealPath(fetchers::downloadFile(store, fetchSettings, url + "/nixexprs.tar.bz2", "nixexprs.tar.bz2").storePath);
+                    filename = store->toRealPath(
+                        fetchers::downloadFile(store, fetchSettings, url + "/nixexprs.tar.bz2", "nixexprs.tar.bz2")
+                            .storePath);
                 }
             }
             // Regardless of where it came from, add the expression representing this channel to accumulated expression
-            exprs.push_back("f: f { name = \"" + cname + "\"; channelName = \"" + name + "\"; src = builtins.storePath \"" + filename + "\"; " + extraAttrs + " }");
+            exprs.push_back(
+                "f: f { name = \"" + cname + "\"; channelName = \"" + name + "\"; src = builtins.storePath \""
+                + filename + "\"; " + extraAttrs + " }");
         }
     }
 
     // Unpack the channel tarballs into the Nix store and install them
     // into the channels profile.
     std::cerr << "unpacking " << exprs.size() << " channels...\n";
-    Strings envArgs{ "--profile", profile, "--file", unpackChannelPath, "--install", "--remove-all", "--from-expression" };
+    Strings envArgs{
+        "--profile", profile, "--file", unpackChannelPath, "--install", "--remove-all", "--from-expression"};
     for (auto & expr : exprs)
         envArgs.push_back(std::move(expr));
     envArgs.push_back("--quiet");
@@ -173,18 +190,11 @@ static int main_nix_channel(int argc, char ** argv)
         nixDefExpr = getNixDefExpr();
 
         // Figure out the name of the channels profile.
-        profile = profilesDir() +  "/channels";
+        profile = profilesDir() + "/channels";
         createDirs(dirOf(profile));
 
-        enum {
-            cNone,
-            cAdd,
-            cRemove,
-            cList,
-            cUpdate,
-            cListGenerations,
-            cRollback
-        } cmd = cNone;
+        enum { cNone, cAdd, cRemove, cList, cUpdate, cListGenerations, cRollback } cmd = cNone;
+
         std::vector<std::string> args;
         parseCmdLine(argc, argv, [&](Strings::iterator & arg, const Strings::iterator & end) {
             if (*arg == "--help") {
@@ -212,12 +222,12 @@ static int main_nix_channel(int argc, char ** argv)
         });
 
         switch (cmd) {
-            case cNone:
-                throw UsageError("no command specified");
-            case cAdd:
-                if (args.size() < 1 || args.size() > 2)
-                    throw UsageError("'--add' requires one or two arguments");
-                {
+        case cNone:
+            throw UsageError("no command specified");
+        case cAdd:
+            if (args.size() < 1 || args.size() > 2)
+                throw UsageError("'--add' requires one or two arguments");
+            {
                 auto url = args[0];
                 std::string name;
                 if (args.size() == 2) {
@@ -228,40 +238,41 @@ static int main_nix_channel(int argc, char ** argv)
                     name = std::regex_replace(name, std::regex("-stable$"), "");
                 }
                 addChannel(url, name);
-                }
-                break;
-            case cRemove:
-                if (args.size() != 1)
-                    throw UsageError("'--remove' requires one argument");
-                removeChannel(args[0]);
-                break;
-            case cList:
-                if (!args.empty())
-                    throw UsageError("'--list' expects no arguments");
-                readChannels();
-                for (const auto & channel : channels)
-                    std::cout << channel.first << ' ' << channel.second << '\n';
-                break;
-            case cUpdate:
-                update(StringSet(args.begin(), args.end()));
-                break;
-            case cListGenerations:
-                if (!args.empty())
-                    throw UsageError("'--list-generations' expects no arguments");
-                std::cout << runProgram(getNixBin("nix-env").string(), false, {"--profile", profile, "--list-generations"}) << std::flush;
-                break;
-            case cRollback:
-                if (args.size() > 1)
-                    throw UsageError("'--rollback' has at most one argument");
-                Strings envArgs{"--profile", profile};
-                if (args.size() == 1) {
-                    envArgs.push_back("--switch-generation");
-                    envArgs.push_back(args[0]);
-                } else {
-                    envArgs.push_back("--rollback");
-                }
-                runProgram(getNixBin("nix-env").string(), false, envArgs);
-                break;
+            }
+            break;
+        case cRemove:
+            if (args.size() != 1)
+                throw UsageError("'--remove' requires one argument");
+            removeChannel(args[0]);
+            break;
+        case cList:
+            if (!args.empty())
+                throw UsageError("'--list' expects no arguments");
+            readChannels();
+            for (const auto & channel : channels)
+                std::cout << channel.first << ' ' << channel.second << '\n';
+            break;
+        case cUpdate:
+            update(StringSet(args.begin(), args.end()));
+            break;
+        case cListGenerations:
+            if (!args.empty())
+                throw UsageError("'--list-generations' expects no arguments");
+            std::cout << runProgram(getNixBin("nix-env").string(), false, {"--profile", profile, "--list-generations"})
+                      << std::flush;
+            break;
+        case cRollback:
+            if (args.size() > 1)
+                throw UsageError("'--rollback' has at most one argument");
+            Strings envArgs{"--profile", profile};
+            if (args.size() == 1) {
+                envArgs.push_back("--switch-generation");
+                envArgs.push_back(args[0]);
+            } else {
+                envArgs.push_back("--rollback");
+            }
+            runProgram(getNixBin("nix-env").string(), false, envArgs);
+            break;
         }
 
         return 0;
diff --git a/src/nix-channel/unpack-channel.nix b/src/nix/nix-channel/unpack-channel.nix
similarity index 100%
rename from src/nix-channel/unpack-channel.nix
rename to src/nix/nix-channel/unpack-channel.nix
diff --git a/src/nix/nix-collect-garbage b/src/nix/nix-collect-garbage
deleted file mode 120000
index b037fc1b0..000000000
--- a/src/nix/nix-collect-garbage
+++ /dev/null
@@ -1 +0,0 @@
-../nix-collect-garbage
\ No newline at end of file
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix/nix-collect-garbage/nix-collect-garbage.cc
similarity index 89%
rename from src/nix-collect-garbage/nix-collect-garbage.cc
rename to src/nix/nix-collect-garbage/nix-collect-garbage.cc
index 7f86b2b5c..4d6e60bf3 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix/nix-collect-garbage/nix-collect-garbage.cc
@@ -12,21 +12,23 @@
 #include <iostream>
 #include <cerrno>
 
-namespace nix::fs { using namespace std::filesystem; }
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 using namespace nix;
 
 std::string deleteOlderThan;
 bool dryRun = false;
 
-
 /* If `-d' was specified, remove all old generations of all profiles.
  * Of course, this makes rollbacks to before this point in time
  * impossible. */
 
 void removeOldGenerations(std::filesystem::path dir)
 {
-    if (access(dir.string().c_str(), R_OK) != 0) return;
+    if (access(dir.string().c_str(), R_OK) != 0)
+        return;
 
     bool canWrite = access(dir.string().c_str(), W_OK) == 0;
 
@@ -41,7 +43,8 @@ void removeOldGenerations(std::filesystem::path dir)
             try {
                 link = readLink(path);
             } catch (std::filesystem::filesystem_error & e) {
-                if (e.code() == std::errc::no_such_file_or_directory) continue;
+                if (e.code() == std::errc::no_such_file_or_directory)
+                    continue;
                 throw;
             }
             if (link.find("link") != std::string::npos) {
@@ -58,7 +61,7 @@ void removeOldGenerations(std::filesystem::path dir)
     }
 }
 
-static int main_nix_collect_garbage(int argc, char * * argv)
+static int main_nix_collect_garbage(int argc, char ** argv)
 {
     {
         bool removeOld = false;
@@ -70,12 +73,13 @@ static int main_nix_collect_garbage(int argc, char * * argv)
                 showManPage("nix-collect-garbage");
             else if (*arg == "--version")
                 printVersion("nix-collect-garbage");
-            else if (*arg == "--delete-old" || *arg == "-d") removeOld = true;
+            else if (*arg == "--delete-old" || *arg == "-d")
+                removeOld = true;
             else if (*arg == "--delete-older-than") {
                 removeOld = true;
                 deleteOlderThan = getArg(*arg, arg, end);
-            }
-            else if (*arg == "--dry-run") dryRun = true;
+            } else if (*arg == "--dry-run")
+                dryRun = true;
             else if (*arg == "--max-freed")
                 options.maxFreed = std::max(getIntArg<int64_t>(*arg, arg, end, true), (int64_t) 0);
             else
diff --git a/src/nix/nix-copy-closure b/src/nix/nix-copy-closure
deleted file mode 120000
index 9063c583a..000000000
--- a/src/nix/nix-copy-closure
+++ /dev/null
@@ -1 +0,0 @@
-../nix-copy-closure
\ No newline at end of file
diff --git a/src/nix-copy-closure/nix-copy-closure.cc b/src/nix/nix-copy-closure/nix-copy-closure.cc
similarity index 100%
rename from src/nix-copy-closure/nix-copy-closure.cc
rename to src/nix/nix-copy-closure/nix-copy-closure.cc
diff --git a/src/nix/nix-env b/src/nix/nix-env
deleted file mode 120000
index f2f19f580..000000000
--- a/src/nix/nix-env
+++ /dev/null
@@ -1 +0,0 @@
-../nix-env
\ No newline at end of file
diff --git a/src/nix-env/buildenv.nix b/src/nix/nix-env/buildenv.nix
similarity index 100%
rename from src/nix-env/buildenv.nix
rename to src/nix/nix-env/buildenv.nix
diff --git a/src/nix-env/nix-env.cc b/src/nix/nix-env/nix-env.cc
similarity index 72%
rename from src/nix-env/nix-env.cc
rename to src/nix/nix-env/nix-env.cc
index fd48e67dc..01c8ccf4b 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix/nix-env/nix-env.cc
@@ -33,27 +33,17 @@
 using namespace nix;
 using std::cout;
 
-
-typedef enum {
-    srcNixExprDrvs,
-    srcNixExprs,
-    srcStorePaths,
-    srcProfile,
-    srcAttrPath,
-    srcUnknown
-} InstallSourceType;
-
+typedef enum { srcNixExprDrvs, srcNixExprs, srcStorePaths, srcProfile, srcAttrPath, srcUnknown } InstallSourceType;
 
 struct InstallSourceInfo
 {
     InstallSourceType type;
     std::shared_ptr<SourcePath> nixExprPath; /* for srcNixExprDrvs, srcNixExprs */
-    Path profile; /* for srcProfile */
-    std::string systemFilter; /* for srcNixExprDrvs */
+    Path profile;                            /* for srcProfile */
+    std::string systemFilter;                /* for srcNixExprDrvs */
     Bindings * autoArgs;
 };
 
-
 struct Globals
 {
     InstallSourceInfo instSource;
@@ -66,57 +56,49 @@ struct Globals
     bool prebuiltOnly;
 };
 
+typedef void (*Operation)(Globals & globals, Strings opFlags, Strings opArgs);
 
-typedef void (* Operation) (Globals & globals,
-    Strings opFlags, Strings opArgs);
-
-
-static std::string needArg(Strings::iterator & i,
-    Strings & args, const std::string & arg)
+static std::string needArg(Strings::iterator & i, Strings & args, const std::string & arg)
 {
-    if (i == args.end()) throw UsageError("'%1%' requires an argument", arg);
+    if (i == args.end())
+        throw UsageError("'%1%' requires an argument", arg);
     return *i++;
 }
 
-
-static bool parseInstallSourceOptions(Globals & globals,
-    Strings::iterator & i, Strings & args, const std::string & arg)
+static bool parseInstallSourceOptions(Globals & globals, Strings::iterator & i, Strings & args, const std::string & arg)
 {
     if (arg == "--from-expression" || arg == "-E")
         globals.instSource.type = srcNixExprs;
     else if (arg == "--from-profile") {
         globals.instSource.type = srcProfile;
         globals.instSource.profile = needArg(i, args, arg);
-    }
-    else if (arg == "--attr" || arg == "-A")
+    } else if (arg == "--attr" || arg == "-A")
         globals.instSource.type = srcAttrPath;
-    else return false;
+    else
+        return false;
     return true;
 }
 
-
 static bool isNixExpr(const SourcePath & path, struct SourceAccessor::Stat & st)
 {
-    return
-        st.type == SourceAccessor::tRegular
-        || (st.type == SourceAccessor::tDirectory && (path / "default.nix").resolveSymlinks().pathExists());
+    return st.type == SourceAccessor::tRegular
+           || (st.type == SourceAccessor::tDirectory && (path / "default.nix").resolveSymlinks().pathExists());
 }
 
-
 static constexpr size_t maxAttrs = 1024;
 
-
-static void getAllExprs(EvalState & state,
-    const SourcePath & path, StringSet & seen, BindingsBuilder & attrs)
+static void getAllExprs(EvalState & state, const SourcePath & path, StringSet & seen, BindingsBuilder & attrs)
 {
     StringSet namesSorted;
-    for (auto & [name, _] : path.resolveSymlinks().readDirectory()) namesSorted.insert(name);
+    for (auto & [name, _] : path.resolveSymlinks().readDirectory())
+        namesSorted.insert(name);
 
     for (auto & i : namesSorted) {
         /* Ignore the manifest.nix used by profiles.  This is
            necessary to prevent it from showing up in channels (which
            are implemented using profiles). */
-        if (i == "manifest.nix") continue;
+        if (i == "manifest.nix")
+            continue;
 
         auto path2 = (path / i).resolveSymlinks();
 
@@ -137,10 +119,15 @@ static void getAllExprs(EvalState & state,
                 attrName = std::string(attrName, 0, attrName.size() - 4);
             if (!seen.insert(attrName).second) {
                 std::string suggestionMessage = "";
-                if (path2.path.abs().find("channels") != std::string::npos && path.path.abs().find("channels") != std::string::npos)
-                    suggestionMessage = fmt("\nsuggestion: remove '%s' from either the root channels or the user channels", attrName);
-                printError("warning: name collision in input Nix expressions, skipping '%1%'"
-                            "%2%", path2, suggestionMessage);
+                if (path2.path.abs().find("channels") != std::string::npos
+                    && path.path.abs().find("channels") != std::string::npos)
+                    suggestionMessage =
+                        fmt("\nsuggestion: remove '%s' from either the root channels or the user channels", attrName);
+                printError(
+                    "warning: name collision in input Nix expressions, skipping '%1%'"
+                    "%2%",
+                    path2,
+                    suggestionMessage);
                 continue;
             }
             /* Load the expression on demand. */
@@ -149,16 +136,13 @@ static void getAllExprs(EvalState & state,
             if (seen.size() == maxAttrs)
                 throw Error("too many Nix expressions in directory '%1%'", path);
             attrs.alloc(attrName).mkApp(&state.getBuiltin("import"), vArg);
-        }
-        else if (st.type == SourceAccessor::tDirectory)
+        } else if (st.type == SourceAccessor::tDirectory)
             /* `path2' is a directory (with no default.nix in it);
                recurse into it. */
             getAllExprs(state, path2, seen, attrs);
     }
 }
 
-
-
 static void loadSourceExpr(EvalState & state, const SourcePath & path, Value & v)
 {
     auto st = path.resolveSymlinks().lstat();
@@ -174,19 +158,23 @@ static void loadSourceExpr(EvalState & state, const SourcePath & path, Value & v
        directory). */
     else if (st.type == SourceAccessor::tDirectory) {
         auto attrs = state.buildBindings(maxAttrs);
-        attrs.insert(state.symbols.create("_combineChannels"), &state.vEmptyList);
+        attrs.insert(state.symbols.create("_combineChannels"), &Value::vEmptyList);
         StringSet seen;
         getAllExprs(state, path, seen, attrs);
         v.mkAttrs(attrs);
     }
 
-    else throw Error("path '%s' is not a directory or a Nix expression", path);
+    else
+        throw Error("path '%s' is not a directory or a Nix expression", path);
 }
 
-
-static void loadDerivations(EvalState & state, const SourcePath & nixExprPath,
-    std::string systemFilter, Bindings & autoArgs,
-    const std::string & pathPrefix, PackageInfos & elems)
+static void loadDerivations(
+    EvalState & state,
+    const SourcePath & nixExprPath,
+    std::string systemFilter,
+    Bindings & autoArgs,
+    const std::string & pathPrefix,
+    PackageInfos & elems)
 {
     Value vRoot;
     loadSourceExpr(state, nixExprPath, vRoot);
@@ -198,35 +186,33 @@ static void loadDerivations(EvalState & state, const SourcePath & nixExprPath,
     /* Filter out all derivations not applicable to the current
        system. */
     for (PackageInfos::iterator i = elems.begin(), j; i != elems.end(); i = j) {
-        j = i; j++;
+        j = i;
+        j++;
         if (systemFilter != "*" && i->querySystem() != systemFilter)
             elems.erase(i);
     }
 }
 
-
 static NixInt getPriority(EvalState & state, PackageInfo & drv)
 {
     return drv.queryMetaInt("priority", NixInt(0));
 }
 
-
 static std::strong_ordering comparePriorities(EvalState & state, PackageInfo & drv1, PackageInfo & drv2)
 {
     return getPriority(state, drv2) <=> getPriority(state, drv1);
 }
 
-
 // FIXME: this function is rather slow since it checks a single path
 // at a time.
 static bool isPrebuilt(EvalState & state, PackageInfo & elem)
 {
     auto path = elem.queryOutPath();
-    if (state.store->isValidPath(path)) return true;
+    if (state.store->isValidPath(path))
+        return true;
     return state.store->querySubstitutablePaths({path}).count(path);
 }
 
-
 static void checkSelectorUse(DrvNames & selectors)
 {
     /* Check that all selectors have been used. */
@@ -235,14 +221,14 @@ static void checkSelectorUse(DrvNames & selectors)
             throw Error("selector '%1%' matches no derivations", i.fullName);
 }
 
-
 namespace {
 
-StringSet searchByPrefix(const PackageInfos & allElems, std::string_view prefix) {
+StringSet searchByPrefix(const PackageInfos & allElems, std::string_view prefix)
+{
     constexpr std::size_t maxResults = 3;
     StringSet result;
     for (const auto & packageInfo : allElems) {
-        const auto drvName = DrvName { packageInfo.queryName() };
+        const auto drvName = DrvName{packageInfo.queryName()};
         if (hasPrefix(drvName.name, prefix)) {
             result.emplace(drvName.name);
 
@@ -260,9 +246,10 @@ struct Match
     std::size_t index;
 
     Match(PackageInfo packageInfo_, std::size_t index_)
-    : packageInfo{std::move(packageInfo_)}
-    , index{index_}
-    {}
+        : packageInfo{std::move(packageInfo_)}
+        , index{index_}
+    {
+    }
 };
 
 /* If a selector matches multiple derivations
@@ -272,7 +259,8 @@ struct Match
    derivations, pick the one with the highest version.
    Finally, if there are still multiple derivations,
    arbitrarily pick the first one. */
-std::vector<Match> pickNewestOnly(EvalState & state, std::vector<Match> matches) {
+std::vector<Match> pickNewestOnly(EvalState & state, std::vector<Match> matches)
+{
     /* Map from package names to derivations. */
     std::map<std::string, Match> newest;
     StringSet multiple;
@@ -280,7 +268,7 @@ std::vector<Match> pickNewestOnly(EvalState & state, std::vector<Match> matches)
     for (auto & match : matches) {
         auto & oneDrv = match.packageInfo;
 
-        const auto drvName = DrvName { oneDrv.queryName() };
+        const auto drvName = DrvName{oneDrv.queryName()};
         std::strong_ordering comparison = std::strong_ordering::greater;
 
         const auto itOther = newest.find(drvName.name);
@@ -288,14 +276,14 @@ std::vector<Match> pickNewestOnly(EvalState & state, std::vector<Match> matches)
         if (itOther != newest.end()) {
             auto & newestDrv = itOther->second.packageInfo;
 
-            comparison =
-                oneDrv.querySystem() == newestDrv.querySystem() ? std::strong_ordering::equal :
-                oneDrv.querySystem() == settings.thisSystem ? std::strong_ordering::greater :
-                newestDrv.querySystem() == settings.thisSystem ? std::strong_ordering::less : std::strong_ordering::equal;
+            comparison = oneDrv.querySystem() == newestDrv.querySystem()  ? std::strong_ordering::equal
+                         : oneDrv.querySystem() == settings.thisSystem    ? std::strong_ordering::greater
+                         : newestDrv.querySystem() == settings.thisSystem ? std::strong_ordering::less
+                                                                          : std::strong_ordering::equal;
             if (comparison == 0)
                 comparison = comparePriorities(state, oneDrv, newestDrv);
             if (comparison == 0)
-                comparison = compareVersions(drvName.version, DrvName { newestDrv.queryName() }.version);
+                comparison = compareVersions(drvName.version, DrvName{newestDrv.queryName()}.version);
         }
 
         if (comparison > 0) {
@@ -310,9 +298,7 @@ std::vector<Match> pickNewestOnly(EvalState & state, std::vector<Match> matches)
     matches.clear();
     for (auto & [name, match] : newest) {
         if (multiple.find(name) != multiple.end())
-            warn(
-                "there are multiple derivations named '%1%'; using the first one",
-                name);
+            warn("there are multiple derivations named '%1%'; using the first one", name);
         matches.push_back(match);
     }
 
@@ -321,8 +307,8 @@ std::vector<Match> pickNewestOnly(EvalState & state, std::vector<Match> matches)
 
 } // end namespace
 
-static PackageInfos filterBySelector(EvalState & state, const PackageInfos & allElems,
-    const Strings & args, bool newestOnly)
+static PackageInfos
+filterBySelector(EvalState & state, const PackageInfos & allElems, const Strings & args, bool newestOnly)
 {
     DrvNames selectors = drvNamesFromArgs(args);
     if (selectors.empty())
@@ -334,7 +320,7 @@ static PackageInfos filterBySelector(EvalState & state, const PackageInfos & all
     for (auto & selector : selectors) {
         std::vector<Match> matches;
         for (const auto & [index, packageInfo] : enumerate(allElems)) {
-            const auto drvName = DrvName { packageInfo.queryName() };
+            const auto drvName = DrvName{packageInfo.queryName()};
             if (selector.matches(drvName)) {
                 ++selector.hits;
                 matches.emplace_back(packageInfo, index);
@@ -369,16 +355,13 @@ static PackageInfos filterBySelector(EvalState & state, const PackageInfos & all
     return elems;
 }
 
-
 static bool isPath(std::string_view s)
 {
     return s.find('/') != std::string_view::npos;
 }
 
-
-static void queryInstSources(EvalState & state,
-    InstallSourceInfo & instSource, const Strings & args,
-    PackageInfos & elems, bool newestOnly)
+static void queryInstSources(
+    EvalState & state, InstallSourceInfo & instSource, const Strings & args, PackageInfos & elems, bool newestOnly)
 {
     InstallSourceType type = instSource.type;
     if (type == srcUnknown && args.size() > 0 && isPath(args.front()))
@@ -386,98 +369,93 @@ static void queryInstSources(EvalState & state,
 
     switch (type) {
 
-        /* Get the available user environment elements from the
-           derivations specified in a Nix expression, including only
-           those with names matching any of the names in `args'. */
-        case srcUnknown:
-        case srcNixExprDrvs: {
+    /* Get the available user environment elements from the
+       derivations specified in a Nix expression, including only
+       those with names matching any of the names in `args'. */
+    case srcUnknown:
+    case srcNixExprDrvs: {
 
-            /* Load the derivations from the (default or specified)
-               Nix expression. */
-            PackageInfos allElems;
-            loadDerivations(state, *instSource.nixExprPath,
-                instSource.systemFilter, *instSource.autoArgs, "", allElems);
+        /* Load the derivations from the (default or specified)
+           Nix expression. */
+        PackageInfos allElems;
+        loadDerivations(state, *instSource.nixExprPath, instSource.systemFilter, *instSource.autoArgs, "", allElems);
 
-            elems = filterBySelector(state, allElems, args, newestOnly);
+        elems = filterBySelector(state, allElems, args, newestOnly);
 
-            break;
+        break;
+    }
+
+    /* Get the available user environment elements from the Nix
+       expressions specified on the command line; these should be
+       functions that take the default Nix expression file as
+       argument, e.g., if the file is `./foo.nix', then the
+       argument `x: x.bar' is equivalent to `(x: x.bar)
+       (import ./foo.nix)' = `(import ./foo.nix).bar'. */
+    case srcNixExprs: {
+
+        Value vArg;
+        loadSourceExpr(state, *instSource.nixExprPath, vArg);
+
+        for (auto & i : args) {
+            Expr * eFun = state.parseExprFromString(i, state.rootPath("."));
+            Value vFun, vTmp;
+            state.eval(eFun, vFun);
+            vTmp.mkApp(&vFun, &vArg);
+            getDerivations(state, vTmp, "", *instSource.autoArgs, elems, true);
         }
 
-        /* Get the available user environment elements from the Nix
-           expressions specified on the command line; these should be
-           functions that take the default Nix expression file as
-           argument, e.g., if the file is `./foo.nix', then the
-           argument `x: x.bar' is equivalent to `(x: x.bar)
-           (import ./foo.nix)' = `(import ./foo.nix).bar'. */
-        case srcNixExprs: {
+        break;
+    }
 
-            Value vArg;
-            loadSourceExpr(state, *instSource.nixExprPath, vArg);
+    /* The available user environment elements are specified as a
+       list of store paths (which may or may not be
+       derivations). */
+    case srcStorePaths: {
 
-            for (auto & i : args) {
-                Expr * eFun = state.parseExprFromString(i, state.rootPath("."));
-                Value vFun, vTmp;
-                state.eval(eFun, vFun);
-                vTmp.mkApp(&vFun, &vArg);
-                getDerivations(state, vTmp, "", *instSource.autoArgs, elems, true);
-            }
+        for (auto & i : args) {
+            auto path = state.store->followLinksToStorePath(i);
 
-            break;
+            std::string name(path.name());
+
+            PackageInfo elem(state, "", nullptr);
+            elem.setName(name);
+
+            if (path.isDerivation()) {
+                elem.setDrvPath(path);
+                auto outputs = state.store->queryDerivationOutputMap(path);
+                elem.setOutPath(outputs.at("out"));
+                if (name.size() >= drvExtension.size()
+                    && std::string(name, name.size() - drvExtension.size()) == drvExtension)
+                    name = name.substr(0, name.size() - drvExtension.size());
+            } else
+                elem.setOutPath(path);
+
+            elems.push_back(elem);
         }
 
-        /* The available user environment elements are specified as a
-           list of store paths (which may or may not be
-           derivations). */
-        case srcStorePaths: {
+        break;
+    }
 
-            for (auto & i : args) {
-                auto path = state.store->followLinksToStorePath(i);
+    /* Get the available user environment elements from another
+       user environment.  These are then filtered as in the
+       `srcNixExprDrvs' case. */
+    case srcProfile: {
+        elems = filterBySelector(state, queryInstalled(state, instSource.profile), args, newestOnly);
+        break;
+    }
 
-                std::string name(path.name());
-
-                PackageInfo elem(state, "", nullptr);
-                elem.setName(name);
-
-                if (path.isDerivation()) {
-                    elem.setDrvPath(path);
-                    auto outputs = state.store->queryDerivationOutputMap(path);
-                    elem.setOutPath(outputs.at("out"));
-                    if (name.size() >= drvExtension.size() &&
-                        std::string(name, name.size() - drvExtension.size()) == drvExtension)
-                        name = name.substr(0, name.size() - drvExtension.size());
-                }
-                else
-                    elem.setOutPath(path);
-
-                elems.push_back(elem);
-            }
-
-            break;
-        }
-
-        /* Get the available user environment elements from another
-           user environment.  These are then filtered as in the
-           `srcNixExprDrvs' case. */
-        case srcProfile: {
-            elems = filterBySelector(state,
-                queryInstalled(state, instSource.profile),
-                args, newestOnly);
-            break;
-        }
-
-        case srcAttrPath: {
-            Value vRoot;
-            loadSourceExpr(state, *instSource.nixExprPath, vRoot);
-            for (auto & i : args) {
-                Value & v(*findAlongAttrPath(state, i, *instSource.autoArgs, vRoot).first);
-                getDerivations(state, v, "", *instSource.autoArgs, elems, true);
-            }
-            break;
+    case srcAttrPath: {
+        Value vRoot;
+        loadSourceExpr(state, *instSource.nixExprPath, vRoot);
+        for (auto & i : args) {
+            Value & v(*findAlongAttrPath(state, i, *instSource.autoArgs, vRoot).first);
+            getDerivations(state, v, "", *instSource.autoArgs, elems, true);
         }
+        break;
+    }
     }
 }
 
-
 static void printMissing(EvalState & state, PackageInfos & elems)
 {
     std::vector<DerivedPath> targets;
@@ -485,34 +463,32 @@ static void printMissing(EvalState & state, PackageInfos & elems)
         if (auto drvPath = i.queryDrvPath()) {
             auto path = DerivedPath::Built{
                 .drvPath = makeConstantStorePathRef(*drvPath),
-                .outputs = OutputsSpec::All { },
+                .outputs = OutputsSpec::All{},
             };
             targets.emplace_back(std::move(path));
         } else
-            targets.emplace_back(DerivedPath::Opaque{
-                .path = i.queryOutPath(),
-            });
+            targets.emplace_back(
+                DerivedPath::Opaque{
+                    .path = i.queryOutPath(),
+                });
 
     printMissing(state.store, targets);
 }
 
-
 static bool keep(PackageInfo & drv)
 {
     return drv.queryMetaBool("keep", false);
 }
 
-static void setMetaFlag(EvalState & state, PackageInfo & drv,
-    const std::string & name, const std::string & value)
+static void setMetaFlag(EvalState & state, PackageInfo & drv, const std::string & name, const std::string & value)
 {
     auto v = state.allocValue();
     v->mkString(value);
     drv.setMeta(name, v);
 }
 
-
-static void installDerivations(Globals & globals,
-    const Strings & args, const Path & profile, std::optional<int> priority)
+static void
+installDerivations(Globals & globals, const Strings & args, const Path & profile, std::optional<int> priority)
 {
     debug("installing derivations");
 
@@ -554,9 +530,7 @@ static void installDerivations(Globals & globals,
 
             for (auto & i : installedElems) {
                 DrvName drvName(i.queryName());
-                if (!globals.preserveInstalled &&
-                    newNames.find(drvName.name) != newNames.end() &&
-                    !keep(i))
+                if (!globals.preserveInstalled && newNames.find(drvName.name) != newNames.end() && !keep(i))
                     printInfo("replacing old '%s'", i.queryName());
                 else
                     allElems.push_back(i);
@@ -568,20 +542,21 @@ static void installDerivations(Globals & globals,
 
         printMissing(*globals.state, newElems);
 
-        if (globals.dryRun) return;
+        if (globals.dryRun)
+            return;
 
-        if (createUserEnv(*globals.state, allElems,
-                profile, settings.envKeepDerivations, lockToken)) break;
+        if (createUserEnv(*globals.state, allElems, profile, settings.envKeepDerivations, lockToken))
+            break;
     }
 }
 
-
 static void opInstall(Globals & globals, Strings opFlags, Strings opArgs)
 {
     std::optional<int> priority;
-    for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
+    for (Strings::iterator i = opFlags.begin(); i != opFlags.end();) {
         auto arg = *i++;
-        if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
+        if (parseInstallSourceOptions(globals, i, opFlags, arg))
+            ;
         else if (arg == "--preserve-installed" || arg == "-P")
             globals.preserveInstalled = true;
         else if (arg == "--remove-all" || arg == "-r")
@@ -592,19 +567,16 @@ static void opInstall(Globals & globals, Strings opFlags, Strings opArgs)
             priority = string2Int<int>(*i++);
             if (!priority)
                 throw UsageError("'--priority' requires an integer argument");
-        }
-        else throw UsageError("unknown flag '%1%'", arg);
+        } else
+            throw UsageError("unknown flag '%1%'", arg);
     }
 
     installDerivations(globals, opArgs, globals.profile, priority);
 }
 
-
 typedef enum { utLt, utLeq, utEq, utAlways } UpgradeType;
 
-
-static void upgradeDerivations(Globals & globals,
-    const Strings & args, UpgradeType upgradeType)
+static void upgradeDerivations(Globals & globals, const Strings & args, UpgradeType upgradeType)
 {
     debug("upgrading derivations");
 
@@ -649,15 +621,13 @@ static void upgradeDerivations(Globals & globals,
                     DrvName newName(j->queryName());
                     if (newName.name == drvName.name) {
                         std::strong_ordering d = compareVersions(drvName.version, newName.version);
-                        if ((upgradeType == utLt && d < 0) ||
-                            (upgradeType == utLeq && d <= 0) ||
-                            (upgradeType == utEq && d == 0) ||
-                            upgradeType == utAlways)
-                        {
+                        if ((upgradeType == utLt && d < 0) || (upgradeType == utLeq && d <= 0)
+                            || (upgradeType == utEq && d == 0) || upgradeType == utAlways) {
                             std::strong_ordering d2 = std::strong_ordering::less;
                             if (bestElem != availElems.end()) {
                                 d2 = comparePriorities(*globals.state, *bestElem, *j);
-                                if (d2 == 0) d2 = compareVersions(bestVersion, newName.version);
+                                if (d2 == 0)
+                                    d2 = compareVersions(bestVersion, newName.version);
                             }
                             if (d2 < 0 && (!globals.prebuiltOnly || isPrebuilt(*globals.state, *j))) {
                                 bestElem = j;
@@ -667,16 +637,13 @@ static void upgradeDerivations(Globals & globals,
                     }
                 }
 
-                if (bestElem != availElems.end() &&
-                    i.queryOutPath() !=
-                    bestElem->queryOutPath())
-                {
-                    const char * action = compareVersions(drvName.version, bestVersion) <= 0
-                        ? "upgrading" : "downgrading";
-                    printInfo("%1% '%2%' to '%3%'",
-                        action, i.queryName(), bestElem->queryName());
+                if (bestElem != availElems.end() && i.queryOutPath() != bestElem->queryOutPath()) {
+                    const char * action =
+                        compareVersions(drvName.version, bestVersion) <= 0 ? "upgrading" : "downgrading";
+                    printInfo("%1% '%2%' to '%3%'", action, i.queryName(), bestElem->queryName());
                     newElems.push_back(*bestElem);
-                } else newElems.push_back(i);
+                } else
+                    newElems.push_back(i);
 
             } catch (Error & e) {
                 e.addTrace(nullptr, "while trying to find an upgrade for '%s'", i.queryName());
@@ -686,31 +653,36 @@ static void upgradeDerivations(Globals & globals,
 
         printMissing(*globals.state, newElems);
 
-        if (globals.dryRun) return;
+        if (globals.dryRun)
+            return;
 
-        if (createUserEnv(*globals.state, newElems,
-                globals.profile, settings.envKeepDerivations, lockToken)) break;
+        if (createUserEnv(*globals.state, newElems, globals.profile, settings.envKeepDerivations, lockToken))
+            break;
     }
 }
 
-
 static void opUpgrade(Globals & globals, Strings opFlags, Strings opArgs)
 {
     UpgradeType upgradeType = utLt;
-    for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
+    for (Strings::iterator i = opFlags.begin(); i != opFlags.end();) {
         std::string arg = *i++;
-        if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
-        else if (arg == "--lt") upgradeType = utLt;
-        else if (arg == "--leq") upgradeType = utLeq;
-        else if (arg == "--eq") upgradeType = utEq;
-        else if (arg == "--always") upgradeType = utAlways;
-        else throw UsageError("unknown flag '%1%'", arg);
+        if (parseInstallSourceOptions(globals, i, opFlags, arg))
+            ;
+        else if (arg == "--lt")
+            upgradeType = utLt;
+        else if (arg == "--leq")
+            upgradeType = utLeq;
+        else if (arg == "--eq")
+            upgradeType = utEq;
+        else if (arg == "--always")
+            upgradeType = utAlways;
+        else
+            throw UsageError("unknown flag '%1%'", arg);
     }
 
     upgradeDerivations(globals, opArgs, upgradeType);
 }
 
-
 static void opSetFlag(Globals & globals, Strings opFlags, Strings opArgs)
 {
     if (opFlags.size() > 0)
@@ -743,21 +715,23 @@ static void opSetFlag(Globals & globals, Strings opFlags, Strings opArgs)
         checkSelectorUse(selectors);
 
         /* Write the new user environment. */
-        if (createUserEnv(*globals.state, installedElems,
-                globals.profile, settings.envKeepDerivations, lockToken)) break;
+        if (createUserEnv(*globals.state, installedElems, globals.profile, settings.envKeepDerivations, lockToken))
+            break;
     }
 }
 
-
 static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
 {
     auto store2 = globals.state->store.dynamic_pointer_cast<LocalFSStore>();
-    if (!store2) throw Error("--set is not supported for this Nix store");
+    if (!store2)
+        throw Error("--set is not supported for this Nix store");
 
-    for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
+    for (Strings::iterator i = opFlags.begin(); i != opFlags.end();) {
         std::string arg = *i++;
-        if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
-        else throw UsageError("unknown flag '%1%'", arg);
+        if (parseInstallSourceOptions(globals, i, opFlags, arg))
+            ;
+        else
+            throw UsageError("unknown flag '%1%'", arg);
     }
 
     PackageInfos elems;
@@ -772,31 +746,26 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
         drv.setName(globals.forceName);
 
     auto drvPath = drv.queryDrvPath();
-    std::vector<DerivedPath> paths {
-        drvPath
-        ? (DerivedPath) (DerivedPath::Built {
-            .drvPath = makeConstantStorePathRef(*drvPath),
-            .outputs = OutputsSpec::All { },
-        })
-        : (DerivedPath) (DerivedPath::Opaque {
-            .path = drv.queryOutPath(),
-        }),
+    std::vector<DerivedPath> paths{
+        drvPath ? (DerivedPath) (DerivedPath::Built{
+                      .drvPath = makeConstantStorePathRef(*drvPath),
+                      .outputs = OutputsSpec::All{},
+                  })
+                : (DerivedPath) (DerivedPath::Opaque{
+                      .path = drv.queryOutPath(),
+                  }),
     };
     printMissing(globals.state->store, paths);
-    if (globals.dryRun) return;
+    if (globals.dryRun)
+        return;
     globals.state->store->buildPaths(paths, globals.state->repair ? bmRepair : bmNormal);
 
     debug("switching to new user environment");
-    Path generation = createGeneration(
-        *store2,
-        globals.profile,
-        drv.queryOutPath());
+    Path generation = createGeneration(*store2, globals.profile, drv.queryOutPath());
     switchLink(globals.profile, generation);
 }
 
-
-static void uninstallDerivations(Globals & globals, Strings & selectors,
-    Path & profile)
+static void uninstallDerivations(Globals & globals, Strings & selectors, Path & profile)
 {
     while (true) {
         auto lockToken = optimisticLockProfile(profile);
@@ -808,20 +777,15 @@ static void uninstallDerivations(Globals & globals, Strings & selectors,
             if (isPath(selector)) {
                 StorePath selectorStorePath = globals.state->store->followLinksToStorePath(selector);
                 split = std::partition(
-                    workingElems.begin(), workingElems.end(),
-                    [&selectorStorePath, globals](auto &elem) {
+                    workingElems.begin(), workingElems.end(), [&selectorStorePath, globals](auto & elem) {
                         return selectorStorePath != elem.queryOutPath();
-                    }
-                );
+                    });
             } else {
                 DrvName selectorName(selector);
-                split = std::partition(
-                    workingElems.begin(), workingElems.end(),
-                    [&selectorName](auto &elem){
-                        DrvName elemName(elem.queryName());
-                        return !selectorName.matches(elemName);
-                    }
-                );
+                split = std::partition(workingElems.begin(), workingElems.end(), [&selectorName](auto & elem) {
+                    DrvName elemName(elem.queryName());
+                    return !selectorName.matches(elemName);
+                });
             }
             if (split == workingElems.end())
                 warn("selector '%s' matched no installed derivations", selector);
@@ -831,14 +795,14 @@ static void uninstallDerivations(Globals & globals, Strings & selectors,
             workingElems.erase(split, workingElems.end());
         }
 
-        if (globals.dryRun) return;
+        if (globals.dryRun)
+            return;
 
-        if (createUserEnv(*globals.state, workingElems,
-                profile, settings.envKeepDerivations, lockToken)) break;
+        if (createUserEnv(*globals.state, workingElems, profile, settings.envKeepDerivations, lockToken))
+            break;
     }
 }
 
-
 static void opUninstall(Globals & globals, Strings opFlags, Strings opArgs)
 {
     if (opFlags.size() > 0)
@@ -846,26 +810,20 @@ static void opUninstall(Globals & globals, Strings opFlags, Strings opArgs)
     uninstallDerivations(globals, opArgs, globals.profile);
 }
 
-
 static bool cmpChars(char a, char b)
 {
     return toupper(a) < toupper(b);
 }
 
-
 static bool cmpElemByName(const PackageInfo & a, const PackageInfo & b)
 {
     auto a_name = a.queryName();
     auto b_name = b.queryName();
-    return lexicographical_compare(
-        a_name.begin(), a_name.end(),
-        b_name.begin(), b_name.end(), cmpChars);
+    return lexicographical_compare(a_name.begin(), a_name.end(), b_name.begin(), b_name.end(), cmpChars);
 }
 
-
 typedef std::list<Strings> Table;
 
-
 void printTable(Table & table)
 {
     auto nrColumns = table.size() > 0 ? table.front().size() : 0;
@@ -878,7 +836,8 @@ void printTable(Table & table)
         Strings::iterator j;
         size_t column;
         for (j = i.begin(), column = 0; j != i.end(); ++j, ++column)
-            if (j->size() > widths[column]) widths[column] = j->size();
+            if (j->size() > widths[column])
+                widths[column] = j->size();
     }
 
     for (auto & i : table) {
@@ -895,7 +854,6 @@ void printTable(Table & table)
     }
 }
 
-
 /* This function compares the version of an element against the
    versions in the given set of elements.  `cvLess' means that only
    lower versions are in the set, `cvEqual' means that at most an
@@ -905,8 +863,7 @@ void printTable(Table & table)
 
 typedef enum { cvLess, cvEqual, cvGreater, cvUnavail } VersionDiff;
 
-static VersionDiff compareVersionAgainstSet(
-    const PackageInfo & elem, const PackageInfos & elems, std::string & version)
+static VersionDiff compareVersionAgainstSet(const PackageInfo & elem, const PackageInfos & elems, std::string & version)
 {
     DrvName name(elem.queryName());
 
@@ -920,12 +877,10 @@ static VersionDiff compareVersionAgainstSet(
             if (d < 0) {
                 diff = cvGreater;
                 version = name2.version;
-            }
-            else if (diff != cvGreater && d == 0) {
+            } else if (diff != cvGreater && d == 0) {
                 diff = cvEqual;
                 version = name2.version;
-            }
-            else if (diff != cvGreater && diff != cvEqual && d > 0) {
+            } else if (diff != cvGreater && diff != cvEqual && d > 0) {
                 diff = cvLess;
                 if (version == "" || compareVersions(version, name2.version) < 0)
                     version = name2.version;
@@ -936,18 +891,18 @@ static VersionDiff compareVersionAgainstSet(
     return diff;
 }
 
-
-static void queryJSON(Globals & globals, std::vector<PackageInfo> & elems, bool printOutPath, bool printDrvPath, bool printMeta)
+static void
+queryJSON(Globals & globals, std::vector<PackageInfo> & elems, bool printOutPath, bool printDrvPath, bool printMeta)
 {
     using nlohmann::json;
     json topObj = json::object();
     for (auto & i : elems) {
         try {
-            if (i.hasFailed()) continue;
-
+            if (i.hasFailed())
+                continue;
 
             auto drvName = DrvName(i.queryName());
-            json &pkgObj = topObj[i.attrPath];
+            json & pkgObj = topObj[i.attrPath];
             pkgObj = {
                 {"name", drvName.fullName},
                 {"pname", drvName.name},
@@ -958,7 +913,7 @@ static void queryJSON(Globals & globals, std::vector<PackageInfo> & elems, bool
 
             {
                 PackageInfo::Outputs outputs = i.queryOutputs(printOutPath);
-                json &outputObj = pkgObj["outputs"];
+                json & outputObj = pkgObj["outputs"];
                 outputObj = json::object();
                 for (auto & j : outputs) {
                     if (j.second)
@@ -970,11 +925,12 @@ static void queryJSON(Globals & globals, std::vector<PackageInfo> & elems, bool
 
             if (printDrvPath) {
                 auto drvPath = i.queryDrvPath();
-                if (drvPath) pkgObj["drvPath"] = globals.state->store->printStorePath(*drvPath);
+                if (drvPath)
+                    pkgObj["drvPath"] = globals.state->store->printStorePath(*drvPath);
             }
 
             if (printMeta) {
-                json &metaObj = pkgObj["meta"];
+                json & metaObj = pkgObj["meta"];
                 metaObj = json::object();
                 StringSet metaNames = i.queryMetaNames();
                 for (auto & j : metaNames) {
@@ -998,10 +954,9 @@ static void queryJSON(Globals & globals, std::vector<PackageInfo> & elems, bool
     std::cout << topObj.dump(2);
 }
 
-
 static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 {
-    auto & store { *globals.state->store };
+    auto & store{*globals.state->store};
 
     Strings remaining;
     std::string attrPath;
@@ -1022,21 +977,34 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
     settings.readOnlyMode = true; /* makes evaluation a bit faster */
 
-    for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
+    for (Strings::iterator i = opFlags.begin(); i != opFlags.end();) {
         auto arg = *i++;
-        if (arg == "--status" || arg == "-s") printStatus = true;
-        else if (arg == "--no-name") printName = false;
-        else if (arg == "--system") printSystem = true;
-        else if (arg == "--description") printDescription = true;
-        else if (arg == "--compare-versions" || arg == "-c") compareVersions = true;
-        else if (arg == "--drv-path") printDrvPath = true;
-        else if (arg == "--out-path") printOutPath = true;
-        else if (arg == "--meta") printMeta = true;
-        else if (arg == "--installed") source = sInstalled;
-        else if (arg == "--available" || arg == "-a") source = sAvailable;
-        else if (arg == "--xml") xmlOutput = true;
-        else if (arg == "--json") jsonOutput = true;
-        else if (arg == "--attr-path" || arg == "-P") printAttrPath = true;
+        if (arg == "--status" || arg == "-s")
+            printStatus = true;
+        else if (arg == "--no-name")
+            printName = false;
+        else if (arg == "--system")
+            printSystem = true;
+        else if (arg == "--description")
+            printDescription = true;
+        else if (arg == "--compare-versions" || arg == "-c")
+            compareVersions = true;
+        else if (arg == "--drv-path")
+            printDrvPath = true;
+        else if (arg == "--out-path")
+            printOutPath = true;
+        else if (arg == "--meta")
+            printMeta = true;
+        else if (arg == "--installed")
+            source = sInstalled;
+        else if (arg == "--available" || arg == "-a")
+            source = sAvailable;
+        else if (arg == "--xml")
+            xmlOutput = true;
+        else if (arg == "--json")
+            jsonOutput = true;
+        else if (arg == "--attr-path" || arg == "-P")
+            printAttrPath = true;
         else if (arg == "--attr" || arg == "-A")
             attrPath = needArg(i, opFlags, arg);
         else
@@ -1053,24 +1021,26 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
         installedElems = queryInstalled(*globals.state, globals.profile);
 
     if (source == sAvailable || compareVersions)
-        loadDerivations(*globals.state, *globals.instSource.nixExprPath,
-            globals.instSource.systemFilter, *globals.instSource.autoArgs,
-            attrPath, availElems);
+        loadDerivations(
+            *globals.state,
+            *globals.instSource.nixExprPath,
+            globals.instSource.systemFilter,
+            *globals.instSource.autoArgs,
+            attrPath,
+            availElems);
 
-    PackageInfos elems_ = filterBySelector(*globals.state,
-        source == sInstalled ? installedElems : availElems,
-        opArgs, false);
+    PackageInfos elems_ =
+        filterBySelector(*globals.state, source == sInstalled ? installedElems : availElems, opArgs, false);
 
     PackageInfos & otherElems(source == sInstalled ? availElems : installedElems);
 
-
     /* Sort them by name. */
     /* !!! */
     std::vector<PackageInfo> elems;
-    for (auto & i : elems_) elems.push_back(i);
+    for (auto & i : elems_)
+        elems.push_back(i);
     sort(elems.begin(), elems.end(), cmpElemByName);
 
-
     /* We only need to know the installed paths when we are querying
        the status of the derivation. */
     StorePathSet installed; /* installed paths */
@@ -1079,7 +1049,6 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
         for (auto & i : installedElems)
             installed.insert(i.queryOutPath());
 
-
     /* Query which paths have substitutes. */
     StorePathSet validPaths;
     StorePathSet substitutablePaths;
@@ -1089,14 +1058,14 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             try {
                 paths.insert(i.queryOutPath());
             } catch (AssertionError & e) {
-                printMsg(lvlTalkative, "skipping derivation named '%s' which gives an assertion failure", i.queryName());
+                printMsg(
+                    lvlTalkative, "skipping derivation named '%s' which gives an assertion failure", i.queryName());
                 i.setFailed();
             }
         validPaths = store.queryValidPaths(paths);
         substitutablePaths = store.querySubstitutablePaths(paths);
     }
 
-
     /* Print the desired columns, or XML output. */
     if (jsonOutput) {
         queryJSON(globals, elems, printOutPath, printDrvPath, printMeta);
@@ -1114,13 +1083,13 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
     for (auto & i : elems) {
         try {
-            if (i.hasFailed()) continue;
+            if (i.hasFailed())
+                continue;
 
-            //Activity act(*logger, lvlDebug, "outputting query result '%1%'", i.attrPath);
+            // Activity act(*logger, lvlDebug, "outputting query result '%1%'", i.attrPath);
 
-            if (globals.prebuiltOnly &&
-                !validPaths.count(i.queryOutPath()) &&
-                !substitutablePaths.count(i.queryOutPath()))
+            if (globals.prebuiltOnly && !validPaths.count(i.queryOutPath())
+                && !substitutablePaths.count(i.queryOutPath()))
                 continue;
 
             /* For table output. */
@@ -1140,9 +1109,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                     attrs["substitutable"] = hasSubs ? "1" : "0";
                 } else
                     columns.push_back(
-                        (std::string) (isInstalled ? "I" : "-")
-                        + (isValid ? "P" : "-")
-                        + (hasSubs ? "S" : "-"));
+                        (std::string) (isInstalled ? "I" : "-") + (isValid ? "P" : "-") + (hasSubs ? "S" : "-"));
             }
 
             if (xmlOutput)
@@ -1169,11 +1136,20 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
                 char ch;
                 switch (diff) {
-                    case cvLess: ch = '>'; break;
-                    case cvEqual: ch = '='; break;
-                    case cvGreater: ch = '<'; break;
-                    case cvUnavail: ch = '-'; break;
-                    default: unreachable();
+                case cvLess:
+                    ch = '>';
+                    break;
+                case cvEqual:
+                    ch = '=';
+                    break;
+                case cvGreater:
+                    ch = '<';
+                    break;
+                case cvUnavail:
+                    ch = '-';
+                    break;
+                default:
+                    unreachable();
                 }
 
                 if (xmlOutput) {
@@ -1190,15 +1166,16 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             }
 
             if (xmlOutput) {
-                if (i.querySystem() != "") attrs["system"] = i.querySystem();
-            }
-            else if (printSystem)
+                if (i.querySystem() != "")
+                    attrs["system"] = i.querySystem();
+            } else if (printSystem)
                 columns.push_back(i.querySystem());
 
             if (printDrvPath) {
                 auto drvPath = i.queryDrvPath();
                 if (xmlOutput) {
-                    if (drvPath) attrs["drvPath"] = store.printStorePath(*drvPath);
+                    if (drvPath)
+                        attrs["drvPath"] = store.printStorePath(*drvPath);
                 } else
                     columns.push_back(drvPath ? store.printStorePath(*drvPath) : "-");
             }
@@ -1210,8 +1187,12 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                 PackageInfo::Outputs outputs = i.queryOutputs();
                 std::string s;
                 for (auto & j : outputs) {
-                    if (!s.empty()) s += ';';
-                    if (j.first != "out") { s += j.first; s += "="; }
+                    if (!s.empty())
+                        s += ';';
+                    if (j.first != "out") {
+                        s += j.first;
+                        s += "=";
+                    }
                     s += store.printStorePath(*j.second);
                 }
                 columns.push_back(s);
@@ -1220,7 +1201,8 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             if (printDescription) {
                 auto descr = i.queryMetaString("description");
                 if (xmlOutput) {
-                    if (descr != "") attrs["description"] = descr;
+                    if (descr != "")
+                        attrs["description"] = descr;
                 } else
                     columns.push_back(descr);
             }
@@ -1242,9 +1224,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                         attrs2["name"] = j;
                         Value * v = i.queryMeta(j);
                         if (!v)
-                            printError(
-                                "derivation '%s' has invalid meta attribute '%s'",
-                                i.queryName(), j);
+                            printError("derivation '%s' has invalid meta attribute '%s'", i.queryName(), j);
                         else {
                             if (v->type() == nString) {
                                 attrs2["type"] = "string";
@@ -1266,7 +1246,8 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                                 attrs2["type"] = "strings";
                                 XMLOpenElement m(xml, "meta", attrs2);
                                 for (auto elem : v->listView()) {
-                                    if (elem->type() != nString) continue;
+                                    if (elem->type() != nString)
+                                        continue;
                                     XMLAttrs attrs3;
                                     attrs3["value"] = elem->c_str();
                                     xml.writeEmptyElement("string", attrs3);
@@ -1275,12 +1256,13 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                                 attrs2["type"] = "strings";
                                 XMLOpenElement m(xml, "meta", attrs2);
                                 for (auto & i : *v->attrs()) {
-                                    if (i.value->type() != nString) continue;
+                                    if (i.value->type() != nString)
+                                        continue;
                                     XMLAttrs attrs3;
                                     attrs3["type"] = globals.state->symbols[i.name];
                                     attrs3["value"] = i.value->c_str();
                                     xml.writeEmptyElement("string", attrs3);
-                            }
+                                }
                             }
                         }
                     }
@@ -1298,10 +1280,10 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
         }
     }
 
-    if (!xmlOutput) printTable(table);
+    if (!xmlOutput)
+        printTable(table);
 }
 
-
 static void opSwitchProfile(Globals & globals, Strings opFlags, Strings opArgs)
 {
     if (opFlags.size() > 0)
@@ -1315,7 +1297,6 @@ static void opSwitchProfile(Globals & globals, Strings opFlags, Strings opArgs)
     switchLink(profileLink, profile);
 }
 
-
 static void opSwitchGeneration(Globals & globals, Strings opFlags, Strings opArgs)
 {
     if (opFlags.size() > 0)
@@ -1329,7 +1310,6 @@ static void opSwitchGeneration(Globals & globals, Strings opFlags, Strings opArg
         throw UsageError("expected a generation number");
 }
 
-
 static void opRollback(Globals & globals, Strings opFlags, Strings opArgs)
 {
     if (opFlags.size() > 0)
@@ -1340,7 +1320,6 @@ static void opRollback(Globals & globals, Strings opFlags, Strings opArgs)
     switchGeneration(globals.profile, {}, globals.dryRun);
 }
 
-
 static void opListGenerations(Globals & globals, Strings opFlags, Strings opArgs)
 {
     if (opFlags.size() > 0)
@@ -1366,15 +1345,19 @@ static void opListGenerations(Globals & globals, Strings opFlags, Strings opArgs
         if (!localtime_r(&i.creationTime, &t))
             throw Error("cannot convert time");
 #endif
-        logger->cout("%|4|   %|4|-%|02|-%|02| %|02|:%|02|:%|02|   %||",
+        logger->cout(
+            "%|4|   %|4|-%|02|-%|02| %|02|:%|02|:%|02|   %||",
             i.number,
-            t.tm_year + 1900, t.tm_mon + 1, t.tm_mday,
-            t.tm_hour, t.tm_min, t.tm_sec,
+            t.tm_year + 1900,
+            t.tm_mon + 1,
+            t.tm_mday,
+            t.tm_hour,
+            t.tm_min,
+            t.tm_sec,
             i.number == curGen ? "(current)" : "");
     }
 }
 
-
 static void opDeleteGenerations(Globals & globals, Strings opFlags, Strings opArgs)
 {
     if (opFlags.size() > 0)
@@ -1405,14 +1388,12 @@ static void opDeleteGenerations(Globals & globals, Strings opFlags, Strings opAr
     }
 }
 
-
 static void opVersion(Globals & globals, Strings opFlags, Strings opArgs)
 {
     printVersion("nix-env");
 }
 
-
-static int main_nix_env(int argc, char * * argv)
+static int main_nix_env(int argc, char ** argv)
 {
     {
         Strings opFlags, opArgs;
@@ -1431,14 +1412,11 @@ static int main_nix_env(int argc, char * * argv)
         if (!pathExists(nixExprPath)) {
             try {
                 createDirs(nixExprPath);
-                replaceSymlink(
-                    defaultChannelsDir(),
-                    nixExprPath + "/channels");
+                replaceSymlink(defaultChannelsDir(), nixExprPath + "/channels");
                 if (!isRootUser())
-                    replaceSymlink(
-                        rootChannelsDir(),
-                        nixExprPath + "/channels_root");
-            } catch (Error &) { }
+                    replaceSymlink(rootChannelsDir(), nixExprPath + "/channels_root");
+            } catch (Error &) {
+            }
         }
 
         globals.dryRun = false;
@@ -1461,70 +1439,56 @@ static int main_nix_env(int argc, char * * argv)
             else if (*arg == "--install" || *arg == "-i") {
                 op = opInstall;
                 opName = "-install";
-            }
-            else if (*arg == "--force-name") // undocumented flag for nix-install-package
+            } else if (*arg == "--force-name") // undocumented flag for nix-install-package
                 globals.forceName = getArg(*arg, arg, end);
             else if (*arg == "--uninstall" || *arg == "-e") {
                 op = opUninstall;
                 opName = "-uninstall";
-            }
-            else if (*arg == "--upgrade" || *arg == "-u") {
+            } else if (*arg == "--upgrade" || *arg == "-u") {
                 op = opUpgrade;
                 opName = "-upgrade";
-            }
-            else if (*arg == "--set-flag") {
+            } else if (*arg == "--set-flag") {
                 op = opSetFlag;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--set") {
+            } else if (*arg == "--set") {
                 op = opSet;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--query" || *arg == "-q") {
+            } else if (*arg == "--query" || *arg == "-q") {
                 op = opQuery;
                 opName = "-query";
-            }
-            else if (*arg == "--profile" || *arg == "-p")
+            } else if (*arg == "--profile" || *arg == "-p")
                 globals.profile = absPath(getArg(*arg, arg, end));
             else if (*arg == "--file" || *arg == "-f")
                 file = getArg(*arg, arg, end);
             else if (*arg == "--switch-profile" || *arg == "-S") {
                 op = opSwitchProfile;
                 opName = "-switch-profile";
-            }
-            else if (*arg == "--switch-generation" || *arg == "-G") {
+            } else if (*arg == "--switch-generation" || *arg == "-G") {
                 op = opSwitchGeneration;
                 opName = "-switch-generation";
-            }
-            else if (*arg == "--rollback") {
+            } else if (*arg == "--rollback") {
                 op = opRollback;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--list-generations") {
+            } else if (*arg == "--list-generations") {
                 op = opListGenerations;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--delete-generations") {
+            } else if (*arg == "--delete-generations") {
                 op = opDeleteGenerations;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--dry-run") {
+            } else if (*arg == "--dry-run") {
                 printInfo("(dry run; not doing anything)");
                 globals.dryRun = true;
-            }
-            else if (*arg == "--system-filter")
+            } else if (*arg == "--system-filter")
                 globals.instSource.systemFilter = getArg(*arg, arg, end);
             else if (*arg == "--prebuilt-only" || *arg == "-b")
                 globals.prebuiltOnly = true;
             else if (*arg != "" && arg->at(0) == '-') {
                 opFlags.push_back(*arg);
                 /* FIXME: hacky */
-                if (*arg == "--from-profile" ||
-                    (op == opQuery && (*arg == "--attr" || *arg == "-A")) ||
-                    (op == opInstall && (*arg == "--priority")))
+                if (*arg == "--from-profile" || (op == opQuery && (*arg == "--attr" || *arg == "-A"))
+                    || (op == opInstall && (*arg == "--priority")))
                     opFlags.push_back(getArg(*arg, arg, end));
-            }
-            else
+            } else
                 opArgs.push_back(*arg);
 
             if (oldOp && oldOp != op)
@@ -1535,18 +1499,19 @@ static int main_nix_env(int argc, char * * argv)
 
         myArgs.parseCmdline(argvToStrings(argc, argv));
 
-        if (showHelp) showManPage("nix-env" + opName);
-        if (!op) throw UsageError("no operation specified");
+        if (showHelp)
+            showManPage("nix-env" + opName);
+        if (!op)
+            throw UsageError("no operation specified");
 
         auto store = openStore();
 
-        globals.state = std::shared_ptr<EvalState>(new EvalState(myArgs.lookupPath, store, fetchSettings, evalSettings));
+        globals.state =
+            std::shared_ptr<EvalState>(new EvalState(myArgs.lookupPath, store, fetchSettings, evalSettings));
         globals.state->repair = myArgs.repair;
 
         globals.instSource.nixExprPath = std::make_shared<SourcePath>(
-            file != ""
-            ? lookupFileArg(*globals.state, file)
-            : globals.state->rootPath(CanonPath(nixExprPath)));
+            file != "" ? lookupFileArg(*globals.state, file) : globals.state->rootPath(CanonPath(nixExprPath)));
 
         globals.instSource.autoArgs = myArgs.getAutoArgs(*globals.state);
 
diff --git a/src/nix-env/user-env.cc b/src/nix/nix-env/user-env.cc
similarity index 75%
rename from src/nix-env/user-env.cc
rename to src/nix/nix-env/user-env.cc
index e149b6aeb..fbdcb14f8 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix/nix-env/user-env.cc
@@ -15,7 +15,6 @@
 
 namespace nix {
 
-
 PackageInfos queryInstalled(EvalState & state, const Path & userEnv)
 {
     PackageInfos elems;
@@ -25,16 +24,14 @@ PackageInfos queryInstalled(EvalState & state, const Path & userEnv)
     if (pathExists(manifestFile)) {
         Value v;
         state.evalFile(state.rootPath(CanonPath(manifestFile)).resolveSymlinks(), v);
-        Bindings & bindings(*state.allocBindings(0));
+        Bindings & bindings = Bindings::emptyBindings;
         getDerivations(state, v, "", bindings, elems, false);
     }
     return elems;
 }
 
-
-bool createUserEnv(EvalState & state, PackageInfos & elems,
-    const Path & profile, bool keepDerivations,
-    const std::string & lockToken)
+bool createUserEnv(
+    EvalState & state, PackageInfos & elems, const Path & profile, bool keepDerivations, const std::string & lockToken)
 {
     /* Build the components in the user environment, if they don't
        exist already. */
@@ -44,9 +41,7 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
             drvsToBuild.push_back({*drvPath});
 
     debug("building user environment dependencies");
-    state.store->buildPaths(
-        toDerivedPaths(drvsToBuild),
-        state.repair ? bmRepair : bmNormal);
+    state.store->buildPaths(toDerivedPaths(drvsToBuild), state.repair ? bmRepair : bmNormal);
 
     /* Construct the whole top level derivation. */
     StorePathSet references;
@@ -61,21 +56,21 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
 
         auto attrs = state.buildBindings(7 + outputs.size());
 
-        attrs.alloc(state.sType).mkString("derivation");
-        attrs.alloc(state.sName).mkString(i.queryName());
+        attrs.alloc(state.s.type).mkStringNoCopy("derivation");
+        attrs.alloc(state.s.name).mkString(i.queryName());
         auto system = i.querySystem();
         if (!system.empty())
-            attrs.alloc(state.sSystem).mkString(system);
-        attrs.alloc(state.sOutPath).mkString(state.store->printStorePath(i.queryOutPath()));
+            attrs.alloc(state.s.system).mkString(system);
+        attrs.alloc(state.s.outPath).mkString(state.store->printStorePath(i.queryOutPath()));
         if (drvPath)
-            attrs.alloc(state.sDrvPath).mkString(state.store->printStorePath(*drvPath));
+            attrs.alloc(state.s.drvPath).mkString(state.store->printStorePath(*drvPath));
 
         // Copy each output meant for installation.
         auto outputsList = state.buildList(outputs.size());
         for (const auto & [m, j] : enumerate(outputs)) {
             (outputsList[m] = state.allocValue())->mkString(j.first);
             auto outputAttrs = state.buildBindings(2);
-            outputAttrs.alloc(state.sOutPath).mkString(state.store->printStorePath(*j.second));
+            outputAttrs.alloc(state.s.outPath).mkString(state.store->printStorePath(*j.second));
             attrs.alloc(j.first).mkAttrs(outputAttrs);
 
             /* This is only necessary when installing store paths, e.g.,
@@ -85,21 +80,23 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
 
             references.insert(*j.second);
         }
-        attrs.alloc(state.sOutputs).mkList(outputsList);
+        attrs.alloc(state.s.outputs).mkList(outputsList);
 
         // Copy the meta attributes.
         auto meta = state.buildBindings(metaNames.size());
         for (auto & j : metaNames) {
             Value * v = i.queryMeta(j);
-            if (!v) continue;
+            if (!v)
+                continue;
             meta.insert(state.symbols.create(j), v);
         }
 
-        attrs.alloc(state.sMeta).mkAttrs(meta);
+        attrs.alloc(state.s.meta).mkAttrs(meta);
 
         (list[n] = state.allocValue())->mkAttrs(attrs);
 
-        if (drvPath) references.insert(*drvPath);
+        if (drvPath)
+            references.insert(*drvPath);
     }
 
     Value manifest;
@@ -111,16 +108,23 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
     auto manifestFile = ({
         std::ostringstream str;
         printAmbiguous(manifest, state.symbols, str, nullptr, std::numeric_limits<int>::max());
-        StringSource source { toView(str) };
+        StringSource source{toView(str)};
         state.store->addToStoreFromDump(
-            source, "env-manifest.nix", FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, references);
+            source,
+            "env-manifest.nix",
+            FileSerialisationMethod::Flat,
+            ContentAddressMethod::Raw::Text,
+            HashAlgorithm::SHA256,
+            references);
     });
 
     /* Get the environment builder expression. */
     Value envBuilder;
-    state.eval(state.parseExprFromString(
-        #include "buildenv.nix.gen.hh"
-            , state.rootPath(CanonPath::root)), envBuilder);
+    state.eval(
+        state.parseExprFromString(
+#include "buildenv.nix.gen.hh"
+            , state.rootPath(CanonPath::root)),
+        envBuilder);
 
     /* Construct a Nix expression that calls the user environment
        builder with the manifest as argument. */
@@ -137,19 +141,17 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
     debug("evaluating user environment builder");
     state.forceValue(topLevel, topLevel.determinePos(noPos));
     NixStringContext context;
-    auto & aDrvPath(*topLevel.attrs()->find(state.sDrvPath));
+    auto & aDrvPath(*topLevel.attrs()->get(state.s.drvPath));
     auto topLevelDrv = state.coerceToStorePath(aDrvPath.pos, *aDrvPath.value, context, "");
     topLevelDrv.requireDerivation();
-    auto & aOutPath(*topLevel.attrs()->find(state.sOutPath));
+    auto & aOutPath(*topLevel.attrs()->get(state.s.outPath));
     auto topLevelOut = state.coerceToStorePath(aOutPath.pos, *aOutPath.value, context, "");
 
     /* Realise the resulting store expression. */
     debug("building user environment");
     std::vector<StorePathWithOutputs> topLevelDrvs;
     topLevelDrvs.push_back({topLevelDrv});
-    state.store->buildPaths(
-        toDerivedPaths(topLevelDrvs),
-        state.repair ? bmRepair : bmNormal);
+    state.store->buildPaths(toDerivedPaths(topLevelDrvs), state.repair ? bmRepair : bmNormal);
 
     /* Switch the current user environment to the output path. */
     auto store2 = state.store.dynamic_pointer_cast<LocalFSStore>();
@@ -172,5 +174,4 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
     return true;
 }
 
-
-}
+} // namespace nix
diff --git a/src/nix/nix-env/user-env.hh b/src/nix/nix-env/user-env.hh
new file mode 100644
index 000000000..abe25af65
--- /dev/null
+++ b/src/nix/nix-env/user-env.hh
@@ -0,0 +1,13 @@
+#pragma once
+///@file
+
+#include "nix/expr/get-drvs.hh"
+
+namespace nix {
+
+PackageInfos queryInstalled(EvalState & state, const Path & userEnv);
+
+bool createUserEnv(
+    EvalState & state, PackageInfos & elems, const Path & profile, bool keepDerivations, const std::string & lockToken);
+
+} // namespace nix
diff --git a/src/nix/nix-instantiate b/src/nix/nix-instantiate
deleted file mode 120000
index 2d7502ffa..000000000
--- a/src/nix/nix-instantiate
+++ /dev/null
@@ -1 +0,0 @@
-../nix-instantiate
\ No newline at end of file
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix/nix-instantiate/nix-instantiate.cc
similarity index 83%
rename from src/nix-instantiate/nix-instantiate.cc
rename to src/nix/nix-instantiate/nix-instantiate.cc
index f7b218efc..3d5c3e26a 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix/nix-instantiate/nix-instantiate.cc
@@ -17,19 +17,23 @@
 #include <map>
 #include <iostream>
 
-
 using namespace nix;
 
-
 static Path gcRoot;
 static int rootNr = 0;
 
-
 enum OutputKind { okPlain, okRaw, okXML, okJSON };
 
-void processExpr(EvalState & state, const Strings & attrPaths,
-    bool parseOnly, bool strict, Bindings & autoArgs,
-    bool evalOnly, OutputKind output, bool location, Expr * e)
+void processExpr(
+    EvalState & state,
+    const Strings & attrPaths,
+    bool parseOnly,
+    bool strict,
+    Bindings & autoArgs,
+    bool evalOnly,
+    OutputKind output,
+    bool location,
+    Expr * e)
 {
     if (parseOnly) {
         e->show(state.symbols, std::cout);
@@ -53,15 +57,16 @@ void processExpr(EvalState & state, const Strings & attrPaths,
                 state.autoCallFunction(autoArgs, v, vRes);
             if (output == okRaw)
                 std::cout << *state.coerceToString(noPos, vRes, context, "while generating the nix-instantiate output");
-                // We intentionally don't output a newline here. The default PS1 for Bash in NixOS starts with a newline
-                // and other interactive shells like Zsh are smart enough to print a missing newline before the prompt.
+            // We intentionally don't output a newline here. The default PS1 for Bash in NixOS starts with a newline
+            // and other interactive shells like Zsh are smart enough to print a missing newline before the prompt.
             else if (output == okXML)
                 printValueAsXML(state, strict, location, vRes, std::cout, context, noPos);
             else if (output == okJSON) {
                 printValueAsJSON(state, strict, vRes, v.determinePos(noPos), std::cout, context);
                 std::cout << std::endl;
             } else {
-                if (strict) state.forceValueDeep(vRes);
+                if (strict)
+                    state.forceValueDeep(vRes);
                 std::set<const void *> seen;
                 printAmbiguous(vRes, state.symbols, std::cout, &seen, std::numeric_limits<int>::max());
                 std::cout << std::endl;
@@ -82,7 +87,8 @@ void processExpr(EvalState & state, const Strings & attrPaths,
                     printGCWarning();
                 else {
                     Path rootName = absPath(gcRoot);
-                    if (++rootNr > 1) rootName += "-" + std::to_string(rootNr);
+                    if (++rootNr > 1)
+                        rootName += "-" + std::to_string(rootNr);
                     auto store2 = state.store.dynamic_pointer_cast<LocalFSStore>();
                     if (store2)
                         drvPathS = store2->addPermRoot(drvPath, rootName);
@@ -93,8 +99,7 @@ void processExpr(EvalState & state, const Strings & attrPaths,
     }
 }
 
-
-static int main_nix_instantiate(int argc, char * * argv)
+static int main_nix_instantiate(int argc, char ** argv)
 {
     {
         Strings files;
@@ -169,7 +174,8 @@ static int main_nix_instantiate(int argc, char * * argv)
 
         Bindings & autoArgs = *myArgs.getAutoArgs(*state);
 
-        if (attrPaths.empty()) attrPaths = {""};
+        if (attrPaths.empty())
+            attrPaths = {""};
 
         if (findFile) {
             for (auto & i : files) {
@@ -184,17 +190,16 @@ static int main_nix_instantiate(int argc, char * * argv)
 
         if (readStdin) {
             Expr * e = state->parseStdin();
-            processExpr(*state, attrPaths, parseOnly, strict, autoArgs,
-                evalOnly, outputKind, xmlOutputSourceLocation, e);
+            processExpr(
+                *state, attrPaths, parseOnly, strict, autoArgs, evalOnly, outputKind, xmlOutputSourceLocation, e);
         } else if (files.empty() && !fromArgs)
             files.push_back("./default.nix");
 
         for (auto & i : files) {
-            Expr * e = fromArgs
-                ? state->parseExprFromString(i, state->rootPath("."))
-                : state->parseExprFromFile(resolveExprPath(lookupFileArg(*state, i)));
-            processExpr(*state, attrPaths, parseOnly, strict, autoArgs,
-                evalOnly, outputKind, xmlOutputSourceLocation, e);
+            Expr * e = fromArgs ? state->parseExprFromString(i, state->rootPath("."))
+                                : state->parseExprFromFile(resolveExprPath(lookupFileArg(*state, i)));
+            processExpr(
+                *state, attrPaths, parseOnly, strict, autoArgs, evalOnly, outputKind, xmlOutputSourceLocation, e);
         }
 
         state->maybePrintStats();
diff --git a/src/nix/nix-store b/src/nix/nix-store
deleted file mode 120000
index e6efcac42..000000000
--- a/src/nix/nix-store
+++ /dev/null
@@ -1 +0,0 @@
-../nix-store/
\ No newline at end of file
diff --git a/src/nix-store/dotgraph.cc b/src/nix/nix-store/dotgraph.cc
similarity index 71%
rename from src/nix-store/dotgraph.cc
rename to src/nix/nix-store/dotgraph.cc
index f8054b554..e2963b4bb 100644
--- a/src/nix-store/dotgraph.cc
+++ b/src/nix/nix-store/dotgraph.cc
@@ -3,44 +3,37 @@
 
 #include <iostream>
 
-
 using std::cout;
 
 namespace nix {
 
-
 static std::string dotQuote(std::string_view s)
 {
     return "\"" + std::string(s) + "\"";
 }
 
-
 static const std::string & nextColour()
 {
     static int n = 0;
-    static std::vector<std::string> colours
-        { "black", "red", "green", "blue"
-        , "magenta", "burlywood" };
+    static std::vector<std::string> colours{"black", "red", "green", "blue", "magenta", "burlywood"};
     return colours[n++ % colours.size()];
 }
 
-
 static std::string makeEdge(std::string_view src, std::string_view dst)
 {
-    return fmt("%1% -> %2% [color = %3%];\n",
-        dotQuote(src), dotQuote(dst), dotQuote(nextColour()));
+    return fmt("%1% -> %2% [color = %3%];\n", dotQuote(src), dotQuote(dst), dotQuote(nextColour()));
 }
 
-
-static std::string makeNode(std::string_view id, std::string_view label,
-    std::string_view colour)
+static std::string makeNode(std::string_view id, std::string_view label, std::string_view colour)
 {
-    return fmt("%1% [label = %2%, shape = box, "
+    return fmt(
+        "%1% [label = %2%, shape = box, "
         "style = filled, fillcolor = %3%];\n",
-        dotQuote(id), dotQuote(label), dotQuote(colour));
+        dotQuote(id),
+        dotQuote(label),
+        dotQuote(colour));
 }
 
-
 void printDotGraph(ref<Store> store, StorePathSet && roots)
 {
     StorePathSet workList(std::move(roots));
@@ -51,7 +44,8 @@ void printDotGraph(ref<Store> store, StorePathSet && roots)
     while (!workList.empty()) {
         auto path = std::move(workList.extract(workList.begin()).value());
 
-        if (!doneSet.insert(path).second) continue;
+        if (!doneSet.insert(path).second)
+            continue;
 
         cout << makeNode(std::string(path.to_string()), path.name(), "#ff0000");
 
@@ -66,5 +60,4 @@ void printDotGraph(ref<Store> store, StorePathSet && roots)
     cout << "}\n";
 }
 
-
-}
+} // namespace nix
diff --git a/src/nix-store/dotgraph.hh b/src/nix/nix-store/dotgraph.hh
similarity index 100%
rename from src/nix-store/dotgraph.hh
rename to src/nix/nix-store/dotgraph.hh
diff --git a/src/nix-store/graphml.cc b/src/nix/nix-store/graphml.cc
similarity index 93%
rename from src/nix-store/graphml.cc
rename to src/nix/nix-store/graphml.cc
index 3b3188a41..009db05d4 100644
--- a/src/nix-store/graphml.cc
+++ b/src/nix/nix-store/graphml.cc
@@ -4,12 +4,10 @@
 
 #include <iostream>
 
-
 using std::cout;
 
 namespace nix {
 
-
 static inline std::string_view xmlQuote(std::string_view s)
 {
     // Luckily, store paths shouldn't contain any character that needs to be
@@ -17,20 +15,16 @@ static inline std::string_view xmlQuote(std::string_view s)
     return s;
 }
 
-
 static std::string symbolicName(std::string_view p)
 {
     return std::string(p.substr(0, p.find('-') + 1));
 }
 
-
 static std::string makeEdge(std::string_view src, std::string_view dst)
 {
-    return fmt("  <edge source=\"%1%\" target=\"%2%\"/>\n",
-        xmlQuote(src), xmlQuote(dst));
+    return fmt("  <edge source=\"%1%\" target=\"%2%\"/>\n", xmlQuote(src), xmlQuote(dst));
 }
 
-
 static std::string makeNode(const ValidPathInfo & info)
 {
     return fmt(
@@ -45,7 +39,6 @@ static std::string makeNode(const ValidPathInfo & info)
         (info.path.isDerivation() ? "derivation" : "output-path"));
 }
 
-
 void printGraphML(ref<Store> store, StorePathSet && roots)
 {
     StorePathSet workList(std::move(roots));
@@ -65,7 +58,8 @@ void printGraphML(ref<Store> store, StorePathSet && roots)
         auto path = std::move(workList.extract(workList.begin()).value());
 
         ret = doneSet.insert(path);
-        if (ret.second == false) continue;
+        if (ret.second == false)
+            continue;
 
         auto info = store->queryPathInfo(path);
         cout << makeNode(*info);
@@ -76,12 +70,10 @@ void printGraphML(ref<Store> store, StorePathSet && roots)
                 cout << makeEdge(path.to_string(), p.to_string());
             }
         }
-
     }
 
     cout << "</graph>\n";
     cout << "</graphml>\n";
 }
 
-
-}
+} // namespace nix
diff --git a/src/nix-store/graphml.hh b/src/nix/nix-store/graphml.hh
similarity index 100%
rename from src/nix-store/graphml.hh
rename to src/nix/nix-store/graphml.hh
diff --git a/src/nix-store/nix-store.cc b/src/nix/nix-store/nix-store.cc
similarity index 56%
rename from src/nix-store/nix-store.cc
rename to src/nix/nix-store/nix-store.cc
index 3da7a8ac1..5f85e06f0 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix/nix-store/nix-store.cc
@@ -12,13 +12,16 @@
 #include "graphml.hh"
 #include "nix/cmd/legacy.hh"
 #include "nix/util/posix-source-accessor.hh"
+#include "nix/store/globals.hh"
 #include "nix/store/path-with-outputs.hh"
+#include "nix/store/export-import.hh"
+
 #include "man-pages.hh"
 
 #ifndef _WIN32 // TODO implement on Windows or provide allowed-to-noop interface
-# include "nix/store/local-store.hh"
-# include "nix/util/monitor-fd.hh"
-# include "nix/store/posix-fs-canonicalise.hh"
+#  include "nix/store/local-store.hh"
+#  include "nix/util/monitor-fd.hh"
+#  include "nix/store/posix-fs-canonicalise.hh"
 #endif
 
 #include <iostream>
@@ -34,41 +37,37 @@
 
 namespace nix_store {
 
-
 using namespace nix;
 using std::cin;
 using std::cout;
 
-
-typedef void (* Operation) (Strings opFlags, Strings opArgs);
-
+typedef void (*Operation)(Strings opFlags, Strings opArgs);
 
 static Path gcRoot;
 static int rootNr = 0;
 static bool noOutput = false;
 static std::shared_ptr<Store> store;
 
-
 #ifndef _WIN32 // TODO reenable on Windows once we have `LocalStore` there
 ref<LocalStore> ensureLocalStore()
 {
     auto store2 = std::dynamic_pointer_cast<LocalStore>(store);
-    if (!store2) throw Error("you don't have sufficient rights to use this command");
+    if (!store2)
+        throw Error("you don't have sufficient rights to use this command");
     return ref<LocalStore>(store2);
 }
 #endif
 
-
 static StorePath useDeriver(const StorePath & path)
 {
-    if (path.isDerivation()) return path;
+    if (path.isDerivation())
+        return path;
     auto info = store->queryPathInfo(path);
     if (!info->deriver)
         throw Error("deriver of path '%s' is not known", store->printStorePath(path));
     return *info->deriver;
 }
 
-
 /* Realise the given path.  For a derivation that means build it; for
    other paths it means ensure their validity. */
 static PathSet realisePath(StorePathWithOutputs path, bool build = true)
@@ -76,22 +75,23 @@ static PathSet realisePath(StorePathWithOutputs path, bool build = true)
     auto store2 = std::dynamic_pointer_cast<LocalFSStore>(store);
 
     if (path.path.isDerivation()) {
-        if (build) store->buildPaths({path.toDerivedPath()});
+        if (build)
+            store->buildPaths({path.toDerivedPath()});
         auto outputPaths = store->queryDerivationOutputMap(path.path);
         Derivation drv = store->derivationFromPath(path.path);
         rootNr++;
 
         /* FIXME: Encode this empty special case explicitly in the type. */
         if (path.outputs.empty())
-            for (auto & i : drv.outputs) path.outputs.insert(i.first);
+            for (auto & i : drv.outputs)
+                path.outputs.insert(i.first);
 
         PathSet outputs;
         for (auto & j : path.outputs) {
             /* Match outputs of a store path with outputs of the derivation that produces it. */
             DerivationOutputs::iterator i = drv.outputs.find(j);
             if (i == drv.outputs.end())
-                throw Error("derivation '%s' does not have an output named '%s'",
-                    store2->printStorePath(path.path), j);
+                throw Error("derivation '%s' does not have an output named '%s'", store2->printStorePath(path.path), j);
             auto outPath = outputPaths.at(i->first);
             auto retPath = store->printStorePath(outPath);
             if (store2) {
@@ -99,8 +99,10 @@ static PathSet realisePath(StorePathWithOutputs path, bool build = true)
                     printGCWarning();
                 else {
                     Path rootName = gcRoot;
-                    if (rootNr > 1) rootName += "-" + std::to_string(rootNr);
-                    if (i->first != "out") rootName += "-" + i->first;
+                    if (rootNr > 1)
+                        rootName += "-" + std::to_string(rootNr);
+                    if (i->first != "out")
+                        rootName += "-" + i->first;
                     retPath = store2->addPermRoot(outPath, rootName);
                 }
             }
@@ -110,7 +112,8 @@ static PathSet realisePath(StorePathWithOutputs path, bool build = true)
     }
 
     else {
-        if (build) store->ensurePath(path.path);
+        if (build)
+            store->ensurePath(path.path);
         else if (!store->isValidPath(path.path))
             throw Error("path '%s' does not exist and cannot be created", store->printStorePath(path.path));
         if (store2) {
@@ -119,7 +122,8 @@ static PathSet realisePath(StorePathWithOutputs path, bool build = true)
             else {
                 Path rootName = gcRoot;
                 rootNr++;
-                if (rootNr > 1) rootName += "-" + std::to_string(rootNr);
+                if (rootNr > 1)
+                    rootName += "-" + std::to_string(rootNr);
                 return {store2->addPermRoot(path.path, rootName)};
             }
         }
@@ -127,7 +131,6 @@ static PathSet realisePath(StorePathWithOutputs path, bool build = true)
     }
 }
 
-
 /* Realise the given paths. */
 static void opRealise(Strings opFlags, Strings opArgs)
 {
@@ -136,11 +139,16 @@ static void opRealise(Strings opFlags, Strings opArgs)
     bool ignoreUnknown = false;
 
     for (auto & i : opFlags)
-        if (i == "--dry-run") dryRun = true;
-        else if (i == "--repair") buildMode = bmRepair;
-        else if (i == "--check") buildMode = bmCheck;
-        else if (i == "--ignore-unknown") ignoreUnknown = true;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--dry-run")
+            dryRun = true;
+        else if (i == "--repair")
+            buildMode = bmRepair;
+        else if (i == "--check")
+            buildMode = bmCheck;
+        else if (i == "--ignore-unknown")
+            ignoreUnknown = true;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
     std::vector<StorePathWithOutputs> paths;
     for (auto & i : opArgs)
@@ -152,7 +160,8 @@ static void opRealise(Strings opFlags, Strings opArgs)
     if (ignoreUnknown) {
         std::vector<StorePathWithOutputs> paths2;
         for (auto & i : paths)
-            if (!missing.unknown.count(i.path)) paths2.push_back(i);
+            if (!missing.unknown.count(i.path))
+                paths2.push_back(i);
         paths = std::move(paths2);
         missing.unknown = StorePathSet();
     }
@@ -160,7 +169,8 @@ static void opRealise(Strings opFlags, Strings opArgs)
     if (settings.printMissing)
         printMissing(ref<Store>(store), missing);
 
-    if (dryRun) return;
+    if (dryRun)
+        return;
 
     /* Build all paths at the same time to exploit parallelism. */
     store->buildPaths(toDerivedPaths(paths), buildMode);
@@ -174,20 +184,18 @@ static void opRealise(Strings opFlags, Strings opArgs)
         }
 }
 
-
 /* Add files to the Nix store and print the resulting paths. */
 static void opAdd(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
 
     for (auto & i : opArgs) {
         auto sourcePath = PosixSourceAccessor::createAtRoot(makeParentCanonical(i));
-        cout << fmt("%s\n", store->printStorePath(store->addToStore(
-            std::string(baseNameOf(i)), sourcePath)));
+        cout << fmt("%s\n", store->printStorePath(store->addToStore(std::string(baseNameOf(i)), sourcePath)));
     }
 }
 
-
 /* Preload the output of a fixed-output derivation into the Nix
    store. */
 static void opAddFixed(Strings opFlags, Strings opArgs)
@@ -195,8 +203,10 @@ static void opAddFixed(Strings opFlags, Strings opArgs)
     ContentAddressMethod method = ContentAddressMethod::Raw::Flat;
 
     for (auto & i : opFlags)
-        if (i == "--recursive") method = ContentAddressMethod::Raw::NixArchive;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--recursive")
+            method = ContentAddressMethod::Raw::NixArchive;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
     if (opArgs.empty())
         throw UsageError("first argument must be hash algorithm");
@@ -206,23 +216,21 @@ static void opAddFixed(Strings opFlags, Strings opArgs)
 
     for (auto & i : opArgs) {
         auto sourcePath = PosixSourceAccessor::createAtRoot(makeParentCanonical(i));
-        std::cout << fmt("%s\n", store->printStorePath(store->addToStoreSlow(
-            baseNameOf(i),
-            sourcePath,
-            method,
-            hashAlgo).path));
+        std::cout << fmt(
+            "%s\n", store->printStorePath(store->addToStoreSlow(baseNameOf(i), sourcePath, method, hashAlgo).path));
     }
 }
 
-
 /* Hack to support caching in `nix-prefetch-url'. */
 static void opPrintFixedPath(Strings opFlags, Strings opArgs)
 {
     auto method = FileIngestionMethod::Flat;
 
     for (const auto & i : opFlags)
-        if (i == "--recursive") method = FileIngestionMethod::NixArchive;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--recursive")
+            method = FileIngestionMethod::NixArchive;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
     if (opArgs.size() != 3)
         throw UsageError("'--print-fixed-path' requires three arguments");
@@ -232,17 +240,21 @@ static void opPrintFixedPath(Strings opFlags, Strings opArgs)
     std::string hash = *i++;
     std::string name = *i++;
 
-    cout << fmt("%s\n", store->printStorePath(store->makeFixedOutputPath(name, FixedOutputInfo {
-        .method = method,
-        .hash = Hash::parseAny(hash, hashAlgo),
-        .references = {},
-    })));
+    cout << fmt(
+        "%s\n",
+        store->printStorePath(store->makeFixedOutputPath(
+            name,
+            FixedOutputInfo{
+                .method = method,
+                .hash = Hash::parseAny(hash, hashAlgo),
+                .references = {},
+            })));
 }
 
-
 static StorePathSet maybeUseOutputs(const StorePath & storePath, bool useOutput, bool forceRealise)
 {
-    if (forceRealise) realisePath({storePath});
+    if (forceRealise)
+        realisePath({storePath});
     if (useOutput && storePath.isDerivation()) {
         auto drv = store->derivationFromPath(storePath);
         StorePathSet outputs;
@@ -250,20 +262,20 @@ static StorePathSet maybeUseOutputs(const StorePath & storePath, bool useOutput,
             return store->queryDerivationOutputs(storePath);
         for (auto & i : drv.outputsAndOptPaths(*store)) {
             if (!i.second.second)
-                throw UsageError("Cannot use output path of floating content-addressing derivation until we know what it is (e.g. by building it)");
+                throw UsageError(
+                    "Cannot use output path of floating content-addressing derivation until we know what it is (e.g. by building it)");
             outputs.insert(*i.second.second);
         }
         return outputs;
-    }
-    else return {storePath};
+    } else
+        return {storePath};
 }
 
-
 /* Some code to print a tree representation of a derivation dependency
    graph.  Topological sorting is used to keep the tree relatively
    flat. */
-static void printTree(const StorePath & path,
-    const std::string & firstPad, const std::string & tailPad, StorePathSet & done)
+static void
+printTree(const StorePath & path, const std::string & firstPad, const std::string & tailPad, StorePathSet & done)
 {
     if (!done.insert(path).second) {
         cout << fmt("%s%s [...]\n", firstPad, store->printStorePath(path));
@@ -281,23 +293,33 @@ static void printTree(const StorePath & path,
     auto sorted = store->topoSortPaths(info->references);
     reverse(sorted.begin(), sorted.end());
 
-    for (const auto &[n, i] : enumerate(sorted)) {
+    for (const auto & [n, i] : enumerate(sorted)) {
         bool last = n + 1 == sorted.size();
-        printTree(i,
-            tailPad + (last ? treeLast : treeConn),
-            tailPad + (last ? treeNull : treeLine),
-            done);
+        printTree(i, tailPad + (last ? treeLast : treeConn), tailPad + (last ? treeNull : treeLine), done);
     }
 }
 
-
 /* Perform various sorts of queries. */
 static void opQuery(Strings opFlags, Strings opArgs)
 {
-    enum QueryType
-        { qOutputs, qRequisites, qReferences, qReferrers
-        , qReferrersClosure, qDeriver, qValidDerivers, qBinding, qHash, qSize
-        , qTree, qGraph, qGraphML, qResolve, qRoots };
+    enum QueryType {
+        qOutputs,
+        qRequisites,
+        qReferences,
+        qReferrers,
+        qReferrersClosure,
+        qDeriver,
+        qValidDerivers,
+        qBinding,
+        qHash,
+        qSize,
+        qTree,
+        qGraph,
+        qGraphML,
+        qResolve,
+        qRoots
+    };
+
     std::optional<QueryType> query;
     bool useOutput = false;
     bool includeOutputs = false;
@@ -306,187 +328,203 @@ static void opQuery(Strings opFlags, Strings opArgs)
 
     for (auto & i : opFlags) {
         std::optional<QueryType> prev = query;
-        if (i == "--outputs") query = qOutputs;
-        else if (i == "--requisites" || i == "-R") query = qRequisites;
-        else if (i == "--references") query = qReferences;
-        else if (i == "--referrers" || i == "--referers") query = qReferrers;
-        else if (i == "--referrers-closure" || i == "--referers-closure") query = qReferrersClosure;
-        else if (i == "--deriver" || i == "-d") query = qDeriver;
-        else if (i == "--valid-derivers") query = qValidDerivers;
+        if (i == "--outputs")
+            query = qOutputs;
+        else if (i == "--requisites" || i == "-R")
+            query = qRequisites;
+        else if (i == "--references")
+            query = qReferences;
+        else if (i == "--referrers" || i == "--referers")
+            query = qReferrers;
+        else if (i == "--referrers-closure" || i == "--referers-closure")
+            query = qReferrersClosure;
+        else if (i == "--deriver" || i == "-d")
+            query = qDeriver;
+        else if (i == "--valid-derivers")
+            query = qValidDerivers;
         else if (i == "--binding" || i == "-b") {
             if (opArgs.size() == 0)
                 throw UsageError("expected binding name");
             bindingName = opArgs.front();
             opArgs.pop_front();
             query = qBinding;
-        }
-        else if (i == "--hash") query = qHash;
-        else if (i == "--size") query = qSize;
-        else if (i == "--tree") query = qTree;
-        else if (i == "--graph") query = qGraph;
-        else if (i == "--graphml") query = qGraphML;
-        else if (i == "--resolve") query = qResolve;
-        else if (i == "--roots") query = qRoots;
-        else if (i == "--use-output" || i == "-u") useOutput = true;
-        else if (i == "--force-realise" || i == "--force-realize" || i == "-f") forceRealise = true;
-        else if (i == "--include-outputs") includeOutputs = true;
-        else throw UsageError("unknown flag '%1%'", i);
+        } else if (i == "--hash")
+            query = qHash;
+        else if (i == "--size")
+            query = qSize;
+        else if (i == "--tree")
+            query = qTree;
+        else if (i == "--graph")
+            query = qGraph;
+        else if (i == "--graphml")
+            query = qGraphML;
+        else if (i == "--resolve")
+            query = qResolve;
+        else if (i == "--roots")
+            query = qRoots;
+        else if (i == "--use-output" || i == "-u")
+            useOutput = true;
+        else if (i == "--force-realise" || i == "--force-realize" || i == "-f")
+            forceRealise = true;
+        else if (i == "--include-outputs")
+            includeOutputs = true;
+        else
+            throw UsageError("unknown flag '%1%'", i);
         if (prev && prev != query)
             throw UsageError("query type '%1%' conflicts with earlier flag", i);
     }
 
-    if (!query) query = qOutputs;
+    if (!query)
+        query = qOutputs;
 
     RunPager pager;
 
     switch (*query) {
 
-        case qOutputs: {
-            for (auto & i : opArgs) {
-                auto outputs = maybeUseOutputs(store->followLinksToStorePath(i), true, forceRealise);
-                for (auto & outputPath : outputs)
-                    cout << fmt("%1%\n", store->printStorePath(outputPath));
+    case qOutputs: {
+        for (auto & i : opArgs) {
+            auto outputs = maybeUseOutputs(store->followLinksToStorePath(i), true, forceRealise);
+            for (auto & outputPath : outputs)
+                cout << fmt("%1%\n", store->printStorePath(outputPath));
+        }
+        break;
+    }
+
+    case qRequisites:
+    case qReferences:
+    case qReferrers:
+    case qReferrersClosure: {
+        StorePathSet paths;
+        for (auto & i : opArgs) {
+            auto ps = maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise);
+            for (auto & j : ps) {
+                if (query == qRequisites)
+                    store->computeFSClosure(j, paths, false, includeOutputs);
+                else if (query == qReferences) {
+                    for (auto & p : store->queryPathInfo(j)->references)
+                        paths.insert(p);
+                } else if (query == qReferrers) {
+                    StorePathSet tmp;
+                    store->queryReferrers(j, tmp);
+                    for (auto & i : tmp)
+                        paths.insert(i);
+                } else if (query == qReferrersClosure)
+                    store->computeFSClosure(j, paths, true);
             }
-            break;
         }
+        auto sorted = store->topoSortPaths(paths);
+        for (StorePaths::reverse_iterator i = sorted.rbegin(); i != sorted.rend(); ++i)
+            cout << fmt("%s\n", store->printStorePath(*i));
+        break;
+    }
 
-        case qRequisites:
-        case qReferences:
-        case qReferrers:
-        case qReferrersClosure: {
-            StorePathSet paths;
-            for (auto & i : opArgs) {
-                auto ps = maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise);
-                for (auto & j : ps) {
-                    if (query == qRequisites) store->computeFSClosure(j, paths, false, includeOutputs);
-                    else if (query == qReferences) {
-                        for (auto & p : store->queryPathInfo(j)->references)
-                            paths.insert(p);
-                    }
-                    else if (query == qReferrers) {
-                        StorePathSet tmp;
-                        store->queryReferrers(j, tmp);
-                        for (auto & i : tmp)
-                            paths.insert(i);
-                    }
-                    else if (query == qReferrersClosure) store->computeFSClosure(j, paths, true);
-                }
+    case qDeriver:
+        for (auto & i : opArgs) {
+            auto info = store->queryPathInfo(store->followLinksToStorePath(i));
+            cout << fmt("%s\n", info->deriver ? store->printStorePath(*info->deriver) : "unknown-deriver");
+        }
+        break;
+
+    case qValidDerivers: {
+        StorePathSet result;
+        for (auto & i : opArgs) {
+            auto derivers = store->queryValidDerivers(store->followLinksToStorePath(i));
+            for (const auto & i : derivers) {
+                result.insert(i);
             }
-            auto sorted = store->topoSortPaths(paths);
-            for (StorePaths::reverse_iterator i = sorted.rbegin();
-                 i != sorted.rend(); ++i)
-                cout << fmt("%s\n", store->printStorePath(*i));
-            break;
         }
+        auto sorted = store->topoSortPaths(result);
+        for (StorePaths::reverse_iterator i = sorted.rbegin(); i != sorted.rend(); ++i)
+            cout << fmt("%s\n", store->printStorePath(*i));
+        break;
+    }
 
-        case qDeriver:
-            for (auto & i : opArgs) {
-                auto info = store->queryPathInfo(store->followLinksToStorePath(i));
-                cout << fmt("%s\n", info->deriver ? store->printStorePath(*info->deriver) : "unknown-deriver");
+    case qBinding:
+        for (auto & i : opArgs) {
+            auto path = useDeriver(store->followLinksToStorePath(i));
+            Derivation drv = store->derivationFromPath(path);
+            StringPairs::iterator j = drv.env.find(bindingName);
+            if (j == drv.env.end())
+                throw Error(
+                    "derivation '%s' has no environment binding named '%s'", store->printStorePath(path), bindingName);
+            cout << fmt("%s\n", j->second);
+        }
+        break;
+
+    case qHash:
+    case qSize:
+        for (auto & i : opArgs) {
+            for (auto & j : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise)) {
+                auto info = store->queryPathInfo(j);
+                if (query == qHash) {
+                    assert(info->narHash.algo == HashAlgorithm::SHA256);
+                    cout << fmt("%s\n", info->narHash.to_string(HashFormat::Nix32, true));
+                } else if (query == qSize)
+                    cout << fmt("%d\n", info->narSize);
             }
-            break;
-
-        case qValidDerivers: {
-            StorePathSet result;
-            for (auto & i : opArgs) {
-                auto derivers = store->queryValidDerivers(store->followLinksToStorePath(i));
-                for (const auto &i: derivers) {
-                    result.insert(i);
-                }
-            }
-            auto sorted = store->topoSortPaths(result);
-            for (StorePaths::reverse_iterator i = sorted.rbegin();
-                 i != sorted.rend(); ++i)
-                cout << fmt("%s\n", store->printStorePath(*i));
-            break;
         }
+        break;
 
-        case qBinding:
-            for (auto & i : opArgs) {
-                auto path = useDeriver(store->followLinksToStorePath(i));
-                Derivation drv = store->derivationFromPath(path);
-                StringPairs::iterator j = drv.env.find(bindingName);
-                if (j == drv.env.end())
-                    throw Error("derivation '%s' has no environment binding named '%s'",
-                        store->printStorePath(path), bindingName);
-                cout << fmt("%s\n", j->second);
-            }
-            break;
+    case qTree: {
+        StorePathSet done;
+        for (auto & i : opArgs)
+            printTree(store->followLinksToStorePath(i), "", "", done);
+        break;
+    }
 
-        case qHash:
-        case qSize:
-            for (auto & i : opArgs) {
-                for (auto & j : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise)) {
-                    auto info = store->queryPathInfo(j);
-                    if (query == qHash) {
-                        assert(info->narHash.algo == HashAlgorithm::SHA256);
-                        cout << fmt("%s\n", info->narHash.to_string(HashFormat::Nix32, true));
-                    } else if (query == qSize)
-                        cout << fmt("%d\n", info->narSize);
-                }
-            }
-            break;
+    case qGraph: {
+        StorePathSet roots;
+        for (auto & i : opArgs)
+            for (auto & j : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise))
+                roots.insert(j);
+        printDotGraph(ref<Store>(store), std::move(roots));
+        break;
+    }
 
-        case qTree: {
-            StorePathSet done;
-            for (auto & i : opArgs)
-                printTree(store->followLinksToStorePath(i), "", "", done);
-            break;
-        }
+    case qGraphML: {
+        StorePathSet roots;
+        for (auto & i : opArgs)
+            for (auto & j : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise))
+                roots.insert(j);
+        printGraphML(ref<Store>(store), std::move(roots));
+        break;
+    }
 
-        case qGraph: {
-            StorePathSet roots;
-            for (auto & i : opArgs)
-                for (auto & j : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise))
-                    roots.insert(j);
-            printDotGraph(ref<Store>(store), std::move(roots));
-            break;
-        }
+    case qResolve: {
+        for (auto & i : opArgs)
+            cout << fmt("%s\n", store->printStorePath(store->followLinksToStorePath(i)));
+        break;
+    }
 
-        case qGraphML: {
-            StorePathSet roots;
-            for (auto & i : opArgs)
-                for (auto & j : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise))
-                    roots.insert(j);
-            printGraphML(ref<Store>(store), std::move(roots));
-            break;
-        }
+    case qRoots: {
+        StorePathSet args;
+        for (auto & i : opArgs)
+            for (auto & p : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise))
+                args.insert(p);
 
-        case qResolve: {
-            for (auto & i : opArgs)
-                cout << fmt("%s\n", store->printStorePath(store->followLinksToStorePath(i)));
-            break;
-        }
+        StorePathSet referrers;
+        store->computeFSClosure(args, referrers, true, settings.gcKeepOutputs, settings.gcKeepDerivations);
 
-        case qRoots: {
-            StorePathSet args;
-            for (auto & i : opArgs)
-                for (auto & p : maybeUseOutputs(store->followLinksToStorePath(i), useOutput, forceRealise))
-                    args.insert(p);
+        auto & gcStore = require<GcStore>(*store);
+        Roots roots = gcStore.findRoots(false);
+        for (auto & [target, links] : roots)
+            if (referrers.find(target) != referrers.end())
+                for (auto & link : links)
+                    cout << fmt("%1% -> %2%\n", link, gcStore.printStorePath(target));
+        break;
+    }
 
-            StorePathSet referrers;
-            store->computeFSClosure(
-                args, referrers, true, settings.gcKeepOutputs, settings.gcKeepDerivations);
-
-            auto & gcStore = require<GcStore>(*store);
-            Roots roots = gcStore.findRoots(false);
-            for (auto & [target, links] : roots)
-                if (referrers.find(target) != referrers.end())
-                    for (auto & link : links)
-                        cout << fmt("%1% -> %2%\n", link, gcStore.printStorePath(target));
-            break;
-        }
-
-        default:
-            unreachable();
+    default:
+        unreachable();
     }
 }
 
-
 static void opPrintEnv(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
-    if (opArgs.size() != 1) throw UsageError("'--print-env' requires one derivation store path");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
+    if (opArgs.size() != 1)
+        throw UsageError("'--print-env' requires one derivation store path");
 
     Path drvPath = opArgs.front();
     Derivation drv = store->derivationFromPath(store->parseStorePath(drvPath));
@@ -501,17 +539,18 @@ static void opPrintEnv(Strings opFlags, Strings opArgs)
     cout << "export _args; _args='";
     bool first = true;
     for (auto & i : drv.args) {
-        if (!first) cout << ' ';
+        if (!first)
+            cout << ' ';
         first = false;
         cout << escapeShellArgAlways(i);
     }
     cout << "'\n";
 }
 
-
 static void opReadLog(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
 
     auto & logStore = require<LogStore>(*store);
 
@@ -526,10 +565,10 @@ static void opReadLog(Strings opFlags, Strings opArgs)
     }
 }
 
-
 static void opDumpDB(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
     if (!opArgs.empty()) {
         for (auto & i : opArgs)
             cout << store->makeValidityRegistration({store->followLinksToStorePath(i)}, true, true);
@@ -539,7 +578,6 @@ static void opDumpDB(Strings opFlags, Strings opArgs)
     }
 }
 
-
 static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
 {
     ValidPathInfos infos;
@@ -547,9 +585,14 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
     while (1) {
         // We use a dummy value because we'll set it below. FIXME be correct by
         // construction and avoid dummy value.
-        auto hashResultOpt = !hashGiven ? std::optional<HashResult> { {Hash::dummy, -1} } : std::nullopt;
+        auto hashResultOpt = !hashGiven ? std::optional<HashResult>{{
+                                              Hash::dummy,
+                                              std::numeric_limits<uint64_t>::max(),
+                                          }}
+                                        : std::nullopt;
         auto info = decodeValidPathInfo(*store, cin, hashResultOpt);
-        if (!info) break;
+        if (!info)
+            break;
         if (!store->isValidPath(info->path) || reregister) {
             /* !!! races */
             if (canonicalise)
@@ -560,10 +603,11 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
 #endif
             if (!hashGiven) {
                 HashResult hash = hashPath(
-                    {store->getFSAccessor(false), CanonPath { info->path.to_string() }},
-                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256);
-                info->narHash = hash.first;
-                info->narSize = hash.second;
+                    {store->getFSAccessor(false), CanonPath{info->path.to_string()}},
+                    FileSerialisationMethod::NixArchive,
+                    HashAlgorithm::SHA256);
+                info->narHash = hash.hash;
+                info->narSize = hash.numBytesDigested;
             }
             infos.insert_or_assign(info->path, *info);
         }
@@ -574,39 +618,43 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
 #endif
 }
 
-
 static void opLoadDB(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
     if (!opArgs.empty())
         throw UsageError("no arguments expected");
     registerValidity(true, true, false);
 }
 
-
 static void opRegisterValidity(Strings opFlags, Strings opArgs)
 {
     bool reregister = false; // !!! maybe this should be the default
     bool hashGiven = false;
 
     for (auto & i : opFlags)
-        if (i == "--reregister") reregister = true;
-        else if (i == "--hash-given") hashGiven = true;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--reregister")
+            reregister = true;
+        else if (i == "--hash-given")
+            hashGiven = true;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
-    if (!opArgs.empty()) throw UsageError("no arguments expected");
+    if (!opArgs.empty())
+        throw UsageError("no arguments expected");
 
     registerValidity(reregister, hashGiven, true);
 }
 
-
 static void opCheckValidity(Strings opFlags, Strings opArgs)
 {
     bool printInvalid = false;
 
     for (auto & i : opFlags)
-        if (i == "--print-invalid") printInvalid = true;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--print-invalid")
+            printInvalid = true;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
     for (auto & i : opArgs) {
         auto path = store->followLinksToStorePath(i);
@@ -619,7 +667,6 @@ static void opCheckValidity(Strings opFlags, Strings opArgs)
     }
 }
 
-
 static void opGC(Strings opFlags, Strings opArgs)
 {
     bool printRoots = false;
@@ -630,14 +677,19 @@ static void opGC(Strings opFlags, Strings opArgs)
 
     /* Do what? */
     for (auto i = opFlags.begin(); i != opFlags.end(); ++i)
-        if (*i == "--print-roots") printRoots = true;
-        else if (*i == "--print-live") options.action = GCOptions::gcReturnLive;
-        else if (*i == "--print-dead") options.action = GCOptions::gcReturnDead;
+        if (*i == "--print-roots")
+            printRoots = true;
+        else if (*i == "--print-live")
+            options.action = GCOptions::gcReturnLive;
+        else if (*i == "--print-dead")
+            options.action = GCOptions::gcReturnDead;
         else if (*i == "--max-freed")
             options.maxFreed = std::max(getIntArg<int64_t>(*i, i, opFlags.end(), true), (int64_t) 0);
-        else throw UsageError("bad sub-operation '%1%' in GC", *i);
+        else
+            throw UsageError("bad sub-operation '%1%' in GC", *i);
 
-    if (!opArgs.empty()) throw UsageError("no arguments expected");
+    if (!opArgs.empty())
+        throw UsageError("no arguments expected");
 
     auto & gcStore = require<GcStore>(*store);
 
@@ -662,7 +714,6 @@ static void opGC(Strings opFlags, Strings opArgs)
     }
 }
 
-
 /* Remove paths from the Nix store if possible (i.e., if they do not
    have any remaining referrers and are not reachable from any GC
    roots). */
@@ -672,8 +723,10 @@ static void opDelete(Strings opFlags, Strings opArgs)
     options.action = GCOptions::gcDeleteSpecific;
 
     for (auto & i : opFlags)
-        if (i == "--ignore-liveness") options.ignoreLiveness = true;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--ignore-liveness")
+            options.ignoreLiveness = true;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
     for (auto & i : opArgs)
         options.pathsToDelete.insert(store->followLinksToStorePath(i));
@@ -685,12 +738,13 @@ static void opDelete(Strings opFlags, Strings opArgs)
     gcStore.collectGarbage(options, results);
 }
 
-
 /* Dump a path as a Nix archive.  The archive is written to stdout */
 static void opDump(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
-    if (opArgs.size() != 1) throw UsageError("only one argument allowed");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
+    if (opArgs.size() != 1)
+        throw UsageError("only one argument allowed");
 
     FdSink sink(getStandardOutput());
     std::string path = *opArgs.begin();
@@ -698,18 +752,18 @@ static void opDump(Strings opFlags, Strings opArgs)
     sink.flush();
 }
 
-
 /* Restore a value from a Nix archive.  The archive is read from stdin. */
 static void opRestore(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
-    if (opArgs.size() != 1) throw UsageError("only one argument allowed");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
+    if (opArgs.size() != 1)
+        throw UsageError("only one argument allowed");
 
     FdSource source(STDIN_FILENO);
     restorePath(*opArgs.begin(), source);
 }
 
-
 static void opExport(Strings opFlags, Strings opArgs)
 {
     for (auto & i : opFlags)
@@ -721,37 +775,36 @@ static void opExport(Strings opFlags, Strings opArgs)
         paths.insert(store->followLinksToStorePath(i));
 
     FdSink sink(getStandardOutput());
-    store->exportPaths(paths, sink);
+    exportPaths(*store, paths, sink);
     sink.flush();
 }
 
-
 static void opImport(Strings opFlags, Strings opArgs)
 {
     for (auto & i : opFlags)
         throw UsageError("unknown flag '%1%'", i);
 
-    if (!opArgs.empty()) throw UsageError("no arguments expected");
+    if (!opArgs.empty())
+        throw UsageError("no arguments expected");
 
     FdSource source(STDIN_FILENO);
-    auto paths = store->importPaths(source, NoCheckSigs);
+    auto paths = importPaths(*store, source, NoCheckSigs);
 
     for (auto & i : paths)
         cout << fmt("%s\n", store->printStorePath(i)) << std::flush;
 }
 
-
 /* Initialise the Nix databases. */
 static void opInit(Strings opFlags, Strings opArgs)
 {
-    if (!opFlags.empty()) throw UsageError("unknown flag");
+    if (!opFlags.empty())
+        throw UsageError("unknown flag");
     if (!opArgs.empty())
         throw UsageError("no arguments expected");
     /* Doesn't do anything right now; database tables are initialised
        automatically. */
 }
 
-
 /* Verify the consistency of the Nix environment. */
 static void opVerify(Strings opFlags, Strings opArgs)
 {
@@ -762,9 +815,12 @@ static void opVerify(Strings opFlags, Strings opArgs)
     RepairFlag repair = NoRepair;
 
     for (auto & i : opFlags)
-        if (i == "--check-contents") checkContents = true;
-        else if (i == "--repair") repair = Repair;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--check-contents")
+            checkContents = true;
+        else if (i == "--repair")
+            repair = Repair;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
     if (store->verifyStore(checkContents, repair)) {
         warn("not all store errors were fixed");
@@ -772,7 +828,6 @@ static void opVerify(Strings opFlags, Strings opArgs)
     }
 }
 
-
 /* Verify whether the contents of the given store path have not changed. */
 static void opVerifyPath(Strings opFlags, Strings opArgs)
 {
@@ -788,11 +843,12 @@ static void opVerifyPath(Strings opFlags, Strings opArgs)
         HashSink sink(info->narHash.algo);
         store->narFromPath(path, sink);
         auto current = sink.finish();
-        if (current.first != info->narHash) {
-            printError("path '%s' was modified! expected hash '%s', got '%s'",
+        if (current.hash != info->narHash) {
+            printError(
+                "path '%s' was modified! expected hash '%s', got '%s'",
                 store->printStorePath(path),
                 info->narHash.to_string(HashFormat::Nix32, true),
-                current.first.to_string(HashFormat::Nix32, true));
+                current.hash.to_string(HashFormat::Nix32, true));
             status = 1;
         }
     }
@@ -800,7 +856,6 @@ static void opVerifyPath(Strings opFlags, Strings opArgs)
     throw Exit(status);
 }
 
-
 /* Repair the contents of the given path by redownloading it using a
    substituter (if available). */
 static void opRepairPath(Strings opFlags, Strings opArgs)
@@ -827,24 +882,25 @@ static void opServe(Strings opFlags, Strings opArgs)
 {
     bool writeAllowed = false;
     for (auto & i : opFlags)
-        if (i == "--write") writeAllowed = true;
-        else throw UsageError("unknown flag '%1%'", i);
+        if (i == "--write")
+            writeAllowed = true;
+        else
+            throw UsageError("unknown flag '%1%'", i);
 
-    if (!opArgs.empty()) throw UsageError("no arguments expected");
+    if (!opArgs.empty())
+        throw UsageError("no arguments expected");
 
     FdSource in(STDIN_FILENO);
     FdSink out(getStandardOutput());
 
     /* Exchange the greeting. */
-    ServeProto::Version clientVersion =
-        ServeProto::BasicServerConnection::handshake(
-            out, in, SERVE_PROTOCOL_VERSION);
+    ServeProto::Version clientVersion = ServeProto::BasicServerConnection::handshake(out, in, SERVE_PROTOCOL_VERSION);
 
-    ServeProto::ReadConn rconn {
+    ServeProto::ReadConn rconn{
         .from = in,
         .version = clientVersion,
     };
-    ServeProto::WriteConn wconn {
+    ServeProto::WriteConn wconn{
         .to = out,
         .version = clientVersion,
     };
@@ -895,151 +951,141 @@ static void opServe(Strings opFlags, Strings opArgs)
 
         switch (cmd) {
 
-            case ServeProto::Command::QueryValidPaths: {
-                bool lock = readInt(in);
-                bool substitute = readInt(in);
-                auto paths = ServeProto::Serialise<StorePathSet>::read(*store, rconn);
-                if (lock && writeAllowed)
-                    for (auto & path : paths)
-                        store->addTempRoot(path);
+        case ServeProto::Command::QueryValidPaths: {
+            bool lock = readInt(in);
+            bool substitute = readInt(in);
+            auto paths = ServeProto::Serialise<StorePathSet>::read(*store, rconn);
+            if (lock && writeAllowed)
+                for (auto & path : paths)
+                    store->addTempRoot(path);
 
-                if (substitute && writeAllowed) {
-                    store->substitutePaths(paths);
-                }
-
-                ServeProto::write(*store, wconn, store->queryValidPaths(paths));
-                break;
+            if (substitute && writeAllowed) {
+                store->substitutePaths(paths);
             }
 
-            case ServeProto::Command::QueryPathInfos: {
-                auto paths = ServeProto::Serialise<StorePathSet>::read(*store, rconn);
-                // !!! Maybe we want a queryPathInfos?
-                for (auto & i : paths) {
-                    try {
-                        auto info = store->queryPathInfo(i);
-                        out << store->printStorePath(info->path);
-                        ServeProto::write(*store, wconn, static_cast<const UnkeyedValidPathInfo &>(*info));
-                    } catch (InvalidPath &) {
-                    }
-                }
-                out << "";
-                break;
-            }
-
-            case ServeProto::Command::DumpStorePath:
-                store->narFromPath(store->parseStorePath(readString(in)), out);
-                break;
-
-            case ServeProto::Command::ImportPaths: {
-                if (!writeAllowed) throw Error("importing paths is not allowed");
-                store->importPaths(in, NoCheckSigs); // FIXME: should we skip sig checking?
-                out << 1; // indicate success
-                break;
-            }
-
-            case ServeProto::Command::ExportPaths: {
-                readInt(in); // obsolete
-                store->exportPaths(ServeProto::Serialise<StorePathSet>::read(*store, rconn), out);
-                break;
-            }
-
-            case ServeProto::Command::BuildPaths: {
-
-                if (!writeAllowed) throw Error("building paths is not allowed");
-
-                std::vector<StorePathWithOutputs> paths;
-                for (auto & s : readStrings<Strings>(in))
-                    paths.push_back(parsePathWithOutputs(*store, s));
-
-                getBuildSettings();
+            ServeProto::write(*store, wconn, store->queryValidPaths(paths));
+            break;
+        }
 
+        case ServeProto::Command::QueryPathInfos: {
+            auto paths = ServeProto::Serialise<StorePathSet>::read(*store, rconn);
+            // !!! Maybe we want a queryPathInfos?
+            for (auto & i : paths) {
                 try {
-#ifndef _WIN32 // TODO figure out if Windows needs something similar
-                    MonitorFdHup monitor(in.fd);
-#endif
-                    store->buildPaths(toDerivedPaths(paths));
-                    out << 0;
-                } catch (Error & e) {
-                    assert(e.info().status);
-                    out << e.info().status << e.msg();
+                    auto info = store->queryPathInfo(i);
+                    out << store->printStorePath(info->path);
+                    ServeProto::write(*store, wconn, static_cast<const UnkeyedValidPathInfo &>(*info));
+                } catch (InvalidPath &) {
                 }
-                break;
             }
+            out << "";
+            break;
+        }
 
-            case ServeProto::Command::BuildDerivation: { /* Used by hydra-queue-runner. */
+        case ServeProto::Command::DumpStorePath:
+            store->narFromPath(store->parseStorePath(readString(in)), out);
+            break;
 
-                if (!writeAllowed) throw Error("building paths is not allowed");
+        case ServeProto::Command::BuildPaths: {
 
-                auto drvPath = store->parseStorePath(readString(in));
-                BasicDerivation drv;
-                readDerivation(in, *store, drv, Derivation::nameFromPath(drvPath));
+            if (!writeAllowed)
+                throw Error("building paths is not allowed");
 
-                getBuildSettings();
+            std::vector<StorePathWithOutputs> paths;
+            for (auto & s : readStrings<Strings>(in))
+                paths.push_back(parsePathWithOutputs(*store, s));
 
+            getBuildSettings();
+
+            try {
 #ifndef _WIN32 // TODO figure out if Windows needs something similar
                 MonitorFdHup monitor(in.fd);
 #endif
-                auto status = store->buildDerivation(drvPath, drv);
-
-                ServeProto::write(*store, wconn, status);
-                break;
+                store->buildPaths(toDerivedPaths(paths));
+                out << 0;
+            } catch (Error & e) {
+                assert(e.info().status);
+                out << e.info().status << e.msg();
             }
+            break;
+        }
 
-            case ServeProto::Command::QueryClosure: {
-                bool includeOutputs = readInt(in);
-                StorePathSet closure;
-                store->computeFSClosure(ServeProto::Serialise<StorePathSet>::read(*store, rconn),
-                    closure, false, includeOutputs);
-                ServeProto::write(*store, wconn, closure);
-                break;
-            }
+        case ServeProto::Command::BuildDerivation: { /* Used by hydra-queue-runner. */
 
-            case ServeProto::Command::AddToStoreNar: {
-                if (!writeAllowed) throw Error("importing paths is not allowed");
+            if (!writeAllowed)
+                throw Error("building paths is not allowed");
 
-                auto path = readString(in);
-                auto deriver = readString(in);
-                ValidPathInfo info {
-                    store->parseStorePath(path),
-                    Hash::parseAny(readString(in), HashAlgorithm::SHA256),
-                };
-                if (deriver != "")
-                    info.deriver = store->parseStorePath(deriver);
-                info.references = ServeProto::Serialise<StorePathSet>::read(*store, rconn);
-                in >> info.registrationTime >> info.narSize >> info.ultimate;
-                info.sigs = readStrings<StringSet>(in);
-                info.ca = ContentAddress::parseOpt(readString(in));
+            auto drvPath = store->parseStorePath(readString(in));
+            BasicDerivation drv;
+            readDerivation(in, *store, drv, Derivation::nameFromPath(drvPath));
 
-                if (info.narSize == 0)
-                    throw Error("narInfo is too old and missing the narSize field");
+            getBuildSettings();
 
-                SizedSource sizedSource(in, info.narSize);
+#ifndef _WIN32 // TODO figure out if Windows needs something similar
+            MonitorFdHup monitor(in.fd);
+#endif
+            auto status = store->buildDerivation(drvPath, drv);
 
-                store->addToStore(info, sizedSource, NoRepair, NoCheckSigs);
+            ServeProto::write(*store, wconn, status);
+            break;
+        }
 
-                // consume all the data that has been sent before continuing.
-                sizedSource.drainAll();
+        case ServeProto::Command::QueryClosure: {
+            bool includeOutputs = readInt(in);
+            StorePathSet closure;
+            store->computeFSClosure(
+                ServeProto::Serialise<StorePathSet>::read(*store, rconn), closure, false, includeOutputs);
+            ServeProto::write(*store, wconn, closure);
+            break;
+        }
 
-                out << 1; // indicate success
+        case ServeProto::Command::AddToStoreNar: {
+            if (!writeAllowed)
+                throw Error("importing paths is not allowed");
 
-                break;
-            }
+            auto path = readString(in);
+            auto deriver = readString(in);
+            ValidPathInfo info{
+                store->parseStorePath(path),
+                Hash::parseAny(readString(in), HashAlgorithm::SHA256),
+            };
+            if (deriver != "")
+                info.deriver = store->parseStorePath(deriver);
+            info.references = ServeProto::Serialise<StorePathSet>::read(*store, rconn);
+            in >> info.registrationTime >> info.narSize >> info.ultimate;
+            info.sigs = readStrings<StringSet>(in);
+            info.ca = ContentAddress::parseOpt(readString(in));
 
-            default:
-                throw Error("unknown serve command %1%", cmd);
+            if (info.narSize == 0)
+                throw Error("narInfo is too old and missing the narSize field");
+
+            SizedSource sizedSource(in, info.narSize);
+
+            store->addToStore(info, sizedSource, NoRepair, NoCheckSigs);
+
+            // consume all the data that has been sent before continuing.
+            sizedSource.drainAll();
+
+            out << 1; // indicate success
+
+            break;
+        }
+
+        default:
+            throw Error("unknown serve command %1%", cmd);
         }
 
         out.flush();
     }
 }
 
-
 static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs)
 {
     for (auto & i : opFlags)
         throw UsageError("unknown flag '%1%'", i);
 
-    if (opArgs.size() != 3) throw UsageError("three arguments expected");
+    if (opArgs.size() != 3)
+        throw UsageError("three arguments expected");
     auto i = opArgs.begin();
     std::string keyName = *i++;
     std::string secretKeyFile = *i++;
@@ -1052,17 +1098,15 @@ static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs)
     writeFile(secretKeyFile, secretKey.to_string());
 }
 
-
 static void opVersion(Strings opFlags, Strings opArgs)
 {
     printVersion("nix-store");
 }
 
-
 /* Scan the arguments; find the operation, set global flags, put all
    other flags in a list, and put all other arguments in another
    list. */
-static int main_nix_store(int argc, char * * argv)
+static int main_nix_store(int argc, char ** argv)
 {
     {
         Strings opFlags, opArgs;
@@ -1081,92 +1125,72 @@ static int main_nix_store(int argc, char * * argv)
             else if (*arg == "--realise" || *arg == "--realize" || *arg == "-r") {
                 op = opRealise;
                 opName = "-realise";
-            }
-            else if (*arg == "--add" || *arg == "-A"){
+            } else if (*arg == "--add" || *arg == "-A") {
                 op = opAdd;
                 opName = "-add";
-            }
-            else if (*arg == "--add-fixed") {
+            } else if (*arg == "--add-fixed") {
                 op = opAddFixed;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--print-fixed-path")
+            } else if (*arg == "--print-fixed-path")
                 op = opPrintFixedPath;
             else if (*arg == "--delete") {
                 op = opDelete;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--query" || *arg == "-q") {
+            } else if (*arg == "--query" || *arg == "-q") {
                 op = opQuery;
                 opName = "-query";
-            }
-            else if (*arg == "--print-env") {
+            } else if (*arg == "--print-env") {
                 op = opPrintEnv;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--read-log" || *arg == "-l") {
+            } else if (*arg == "--read-log" || *arg == "-l") {
                 op = opReadLog;
                 opName = "-read-log";
-            }
-            else if (*arg == "--dump-db") {
+            } else if (*arg == "--dump-db") {
                 op = opDumpDB;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--load-db") {
+            } else if (*arg == "--load-db") {
                 op = opLoadDB;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--register-validity")
+            } else if (*arg == "--register-validity")
                 op = opRegisterValidity;
             else if (*arg == "--check-validity")
                 op = opCheckValidity;
             else if (*arg == "--gc") {
                 op = opGC;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--dump") {
+            } else if (*arg == "--dump") {
                 op = opDump;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--restore") {
+            } else if (*arg == "--restore") {
                 op = opRestore;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--export") {
+            } else if (*arg == "--export") {
                 op = opExport;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--import") {
+            } else if (*arg == "--import") {
                 op = opImport;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--init")
+            } else if (*arg == "--init")
                 op = opInit;
             else if (*arg == "--verify") {
                 op = opVerify;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--verify-path") {
+            } else if (*arg == "--verify-path") {
                 op = opVerifyPath;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--repair-path") {
+            } else if (*arg == "--repair-path") {
                 op = opRepairPath;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--optimise" || *arg == "--optimize") {
+            } else if (*arg == "--optimise" || *arg == "--optimize") {
                 op = opOptimise;
                 opName = "-optimise";
-            }
-            else if (*arg == "--serve") {
+            } else if (*arg == "--serve") {
                 op = opServe;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--generate-binary-cache-key") {
+            } else if (*arg == "--generate-binary-cache-key") {
                 op = opGenerateBinaryCacheKey;
                 opName = arg->substr(1);
-            }
-            else if (*arg == "--add-root")
+            } else if (*arg == "--add-root")
                 gcRoot = absPath(getArg(*arg, arg, end));
             else if (*arg == "--stdin" && !isatty(STDIN_FILENO))
                 readFromStdIn = true;
@@ -1178,15 +1202,14 @@ static int main_nix_store(int argc, char * * argv)
                 opFlags.push_back(*arg);
                 if (*arg == "--max-freed" || *arg == "--max-links" || *arg == "--max-atime") /* !!! hack */
                     opFlags.push_back(getArg(*arg, arg, end));
-            }
-            else
+            } else
                 opArgs.push_back(*arg);
 
             if (readFromStdIn && op != opImport && op != opRestore && op != opServe) {
-                 std::string word;
-                 while (std::cin >> word) {
-                       opArgs.emplace_back(std::move(word));
-                 };
+                std::string word;
+                while (std::cin >> word) {
+                    opArgs.emplace_back(std::move(word));
+                };
             }
 
             if (oldOp && oldOp != op)
@@ -1195,8 +1218,10 @@ static int main_nix_store(int argc, char * * argv)
             return true;
         });
 
-        if (showHelp) showManPage("nix-store" + opName);
-        if (!op) throw UsageError("no operation specified");
+        if (showHelp)
+            showManPage("nix-store" + opName);
+        if (!op)
+            throw UsageError("no operation specified");
 
         if (op != opDump && op != opRestore) /* !!! hack */
             store = openStore();
@@ -1209,4 +1234,4 @@ static int main_nix_store(int argc, char * * argv)
 
 static RegisterLegacyCommand r_nix_store("nix-store", main_nix_store);
 
-}
+} // namespace nix_store
diff --git a/src/nix/nix.md b/src/nix/nix.md
index b88bd9a94..10a2aaee8 100644
--- a/src/nix/nix.md
+++ b/src/nix/nix.md
@@ -44,7 +44,7 @@ R""(
 Nix is a tool for building software, configurations and other
 artifacts in a reproducible and declarative way. For more information,
 see the [Nix homepage](https://nixos.org/) or the [Nix
-manual](https://nixos.org/manual/nix/stable/).
+manual](https://nix.dev/manual/nix/stable/).
 
 # Installables
 
diff --git a/src/nix/optimise-store.cc b/src/nix/optimise-store.cc
index e319f5c90..e000026fc 100644
--- a/src/nix/optimise-store.cc
+++ b/src/nix/optimise-store.cc
@@ -16,8 +16,8 @@ struct CmdOptimiseStore : StoreCommand
     std::string doc() override
     {
         return
-          #include "optimise-store.md"
-          ;
+#include "optimise-store.md"
+            ;
     }
 
     void run(ref<Store> store) override
diff --git a/src/nix/package.nix b/src/nix/package.nix
index 3d4f6f40b..8195e6c6f 100644
--- a/src/nix/package.nix
+++ b/src/nix/package.nix
@@ -33,15 +33,7 @@ mkMesonExecutable (finalAttrs: {
 
       # Symbolic links to other dirs
       ## exes
-      ./build-remote
       ./doc
-      ./nix-build
-      ./nix-channel
-      ./nix-collect-garbage
-      ./nix-copy-closure
-      ./nix-env
-      ./nix-instantiate
-      ./nix-store
       ## dirs
       ./scripts
       ../../scripts
@@ -55,8 +47,8 @@ mkMesonExecutable (finalAttrs: {
       ../../doc/manual/generate-store-info.nix
 
       # Other files to be included as string literals
-      ../nix-channel/unpack-channel.nix
-      ../nix-env/buildenv.nix
+      ./nix-channel/unpack-channel.nix
+      ./nix-env/buildenv.nix
       ./get-env.sh
       ./help-stores.md
       ../../doc/manual/source/store/types/index.md.in
@@ -65,24 +57,11 @@ mkMesonExecutable (finalAttrs: {
 
       # Files
     ]
-    ++
-      lib.concatMap
-        (dir: [
-          (fileset.fileFilter (file: file.hasExt "cc") dir)
-          (fileset.fileFilter (file: file.hasExt "hh") dir)
-          (fileset.fileFilter (file: file.hasExt "md") dir)
-        ])
-        [
-          ./.
-          ../build-remote
-          ../nix-build
-          ../nix-channel
-          ../nix-collect-garbage
-          ../nix-copy-closure
-          ../nix-env
-          ../nix-instantiate
-          ../nix-store
-        ]
+    ++ [
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+      (fileset.fileFilter (file: file.hasExt "md") ./.)
+    ]
   );
 
   buildInputs = [
diff --git a/src/nix/path-from-hash-part.cc b/src/nix/path-from-hash-part.cc
index 814b723f9..7e6c6ec28 100644
--- a/src/nix/path-from-hash-part.cc
+++ b/src/nix/path-from-hash-part.cc
@@ -23,8 +23,8 @@ struct CmdPathFromHashPart : StoreCommand
     std::string doc() override
     {
         return
-          #include "path-from-hash-part.md"
-          ;
+#include "path-from-hash-part.md"
+            ;
     }
 
     void run(ref<Store> store) override
diff --git a/src/nix/path-info.cc b/src/nix/path-info.cc
index 04af72646..fef3ae120 100644
--- a/src/nix/path-info.cc
+++ b/src/nix/path-info.cc
@@ -28,7 +28,6 @@ static uint64_t getStoreObjectsTotalSize(Store & store, const StorePathSet & clo
     return totalNarSize;
 }
 
-
 /**
  * Write a JSON representation of store object metadata, such as the
  * hash and the references.
@@ -36,10 +35,7 @@ static uint64_t getStoreObjectsTotalSize(Store & store, const StorePathSet & clo
  * @param showClosureSize If true, the closure size of each path is
  * included.
  */
-static json pathInfoToJSON(
-    Store & store,
-    const StorePathSet & storePaths,
-    bool showClosureSize)
+static json pathInfoToJSON(Store & store, const StorePathSet & storePaths, bool showClosureSize)
 {
     json::object_t jsonAllObjects = json::object();
 
@@ -70,7 +66,8 @@ static json pathInfoToJSON(
                         if (auto * depNarInfo = dynamic_cast<const NarInfo *>(&*depInfo))
                             totalDownloadSize += depNarInfo->fileSize;
                         else
-                            throw Error("Missing .narinfo for dep %s of %s",
+                            throw Error(
+                                "Missing .narinfo for dep %s of %s",
                                 store.printStorePath(p),
                                 store.printStorePath(storePath));
                     }
@@ -87,7 +84,6 @@ static json pathInfoToJSON(
     return jsonAllObjects;
 }
 
-
 struct CmdPathInfo : StorePathsCommand, MixJSON
 {
     bool showSize = false;
@@ -133,11 +129,14 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "path-info.md"
-          ;
+#include "path-info.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     void printSize(std::ostream & str, uint64_t value)
     {
@@ -186,15 +185,17 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
                 if (showSigs) {
                     str << '\t';
                     Strings ss;
-                    if (info->ultimate) ss.push_back("ultimate");
-                    if (info->ca) ss.push_back("ca:" + renderContentAddress(*info->ca));
-                    for (auto & sig : info->sigs) ss.push_back(sig);
+                    if (info->ultimate)
+                        ss.push_back("ultimate");
+                    if (info->ca)
+                        ss.push_back("ca:" + renderContentAddress(*info->ca));
+                    for (auto & sig : info->sigs)
+                        ss.push_back(sig);
                     str << concatStringsSep(" ", ss);
                 }
 
                 logger->cout(str.str());
             }
-
         }
     }
 };
diff --git a/src/nix/pch/precompiled-headers.hh b/src/nix/pch/precompiled-headers.hh
new file mode 100644
index 000000000..ab5856ea8
--- /dev/null
+++ b/src/nix/pch/precompiled-headers.hh
@@ -0,0 +1,6 @@
+#include "nix/cmd/command.hh"
+#include "nix/expr/eval.hh"
+#include "nix/main/shared.hh"
+#include "nix/store/derivations.hh"
+
+#include <nlohmann/json.hpp>
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 96dcdb4e8..26905e34c 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -12,6 +12,7 @@
 #include "nix/util/posix-source-accessor.hh"
 #include "nix/cmd/misc-store-flags.hh"
 #include "nix/util/terminal.hh"
+#include "nix/util/environment-variables.hh"
 
 #include "man-pages.hh"
 
@@ -23,18 +24,20 @@ using namespace nix;
    mirrors defined in Nixpkgs. */
 std::string resolveMirrorUrl(EvalState & state, const std::string & url)
 {
-    if (url.substr(0, 9) != "mirror://") return url;
+    if (url.substr(0, 9) != "mirror://")
+        return url;
 
     std::string s(url, 9);
     auto p = s.find('/');
-    if (p == std::string::npos) throw Error("invalid mirror URL '%s'", url);
+    if (p == std::string::npos)
+        throw Error("invalid mirror URL '%s'", url);
     std::string mirrorName(s, 0, p);
 
     Value vMirrors;
     // FIXME: use nixpkgs flake
-    state.eval(state.parseExprFromString(
-            "import <nixpkgs/pkgs/build-support/fetchurl/mirrors.nix>",
-            state.rootPath(CanonPath::root)),
+    state.eval(
+        state.parseExprFromString(
+            "import <nixpkgs/pkgs/build-support/fetchurl/mirrors.nix>", state.rootPath(CanonPath::root)),
         vMirrors);
     state.forceAttrs(vMirrors, noPos, "while evaluating the set of all mirrors");
 
@@ -46,22 +49,22 @@ std::string resolveMirrorUrl(EvalState & state, const std::string & url)
     if (mirrorList->value->listSize() < 1)
         throw Error("mirror URL '%s' did not expand to anything", url);
 
-    std::string mirror(state.forceString(*mirrorList->value->listView()[0], noPos, "while evaluating the first available mirror"));
+    std::string mirror(
+        state.forceString(*mirrorList->value->listView()[0], noPos, "while evaluating the first available mirror"));
     return mirror + (hasSuffix(mirror, "/") ? "" : "/") + s.substr(p + 1);
 }
 
 std::tuple<StorePath, Hash> prefetchFile(
-        ref<Store> store,
-        std::string_view url,
-        std::optional<std::string> name,
-        HashAlgorithm hashAlgo,
-        std::optional<Hash> expectedHash,
-        bool unpack,
-        bool executable)
+    ref<Store> store,
+    std::string_view url,
+    std::optional<std::string> name,
+    HashAlgorithm hashAlgo,
+    std::optional<Hash> expectedHash,
+    bool unpack,
+    bool executable)
 {
-    ContentAddressMethod method = unpack || executable
-        ? ContentAddressMethod::Raw::NixArchive
-        : ContentAddressMethod::Raw::Flat;
+    ContentAddressMethod method =
+        unpack || executable ? ContentAddressMethod::Raw::NixArchive : ContentAddressMethod::Raw::Flat;
 
     /* Figure out a name in the Nix store. */
     if (!name) {
@@ -77,10 +80,8 @@ std::tuple<StorePath, Hash> prefetchFile(
        the store. */
     if (expectedHash) {
         hashAlgo = expectedHash->algo;
-        storePath = store->makeFixedOutputPathFromCA(*name, ContentAddressWithReferences::fromParts(
-            method,
-            *expectedHash,
-            {}));
+        storePath =
+            store->makeFixedOutputPathFromCA(*name, ContentAddressWithReferences::fromParts(method, *expectedHash, {}));
         if (store->isValidPath(*storePath))
             hash = expectedHash;
         else
@@ -99,19 +100,19 @@ std::tuple<StorePath, Hash> prefetchFile(
                 mode = 0700;
 
             AutoCloseFD fd = toDescriptor(open(tmpFile.string().c_str(), O_WRONLY | O_CREAT | O_EXCL, mode));
-            if (!fd) throw SysError("creating temporary file '%s'", tmpFile);
+            if (!fd)
+                throw SysError("creating temporary file '%s'", tmpFile);
 
             FdSink sink(fd.get());
 
-            FileTransferRequest req(url);
+            FileTransferRequest req(ValidURL{url});
             req.decompress = false;
             getFileTransfer()->download(std::move(req), sink);
         }
 
         /* Optionally unpack the file. */
         if (unpack) {
-            Activity act(*logger, lvlChatty, actUnknown,
-                fmt("unpacking '%s'", url));
+            Activity act(*logger, lvlChatty, actUnknown, fmt("unpacking '%s'", url));
             auto unpacked = (tmpDir.path() / "unpacked").string();
             createDirs(unpacked);
             unpackTarfile(tmpFile.string(), unpacked);
@@ -127,12 +128,10 @@ std::tuple<StorePath, Hash> prefetchFile(
             }
         }
 
-        Activity act(*logger, lvlChatty, actUnknown,
-            fmt("adding '%s' to the store", url));
+        Activity act(*logger, lvlChatty, actUnknown, fmt("adding '%s' to the store", url));
 
         auto info = store->addToStoreSlow(
-            *name, PosixSourceAccessor::createAtRoot(tmpFile),
-            method, hashAlgo, {}, expectedHash);
+            *name, PosixSourceAccessor::createAtRoot(tmpFile), method, hashAlgo, {}, expectedHash);
         storePath = info.path;
         assert(info.ca);
         hash = info.ca->hash;
@@ -141,7 +140,7 @@ std::tuple<StorePath, Hash> prefetchFile(
     return {storePath.value(), hash.value()};
 }
 
-static int main_nix_prefetch_url(int argc, char * * argv)
+static int main_nix_prefetch_url(int argc, char ** argv)
 {
     {
         HashAlgorithm ha = HashAlgorithm::SHA256;
@@ -166,14 +165,12 @@ static int main_nix_prefetch_url(int argc, char * * argv)
             else if (*arg == "--type") {
                 auto s = getArg(*arg, arg, end);
                 ha = parseHashAlgo(s);
-            }
-            else if (*arg == "--print-path")
+            } else if (*arg == "--print-path")
                 printPath = true;
             else if (*arg == "--attr" || *arg == "-A") {
                 fromExpr = true;
                 attrPath = getArg(*arg, arg, end);
-            }
-            else if (*arg == "--unpack")
+            } else if (*arg == "--unpack")
                 unpack = true;
             else if (*arg == "--executable")
                 executable = true;
@@ -207,10 +204,7 @@ static int main_nix_prefetch_url(int argc, char * * argv)
             url = args[0];
         } else {
             Value vRoot;
-            state->evalFile(
-                resolveExprPath(
-                    lookupFileArg(*state, args.empty() ? "." : args[0])),
-                vRoot);
+            state->evalFile(resolveExprPath(lookupFileArg(*state, args.empty() ? "." : args[0])), vRoot);
             Value & v(*findAlongAttrPath(*state, attrPath, autoArgs, vRoot).first);
             state->forceAttrs(v, noPos, "while evaluating the source attribute to prefetch");
 
@@ -221,20 +215,24 @@ static int main_nix_prefetch_url(int argc, char * * argv)
             state->forceList(*attr->value, noPos, "while evaluating the urls to prefetch");
             if (attr->value->listSize() < 1)
                 throw Error("'urls' list is empty");
-            url = state->forceString(*attr->value->listView()[0], noPos, "while evaluating the first url from the urls list");
+            url = state->forceString(
+                *attr->value->listView()[0], noPos, "while evaluating the first url from the urls list");
 
             /* Extract the hash mode. */
             auto attr2 = v.attrs()->get(state->symbols.create("outputHashMode"));
             if (!attr2)
                 printInfo("warning: this does not look like a fetchurl call");
             else
-                unpack = state->forceString(*attr2->value, noPos, "while evaluating the outputHashMode of the source to prefetch") == "recursive";
+                unpack = state->forceString(
+                             *attr2->value, noPos, "while evaluating the outputHashMode of the source to prefetch")
+                         == "recursive";
 
             /* Extract the name. */
             if (!name) {
                 auto attr3 = v.attrs()->get(state->symbols.create("name"));
                 if (!attr3)
-                    name = state->forceString(*attr3->value, noPos, "while evaluating the name of the source to prefetch");
+                    name =
+                        state->forceString(*attr3->value, noPos, "while evaluating the name of the source to prefetch");
             }
         }
 
@@ -242,15 +240,17 @@ static int main_nix_prefetch_url(int argc, char * * argv)
         if (args.size() == 2)
             expectedHash = Hash::parseAny(args[1], ha);
 
-        auto [storePath, hash] = prefetchFile(
-            store, resolveMirrorUrl(*state, url), name, ha, expectedHash, unpack, executable);
+        auto [storePath, hash] =
+            prefetchFile(store, resolveMirrorUrl(*state, url), name, ha, expectedHash, unpack, executable);
 
         logger->stop();
 
         if (!printPath)
             printInfo("path is '%s'", store->printStorePath(storePath));
 
-        logger->cout(printHash16or32(hash));
+        assert(static_cast<char>(hash.algo));
+        logger->cout(hash.to_string(hash.algo == HashAlgorithm::MD5 ? HashFormat::Base16 : HashFormat::Nix32, false));
+
         if (printPath)
             logger->cout(store->printStorePath(storePath));
 
@@ -273,7 +273,8 @@ struct CmdStorePrefetchFile : StoreCommand, MixJSON
     {
         addFlag({
             .longName = "name",
-            .description = "Override the name component of the resulting store path. It defaults to the base name of *url*.",
+            .description =
+                "Override the name component of the resulting store path. It defaults to the base name of *url*.",
             .labels = {"name"},
             .handler = {&name},
         });
@@ -282,26 +283,22 @@ struct CmdStorePrefetchFile : StoreCommand, MixJSON
             .longName = "expected-hash",
             .description = "The expected hash of the file.",
             .labels = {"hash"},
-            .handler = {[&](std::string s) {
-                expectedHash = Hash::parseAny(s, hashAlgo);
-            }},
+            .handler = {[&](std::string s) { expectedHash = Hash::parseAny(s, hashAlgo); }},
         });
 
         addFlag(flag::hashAlgo("hash-type", &hashAlgo));
 
         addFlag({
             .longName = "executable",
-            .description =
-                "Make the resulting file executable. Note that this causes the "
-                "resulting hash to be a NAR hash rather than a flat file hash.",
+            .description = "Make the resulting file executable. Note that this causes the "
+                           "resulting hash to be a NAR hash rather than a flat file hash.",
             .handler = {&executable, true},
         });
 
         addFlag({
             .longName = "unpack",
-            .description =
-                "Unpack the archive (which must be a tarball or zip file) and add "
-                "the result to the Nix store.",
+            .description = "Unpack the archive (which must be a tarball or zip file) and add "
+                           "the result to the Nix store.",
             .handler = {&unpack, true},
         });
 
@@ -316,9 +313,10 @@ struct CmdStorePrefetchFile : StoreCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "store-prefetch-file.md"
-          ;
+#include "store-prefetch-file.md"
+            ;
     }
+
     void run(ref<Store> store) override
     {
         auto [storePath, hash] = prefetchFile(store, url, name, hashAlgo, expectedHash, unpack, executable);
@@ -329,7 +327,8 @@ struct CmdStorePrefetchFile : StoreCommand, MixJSON
             res["hash"] = hash.to_string(HashFormat::SRI, true);
             printJSON(res);
         } else {
-            notice("Downloaded '%s' to '%s' (hash '%s').",
+            notice(
+                "Downloaded '%s' to '%s' (hash '%s').",
                 url,
                 store->printStorePath(storePath),
                 hash.to_string(HashFormat::SRI, true));
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 2c593729f..68005171f 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -7,7 +7,7 @@
 #include "nix/util/archive.hh"
 #include "nix/store/builtins/buildenv.hh"
 #include "nix/flake/flakeref.hh"
-#include "../nix-env/user-env.hh"
+#include "nix-env/user-env.hh"
 #include "nix/store/profiles.hh"
 #include "nix/store/names.hh"
 #include "nix/util/url.hh"
@@ -30,12 +30,11 @@ struct ProfileElementSource
     ExtendedOutputsSpec outputs;
 
     // TODO libc++ 16 (used by darwin) missing `std::set::operator <=>`, can't do yet.
-    //auto operator <=> (const ProfileElementSource & other) const
-    auto operator < (const ProfileElementSource & other) const
+    // auto operator <=> (const ProfileElementSource & other) const
+    auto operator<(const ProfileElementSource & other) const
     {
-        return
-            std::tuple(originalRef.to_string(), attrPath, outputs) <
-            std::tuple(other.originalRef.to_string(), other.attrPath, other.outputs);
+        return std::tuple(originalRef.to_string(), attrPath, outputs)
+               < std::tuple(other.originalRef.to_string(), other.attrPath, other.outputs);
     }
 
     std::string to_string() const
@@ -85,22 +84,19 @@ struct ProfileElement
         return showVersions(versions);
     }
 
-    void updateStorePaths(
-        ref<Store> evalStore,
-        ref<Store> store,
-        const BuiltPaths & builtPaths)
+    void updateStorePaths(ref<Store> evalStore, ref<Store> store, const BuiltPaths & builtPaths)
     {
         storePaths.clear();
         for (auto & buildable : builtPaths) {
-            std::visit(overloaded {
-                [&](const BuiltPath::Opaque & bo) {
-                    storePaths.insert(bo.path);
+            std::visit(
+                overloaded{
+                    [&](const BuiltPath::Opaque & bo) { storePaths.insert(bo.path); },
+                    [&](const BuiltPath::Built & bfd) {
+                        for (auto & output : bfd.outputs)
+                            storePaths.insert(output.second);
+                    },
                 },
-                [&](const BuiltPath::Built & bfd) {
-                    for (auto & output : bfd.outputs)
-                        storePaths.insert(output.second);
-                },
-            }, buildable.raw());
+                buildable.raw());
         }
     }
 };
@@ -109,7 +105,8 @@ std::string getNameFromElement(const ProfileElement & element)
 {
     std::optional<std::string> result = std::nullopt;
     if (element.source) {
-        result = getNameFromURL(parseURL(element.source->to_string()));
+        // Seems to be for Flake URLs
+        result = getNameFromURL(parseURL(element.source->to_string(), /*lenient=*/true));
     }
     return result.value_or(element.identifier());
 }
@@ -120,7 +117,7 @@ struct ProfileManifest
 
     std::map<ProfileElementName, ProfileElement> elements;
 
-    ProfileManifest() { }
+    ProfileManifest() {}
 
     ProfileManifest(EvalState & state, const std::filesystem::path & profile)
     {
@@ -133,17 +130,17 @@ struct ProfileManifest
             std::string sUrl;
             std::string sOriginalUrl;
             switch (version) {
-                case 1:
-                    sUrl = "uri";
-                    sOriginalUrl = "originalUri";
-                    break;
-                case 2:
-                case 3:
-                    sUrl = "url";
-                    sOriginalUrl = "originalUrl";
-                    break;
-                default:
-                    throw Error("profile manifest '%s' has unsupported version %d", manifestPath, version);
+            case 1:
+                sUrl = "uri";
+                sOriginalUrl = "originalUri";
+                break;
+            case 2:
+            case 3:
+                sUrl = "url";
+                sOriginalUrl = "originalUrl";
+                break;
+            default:
+                throw Error("profile manifest '%s' has unsupported version %d", manifestPath, version);
             }
 
             auto elems = json["elements"];
@@ -153,24 +150,26 @@ struct ProfileManifest
                 for (auto & p : e["storePaths"])
                     element.storePaths.insert(state.store->parseStorePath((std::string) p));
                 element.active = e["active"];
-                if(e.contains("priority")) {
+                if (e.contains("priority")) {
                     element.priority = e["priority"];
                 }
                 if (e.value(sUrl, "") != "") {
-                    element.source = ProfileElementSource {
+                    element.source = ProfileElementSource{
                         parseFlakeRef(fetchSettings, e[sOriginalUrl]),
                         parseFlakeRef(fetchSettings, e[sUrl]),
                         e["attrPath"],
-                        e["outputs"].get<ExtendedOutputsSpec>()
-                    };
+                        e["outputs"].get<ExtendedOutputsSpec>()};
                 }
 
-                std::string name =
-                    elems.is_object()
-                    ? elem.key()
-                    : element.source
-                    ? getNameFromURL(parseURL(element.source->to_string())).value_or(element.identifier())
-                    : element.identifier();
+                std::string name = [&] {
+                    if (elems.is_object())
+                        return elem.key();
+                    if (element.source) {
+                        if (auto optName = getNameFromURL(parseURL(element.source->to_string(), /*lenient=*/true)))
+                            return *optName;
+                    }
+                    return element.identifier();
+                }();
 
                 addElement(name, std::move(element));
             }
@@ -258,20 +257,20 @@ struct ProfileManifest
 
         auto narHash = hashString(HashAlgorithm::SHA256, sink.s);
 
-        ValidPathInfo info {
+        auto info = ValidPathInfo::makeFromCA(
             *store,
             "profile",
-            FixedOutputInfo {
+            FixedOutputInfo{
                 .method = FileIngestionMethod::NixArchive,
                 .hash = narHash,
-                .references = {
-                    .others = std::move(references),
-                    // profiles never refer to themselves
-                    .self = false,
-                },
+                .references =
+                    {
+                        .others = std::move(references),
+                        // profiles never refer to themselves
+                        .self = false,
+                    },
             },
-            narHash,
-        };
+            narHash);
         info.narSize = sink.s.size();
 
         StringSource source(sink.s);
@@ -292,13 +291,11 @@ struct ProfileManifest
                 logger->cout("%s%s: ∅ -> %s", indent, j->second.identifier(), j->second.versions());
                 changes = true;
                 ++j;
-            }
-            else if (i != prev.elements.end() && (j == cur.elements.end() || i->first < j->first)) {
+            } else if (i != prev.elements.end() && (j == cur.elements.end() || i->first < j->first)) {
                 logger->cout("%s%s: %s -> ∅", indent, i->second.identifier(), i->second.versions());
                 changes = true;
                 ++i;
-            }
-            else {
+            } else {
                 auto v1 = i->second.versions();
                 auto v2 = j->second.versions();
                 if (v1 != v2) {
@@ -316,18 +313,16 @@ struct ProfileManifest
 };
 
 static std::map<Installable *, std::pair<BuiltPaths, ref<ExtraPathInfo>>>
-builtPathsPerInstallable(
-    const std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> & builtPaths)
+builtPathsPerInstallable(const std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> & builtPaths)
 {
     std::map<Installable *, std::pair<BuiltPaths, ref<ExtraPathInfo>>> res;
     for (auto & [installable, builtPath] : builtPaths) {
-        auto & r = res.insert({
-            &*installable,
-            {
-                {},
-                make_ref<ExtraPathInfo>(),
-            }
-        }).first->second;
+        auto & r = res.insert({&*installable,
+                               {
+                                   {},
+                                   make_ref<ExtraPathInfo>(),
+                               }})
+                       .first->second;
         /* Note that there could be conflicting info
            (e.g. meta.priority fields) if the installable returned
            multiple derivations. So pick one arbitrarily. FIXME:
@@ -342,7 +337,8 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
 {
     std::optional<int64_t> priority;
 
-    CmdProfileAdd() {
+    CmdProfileAdd()
+    {
         addFlag({
             .longName = "priority",
             .description = "The priority of the package to add.",
@@ -359,8 +355,8 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
     std::string doc() override
     {
         return
-          #include "profile-add.md"
-          ;
+#include "profile-add.md"
+            ;
     }
 
     void run(ref<Store> store, Installables && installables) override
@@ -368,18 +364,18 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
         ProfileManifest manifest(*getEvalState(), *profile);
 
         auto builtPaths = builtPathsPerInstallable(
-            Installable::build2(
-                getEvalStore(), store, Realise::Outputs, installables, bmNormal));
+            Installable::build2(getEvalStore(), store, Realise::Outputs, installables, bmNormal));
 
         for (auto & installable : installables) {
             ProfileElement element;
 
             auto iter = builtPaths.find(&*installable);
-            if (iter == builtPaths.end()) continue;
+            if (iter == builtPaths.end())
+                continue;
             auto & [res, info] = iter->second;
 
             if (auto * info2 = dynamic_cast<ExtraPathInfoFlake *>(&*info)) {
-                element.source = ProfileElementSource {
+                element.source = ProfileElementSource{
                     .originalRef = info2->flake.originalRef,
                     .lockedRef = info2->flake.lockedRef,
                     .attrPath = info2->value.attrPath,
@@ -389,15 +385,10 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
 
             // If --priority was specified we want to override the
             // priority of the installable.
-            element.priority =
-                priority
-                ? *priority
-                : ({
-                    auto * info2 = dynamic_cast<ExtraPathInfoValue *>(&*info);
-                    info2
-                        ? info2->value.priority.value_or(defaultPriority)
-                        : defaultPriority;
-                });
+            element.priority = priority ? *priority : ({
+                auto * info2 = dynamic_cast<ExtraPathInfoValue *>(&*info);
+                info2 ? info2->value.priority.value_or(defaultPriority) : defaultPriority;
+            });
 
             element.updateStorePaths(getEvalStore(), store, res);
 
@@ -409,12 +400,9 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
                 auto existingElement = existingPair->second;
                 auto existingSource = existingElement.source;
                 auto elementSource = element.source;
-                if (existingSource
-                    && elementSource
-                    && existingElement.priority == element.priority
+                if (existingSource && elementSource && existingElement.priority == element.priority
                     && existingSource->originalRef == elementSource->originalRef
-                    && existingSource->attrPath == elementSource->attrPath
-                    ) {
+                    && existingSource->attrPath == elementSource->attrPath) {
                     warn("'%s' is already added", elementName);
                     continue;
                 }
@@ -427,7 +415,8 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
             updateProfile(manifest.build(store));
         } catch (BuildEnvFileConflictError & conflictError) {
             // FIXME use C++20 std::ranges once macOS has it
-            //       See https://github.com/NixOS/nix/compare/3efa476c5439f8f6c1968a6ba20a31d1239c2f04..1fe5d172ece51a619e879c4b86f603d9495cc102
+            //       See
+            //       https://github.com/NixOS/nix/compare/3efa476c5439f8f6c1968a6ba20a31d1239c2f04..1fe5d172ece51a619e879c4b86f603d9495cc102
             auto findRefByFilePath = [&]<typename Iterator>(Iterator begin, Iterator end) {
                 for (auto it = begin; it != end; it++) {
                     auto & [name, profileElement] = *it;
@@ -445,9 +434,11 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
             // There are 2 conflicting files. We need to find out which one is from the already installed package and
             // which one is the package that is the new package that is being installed.
             // The first matching package is the one that was already installed (original).
-            auto [originalConflictingFilePath, originalEntryName, originalConflictingRefs] = findRefByFilePath(manifest.elements.begin(), manifest.elements.end());
+            auto [originalConflictingFilePath, originalEntryName, originalConflictingRefs] =
+                findRefByFilePath(manifest.elements.begin(), manifest.elements.end());
             // The last matching package is the one that was going to be installed (new).
-            auto [newConflictingFilePath, newEntryName, newConflictingRefs] = findRefByFilePath(manifest.elements.rbegin(), manifest.elements.rend());
+            auto [newConflictingFilePath, newEntryName, newConflictingRefs] =
+                findRefByFilePath(manifest.elements.rbegin(), manifest.elements.rend());
 
             throw Error(
                 "An existing package already provides the following file:\n"
@@ -477,15 +468,15 @@ struct CmdProfileAdd : InstallablesCommand, MixDefaultProfile
                 concatStringsSep(" ", newConflictingRefs),
                 conflictError.priority,
                 conflictError.priority - 1,
-                conflictError.priority + 1
-            );
+                conflictError.priority + 1);
         }
     }
 };
 
 struct Matcher
 {
-    virtual ~Matcher() { }
+    virtual ~Matcher() {}
+
     virtual std::string getTitle() = 0;
     virtual bool matches(const std::string & name, const ProfileElement & element) = 0;
 };
@@ -495,8 +486,11 @@ struct RegexMatcher final : public Matcher
     std::regex regex;
     std::string pattern;
 
-    RegexMatcher(const std::string & pattern) : regex(pattern, std::regex::extended | std::regex::icase), pattern(pattern)
-    { }
+    RegexMatcher(const std::string & pattern)
+        : regex(pattern, std::regex::extended | std::regex::icase)
+        , pattern(pattern)
+    {
+    }
 
     std::string getTitle() override
     {
@@ -513,8 +507,10 @@ struct StorePathMatcher final : public Matcher
 {
     nix::StorePath storePath;
 
-    StorePathMatcher(const nix::StorePath & storePath) : storePath(storePath)
-    { }
+    StorePathMatcher(const nix::StorePath & storePath)
+        : storePath(storePath)
+    {
+    }
 
     std::string getTitle() override
     {
@@ -531,8 +527,10 @@ struct NameMatcher final : public Matcher
 {
     std::string name;
 
-    NameMatcher(const std::string & name) : name(name)
-    { }
+    NameMatcher(const std::string & name)
+        : name(name)
+    {
+    }
 
     std::string getTitle() override
     {
@@ -572,40 +570,43 @@ public:
             .longName = "all",
             .description = "Match all packages in the profile.",
             .handler = {[this]() {
-                _matchers.push_back(ref<AllMatcher>(std::shared_ptr<AllMatcher>(&all, [](AllMatcher*) {})));
+                _matchers.push_back(ref<AllMatcher>(std::shared_ptr<AllMatcher>(&all, [](AllMatcher *) {})));
             }},
         });
         addFlag({
             .longName = "regex",
             .description = "A regular expression to match one or more packages in the profile.",
             .labels = {"pattern"},
-            .handler = {[this](std::string arg) {
-                _matchers.push_back(make_ref<RegexMatcher>(arg));
-            }},
-        });
-        expectArgs({
-            .label = "elements",
-            .optional = true,
-            .handler = {[this](std::vector<std::string> args) {
-                for (auto & arg : args) {
-                    if (auto n = string2Int<size_t>(arg)) {
-                        throw Error("'nix profile' no longer supports indices ('%d')", *n);
-                    } else if (getStore()->isStorePath(arg)) {
-                        _matchers.push_back(make_ref<StorePathMatcher>(getStore()->parseStorePath(arg)));
-                    } else {
-                        _matchers.push_back(make_ref<NameMatcher>(arg));
-                    }
-                }
-            }}
+            .handler = {[this](std::string arg) { _matchers.push_back(make_ref<RegexMatcher>(arg)); }},
         });
+        expectArgs(
+            {.label = "elements",
+             .optional = true,
+             .handler = {[this](std::vector<std::string> args) {
+                 for (auto & arg : args) {
+                     if (auto n = string2Int<size_t>(arg)) {
+                         throw Error("'nix profile' no longer supports indices ('%d')", *n);
+                     } else if (getStore()->isStorePath(arg)) {
+                         _matchers.push_back(make_ref<StorePathMatcher>(getStore()->parseStorePath(arg)));
+                     } else {
+                         _matchers.push_back(make_ref<NameMatcher>(arg));
+                     }
+                 }
+             }}});
     }
 
-    StringSet getMatchingElementNames(ProfileManifest & manifest) {
+    StringSet getMatchingElementNames(ProfileManifest & manifest)
+    {
         if (_matchers.empty()) {
             throw UsageError("No packages specified.");
         }
 
-        if (std::find_if(_matchers.begin(), _matchers.end(), [](const ref<Matcher> & m) { return m.dynamic_pointer_cast<AllMatcher>(); }) != _matchers.end() && _matchers.size() > 1) {
+        if (std::find_if(
+                _matchers.begin(),
+                _matchers.end(),
+                [](const ref<Matcher> & m) { return m.dynamic_pointer_cast<AllMatcher>(); })
+                != _matchers.end()
+            && _matchers.size() > 1) {
             throw UsageError("--all cannot be used with package names or regular expressions.");
         }
 
@@ -641,8 +642,8 @@ struct CmdProfileRemove : virtual EvalCommand, MixDefaultProfile, MixProfileElem
     std::string doc() override
     {
         return
-          #include "profile-remove.md"
-          ;
+#include "profile-remove.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -654,7 +655,7 @@ struct CmdProfileRemove : virtual EvalCommand, MixDefaultProfile, MixProfileElem
         auto matchingElementNames = getMatchingElementNames(oldManifest);
 
         if (matchingElementNames.empty()) {
-            warn ("No packages to remove. Use 'nix profile list' to see the current profile.");
+            warn("No packages to remove. Use 'nix profile list' to see the current profile.");
             return;
         }
 
@@ -665,9 +666,7 @@ struct CmdProfileRemove : virtual EvalCommand, MixDefaultProfile, MixProfileElem
         }
 
         auto removedCount = oldManifest.elements.size() - newManifest.elements.size();
-        printInfo("removed %d packages, kept %d packages",
-            removedCount,
-            newManifest.elements.size());
+        printInfo("removed %d packages, kept %d packages", removedCount, newManifest.elements.size());
 
         updateProfile(newManifest.build(store));
     }
@@ -683,8 +682,8 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
     std::string doc() override
     {
         return
-          #include "profile-upgrade.md"
-          ;
+#include "profile-upgrade.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -721,8 +720,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
 
             upgradedCount++;
 
-            Activity act(*logger, lvlChatty, actUnknown,
-                fmt("checking '%s' for updates", element.source->attrPath));
+            Activity act(*logger, lvlChatty, actUnknown, fmt("checking '%s' for updates", element.source->attrPath));
 
             auto installable = make_ref<InstallableFlake>(
                 this,
@@ -735,20 +733,23 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
                 lockFlags);
 
             auto derivedPaths = installable->toDerivedPaths();
-            if (derivedPaths.empty()) continue;
+            if (derivedPaths.empty())
+                continue;
             auto * infop = dynamic_cast<ExtraPathInfoFlake *>(&*derivedPaths[0].info);
             // `InstallableFlake` should use `ExtraPathInfoFlake`.
             assert(infop);
             auto & info = *infop;
 
-            if (info.flake.lockedRef.input.isLocked()
-                && element.source->lockedRef == info.flake.lockedRef)
+            if (info.flake.lockedRef.input.isLocked() && element.source->lockedRef == info.flake.lockedRef)
                 continue;
 
-            printInfo("upgrading '%s' from flake '%s' to '%s'",
-                element.source->attrPath, element.source->lockedRef, info.flake.lockedRef);
+            printInfo(
+                "upgrading '%s' from flake '%s' to '%s'",
+                element.source->attrPath,
+                element.source->lockedRef,
+                info.flake.lockedRef);
 
-            element.source = ProfileElementSource {
+            element.source = ProfileElementSource{
                 .originalRef = installable->flakeRef,
                 .lockedRef = info.flake.lockedRef,
                 .attrPath = info.value.attrPath,
@@ -765,16 +766,12 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
         }
 
         auto builtPaths = builtPathsPerInstallable(
-            Installable::build2(
-                getEvalStore(), store, Realise::Outputs, installables, bmNormal));
+            Installable::build2(getEvalStore(), store, Realise::Outputs, installables, bmNormal));
 
         for (size_t i = 0; i < installables.size(); ++i) {
             auto & installable = installables.at(i);
             auto & element = *elems.at(i);
-            element.updateStorePaths(
-                getEvalStore(),
-                store,
-                builtPaths.find(&*installable)->second.first);
+            element.updateStorePaths(getEvalStore(), store, builtPaths.find(&*installable)->second.first);
         }
 
         updateProfile(manifest.build(store));
@@ -791,8 +788,8 @@ struct CmdProfileList : virtual EvalCommand, virtual StoreCommand, MixDefaultPro
     std::string doc() override
     {
         return
-          #include "profile-list.md"
-          ;
+#include "profile-list.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -804,16 +801,20 @@ struct CmdProfileList : virtual EvalCommand, virtual StoreCommand, MixDefaultPro
         } else {
             for (const auto & [i, e] : enumerate(manifest.elements)) {
                 auto & [name, element] = e;
-                if (i) logger->cout("");
-                logger->cout("Name:               " ANSI_BOLD "%s" ANSI_NORMAL "%s",
+                if (i)
+                    logger->cout("");
+                logger->cout(
+                    "Name:               " ANSI_BOLD "%s" ANSI_NORMAL "%s",
                     name,
                     element.active ? "" : " " ANSI_RED "(inactive)" ANSI_NORMAL);
                 if (element.source) {
-                    logger->cout("Flake attribute:    %s%s", element.source->attrPath, element.source->outputs.to_string());
+                    logger->cout(
+                        "Flake attribute:    %s%s", element.source->attrPath, element.source->outputs.to_string());
                     logger->cout("Original flake URL: %s", element.source->originalRef.to_string());
                     logger->cout("Locked flake URL:   %s", element.source->lockedRef.to_string());
                 }
-                logger->cout("Store paths:        %s", concatStringsSep(" ", store->printStorePathSet(element.storePaths)));
+                logger->cout(
+                    "Store paths:        %s", concatStringsSep(" ", store->printStorePathSet(element.storePaths)));
             }
         }
     }
@@ -829,8 +830,8 @@ struct CmdProfileDiffClosures : virtual StoreCommand, MixDefaultProfile
     std::string doc() override
     {
         return
-          #include "profile-diff-closures.md"
-          ;
+#include "profile-diff-closures.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -842,13 +843,12 @@ struct CmdProfileDiffClosures : virtual StoreCommand, MixDefaultProfile
 
         for (auto & gen : gens) {
             if (prevGen) {
-                if (!first) logger->cout("");
+                if (!first)
+                    logger->cout("");
                 first = false;
                 logger->cout("Version %d -> %d:", prevGen->number, gen.number);
-                printClosureDiff(store,
-                    store->followLinksToStorePath(prevGen->path),
-                    store->followLinksToStorePath(gen.path),
-                    "  ");
+                printClosureDiff(
+                    store, store->followLinksToStorePath(prevGen->path), store->followLinksToStorePath(gen.path), "  ");
             }
 
             prevGen = gen;
@@ -866,8 +866,8 @@ struct CmdProfileHistory : virtual StoreCommand, EvalCommand, MixDefaultProfile
     std::string doc() override
     {
         return
-          #include "profile-history.md"
-          ;
+#include "profile-history.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -880,19 +880,18 @@ struct CmdProfileHistory : virtual StoreCommand, EvalCommand, MixDefaultProfile
         for (auto & gen : gens) {
             ProfileManifest manifest(*getEvalState(), gen.path);
 
-            if (!first) logger->cout("");
+            if (!first)
+                logger->cout("");
             first = false;
 
-            logger->cout("Version %s%d" ANSI_NORMAL " (%s)%s:",
+            logger->cout(
+                "Version %s%d" ANSI_NORMAL " (%s)%s:",
                 gen.number == curGen ? ANSI_GREEN : ANSI_BOLD,
                 gen.number,
                 std::put_time(std::gmtime(&gen.creationTime), "%Y-%m-%d"),
                 prevGen ? fmt(" <- %d", prevGen->first.number) : "");
 
-            ProfileManifest::printDiff(
-                prevGen ? prevGen->second : ProfileManifest(),
-                manifest,
-                "  ");
+            ProfileManifest::printDiff(prevGen ? prevGen->second : ProfileManifest(), manifest, "  ");
 
             prevGen = {gen, std::move(manifest)};
         }
@@ -921,8 +920,8 @@ struct CmdProfileRollback : virtual StoreCommand, MixDefaultProfile, MixDryRun
     std::string doc() override
     {
         return
-          #include "profile-rollback.md"
-          ;
+#include "profile-rollback.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -939,10 +938,9 @@ struct CmdProfileWipeHistory : virtual StoreCommand, MixDefaultProfile, MixDryRu
     {
         addFlag({
             .longName = "older-than",
-            .description =
-                "Delete versions older than the specified age. *age* "
-                "must be in the format *N*`d`, where *N* denotes a number "
-                "of days.",
+            .description = "Delete versions older than the specified age. *age* "
+                           "must be in the format *N*`d`, where *N* denotes a number "
+                           "of days.",
             .labels = {"age"},
             .handler = {&minAge},
         });
@@ -956,8 +954,8 @@ struct CmdProfileWipeHistory : virtual StoreCommand, MixDefaultProfile, MixDryRu
     std::string doc() override
     {
         return
-          #include "profile-wipe-history.md"
-          ;
+#include "profile-wipe-history.md"
+            ;
     }
 
     void run(ref<Store> store) override
@@ -974,20 +972,20 @@ struct CmdProfile : NixMultiCommand
 {
     CmdProfile()
         : NixMultiCommand(
-            "profile",
-            {
-              {"add", []() { return make_ref<CmdProfileAdd>(); }},
-              {"remove", []() { return make_ref<CmdProfileRemove>(); }},
-              {"upgrade", []() { return make_ref<CmdProfileUpgrade>(); }},
-              {"list", []() { return make_ref<CmdProfileList>(); }},
-              {"diff-closures", []() { return make_ref<CmdProfileDiffClosures>(); }},
-              {"history", []() { return make_ref<CmdProfileHistory>(); }},
-              {"rollback", []() { return make_ref<CmdProfileRollback>(); }},
-              {"wipe-history", []() { return make_ref<CmdProfileWipeHistory>(); }},
-          })
+              "profile",
+              {
+                  {"add", []() { return make_ref<CmdProfileAdd>(); }},
+                  {"remove", []() { return make_ref<CmdProfileRemove>(); }},
+                  {"upgrade", []() { return make_ref<CmdProfileUpgrade>(); }},
+                  {"list", []() { return make_ref<CmdProfileList>(); }},
+                  {"diff-closures", []() { return make_ref<CmdProfileDiffClosures>(); }},
+                  {"history", []() { return make_ref<CmdProfileHistory>(); }},
+                  {"rollback", []() { return make_ref<CmdProfileRollback>(); }},
+                  {"wipe-history", []() { return make_ref<CmdProfileWipeHistory>(); }},
+              })
     {
         aliases = {
-            {"install", { AliasStatus::Deprecated, {"add"}}},
+            {"install", {AliasStatus::Deprecated, {"add"}}},
         };
     }
 
@@ -999,8 +997,8 @@ struct CmdProfile : NixMultiCommand
     std::string doc() override
     {
         return
-          #include "profile.md"
-          ;
+#include "profile.md"
+            ;
     }
 };
 
diff --git a/src/nix/realisation.cc b/src/nix/realisation.cc
index f21567639..a0e400f54 100644
--- a/src/nix/realisation.cc
+++ b/src/nix/realisation.cc
@@ -7,15 +7,20 @@ using namespace nix;
 
 struct CmdRealisation : NixMultiCommand
 {
-    CmdRealisation() : NixMultiCommand("realisation", RegisterCommand::getCommandsFor({"realisation"}))
-    { }
+    CmdRealisation()
+        : NixMultiCommand("realisation", RegisterCommand::getCommandsFor({"realisation"}))
+    {
+    }
 
     std::string description() override
     {
         return "manipulate a Nix realisation";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 static auto rCmdRealisation = registerCommand<CmdRealisation>("realisation");
@@ -30,11 +35,14 @@ struct CmdRealisationInfo : BuiltPathsCommand, MixJSON
     std::string doc() override
     {
         return
-            #include "realisation/info.md"
+#include "realisation/info.md"
             ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     void run(ref<Store> store, BuiltPaths && paths, BuiltPaths && rootPaths) override
     {
@@ -58,13 +66,10 @@ struct CmdRealisationInfo : BuiltPathsCommand, MixJSON
                 res.push_back(currentPath);
             }
             printJSON(res);
-        }
-        else {
+        } else {
             for (auto & path : realisations) {
                 if (auto realisation = std::get_if<Realisation>(&path.raw)) {
-                    logger->cout("%s %s",
-                        realisation->id.to_string(),
-                        store->printStorePath(realisation->outPath));
+                    logger->cout("%s %s", realisation->id.to_string(), store->printStorePath(realisation->outPath));
                 } else
                     logger->cout("%s", store->printStorePath(path.path()));
             }
diff --git a/src/nix/registry.cc b/src/nix/registry.cc
index 340d10ec4..d9fcf09fc 100644
--- a/src/nix/registry.cc
+++ b/src/nix/registry.cc
@@ -10,7 +10,6 @@
 using namespace nix;
 using namespace nix::flake;
 
-
 class RegistryCommand : virtual Args
 {
     std::string registry_path;
@@ -31,7 +30,8 @@ public:
 
     std::shared_ptr<fetchers::Registry> getRegistry()
     {
-        if (registry) return registry;
+        if (registry)
+            return registry;
         if (registry_path.empty()) {
             registry = fetchers::getUserRegistry(fetchSettings);
         } else {
@@ -60,8 +60,8 @@ struct CmdRegistryList : StoreCommand
     std::string doc() override
     {
         return
-          #include "registry-list.md"
-          ;
+#include "registry-list.md"
+            ;
     }
 
     void run(nix::ref<nix::Store> store) override
@@ -73,11 +73,12 @@ struct CmdRegistryList : StoreCommand
         for (auto & registry : registries) {
             for (auto & entry : registry->entries) {
                 // FIXME: format nicely
-                logger->cout("%s %s %s",
-                    registry->type == Registry::Flag   ? "flags " :
-                    registry->type == Registry::User   ? "user  " :
-                    registry->type == Registry::System ? "system" :
-                    "global",
+                logger->cout(
+                    "%s %s %s",
+                    registry->type == Registry::Flag     ? "flags "
+                    : registry->type == Registry::User   ? "user  "
+                    : registry->type == Registry::System ? "system"
+                                                         : "global",
                     entry.from.toURLString(),
                     entry.to.toURLString(attrsToQuery(entry.extraAttrs)));
             }
@@ -97,8 +98,8 @@ struct CmdRegistryAdd : MixEvalArgs, Command, RegistryCommand
     std::string doc() override
     {
         return
-          #include "registry-add.md"
-          ;
+#include "registry-add.md"
+            ;
     }
 
     CmdRegistryAdd()
@@ -113,7 +114,8 @@ struct CmdRegistryAdd : MixEvalArgs, Command, RegistryCommand
         auto toRef = parseFlakeRef(fetchSettings, toUrl);
         auto registry = getRegistry();
         fetchers::Attrs extraAttrs;
-        if (toRef.subdir != "") extraAttrs["dir"] = toRef.subdir;
+        if (toRef.subdir != "")
+            extraAttrs["dir"] = toRef.subdir;
         registry->remove(fromRef.input);
         registry->add(fromRef.input, toRef.input, extraAttrs);
         registry->write(getRegistryPath());
@@ -132,8 +134,8 @@ struct CmdRegistryRemove : RegistryCommand, Command
     std::string doc() override
     {
         return
-          #include "registry-remove.md"
-          ;
+#include "registry-remove.md"
+            ;
     }
 
     CmdRegistryRemove()
@@ -163,27 +165,27 @@ struct CmdRegistryPin : RegistryCommand, EvalCommand
     std::string doc() override
     {
         return
-          #include "registry-pin.md"
-          ;
+#include "registry-pin.md"
+            ;
     }
 
     CmdRegistryPin()
     {
         expectArg("url", &url);
 
-        expectArgs({
-            .label = "locked",
-            .optional = true,
-            .handler = {&locked},
-            .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
-                completeFlakeRef(completions, getStore(), prefix);
-            }}
-        });
+        expectArgs(
+            {.label = "locked",
+             .optional = true,
+             .handler = {&locked},
+             .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
+                 completeFlakeRef(completions, getStore(), prefix);
+             }}});
     }
 
     void run(nix::ref<nix::Store> store) override
     {
-        if (locked.empty()) locked = url;
+        if (locked.empty())
+            locked = url;
         auto registry = getRegistry();
         auto ref = parseFlakeRef(fetchSettings, url);
         auto lockedRef = parseFlakeRef(fetchSettings, locked);
@@ -192,7 +194,8 @@ struct CmdRegistryPin : RegistryCommand, EvalCommand
         if (!resolved.isLocked())
             warn("flake '%s' is not locked", resolved.to_string());
         fetchers::Attrs extraAttrs;
-        if (ref.subdir != "") extraAttrs["dir"] = ref.subdir;
+        if (ref.subdir != "")
+            extraAttrs["dir"] = ref.subdir;
         registry->add(ref.input, resolved, extraAttrs);
         registry->write(getRegistryPath());
     }
@@ -202,13 +205,13 @@ struct CmdRegistry : NixMultiCommand
 {
     CmdRegistry()
         : NixMultiCommand(
-            "registry",
-            {
-                {"list", []() { return make_ref<CmdRegistryList>(); }},
-                {"add", []() { return make_ref<CmdRegistryAdd>(); }},
-                {"remove", []() { return make_ref<CmdRegistryRemove>(); }},
-                {"pin", []() { return make_ref<CmdRegistryPin>(); }},
-            })
+              "registry",
+              {
+                  {"list", []() { return make_ref<CmdRegistryList>(); }},
+                  {"add", []() { return make_ref<CmdRegistryAdd>(); }},
+                  {"remove", []() { return make_ref<CmdRegistryRemove>(); }},
+                  {"pin", []() { return make_ref<CmdRegistryPin>(); }},
+              })
     {
     }
 
@@ -220,11 +223,14 @@ struct CmdRegistry : NixMultiCommand
     std::string doc() override
     {
         return
-          #include "registry.md"
-          ;
+#include "registry.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 };
 
 static auto rCmdRegistry = registerCommand<CmdRegistry>("registry");
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index ca470e99b..5dd53e932 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -11,26 +11,27 @@
 
 namespace nix {
 
-void runNix(Path program, const Strings & args,
-    const std::optional<std::string> & input = {})
+void runNix(Path program, const Strings & args, const std::optional<std::string> & input = {})
 {
     auto subprocessEnv = getEnv();
     subprocessEnv["NIX_CONFIG"] = globalConfig.toKeyValue();
-    //isInteractive avoid grabling interactive commands
-    runProgram2(RunOptions {
-        .program = getNixBin(program).string(),
-        .args = args,
-        .environment = subprocessEnv,
-        .input = input,
-        .isInteractive = true,
-    });
+    // isInteractive avoid grabling interactive commands
+    runProgram2(
+        RunOptions{
+            .program = getNixBin(program).string(),
+            .args = args,
+            .environment = subprocessEnv,
+            .input = input,
+            .isInteractive = true,
+        });
 
     return;
 }
 
 struct CmdRepl : RawInstallablesCommand
 {
-    CmdRepl() {
+    CmdRepl()
+    {
         evalSettings.pureEval = false;
     }
 
@@ -62,8 +63,8 @@ struct CmdRepl : RawInstallablesCommand
     std::string doc() override
     {
         return
-          #include "repl.md"
-          ;
+#include "repl.md"
+            ;
     }
 
     void applyDefaultInstallables(std::vector<std::string> & rawInstallables) override
@@ -76,13 +77,13 @@ struct CmdRepl : RawInstallablesCommand
     void run(ref<Store> store, std::vector<std::string> && rawInstallables) override
     {
         auto state = getEvalState();
-        auto getValues = [&]()->AbstractNixRepl::AnnotatedValues{
+        auto getValues = [&]() -> AbstractNixRepl::AnnotatedValues {
             auto installables = parseInstallables(store, rawInstallables);
             AbstractNixRepl::AnnotatedValues values;
-            for (auto & installable_: installables){
+            for (auto & installable_ : installables) {
                 auto & installable = InstallableValue::require(*installable_);
                 auto what = installable.what();
-                if (file){
+                if (file) {
                     auto [val, pos] = installable.toValue(*state);
                     auto what = installable.what();
                     state->forceValue(*val, pos);
@@ -90,21 +91,15 @@ struct CmdRepl : RawInstallablesCommand
                     auto valPost = state->allocValue();
                     state->autoCallFunction(*autoArgs, *val, *valPost);
                     state->forceValue(*valPost, pos);
-                    values.push_back( {valPost, what });
+                    values.push_back({valPost, what});
                 } else {
                     auto [val, pos] = installable.toValue(*state);
-                    values.push_back( {val, what} );
+                    values.push_back({val, what});
                 }
             }
             return values;
         };
-        auto repl = AbstractNixRepl::create(
-            lookupPath,
-            openStore(),
-            state,
-            getValues,
-            runNix
-        );
+        auto repl = AbstractNixRepl::create(lookupPath, openStore(), state, getValues, runNix);
         repl->autoArgs = getAutoArgs(*repl->state);
         repl->initEnv();
         repl->mainLoop();
@@ -113,4 +108,4 @@ struct CmdRepl : RawInstallablesCommand
 
 static auto rCmdRepl = registerCommand<CmdRepl>("repl");
 
-}
+} // namespace nix
diff --git a/src/nix/run.cc b/src/nix/run.cc
index 3dae8ebc9..368a5ed57 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -11,18 +11,22 @@
 #include "nix/util/source-accessor.hh"
 #include "nix/expr/eval.hh"
 #include "nix/util/util.hh"
+#include "nix/store/globals.hh"
+
 #include <filesystem>
 
 #ifdef __linux__
-# include <sys/mount.h>
-# include "nix/store/personality.hh"
+#  include <sys/mount.h>
+#  include "nix/store/personality.hh"
 #endif
 
 #include <queue>
 
 extern char ** environ __attribute__((weak));
 
-namespace nix::fs { using namespace std::filesystem; }
+namespace nix::fs {
+using namespace std::filesystem;
+}
 
 using namespace nix;
 
@@ -41,7 +45,8 @@ Strings toEnvp(StringMap env)
     return envStrs;
 }
 
-void execProgramInStore(ref<Store> store,
+void execProgramInStore(
+    ref<Store> store,
     UseLookupPath useLookupPath,
     const std::string & program,
     const Strings & args,
@@ -50,7 +55,7 @@ void execProgramInStore(ref<Store> store,
 {
     logger->stop();
 
-    char **envp;
+    char ** envp;
     Strings envStrs;
     std::vector<char *> envCharPtrs;
     if (env.has_value()) {
@@ -74,11 +79,15 @@ void execProgramInStore(ref<Store> store,
     auto store2 = store.dynamic_pointer_cast<LocalFSStore>();
 
     if (!store2)
-        throw Error("store '%s' is not a local store so it does not support command execution", store->getUri());
+        throw Error(
+            "store '%s' is not a local store so it does not support command execution",
+            store->config.getHumanReadableURI());
 
     if (store->storeDir != store2->getRealStoreDir()) {
-        Strings helperArgs = { chrootHelperName, store->storeDir, store2->getRealStoreDir(), std::string(system.value_or("")), program };
-        for (auto & arg : args) helperArgs.push_back(arg);
+        Strings helperArgs = {
+            chrootHelperName, store->storeDir, store2->getRealStoreDir(), std::string(system.value_or("")), program};
+        for (auto & arg : args)
+            helperArgs.push_back(arg);
 
         execve(getSelfExe().value_or("nix").c_str(), stringsToCharPtrs(helperArgs).data(), envp);
 
@@ -100,7 +109,7 @@ void execProgramInStore(ref<Store> store,
     throw SysError("unable to execute '%s'", program);
 }
 
-}
+} // namespace nix
 
 struct CmdRun : InstallableValueCommand, MixEnvironment
 {
@@ -110,11 +119,7 @@ struct CmdRun : InstallableValueCommand, MixEnvironment
 
     CmdRun()
     {
-        expectArgs({
-            .label = "args",
-            .handler = {&args},
-            .completer = completePath
-        });
+        expectArgs({.label = "args", .handler = {&args}, .completer = completePath});
     }
 
     std::string description() override
@@ -125,8 +130,8 @@ struct CmdRun : InstallableValueCommand, MixEnvironment
     std::string doc() override
     {
         return
-          #include "run.md"
-          ;
+#include "run.md"
+            ;
     }
 
     Strings getDefaultFlakeAttrPaths() override
@@ -156,7 +161,8 @@ struct CmdRun : InstallableValueCommand, MixEnvironment
         auto app = installable->toApp(*state).resolve(getEvalStore(), store);
 
         Strings allArgs{app.program};
-        for (auto & i : args) allArgs.push_back(i);
+        for (auto & i : args)
+            allArgs.push_back(i);
 
         // Release our references to eval caches to ensure they are persisted to disk, because
         // we are about to exec out of this process without running C++ destructors.
@@ -170,7 +176,7 @@ struct CmdRun : InstallableValueCommand, MixEnvironment
 
 static auto rCmdRun = registerCommand<CmdRun>("run");
 
-void chrootHelper(int argc, char * * argv)
+void chrootHelper(int argc, char ** argv)
 {
     int p = 1;
     std::string storeDir = argv[p++];
@@ -211,7 +217,8 @@ void chrootHelper(int argc, char * * argv)
             checkInterrupt();
             const auto & src = entry.path();
             std::filesystem::path dst = tmpDir / entry.path().filename();
-            if (pathExists(dst)) continue;
+            if (pathExists(dst))
+                continue;
             auto st = entry.symlink_status();
             if (std::filesystem::is_directory(st)) {
                 if (mkdir(dst.c_str(), 0700) == -1)
@@ -223,7 +230,8 @@ void chrootHelper(int argc, char * * argv)
         }
 
         char * cwd = getcwd(0, 0);
-        if (!cwd) throw SysError("getting current directory");
+        if (!cwd)
+            throw SysError("getting current directory");
         Finally freeCwd([&]() { free(cwd); });
 
         if (chroot(tmpDir.c_str()) == -1)
@@ -231,19 +239,20 @@ void chrootHelper(int argc, char * * argv)
 
         if (chdir(cwd) == -1)
             throw SysError("chdir to '%s' in chroot", cwd);
-    } else
-        if (mount("overlay", storeDir.c_str(), "overlay", MS_MGC_VAL, fmt("lowerdir=%s:%s", storeDir, realStoreDir).c_str()) == -1)
-            if (mount(realStoreDir.c_str(), storeDir.c_str(), "", MS_BIND, 0) == -1)
-                throw SysError("mounting '%s' on '%s'", realStoreDir, storeDir);
+    } else if (
+        mount("overlay", storeDir.c_str(), "overlay", MS_MGC_VAL, fmt("lowerdir=%s:%s", storeDir, realStoreDir).c_str())
+        == -1)
+        if (mount(realStoreDir.c_str(), storeDir.c_str(), "", MS_BIND, 0) == -1)
+            throw SysError("mounting '%s' on '%s'", realStoreDir, storeDir);
 
     writeFile(std::filesystem::path{"/proc/self/setgroups"}, "deny");
     writeFile(std::filesystem::path{"/proc/self/uid_map"}, fmt("%d %d %d", uid, uid, 1));
     writeFile(std::filesystem::path{"/proc/self/gid_map"}, fmt("%d %d %d", gid, gid, 1));
 
-#ifdef __linux__
+#  ifdef __linux__
     if (system != "")
         linux::setPersonality(system);
-#endif
+#  endif
 
     execvp(cmd.c_str(), stringsToCharPtrs(args).data());
 
diff --git a/src/nix/run.hh b/src/nix/run.hh
index 5367c515c..cfee02a66 100644
--- a/src/nix/run.hh
+++ b/src/nix/run.hh
@@ -5,16 +5,14 @@
 
 namespace nix {
 
-enum struct UseLookupPath {
-    Use,
-    DontUse
-};
+enum struct UseLookupPath { Use, DontUse };
 
-void execProgramInStore(ref<Store> store,
+void execProgramInStore(
+    ref<Store> store,
     UseLookupPath useLookupPath,
     const std::string & program,
     const Strings & args,
     std::optional<std::string_view> system = std::nullopt,
     std::optional<StringMap> env = std::nullopt);
 
-}
+} // namespace nix
diff --git a/src/nix/search.cc b/src/nix/search.cc
index 306a80594..910450e95 100644
--- a/src/nix/search.cc
+++ b/src/nix/search.cc
@@ -34,15 +34,14 @@ struct CmdSearch : InstallableValueCommand, MixJSON
     CmdSearch()
     {
         expectArgs("regex", &res);
-        addFlag(Flag {
-            .longName = "exclude",
-            .shortName = 'e',
-            .description = "Hide packages whose attribute path, name or description contain *regex*.",
-            .labels = {"regex"},
-            .handler = {[this](std::string s) {
-                excludeRes.push_back(s);
-            }},
-        });
+        addFlag(
+            Flag{
+                .longName = "exclude",
+                .shortName = 'e',
+                .description = "Hide packages whose attribute path, name or description contain *regex*.",
+                .labels = {"regex"},
+                .handler = {[this](std::string s) { excludeRes.push_back(s); }},
+            });
     }
 
     std::string description() override
@@ -53,16 +52,13 @@ struct CmdSearch : InstallableValueCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "search.md"
-          ;
+#include "search.md"
+            ;
     }
 
     Strings getDefaultFlakeAttrPaths() override
     {
-        return {
-            "packages." + settings.thisSystem.get(),
-            "legacyPackages." + settings.thisSystem.get()
-        };
+        return {"packages." + settings.thisSystem.get(), "legacyPackages." + settings.thisSystem.get()};
     }
 
     void run(ref<Store> store, ref<InstallableValue> installable) override
@@ -72,7 +68,8 @@ struct CmdSearch : InstallableValueCommand, MixJSON
 
         // Recommend "^" here instead of ".*" due to differences in resulting highlighting
         if (res.empty())
-            throw UsageError("Must provide at least one regex! To match all packages, use '%s'.", "nix search <installable> ^");
+            throw UsageError(
+                "Must provide at least one regex! To match all packages, use '%s'.", "nix search <installable> ^");
 
         std::vector<std::regex> regexes;
         std::vector<std::regex> excludeRegexes;
@@ -88,21 +85,20 @@ struct CmdSearch : InstallableValueCommand, MixJSON
         auto state = getEvalState();
 
         std::optional<nlohmann::json> jsonOut;
-        if (json) jsonOut = json::object();
+        if (json)
+            jsonOut = json::object();
 
         uint64_t results = 0;
 
-        std::function<void(eval_cache::AttrCursor & cursor, const std::vector<Symbol> & attrPath, bool initialRecurse)> visit;
+        std::function<void(eval_cache::AttrCursor & cursor, const std::vector<Symbol> & attrPath, bool initialRecurse)>
+            visit;
 
-        visit = [&](eval_cache::AttrCursor & cursor, const std::vector<Symbol> & attrPath, bool initialRecurse)
-        {
+        visit = [&](eval_cache::AttrCursor & cursor, const std::vector<Symbol> & attrPath, bool initialRecurse) {
             auto attrPathS = state->symbols.resolve(attrPath);
 
-            Activity act(*logger, lvlInfo, actUnknown,
-                fmt("evaluating '%s'", concatStringsSep(".", attrPathS)));
+            Activity act(*logger, lvlInfo, actUnknown, fmt("evaluating '%s'", concatStringsSep(".", attrPathS)));
             try {
-                auto recurse = [&]()
-                {
+                auto recurse = [&]() {
                     for (const auto & attr : cursor.getAttrs()) {
                         auto cursor2 = cursor.getAttr(state->symbols[attr]);
                         auto attrPath2(attrPath);
@@ -112,10 +108,10 @@ struct CmdSearch : InstallableValueCommand, MixJSON
                 };
 
                 if (cursor.isDerivation()) {
-                    DrvName name(cursor.getAttr(state->sName)->getString());
+                    DrvName name(cursor.getAttr(state->s.name)->getString());
 
-                    auto aMeta = cursor.maybeGetAttr(state->sMeta);
-                    auto aDescription = aMeta ? aMeta->maybeGetAttr(state->sDescription) : nullptr;
+                    auto aMeta = cursor.maybeGetAttr(state->s.meta);
+                    auto aDescription = aMeta ? aMeta->maybeGetAttr(state->s.description) : nullptr;
                     auto description = aDescription ? aDescription->getString() : "";
                     std::replace(description.begin(), description.end(), '\n', ' ');
                     auto attrPath2 = concatStringsSep(".", attrPathS);
@@ -126,9 +122,7 @@ struct CmdSearch : InstallableValueCommand, MixJSON
                     bool found = false;
 
                     for (auto & regex : excludeRegexes) {
-                        if (
-                            std::regex_search(attrPath2, regex)
-                            || std::regex_search(name.name, regex)
+                        if (std::regex_search(attrPath2, regex) || std::regex_search(name.name, regex)
                             || std::regex_search(description, regex))
                             return;
                     }
@@ -151,8 +145,7 @@ struct CmdSearch : InstallableValueCommand, MixJSON
                             break;
                     }
 
-                    if (found)
-                    {
+                    if (found) {
                         results++;
                         if (json) {
                             (*jsonOut)[attrPath2] = {
@@ -161,7 +154,8 @@ struct CmdSearch : InstallableValueCommand, MixJSON
                                 {"description", description},
                             };
                         } else {
-                            if (results > 1) logger->cout("");
+                            if (results > 1)
+                                logger->cout("");
                             logger->cout(
                                 "* %s%s",
                                 wrap("\e[0;1m", hiliteMatches(attrPath2, attrPathMatches, ANSI_GREEN, "\e[0;1m")),
@@ -174,8 +168,7 @@ struct CmdSearch : InstallableValueCommand, MixJSON
                 }
 
                 else if (
-                    attrPath.size() == 0
-                    || (attrPathS[0] == "legacyPackages" && attrPath.size() <= 2)
+                    attrPath.size() == 0 || (attrPathS[0] == "legacyPackages" && attrPath.size() <= 2)
                     || (attrPathS[0] == "packages" && attrPath.size() <= 2))
                     recurse();
 
@@ -183,7 +176,7 @@ struct CmdSearch : InstallableValueCommand, MixJSON
                     recurse();
 
                 else if (attrPathS[0] == "legacyPackages" && attrPath.size() > 2) {
-                    auto attr = cursor.maybeGetAttr(state->sRecurseForDerivations);
+                    auto attr = cursor.maybeGetAttr(state->s.recurseForDerivations);
                     if (attr && attr->getBool())
                         recurse();
                 }
diff --git a/src/nix/self-exe.cc b/src/nix/self-exe.cc
index b5eb1190d..36f6e17ec 100644
--- a/src/nix/self-exe.cc
+++ b/src/nix/self-exe.cc
@@ -36,4 +36,4 @@ std::filesystem::path getNixBin(std::optional<std::string_view> binaryNameOpt)
     return getBinaryName();
 }
 
-}
+} // namespace nix
diff --git a/src/nix/self-exe.hh b/src/nix/self-exe.hh
index 91e260f0b..b02aff5af 100644
--- a/src/nix/self-exe.hh
+++ b/src/nix/self-exe.hh
@@ -30,4 +30,4 @@ namespace nix {
  */
 std::filesystem::path getNixBin(std::optional<std::string_view> binary_name = {});
 
-}
+} // namespace nix
diff --git a/src/nix/shell.md b/src/nix/shell.md
index 677151a85..1e44c2478 100644
--- a/src/nix/shell.md
+++ b/src/nix/shell.md
@@ -83,7 +83,7 @@ import prettytable
 # Print a simple table.
 t = prettytable.PrettyTable(["N", "N^2"])
 for n in range(1, 10): t.add_row([n, n * n])
-print t
+print(t)
 ```
 
 Similarly, the following is a Perl script that specifies that it
diff --git a/src/nix/sigs.cc b/src/nix/sigs.cc
index fb868baa1..92bb00500 100644
--- a/src/nix/sigs.cc
+++ b/src/nix/sigs.cc
@@ -42,10 +42,10 @@ struct CmdCopySigs : StorePathsCommand
 
         std::atomic<size_t> added{0};
 
-        //logger->setExpected(doneLabel, storePaths.size());
+        // logger->setExpected(doneLabel, storePaths.size());
 
         auto doPath = [&](const Path & storePathS) {
-            //Activity act(*logger, lvlInfo, "getting signatures for '%s'", storePath);
+            // Activity act(*logger, lvlInfo, "getting signatures for '%s'", storePath);
 
             checkInterrupt();
 
@@ -61,9 +61,8 @@ struct CmdCopySigs : StorePathsCommand
 
                     /* Don't import signatures that don't match this
                        binary. */
-                    if (info->narHash != info2->narHash ||
-                        info->narSize != info2->narSize ||
-                        info->references != info2->references)
+                    if (info->narHash != info2->narHash || info->narSize != info2->narSize
+                        || info->references != info2->references)
                         continue;
 
                     for (auto & sig : info2->sigs)
@@ -78,7 +77,7 @@ struct CmdCopySigs : StorePathsCommand
                 added += newSigs.size();
             }
 
-            //logger->incProgress(doneLabel);
+            // logger->incProgress(doneLabel);
         };
 
         for (auto & storePath : storePaths)
@@ -165,8 +164,8 @@ struct CmdKeyGenerateSecret : Command
     std::string doc() override
     {
         return
-          #include "key-generate-secret.md"
-          ;
+#include "key-generate-secret.md"
+            ;
     }
 
     void run() override
@@ -189,8 +188,8 @@ struct CmdKeyConvertSecretToPublic : Command
     std::string doc() override
     {
         return
-          #include "key-convert-secret-to-public.md"
-          ;
+#include "key-convert-secret-to-public.md"
+            ;
     }
 
     void run() override
@@ -205,11 +204,11 @@ struct CmdKey : NixMultiCommand
 {
     CmdKey()
         : NixMultiCommand(
-            "key",
-            {
-                {"generate-secret", []() { return make_ref<CmdKeyGenerateSecret>(); }},
-                {"convert-secret-to-public", []() { return make_ref<CmdKeyConvertSecretToPublic>(); }},
-            })
+              "key",
+              {
+                  {"generate-secret", []() { return make_ref<CmdKeyGenerateSecret>(); }},
+                  {"convert-secret-to-public", []() { return make_ref<CmdKeyConvertSecretToPublic>(); }},
+              })
     {
     }
 
@@ -218,7 +217,10 @@ struct CmdKey : NixMultiCommand
         return "generate and convert Nix signing keys";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 static auto rCmdKey = registerCommand<CmdKey>("key");
diff --git a/src/nix/store-copy-log.cc b/src/nix/store-copy-log.cc
index 599b40edc..6e442f371 100644
--- a/src/nix/store-copy-log.cc
+++ b/src/nix/store-copy-log.cc
@@ -20,8 +20,8 @@ struct CmdCopyLog : virtual CopyCommand, virtual InstallablesCommand
     std::string doc() override
     {
         return
-          #include "store-copy-log.md"
-          ;
+#include "store-copy-log.md"
+            ;
     }
 
     void run(ref<Store> srcStore, Installables && installables) override
diff --git a/src/nix/store-delete.cc b/src/nix/store-delete.cc
index fae960c90..42517c882 100644
--- a/src/nix/store-delete.cc
+++ b/src/nix/store-delete.cc
@@ -9,7 +9,7 @@ using namespace nix;
 
 struct CmdStoreDelete : StorePathsCommand
 {
-    GCOptions options { .action = GCOptions::gcDeleteSpecific };
+    GCOptions options{.action = GCOptions::gcDeleteSpecific};
 
     CmdStoreDelete()
     {
@@ -28,8 +28,8 @@ struct CmdStoreDelete : StorePathsCommand
     std::string doc() override
     {
         return
-          #include "store-delete.md"
-          ;
+#include "store-delete.md"
+            ;
     }
 
     void run(ref<Store> store, StorePaths && storePaths) override
diff --git a/src/nix/store-gc.cc b/src/nix/store-gc.cc
index c71e89233..b0a627837 100644
--- a/src/nix/store-gc.cc
+++ b/src/nix/store-gc.cc
@@ -29,8 +29,8 @@ struct CmdStoreGC : StoreCommand, MixDryRun
     std::string doc() override
     {
         return
-          #include "store-gc.md"
-          ;
+#include "store-gc.md"
+            ;
     }
 
     void run(ref<Store> store) override
diff --git a/src/nix/store-info.cc b/src/nix/store-info.cc
index c4c63ae3a..4526d9cda 100644
--- a/src/nix/store-info.cc
+++ b/src/nix/store-info.cc
@@ -17,14 +17,14 @@ struct CmdInfoStore : StoreCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "store-info.md"
-          ;
+#include "store-info.md"
+            ;
     }
 
     void run(ref<Store> store) override
     {
         if (!json) {
-            notice("Store URL: %s", store->getUri());
+            notice("Store URL: %s", store->config.getReference().render(/*withParams=*/true));
             store->connect();
             if (auto version = store->getVersion())
                 notice("Version: %s", *version);
@@ -32,11 +32,9 @@ struct CmdInfoStore : StoreCommand, MixJSON
                 notice("Trusted: %s", *trusted);
         } else {
             nlohmann::json res;
-            Finally printRes([&]() {
-                printJSON(res);
-            });
+            Finally printRes([&]() { printJSON(res); });
 
-            res["url"] = store->getUri();
+            res["url"] = store->config.getReference().render(/*withParams=*/true);
             store->connect();
             if (auto version = store->getVersion())
                 res["version"] = *version;
diff --git a/src/nix/store-repair.cc b/src/nix/store-repair.cc
index edd699981..cd243691c 100644
--- a/src/nix/store-repair.cc
+++ b/src/nix/store-repair.cc
@@ -13,8 +13,8 @@ struct CmdStoreRepair : StorePathsCommand
     std::string doc() override
     {
         return
-          #include "store-repair.md"
-          ;
+#include "store-repair.md"
+            ;
     }
 
     void run(ref<Store> store, StorePaths && storePaths) override
diff --git a/src/nix/store.cc b/src/nix/store.cc
index 80f9363ca..45e505d06 100644
--- a/src/nix/store.cc
+++ b/src/nix/store.cc
@@ -4,10 +4,11 @@ using namespace nix;
 
 struct CmdStore : NixMultiCommand
 {
-    CmdStore() : NixMultiCommand("store", RegisterCommand::getCommandsFor({"store"}))
+    CmdStore()
+        : NixMultiCommand("store", RegisterCommand::getCommandsFor({"store"}))
     {
         aliases = {
-            {"ping", { AliasStatus::Deprecated, {"info"}}},
+            {"ping", {AliasStatus::Deprecated, {"info"}}},
         };
     }
 
@@ -16,7 +17,10 @@ struct CmdStore : NixMultiCommand
         return "manipulate a Nix store";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 static auto rCmdStore = registerCommand<CmdStore>("store");
diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index a14632c2f..cb105a385 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -36,11 +36,11 @@
 #include <fcntl.h>
 
 #ifdef __linux__
-#include "nix/util/cgroup.hh"
+#  include "nix/util/cgroup.hh"
 #endif
 
 #if defined(__APPLE__) || defined(__FreeBSD__)
-#include <sys/ucred.h>
+#  include <sys/ucred.h>
 #endif
 
 using namespace nix;
@@ -59,10 +59,13 @@ using namespace nix::daemon;
  * exposed in a header); all authentication and authorization happens in
  * `daemon.cc`.
  */
-struct AuthorizationSettings : Config {
+struct AuthorizationSettings : Config
+{
 
     Setting<Strings> trustedUsers{
-        this, {"root"}, "trusted-users",
+        this,
+        {"root"},
+        "trusted-users",
         R"(
           A list of user names, separated by whitespace.
           These users will have additional rights when connecting to the Nix daemon, such as the ability to specify additional [substituters](#conf-substituters), or to import unsigned realisations or unsigned input-addressed store objects.
@@ -80,7 +83,9 @@ struct AuthorizationSettings : Config {
      * Who we trust to use the daemon in safe ways
      */
     Setting<Strings> allowedUsers{
-        this, {"*"}, "allowed-users",
+        this,
+        {"*"},
+        "allowed-users",
         R"(
           A list user names, separated by whitespace.
           These users are allowed to connect to the Nix daemon.
@@ -100,8 +105,9 @@ AuthorizationSettings authorizationSettings;
 static GlobalConfig::Register rSettings(&authorizationSettings);
 
 #ifndef __linux__
-#define SPLICE_F_MOVE 0
-static ssize_t splice(int fd_in, void *off_in, int fd_out, void *off_out, size_t len, unsigned int flags)
+#  define SPLICE_F_MOVE 0
+
+static ssize_t splice(int fd_in, void * off_in, int fd_out, void * off_out, size_t len, unsigned int flags)
 {
     // We ignore most parameters, we just have them for conformance with the linux syscall
     std::vector<char> buf(8192);
@@ -119,17 +125,16 @@ static ssize_t splice(int fd_in, void *off_in, int fd_out, void *off_out, size_t
 }
 #endif
 
-
 static void sigChldHandler(int sigNo)
 {
     // Ensure we don't modify errno of whatever we've interrupted
     auto saved_errno = errno;
     //  Reap all dead children.
-    while (waitpid(-1, 0, WNOHANG) > 0) ;
+    while (waitpid(-1, 0, WNOHANG) > 0)
+        ;
     errno = saved_errno;
 }
 
-
 static void setSigChldAction(bool autoReap)
 {
     struct sigaction act, oact;
@@ -149,12 +154,12 @@ static void setSigChldAction(bool autoReap)
  */
 static bool matchUser(std::string_view user, const struct group & gr)
 {
-    for (char * * mem = gr.gr_mem; *mem; mem++)
-        if (user == std::string_view(*mem)) return true;
+    for (char ** mem = gr.gr_mem; *mem; mem++)
+        if (user == std::string_view(*mem))
+            return true;
     return false;
 }
 
-
 /**
  * Does the given user (specified by user name and primary group name)
  * match the given user/group whitelist?
@@ -179,16 +184,18 @@ static bool matchUser(const std::string & user, const std::string & group, const
 
     for (auto & i : users)
         if (i.substr(0, 1) == "@") {
-            if (group == i.substr(1)) return true;
+            if (group == i.substr(1))
+                return true;
             struct group * gr = getgrnam(i.c_str() + 1);
-            if (!gr) continue;
-            if (matchUser(user, *gr)) return true;
+            if (!gr)
+                continue;
+            if (matchUser(user, *gr))
+                return true;
         }
 
     return false;
 }
 
-
 struct PeerInfo
 {
     bool pidKnown;
@@ -199,47 +206,44 @@ struct PeerInfo
     gid_t gid;
 };
 
-
 /**
  * Get the identity of the caller, if possible.
  */
 static PeerInfo getPeerInfo(int remote)
 {
-    PeerInfo peer = { false, 0, false, 0, false, 0 };
+    PeerInfo peer = {false, 0, false, 0, false, 0};
 
 #if defined(SO_PEERCRED)
 
-# if defined(__OpenBSD__)
-   struct sockpeercred cred;
-# else
-   ucred cred;
-# endif
+#  if defined(__OpenBSD__)
+    struct sockpeercred cred;
+#  else
+    ucred cred;
+#  endif
     socklen_t credLen = sizeof(cred);
     if (getsockopt(remote, SOL_SOCKET, SO_PEERCRED, &cred, &credLen) == -1)
         throw SysError("getting peer credentials");
-    peer = { true, cred.pid, true, cred.uid, true, cred.gid };
+    peer = {true, cred.pid, true, cred.uid, true, cred.gid};
 
 #elif defined(LOCAL_PEERCRED)
 
-# if !defined(SOL_LOCAL)
-# define SOL_LOCAL 0
-# endif
+#  if !defined(SOL_LOCAL)
+#    define SOL_LOCAL 0
+#  endif
 
     xucred cred;
     socklen_t credLen = sizeof(cred);
     if (getsockopt(remote, SOL_LOCAL, LOCAL_PEERCRED, &cred, &credLen) == -1)
         throw SysError("getting peer credentials");
-    peer = { false, 0, true, cred.cr_uid, false, 0 };
+    peer = {false, 0, true, cred.cr_uid, false, 0};
 
 #endif
 
     return peer;
 }
 
-
 #define SD_LISTEN_FDS_START 3
 
-
 /**
  * Open a store without a path info cache.
  */
@@ -281,10 +285,9 @@ static std::pair<TrustedFlag, std::string> authPeer(const PeerInfo & peer)
     if ((!trusted && !matchUser(user, group, allowedUsers)) || group == settings.buildUsersGroup)
         throw Error("user '%1%' is not allowed to connect to the Nix daemon", user);
 
-    return { trusted, std::move(user) };
+    return {trusted, std::move(user)};
 }
 
-
 /**
  * Run a server. The loop opens a socket and accepts new connections from that
  * socket.
@@ -318,7 +321,7 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
     //  Get rid of children automatically; don't let them become zombies.
     setSigChldAction(true);
 
-    #ifdef __linux__
+#ifdef __linux__
     if (settings.useCgroups) {
         experimentalFeatureSettings.require(Xp::Cgroups);
 
@@ -337,7 +340,7 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
         //  Move daemon into the new cgroup.
         writeFile(daemonCgroupPath + "/cgroup.procs", fmt("%d", getpid()));
     }
-    #endif
+#endif
 
     //  Loop accepting connections.
     while (1) {
@@ -347,17 +350,17 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
             struct sockaddr_un remoteAddr;
             socklen_t remoteAddrLen = sizeof(remoteAddr);
 
-            AutoCloseFD remote = accept(fdSocket.get(),
-                (struct sockaddr *) &remoteAddr, &remoteAddrLen);
+            AutoCloseFD remote = accept(fdSocket.get(), (struct sockaddr *) &remoteAddr, &remoteAddrLen);
             checkInterrupt();
             if (!remote) {
-                if (errno == EINTR) continue;
+                if (errno == EINTR)
+                    continue;
                 throw SysError("accepting connection");
             }
 
             unix::closeOnExec(remote.get());
 
-            PeerInfo peer { .pidKnown = false };
+            PeerInfo peer{.pidKnown = false};
             TrustedFlag trusted;
             std::string user;
 
@@ -370,7 +373,8 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
                 user = _user;
             };
 
-            printInfo((std::string) "accepted connection from pid %1%, user %2%" + (trusted ? " (trusted)" : ""),
+            printInfo(
+                (std::string) "accepted connection from pid %1%, user %2%" + (trusted ? " (trusted)" : ""),
                 peer.pidKnown ? std::to_string(peer.pid) : "<unknown>",
                 peer.uidKnown ? user : "<unknown>");
 
@@ -380,32 +384,30 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
             options.dieWithParent = false;
             options.runExitHandlers = true;
             options.allowVfork = false;
-            startProcess([&]() {
-                fdSocket = -1;
+            startProcess(
+                [&]() {
+                    fdSocket = -1;
 
-                //  Background the daemon.
-                if (setsid() == -1)
-                    throw SysError("creating a new session");
+                    //  Background the daemon.
+                    if (setsid() == -1)
+                        throw SysError("creating a new session");
 
-                //  Restore normal handling of SIGCHLD.
-                setSigChldAction(false);
+                    //  Restore normal handling of SIGCHLD.
+                    setSigChldAction(false);
 
-                //  For debugging, stuff the pid into argv[1].
-                if (peer.pidKnown && savedArgv[1]) {
-                    auto processName = std::to_string(peer.pid);
-                    strncpy(savedArgv[1], processName.c_str(), strlen(savedArgv[1]));
-                }
+                    //  For debugging, stuff the pid into argv[1].
+                    if (peer.pidKnown && savedArgv[1]) {
+                        auto processName = std::to_string(peer.pid);
+                        strncpy(savedArgv[1], processName.c_str(), strlen(savedArgv[1]));
+                    }
 
-                //  Handle the connection.
-                processConnection(
-                    openUncachedStore(),
-                    FdSource(remote.get()),
-                    FdSink(remote.get()),
-                    trusted,
-                    NotRecursive);
+                    //  Handle the connection.
+                    processConnection(
+                        openUncachedStore(), FdSource(remote.get()), FdSink(remote.get()), trusted, NotRecursive);
 
-                exit(0);
-            }, options);
+                    exit(0);
+                },
+                options);
 
         } catch (Interrupted & e) {
             return;
@@ -426,7 +428,8 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
  *
  * Loops until standard input disconnects, or an error is encountered.
  */
-static void forwardStdioConnection(RemoteStore & store) {
+static void forwardStdioConnection(RemoteStore & store)
+{
     auto conn = store.openConnectionWrapper();
     int from = conn->from.fd;
     int to = conn->to.fd;
@@ -467,11 +470,7 @@ static void forwardStdioConnection(RemoteStore & store) {
  */
 static void processStdioConnection(ref<Store> store, TrustedFlag trustClient)
 {
-    processConnection(
-        store,
-        FdSource(STDIN_FILENO),
-        FdSink(STDOUT_FILENO),
-        trustClient, NotRecursive);
+    processConnection(store, FdSource(STDIN_FILENO), FdSink(STDOUT_FILENO), trustClient, NotRecursive);
 }
 
 /**
@@ -507,7 +506,7 @@ static void runDaemon(bool stdio, std::optional<TrustedFlag> forceTrustClientOpt
         daemonLoop(forceTrustClientOpt);
 }
 
-static int main_nix_daemon(int argc, char * * argv)
+static int main_nix_daemon(int argc, char ** argv)
 {
     {
         auto stdio = false;
@@ -535,7 +534,8 @@ static int main_nix_daemon(int argc, char * * argv)
             } else if (*arg == "--process-ops") {
                 experimentalFeatureSettings.require(Xp::MountedSSHStore);
                 processOps = true;
-            } else return false;
+            } else
+                return false;
             return true;
         });
 
@@ -564,27 +564,22 @@ struct CmdDaemon : Command
         addFlag({
             .longName = "force-trusted",
             .description = "Force the daemon to trust connecting clients.",
-            .handler = {[&]() {
-                isTrustedOpt = Trusted;
-            }},
+            .handler = {[&]() { isTrustedOpt = Trusted; }},
             .experimentalFeature = Xp::DaemonTrustOverride,
         });
 
         addFlag({
             .longName = "force-untrusted",
-            .description = "Force the daemon to not trust connecting clients. The connection is processed by the receiving daemon before forwarding commands.",
-            .handler = {[&]() {
-                isTrustedOpt = NotTrusted;
-            }},
+            .description =
+                "Force the daemon to not trust connecting clients. The connection is processed by the receiving daemon before forwarding commands.",
+            .handler = {[&]() { isTrustedOpt = NotTrusted; }},
             .experimentalFeature = Xp::DaemonTrustOverride,
         });
 
         addFlag({
             .longName = "default-trust",
             .description = "Use Nix's default trust.",
-            .handler = {[&]() {
-                isTrustedOpt = std::nullopt;
-            }},
+            .handler = {[&]() { isTrustedOpt = std::nullopt; }},
             .experimentalFeature = Xp::DaemonTrustOverride,
         });
 
@@ -595,9 +590,7 @@ struct CmdDaemon : Command
 
               This is useful for the `mounted-ssh://` store where some actions need to be performed on the remote end but as connected user, and not as the user of the underlying daemon on the remote end.
             )",
-            .handler = {[&]() {
-                processOps = true;
-            }},
+            .handler = {[&]() { processOps = true; }},
             .experimentalFeature = Xp::MountedSSHStore,
         });
     }
@@ -607,13 +600,16 @@ struct CmdDaemon : Command
         return "daemon to perform store operations on behalf of non-root clients";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 
     std::string doc() override
     {
         return
-          #include "daemon.md"
-          ;
+#include "daemon.md"
+            ;
     }
 
     void run() override
diff --git a/src/nix/upgrade-nix.cc b/src/nix/upgrade-nix.cc
index 648241104..f26613bf8 100644
--- a/src/nix/upgrade-nix.cc
+++ b/src/nix/upgrade-nix.cc
@@ -8,6 +8,7 @@
 #include "nix/expr/attr-path.hh"
 #include "nix/store/names.hh"
 #include "nix/util/executable-path.hh"
+#include "nix/store/globals.hh"
 #include "self-exe.hh"
 
 using namespace nix;
@@ -30,7 +31,7 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
             .longName = "nix-store-paths-url",
             .description = "The URL of the file that contains the store paths of the latest Nix release.",
             .labels = {"url"},
-            .handler = {&(std::string&) settings.upgradeNixStorePathUrl},
+            .handler = {&(std::string &) settings.upgradeNixStorePathUrl},
         });
     }
 
@@ -50,11 +51,14 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
     std::string doc() override
     {
         return
-          #include "upgrade-nix.md"
-          ;
+#include "upgrade-nix.md"
+            ;
     }
 
-    Category category() override { return catNixInstallation; }
+    Category category() override
+    {
+        return catNixInstallation;
+    }
 
     void run(ref<Store> store) override
     {
@@ -81,7 +85,8 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         }
 
         {
-            Activity act(*logger, lvlInfo, actUnknown, fmt("verifying that '%s' works...", store->printStorePath(storePath)));
+            Activity act(
+                *logger, lvlInfo, actUnknown, fmt("verifying that '%s' works...", store->printStorePath(storePath)));
             auto program = store->printStorePath(storePath) + "/bin/nix-env";
             auto s = runProgram(program, false, {"--version"});
             if (s.find("Nix") == std::string::npos)
@@ -91,11 +96,16 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         logger->stop();
 
         {
-            Activity act(*logger, lvlInfo, actUnknown,
+            Activity act(
+                *logger,
+                lvlInfo,
+                actUnknown,
                 fmt("installing '%s' into profile %s...", store->printStorePath(storePath), profileDir));
 
             // FIXME: don't call an external process.
-            runProgram(getNixBin("nix-env").string(), false,
+            runProgram(
+                getNixBin("nix-env").string(),
+                false,
                 {"--profile", profileDir.string(), "-i", store->printStorePath(storePath), "--no-sandbox"});
         }
 
@@ -118,7 +128,8 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         auto profileDir = where.parent_path();
 
         // Resolve profile to /nix/var/nix/profiles/<name> link.
-        while (canonPath(profileDir.string()).find("/profiles/") == std::string::npos && std::filesystem::is_symlink(profileDir))
+        while (canonPath(profileDir.string()).find("/profiles/") == std::string::npos
+               && std::filesystem::is_symlink(profileDir))
             profileDir = readLink(profileDir.string());
 
         printInfo("found profile %s", profileDir);
@@ -126,7 +137,9 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         Path userEnv = canonPath(profileDir.string(), true);
 
         if (std::filesystem::exists(profileDir / "manifest.json"))
-            throw Error("directory %s is managed by 'nix profile' and currently cannot be upgraded by 'nix upgrade-nix'", profileDir);
+            throw Error(
+                "directory %s is managed by 'nix profile' and currently cannot be upgraded by 'nix upgrade-nix'",
+                profileDir);
 
         if (!std::filesystem::exists(profileDir / "manifest.nix"))
             throw Error("directory %s does not appear to be part of a Nix profile", profileDir);
@@ -143,16 +156,17 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         Activity act(*logger, lvlInfo, actUnknown, "querying latest Nix version");
 
         // FIXME: use nixos.org?
-        auto req = FileTransferRequest((std::string&) settings.upgradeNixStorePathUrl);
+        auto req = FileTransferRequest(parseURL(settings.upgradeNixStorePathUrl.get()));
         auto res = getFileTransfer()->download(req);
 
         auto state = std::make_unique<EvalState>(LookupPath{}, store, fetchSettings, evalSettings);
         auto v = state->allocValue();
         state->eval(state->parseExprFromString(res.data, state->rootPath(CanonPath("/no-such-path"))), *v);
-        Bindings & bindings(*state->allocBindings(0));
+        Bindings & bindings = Bindings::emptyBindings;
         auto v2 = findAlongAttrPath(*state, settings.thisSystem, bindings, *v).first;
 
-        return store->parseStorePath(state->forceString(*v2, noPos, "while evaluating the path tho latest nix version"));
+        return store->parseStorePath(
+            state->forceString(*v2, noPos, "while evaluating the path tho latest nix version"));
     }
 };
 
diff --git a/src/nix/verify.cc b/src/nix/verify.cc
index eb2cde93c..309d19a1d 100644
--- a/src/nix/verify.cc
+++ b/src/nix/verify.cc
@@ -57,8 +57,8 @@ struct CmdVerify : StorePathsCommand
     std::string doc() override
     {
         return
-          #include "verify.md"
-          ;
+#include "verify.md"
+            ;
     }
 
     void run(ref<Store> store, StorePaths && storePaths) override
@@ -77,9 +77,7 @@ struct CmdVerify : StorePathsCommand
         std::atomic<size_t> failed{0};
         std::atomic<size_t> active{0};
 
-        auto update = [&]() {
-            act.progress(done, storePaths.size(), active, failed);
-        };
+        auto update = [&]() { act.progress(done, storePaths.size(), active, failed); };
 
         ThreadPool pool;
 
@@ -105,13 +103,14 @@ struct CmdVerify : StorePathsCommand
 
                     auto hash = hashSink.finish();
 
-                    if (hash.first != info->narHash) {
+                    if (hash.hash != info->narHash) {
                         corrupted++;
                         act2.result(resCorruptedPath, store->printStorePath(info->path));
-                        printError("path '%s' was modified! expected hash '%s', got '%s'",
+                        printError(
+                            "path '%s' was modified! expected hash '%s', got '%s'",
                             store->printStorePath(info->path),
                             info->narHash.to_string(HashFormat::Nix32, true),
-                            hash.first.to_string(HashFormat::Nix32, true));
+                            hash.hash.to_string(HashFormat::Nix32, true));
                     }
                 }
 
@@ -130,21 +129,25 @@ struct CmdVerify : StorePathsCommand
 
                         auto doSigs = [&](StringSet sigs) {
                             for (const auto & sig : sigs) {
-                                if (!sigsSeen.insert(sig).second) continue;
+                                if (!sigsSeen.insert(sig).second)
+                                    continue;
                                 if (validSigs < ValidPathInfo::maxSigs && info->checkSignature(*store, publicKeys, sig))
                                     validSigs++;
                             }
                         };
 
-                        if (info->isContentAddressed(*store)) validSigs = ValidPathInfo::maxSigs;
+                        if (info->isContentAddressed(*store))
+                            validSigs = ValidPathInfo::maxSigs;
 
                         doSigs(info->sigs);
 
                         for (auto & store2 : substituters) {
-                            if (validSigs >= actualSigsNeeded) break;
+                            if (validSigs >= actualSigsNeeded)
+                                break;
                             try {
                                 auto info2 = store2->queryPathInfo(info->path);
-                                if (info2->isContentAddressed(*store)) validSigs = ValidPathInfo::maxSigs;
+                                if (info2->isContentAddressed(*store))
+                                    validSigs = ValidPathInfo::maxSigs;
                                 doSigs(info2->sigs);
                             } catch (InvalidPath &) {
                             } catch (Error & e) {
@@ -161,7 +164,6 @@ struct CmdVerify : StorePathsCommand
                         act2.result(resUntrustedPath, store->printStorePath(info->path));
                         printError("path '%s' is untrusted", store->printStorePath(info->path));
                     }
-
                 }
 
                 done++;
@@ -179,10 +181,7 @@ struct CmdVerify : StorePathsCommand
 
         pool.process();
 
-        throw Exit(
-            (corrupted ? 1 : 0) |
-            (untrusted ? 2 : 0) |
-            (failed ? 4 : 0));
+        throw Exit((corrupted ? 1 : 0) | (untrusted ? 2 : 0) | (failed ? 4 : 0));
     }
 };
 
diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index 3aac45d34..7869e33a7 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -7,15 +7,9 @@
 
 using namespace nix;
 
-static std::string hilite(const std::string & s, size_t pos, size_t len,
-    const std::string & colour = ANSI_RED)
+static std::string hilite(const std::string & s, size_t pos, size_t len, const std::string & colour = ANSI_RED)
 {
-    return
-        std::string(s, 0, pos)
-        + colour
-        + std::string(s, pos, len)
-        + ANSI_NORMAL
-        + std::string(s, pos + len);
+    return std::string(s, 0, pos) + colour + std::string(s, pos, len) + ANSI_NORMAL + std::string(s, pos + len);
 }
 
 static std::string filterPrintable(const std::string & s)
@@ -49,13 +43,15 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
         addFlag({
             .longName = "all",
             .shortName = 'a',
-            .description = "Show all edges in the dependency graph leading from *package* to *dependency*, rather than just a shortest path.",
+            .description =
+                "Show all edges in the dependency graph leading from *package* to *dependency*, rather than just a shortest path.",
             .handler = {&all, true},
         });
 
         addFlag({
             .longName = "precise",
-            .description = "For each edge in the dependency graph, show the files in the parent that cause the dependency.",
+            .description =
+                "For each edge in the dependency graph, show the files in the parent that cause the dependency.",
             .handler = {&precise, true},
         });
     }
@@ -68,11 +64,14 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
     std::string doc() override
     {
         return
-          #include "why-depends.md"
-          ;
+#include "why-depends.md"
+            ;
     }
 
-    Category category() override { return catSecondary; }
+    Category category() override
+    {
+        return catSecondary;
+    }
 
     void run(ref<Store> store) override
     {
@@ -127,11 +126,12 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
         std::map<StorePath, Node> graph;
 
         for (auto & path : closure)
-            graph.emplace(path, Node {
-                .path = path,
-                .refs = store->queryPathInfo(path)->references,
-                .dist = path == dependencyPath ? 0 : inf
-            });
+            graph.emplace(
+                path,
+                Node{
+                    .path = path,
+                    .refs = store->queryPathInfo(path)->references,
+                    .dist = path == dependencyPath ? 0 : inf});
 
         // Transpose the graph.
         for (auto & node : graph)
@@ -159,7 +159,6 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
                         queue.push(&node2);
                     }
                 }
-
             }
         }
 
@@ -169,26 +168,29 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
            and `dependency`. */
         std::function<void(Node &, const std::string &, const std::string &)> printNode;
 
-        struct BailOut { };
+        struct BailOut
+        {};
 
         printNode = [&](Node & node, const std::string & firstPad, const std::string & tailPad) {
             CanonPath pathS(node.path.to_string());
 
             assert(node.dist != inf);
             if (precise) {
-                logger->cout("%s%s%s%s" ANSI_NORMAL,
+                logger->cout(
+                    "%s%s%s%s" ANSI_NORMAL,
                     firstPad,
                     node.visited ? "\e[38;5;244m" : "",
                     firstPad != "" ? "→ " : "",
                     pathS.abs());
             }
 
-            if (node.path == dependencyPath && !all
-                && packagePath != dependencyPath)
+            if (node.path == dependencyPath && !all && packagePath != dependencyPath)
                 throw BailOut();
 
-            if (node.visited) return;
-            if (precise) node.visited = true;
+            if (node.visited)
+                return;
+            if (precise)
+                node.visited = true;
 
             /* Sort the references by distance to `dependency` to
                ensure that the shortest path is printed first. */
@@ -196,9 +198,11 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
             StringSet hashes;
 
             for (auto & ref : node.refs) {
-                if (ref == node.path && packagePath != dependencyPath) continue;
+                if (ref == node.path && packagePath != dependencyPath)
+                    continue;
                 auto & node2 = graph.at(ref);
-                if (node2.dist == inf) continue;
+                if (node2.dist == inf)
+                    continue;
                 refs.emplace(node2.dist, &node2);
                 hashes.insert(std::string(node2.path.hashPart()));
             }
@@ -233,11 +237,13 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
                         if (pos != std::string::npos) {
                             size_t margin = 32;
                             auto pos2 = pos >= margin ? pos - margin : 0;
-                            hits[hash].emplace_back(fmt("%s: …%s…",
+                            hits[hash].emplace_back(
+                                fmt("%s: …%s…",
                                     p2,
-                                    hilite(filterPrintable(
-                                            std::string(contents, pos2, pos - pos2 + hash.size() + margin)),
-                                        pos - pos2, StorePath::HashLen,
+                                    hilite(
+                                        filterPrintable(std::string(contents, pos2, pos - pos2 + hash.size() + margin)),
+                                        pos - pos2,
+                                        StorePath::HashLen,
                                         getColour(hash))));
                         }
                     }
@@ -249,15 +255,16 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
                     for (auto & hash : hashes) {
                         auto pos = target.find(hash);
                         if (pos != std::string::npos)
-                            hits[hash].emplace_back(fmt("%s -> %s", p2,
-                                    hilite(target, pos, StorePath::HashLen, getColour(hash))));
+                            hits[hash].emplace_back(
+                                fmt("%s -> %s", p2, hilite(target, pos, StorePath::HashLen, getColour(hash))));
                     }
                 }
             };
 
             // FIXME: should use scanForReferences().
 
-            if (precise) visitPath(pathS);
+            if (precise)
+                visitPath(pathS);
 
             for (auto & ref : refs) {
                 std::string hash(ref.second->path.hashPart());
@@ -266,15 +273,16 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
 
                 for (auto & hit : hits[hash]) {
                     bool first = hit == *hits[hash].begin();
-                    logger->cout("%s%s%s", tailPad,
-                              (first ? (last ? treeLast : treeConn) : (last ? treeNull : treeLine)),
-                              hit);
-                    if (!all) break;
+                    logger->cout(
+                        "%s%s%s", tailPad, (first ? (last ? treeLast : treeConn) : (last ? treeNull : treeLine)), hit);
+                    if (!all)
+                        break;
                 }
 
                 if (!precise) {
                     auto pathS = store->printStorePath(ref.second->path);
-                    logger->cout("%s%s%s%s" ANSI_NORMAL,
+                    logger->cout(
+                        "%s%s%s%s" ANSI_NORMAL,
                         firstPad,
                         ref.second->visited ? "\e[38;5;244m" : "",
                         last ? treeLast : treeConn,
@@ -282,9 +290,7 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
                     node.visited = true;
                 }
 
-                printNode(*ref.second,
-                    tailPad + (last ? treeNull : treeLine),
-                    tailPad + (last ? treeNull : treeLine));
+                printNode(*ref.second, tailPad + (last ? treeNull : treeLine), tailPad + (last ? treeNull : treeLine));
             }
         };
 
@@ -294,7 +300,8 @@ struct CmdWhyDepends : SourceExprCommand, MixOperateOnOptions
                 logger->cout("%s", store->printStorePath(graph.at(packagePath).path));
             }
             printNode(graph.at(packagePath), "", "");
-        } catch (BailOut & ) { }
+        } catch (BailOut &) {
+        }
     }
 };
 
diff --git a/src/perl/lib/Nix/Store.xs b/src/perl/lib/Nix/Store.xs
index edcb6d72a..7aa918ba0 100644
--- a/src/perl/lib/Nix/Store.xs
+++ b/src/perl/lib/Nix/Store.xs
@@ -11,6 +11,7 @@
 #include "nix/store/globals.hh"
 #include "nix/store/store-open.hh"
 #include "nix/util/posix-source-accessor.hh"
+#include "nix/store/export-import.hh"
 
 #include <sodium.h>
 #include <nlohmann/json.hpp>
@@ -233,7 +234,7 @@ StoreWrapper::exportPaths(int fd, ...)
             StorePathSet paths;
             for (int n = 2; n < items; ++n) paths.insert(THIS->store->parseStorePath(SvPV_nolen(ST(n))));
             FdSink sink(fd);
-            THIS->store->exportPaths(paths, sink);
+            exportPaths(*THIS->store, paths, sink);
         } catch (Error & e) {
             croak("%s", e.what());
         }
@@ -244,7 +245,7 @@ StoreWrapper::importPaths(int fd, int dontCheckSigs)
     PPCODE:
         try {
             FdSource source(fd);
-            THIS->store->importPaths(source, dontCheckSigs ? NoCheckSigs : CheckSigs);
+            importPaths(*THIS->store, source, dontCheckSigs ? NoCheckSigs : CheckSigs);
         } catch (Error & e) {
             croak("%s", e.what());
         }
diff --git a/src/perl/lib/Nix/meson.build b/src/perl/lib/Nix/meson.build
index 256e66096..dd5560e21 100644
--- a/src/perl/lib/Nix/meson.build
+++ b/src/perl/lib/Nix/meson.build
@@ -16,8 +16,9 @@ nix_perl_scripts = files(
   'Utils.pm',
 )
 
+nix_perl_scripts_copy_tgts = []
 foreach f : nix_perl_scripts
-  fs.copyfile(f)
+  nix_perl_scripts_copy_tgts += fs.copyfile(f)
 endforeach
 
 
@@ -34,7 +35,7 @@ nix_perl_store_cc = custom_target(
   'Store.cc',
   output : 'Store.cc',
   input : nix_perl_store_xs,
-  command : [xsubpp, '@INPUT@', '-output', '@OUTPUT@'],
+  command : [ xsubpp, '@INPUT@', '-output', '@OUTPUT@' ],
 )
 
 # Build Nix::Store Library
@@ -42,7 +43,7 @@ nix_perl_store_cc = custom_target(
 nix_perl_store_lib = library(
   'Store',
   sources : nix_perl_store_cc,
-  name_prefix  : '',
+  name_prefix : '',
   prelink : true, # For C++ static initializers
   install : true,
   install_mode : 'rwxr-xr-x',
@@ -56,5 +57,5 @@ nix_perl_store_lib = library(
 install_data(
   nix_perl_scripts,
   install_mode : 'rw-r--r--',
-  install_dir : join_paths(nix_perl_install_dir,'Nix'),
+  install_dir : join_paths(nix_perl_install_dir, 'Nix'),
 )
diff --git a/src/perl/meson.build b/src/perl/meson.build
index 599e91710..59f2a66b8 100644
--- a/src/perl/meson.build
+++ b/src/perl/meson.build
@@ -4,7 +4,7 @@
 
 # init project
 #============================================================================
-project (
+project(
   'nix-perl',
   'cpp',
   version : files('.version'),
@@ -65,7 +65,7 @@ yath = find_program('yath', required : false)
 
 # Required Libraries
 #-------------------------------------------------
-bzip2_dep = dependency('bzip2', required: false)
+bzip2_dep = dependency('bzip2', required : false)
 if not bzip2_dep.found()
   bzip2_dep = cpp.find_library('bz2')
   if not bzip2_dep.found()
@@ -87,15 +87,36 @@ nix_store_dep = dependency('nix-store')
 # the perl bindings does not appear to be possible.
 #-------------------------------------------------
 perl_archname = run_command(
-  perl, '-e', 'use Config; print $Config{archname};', check: true).stdout()
+  perl,
+  '-e',
+  'use Config; print $Config{archname};',
+  check : true,
+).stdout()
 perl_version = run_command(
-  perl, '-e', 'use Config; print $Config{version};', check: true).stdout()
+  perl,
+  '-e',
+  'use Config; print $Config{version};',
+  check : true,
+).stdout()
 perl_archlibexp = run_command(
-  perl, '-e', 'use Config; print $Config{archlibexp};', check: true).stdout()
+  perl,
+  '-e',
+  'use Config; print $Config{archlibexp};',
+  check : true,
+).stdout()
 perl_site_libdir = run_command(
-  perl, '-e', 'use Config; print $Config{installsitearch};', check: true).stdout()
+  perl,
+  '-e',
+  'use Config; print $Config{installsitearch};',
+  check : true,
+).stdout()
 nix_perl_install_dir = join_paths(
-  libdir, 'perl5', 'site_perl', perl_version, perl_archname)
+  libdir,
+  'perl5',
+  'site_perl',
+  perl_version,
+  perl_archname,
+)
 
 
 # print perl hints for logs
@@ -110,10 +131,11 @@ message('Assumed Nix-Perl install dir: @0@'.format(nix_perl_install_dir))
 #-------------------------------------------------
 perl_check_dbi = run_command(
   perl,
-  '-e', 'use DBI; use DBD::SQLite;',
+  '-e',
+  'use DBI; use DBD::SQLite;',
   '-I@0@'.format(get_option('dbi_path')),
   '-I@0@'.format(get_option('dbd_sqlite_path')),
-  check: true
+  check : true,
 )
 
 if perl_check_dbi.returncode() == 2
@@ -128,10 +150,11 @@ endif
 #-------------------------------------------------
 perl_dep = declare_dependency(
   dependencies : cpp.find_library(
-  'perl',
-  has_headers : [
-    join_paths(perl_archlibexp, 'CORE', 'perl.h'),
-    join_paths(perl_archlibexp, 'CORE', 'EXTERN.h')],
+    'perl',
+    has_headers : [
+      join_paths(perl_archlibexp, 'CORE', 'perl.h'),
+      join_paths(perl_archlibexp, 'CORE', 'EXTERN.h'),
+    ],
     dirs : [
       join_paths(perl_archlibexp, 'CORE'),
     ],
@@ -166,8 +189,8 @@ if get_option('tests').enabled()
   test(
     'nix-perl-test',
     yath,
-    args : ['test'],
+    args : [ 'test' ],
     workdir : meson.current_build_dir(),
-    depends : [nix_perl_store_lib],
+    depends : [ nix_perl_store_lib ] + nix_perl_tests_copy_tgts + nix_perl_scripts_copy_tgts,
   )
 endif
diff --git a/src/perl/meson.options b/src/perl/meson.options
index 9b5b6b1d9..03ddf57f1 100644
--- a/src/perl/meson.options
+++ b/src/perl/meson.options
@@ -9,7 +9,8 @@ option(
   'tests',
   type : 'feature',
   value : 'disabled',
-  description : 'run nix-perl tests')
+  description : 'run nix-perl tests',
+)
 
 
 # Location of Perl Modules
@@ -18,10 +19,12 @@ option(
   'dbi_path',
   type : 'string',
   value : '/usr',
-  description : 'path to perl::dbi')
+  description : 'path to perl::dbi',
+)
 
 option(
   'dbd_sqlite_path',
   type : 'string',
   value : '/usr',
-  description : 'path to perl::dbd-SQLite')
+  description : 'path to perl::dbd-SQLite',
+)
diff --git a/src/perl/package.nix b/src/perl/package.nix
index 5841570cd..10d84de77 100644
--- a/src/perl/package.nix
+++ b/src/perl/package.nix
@@ -45,7 +45,8 @@ perl.pkgs.toPerlModule (
 
     buildInputs = [
       nix-store
-    ] ++ finalAttrs.passthru.externalBuildInputs;
+    ]
+    ++ finalAttrs.passthru.externalBuildInputs;
 
     # Hack for sake of the dev shell
     passthru.externalBuildInputs = [
diff --git a/src/perl/t/meson.build b/src/perl/t/meson.build
index 5e75920ac..f95bee2ff 100644
--- a/src/perl/t/meson.build
+++ b/src/perl/t/meson.build
@@ -7,10 +7,9 @@
 
 nix_perl_tests = files(
   'init.t',
-  # hack for trailing newline
 )
 
-
+nix_perl_tests_copy_tgts = []
 foreach f : nix_perl_tests
-  fs.copyfile(f)
+  nix_perl_tests_copy_tgts += fs.copyfile(f)
 endforeach
diff --git a/tests/functional/build-cores.nix b/tests/functional/build-cores.nix
new file mode 100644
index 000000000..9b763f7d8
--- /dev/null
+++ b/tests/functional/build-cores.nix
@@ -0,0 +1,11 @@
+with import ./config.nix;
+
+{
+  # Test derivation that checks the NIX_BUILD_CORES environment variable
+  testCores = mkDerivation {
+    name = "test-build-cores";
+    buildCommand = ''
+      echo "$NIX_BUILD_CORES" > $out
+    '';
+  };
+}
diff --git a/tests/functional/build-cores.sh b/tests/functional/build-cores.sh
new file mode 100755
index 000000000..a226774c6
--- /dev/null
+++ b/tests/functional/build-cores.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+clearStoreIfPossible
+
+echo "Testing build-cores configuration behavior..."
+
+# Test 1: When build-cores is set to a non-zero value, NIX_BUILD_CORES should have that value
+echo "Testing build-cores=4..."
+rm -f "$TEST_ROOT"/build-cores-output
+nix-build --cores 4 build-cores.nix -A testCores -o "$TEST_ROOT"/build-cores-output
+result=$(cat "$(readlink "$TEST_ROOT"/build-cores-output)")
+if [[ "$result" != "4" ]]; then
+    echo "FAIL: Expected NIX_BUILD_CORES=4, got $result"
+    exit 1
+fi
+echo "PASS: build-cores=4 correctly sets NIX_BUILD_CORES=4"
+rm -f "$TEST_ROOT"/build-cores-output
+
+# Test 2: When build-cores is set to 0, NIX_BUILD_CORES should be resolved to getDefaultCores()
+echo "Testing build-cores=0..."
+nix-build --cores 0 build-cores.nix -A testCores -o "$TEST_ROOT"/build-cores-output
+result=$(cat "$(readlink "$TEST_ROOT"/build-cores-output)")
+if [[ "$result" == "0" ]]; then
+    echo "FAIL: NIX_BUILD_CORES should not be 0 when build-cores=0"
+    exit 1
+fi
+echo "PASS: build-cores=0 resolves to NIX_BUILD_CORES=$result (should be > 0)"
+rm -f "$TEST_ROOT"/build-cores-output
+
+echo "All build-cores tests passed!"
diff --git a/tests/functional/ca/meson.build b/tests/functional/ca/meson.build
index a4611ca42..ec34e9644 100644
--- a/tests/functional/ca/meson.build
+++ b/tests/functional/ca/meson.build
@@ -5,9 +5,9 @@ configure_file(
 )
 
 suites += {
-  'name': 'ca',
-  'deps': [],
-  'tests': [
+  'name' : 'ca',
+  'deps' : [],
+  'tests' : [
     'build-cache.sh',
     'build-with-garbage-path.sh',
     'build.sh',
@@ -30,5 +30,5 @@ suites += {
     'substitute.sh',
     'why-depends.sh',
   ],
-  'workdir': meson.current_source_dir(),
+  'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/check.sh b/tests/functional/check.sh
index a1c6decf5..260506138 100755
--- a/tests/functional/check.sh
+++ b/tests/functional/check.sh
@@ -52,10 +52,10 @@ test_custom_build_dir() {
   nix-build check.nix -A failed --argstr checkBuildId "$checkBuildId" \
       --no-out-link --keep-failed --option build-dir "$TEST_ROOT/custom-build-dir" 2> "$TEST_ROOT/log" || status=$?
   [ "$status" = "100" ]
-  [[ 1 == "$(count "$customBuildDir/nix-build-"*)" ]]
-  local buildDir=("$customBuildDir/nix-build-"*)
+  [[ 1 == "$(count "$customBuildDir/nix-"*)" ]]
+  local buildDir=("$customBuildDir/nix-"*)
   if [[ "${#buildDir[@]}" -ne 1 ]]; then
-    echo "expected one nix-build-* directory, got: ${buildDir[*]}" >&2
+    echo "expected one nix-* directory, got: ${buildDir[*]}" >&2
     exit 1
   fi
   if [[ -e ${buildDir[*]}/build ]]; then
diff --git a/tests/functional/dyn-drv/failing-outer.sh b/tests/functional/dyn-drv/failing-outer.sh
index 3feda74fb..596efe43d 100644
--- a/tests/functional/dyn-drv/failing-outer.sh
+++ b/tests/functional/dyn-drv/failing-outer.sh
@@ -9,4 +9,4 @@ expected=100
 if [[ -v NIX_DAEMON_PACKAGE ]]; then expected=1; fi # work around the daemon not returning a 100 status correctly
 
 expectStderr "$expected" nix-build ./text-hashed-output.nix -A failingWrapper --no-out-link \
-    | grepQuiet "build of '.*use-dynamic-drv-in-non-dynamic-drv-wrong.drv' failed"
+    | grepQuiet "build of resolved derivation '.*use-dynamic-drv-in-non-dynamic-drv-wrong.drv' failed"
diff --git a/tests/functional/dyn-drv/meson.build b/tests/functional/dyn-drv/meson.build
index 07145000d..78950a954 100644
--- a/tests/functional/dyn-drv/meson.build
+++ b/tests/functional/dyn-drv/meson.build
@@ -5,9 +5,9 @@ configure_file(
 )
 
 suites += {
-  'name': 'dyn-drv',
-  'deps': [],
-  'tests': [
+  'name' : 'dyn-drv',
+  'deps' : [],
+  'tests' : [
     'text-hashed-output.sh',
     'recursive-mod-json.sh',
     'build-built-drv.sh',
@@ -17,5 +17,5 @@ suites += {
     'old-daemon-error-hack.sh',
     'dep-built-drv-2.sh',
   ],
-  'workdir': meson.current_source_dir(),
+  'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 49f1a51f5..e171112d9 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -53,6 +53,27 @@ rm -rf $TEST_HOME/.cache/nix
 path=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [[ $(cat $path/hello) = world ]]
 
+# Fetch again. This should be cached.
+# NOTE: This has to be done before the test case below which tries to pack-refs
+# the reason being that the lookup on the cache uses the ref-file `/refs/heads/master`
+# which does not exist after packing.
+mv $repo ${repo}-tmp
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
+[[ $path = $path2 ]]
+
+[[ $(nix eval --impure --expr "(builtins.fetchGit file://$repo).revCount") = 2 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).rev") = $rev2 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).shortRev") = ${rev2:0:7} ]]
+
+# Fetching with a explicit hash should succeed.
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
+[[ $path = $path2 ]]
+
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev1\"; }).outPath")
+[[ $(cat $path2/hello) = utrecht ]]
+
+mv ${repo}-tmp $repo
+
 # Fetch when the cache has packed-refs
 # Regression test of #8822
 git -C $TEST_HOME/.cache/nix/gitv3/*/ pack-refs --all
@@ -83,24 +104,6 @@ path2=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"
 # But without a hash, it fails.
 expectStderr 1 nix eval --expr 'builtins.fetchGit "file:///foo"' | grepQuiet "'fetchGit' doesn't fetch unlocked input"
 
-# Fetch again. This should be cached.
-mv $repo ${repo}-tmp
-path2=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
-[[ $path = $path2 ]]
-
-[[ $(nix eval --impure --expr "(builtins.fetchGit file://$repo).revCount") = 2 ]]
-[[ $(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).rev") = $rev2 ]]
-[[ $(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).shortRev") = ${rev2:0:7} ]]
-
-# Fetching with a explicit hash should succeed.
-path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
-[[ $path = $path2 ]]
-
-path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev1\"; }).outPath")
-[[ $(cat $path2/hello) = utrecht ]]
-
-mv ${repo}-tmp $repo
-
 # Using a clean working tree should produce the same result.
 path2=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [[ $path = $path2 ]]
@@ -233,10 +236,10 @@ path9=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$rep
 # Specifying a ref without a rev shouldn't pick a cached rev for a different ref
 export _NIX_FORCE_HTTP=1
 rev_tag1_nix=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$repo\"; ref = \"refs/tags/tag1\"; }).rev")
-rev_tag1=$(git -C $repo rev-parse refs/tags/tag1)
+rev_tag1=$(git -C $repo rev-parse refs/tags/tag1^{commit})
 [[ $rev_tag1_nix = $rev_tag1 ]]
 rev_tag2_nix=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$repo\"; ref = \"refs/tags/tag2\"; }).rev")
-rev_tag2=$(git -C $repo rev-parse refs/tags/tag2)
+rev_tag2=$(git -C $repo rev-parse refs/tags/tag2^{commit})
 [[ $rev_tag2_nix = $rev_tag2 ]]
 unset _NIX_FORCE_HTTP
 
diff --git a/tests/functional/fetchGitRefs.sh b/tests/functional/fetchGitRefs.sh
index ee054fabc..258a65525 100755
--- a/tests/functional/fetchGitRefs.sh
+++ b/tests/functional/fetchGitRefs.sh
@@ -67,6 +67,7 @@ valid_ref 'foo./bar'
 valid_ref 'heads/foo@bar'
 valid_ref "$(printf 'heads/fu\303\237')"
 valid_ref 'foo-bar-baz'
+valid_ref 'branch#'
 valid_ref '$1'
 valid_ref 'foo.locke'
 
@@ -97,6 +98,7 @@ invalid_ref 'heads/v@{ation'
 invalid_ref 'heads/foo\.ar' # should fail due to \
 invalid_ref 'heads/foo\bar' # should fail due to \
 invalid_ref "$(printf 'heads/foo\t')" # should fail because it has a TAB
+invalid_ref "$(printf 'heads/foo\37')"
 invalid_ref "$(printf 'heads/foo\177')"
 invalid_ref '@'
 
diff --git a/tests/functional/fetchurl.sh b/tests/functional/fetchurl.sh
index c25ac3216..5bc8ca625 100755
--- a/tests/functional/fetchurl.sh
+++ b/tests/functional/fetchurl.sh
@@ -88,3 +88,8 @@ requireDaemonNewerThan "2.20"
 expected=100
 if [[ -v NIX_DAEMON_PACKAGE ]]; then expected=1; fi # work around the daemon not returning a 100 status correctly
 expectStderr $expected nix-build --expr '{ url }: builtins.derivation { name = "nix-cache-info"; system = "x86_64-linux"; builder = "builtin:fetchurl"; inherit url; outputHashMode = "flat"; }' --argstr url "file://$narxz" 2>&1 | grep 'must be a fixed-output or impure derivation'
+
+requireDaemonNewerThan "2.32.0pre20250831"
+
+expect 1 nix-build --expr 'import <nix/fetchurl.nix>' --argstr name 'name' --argstr url "file://authority.not.allowed/fetchurl.sh?a=1&a=2" --no-out-link |&
+        grepQuiet "error: file:// URL 'file://authority.not.allowed/fetchurl.sh?a=1&a=2' has unexpected authority 'authority.not.allowed'"
diff --git a/tests/functional/fixed.nix b/tests/functional/fixed.nix
index eab3ee707..1a743ee39 100644
--- a/tests/functional/fixed.nix
+++ b/tests/functional/fixed.nix
@@ -74,5 +74,10 @@ rec {
   nar-not-recursive = f2 "foo" ./fixed.builder2.sh "nar" "md5" "3670af73070fa14077ad74e0f5ea4e42";
 
   # Experimental feature
-  git = f2 "foo" ./fixed.builder2.sh "git" "sha1" "cd44baf36915d5dec8374232ea7e2057f3b4494e";
+
+  git-sha1 = f2 "foo" ./fixed.builder2.sh "git" "sha1" "cd44baf36915d5dec8374232ea7e2057f3b4494e";
+
+  git-sha256 =
+    f2 "foo" ./fixed.builder2.sh "git" "sha256"
+      "3c957653f90c34c0a8badf343b61393936cddf4a2ca93f64b21f02303ddedcc2";
 }
diff --git a/tests/functional/flakes/check.sh b/tests/functional/flakes/check.sh
index 27e73444a..50a2b21c9 100755
--- a/tests/functional/flakes/check.sh
+++ b/tests/functional/flakes/check.sh
@@ -135,3 +135,35 @@ EOF
 
 checkRes=$(nix flake check --all-systems $flakeDir 2>&1 && fail "nix flake check --all-systems should have failed" || true)
 echo "$checkRes" | grepQuiet "formatter.system-1"
+
+# Test whether `nix flake check` builds checks.
+cat > $flakeDir/flake.nix <<EOF
+{
+  outputs = { self }: {
+    checks.$system.foo = with import ./config.nix; mkDerivation {
+      name = "simple";
+      buildCommand = "mkdir \$out";
+    };
+  };
+}
+EOF
+
+cp "${config_nix}" "$flakeDir/"
+
+expectStderr 0 nix flake check "$flakeDir" | grepQuiet 'running 1 flake check'
+
+cat > $flakeDir/flake.nix <<EOF
+{
+  outputs = { self }: {
+    checks.$system.foo = with import ./config.nix; mkDerivation {
+      name = "simple";
+      buildCommand = "false";
+    };
+  };
+}
+EOF
+
+# FIXME: error code 100 doesn't get propagated from the daemon.
+if !isTestOnNixOS && $NIX_REMOTE != daemon; then
+    expectStderr 100 nix flake check "$flakeDir" | grepQuiet 'builder failed with exit code 1'
+fi
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index ce695a6cb..7b5be112e 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -432,3 +432,71 @@ nix flake metadata "$flake2Dir" --reference-lock-file $TEST_ROOT/flake2-overridd
 
 # reference-lock-file can only be used if allow-dirty is set.
 expectStderr 1 nix flake metadata "$flake2Dir" --no-allow-dirty --reference-lock-file $TEST_ROOT/flake2-overridden.lock
+
+# After changing an input (flake2 from newFlake2Rev to prevFlake2Rev), we should have the transitive inputs locked by revision $prevFlake2Rev of flake2.
+prevFlake1Rev=$(nix flake metadata --json "$flake1Dir" | jq -r .revision)
+prevFlake2Rev=$(nix flake metadata --json "$flake2Dir" | jq -r .revision)
+
+echo "# bla" >> "$flake1Dir/flake.nix"
+git -C "$flake1Dir" commit flake.nix -m 'bla'
+
+nix flake update --flake "$flake2Dir"
+git -C "$flake2Dir" commit flake.lock -m 'bla'
+
+newFlake1Rev=$(nix flake metadata --json "$flake1Dir" | jq -r .revision)
+newFlake2Rev=$(nix flake metadata --json "$flake2Dir" | jq -r .revision)
+
+cat > "$flake3Dir/flake.nix" <<EOF
+{
+  inputs.flake2.url = "flake:flake2/master/$newFlake2Rev";
+
+  outputs = { self, flake2 }: {
+  };
+}
+EOF
+git -C "$flake3Dir" commit flake.nix -m 'bla'
+
+rm "$flake3Dir/flake.lock"
+nix flake lock "$flake3Dir"
+[[ "$(nix flake metadata --json "$flake3Dir" | jq -r .locks.nodes.flake1.locked.rev)" = $newFlake1Rev ]]
+
+cat > "$flake3Dir/flake.nix" <<EOF
+{
+  inputs.flake2.url = "flake:flake2/master/$prevFlake2Rev";
+
+  outputs = { self, flake2 }: {
+  };
+}
+EOF
+
+[[ "$(nix flake metadata --json "$flake3Dir" | jq -r .locks.nodes.flake1.locked.rev)" = $prevFlake1Rev ]]
+
+baseDir=$TEST_ROOT/$RANDOM
+subdirFlakeDir1=$baseDir/foo1
+mkdir -p "$subdirFlakeDir1"
+
+writeSimpleFlake "$baseDir"
+
+cat > "$subdirFlakeDir1"/flake.nix <<EOF
+{
+  outputs = inputs: {
+    shouldBeOne = 1;
+  };
+}
+EOF
+
+nix registry add --registry "$registry" flake2 "path:$baseDir?dir=foo1"
+[[ "$(nix eval --flake-registry "$registry" flake2#shouldBeOne)" = 1 ]]
+
+subdirFlakeDir2=$baseDir/foo2
+mkdir -p "$subdirFlakeDir2"
+cat > "$subdirFlakeDir2"/flake.nix <<EOF
+{
+  inputs.foo1.url = "path:$baseDir?dir=foo1";
+
+  outputs = inputs: { };
+}
+EOF
+
+# Regression test for https://github.com/NixOS/nix/issues/13918
+[[ "$(nix eval --inputs-from "$subdirFlakeDir2" foo1#shouldBeOne)" = 1 ]]
diff --git a/tests/functional/flakes/meson.build b/tests/functional/flakes/meson.build
index 801fefc6f..de76a5580 100644
--- a/tests/functional/flakes/meson.build
+++ b/tests/functional/flakes/meson.build
@@ -1,7 +1,7 @@
 suites += {
-  'name': 'flakes',
-  'deps': [],
-  'tests': [
+  'name' : 'flakes',
+  'deps' : [],
+  'tests' : [
     'flakes.sh',
     'develop.sh',
     'edit.sh',
@@ -35,5 +35,5 @@ suites += {
     'old-lockfiles.sh',
     'trace-ifd.sh',
   ],
-  'workdir': meson.current_source_dir(),
+  'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/flakes/run.sh b/tests/functional/flakes/run.sh
index c92ddca2b..0a2947825 100755
--- a/tests/functional/flakes/run.sh
+++ b/tests/functional/flakes/run.sh
@@ -41,11 +41,13 @@ nix run -f shell-hello.nix env > $TEST_ROOT/actual-env
 # - we unset TMPDIR on macOS if it contains /var/folders. bad. https://github.com/NixOS/nix/issues/7731
 # - _ is set by bash and is expected to differ because it contains the original command
 # - __CF_USER_TEXT_ENCODING is set by macOS and is beyond our control
+# - __LLVM_PROFILE_RT_INIT_ONCE - implementation detail of LLVM source code coverage collection
 sed -i \
   -e 's/PATH=.*/PATH=.../' \
   -e 's/_=.*/_=.../' \
   -e '/^TMPDIR=\/var\/folders\/.*/d' \
   -e '/^__CF_USER_TEXT_ENCODING=.*$/d' \
+  -e '/^__LLVM_PROFILE_RT_INIT_ONCE=.*$/d' \
   $TEST_ROOT/expected-env $TEST_ROOT/actual-env
 sort $TEST_ROOT/expected-env | uniq > $TEST_ROOT/expected-env.sorted
 # nix run appears to clear _. I don't understand why. Is this ok?
diff --git a/tests/functional/git-hashing/common.sh b/tests/functional/git-hashing/common.sh
index 29c518fea..2d41c0ff8 100644
--- a/tests/functional/git-hashing/common.sh
+++ b/tests/functional/git-hashing/common.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 source ../common.sh
 
 TODO_NixOS # Need to enable git hashing feature and make sure test is ok for store we don't clear
diff --git a/tests/functional/git-hashing/fixed.sh b/tests/functional/git-hashing/fixed.sh
index f33d95cfa..080bc6485 100755
--- a/tests/functional/git-hashing/fixed.sh
+++ b/tests/functional/git-hashing/fixed.sh
@@ -5,4 +5,8 @@ source common.sh
 # Store layer needs bugfix
 requireDaemonNewerThan "2.27pre20250122"
 
-nix-build ../fixed.nix -A git --no-out-link
+nix-build ../fixed.nix -A git-sha1 --no-out-link
+
+if isDaemonNewer "2.31pre20250724"; then
+    nix-build ../fixed.nix -A git-sha256 --no-out-link
+fi
diff --git a/tests/functional/git-hashing/meson.build b/tests/functional/git-hashing/meson.build
index d6a782cdc..8e7f693c1 100644
--- a/tests/functional/git-hashing/meson.build
+++ b/tests/functional/git-hashing/meson.build
@@ -1,9 +1,10 @@
 suites += {
-  'name': 'git-hashing',
-  'deps': [],
-  'tests': [
-    'simple.sh',
+  'name' : 'git-hashing',
+  'deps' : [],
+  'tests' : [
+    'simple-sha1.sh',
+    'simple-sha256.sh',
     'fixed.sh',
   ],
-  'workdir': meson.current_source_dir(),
+  'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/git-hashing/simple-common.sh b/tests/functional/git-hashing/simple-common.sh
new file mode 100644
index 000000000..08b5c0e71
--- /dev/null
+++ b/tests/functional/git-hashing/simple-common.sh
@@ -0,0 +1,96 @@
+# shellcheck shell=bash
+
+source common.sh
+
+# Assert is set
+[[ ${hashAlgo+x} ]]
+
+repo="$TEST_ROOT/scratch"
+
+initRepo () {
+    git init "$repo" --object-format="$hashAlgo"
+
+    git -C "$repo" config user.email "you@example.com"
+    git -C "$repo" config user.name "Your Name"
+}
+
+# Compare Nix's and git's implementation of git hashing
+try () {
+    local expected="$1"
+
+    local hash
+    hash=$(nix hash path --mode git --format base16 --algo "$hashAlgo" "$TEST_ROOT/hash-path")
+    [[ "$hash" == "$expected" ]]
+
+    git -C "$repo" rm -rf hash-path || true
+    cp -r "$TEST_ROOT/hash-path" "$repo/hash-path"
+    git -C "$repo" add hash-path
+    git -C "$repo" commit -m "x"
+    git -C "$repo" status
+    local hash2
+    hash2=$(git -C "$repo" rev-parse HEAD:hash-path)
+    [[ "$hash2" = "$expected" ]]
+}
+
+# Check Nix added object has matching git hash
+try2 () {
+    local hashPath="$1"
+    local expected="$2"
+
+    local path
+    path=$(nix store add --mode git --hash-algo "$hashAlgo" "$repo/$hashPath")
+
+    git -C "$repo" add "$hashPath"
+    git -C "$repo" commit -m "x"
+    git -C "$repo" status
+    local hashFromGit
+    hashFromGit=$(git -C "$repo" rev-parse "HEAD:$hashPath")
+    [[ "$hashFromGit" == "$expected" ]]
+
+    local caFromNix
+    caFromNix=$(nix path-info --json "$path" | jq -r ".[] | .ca")
+    [[ "fixed:git:$hashAlgo:$(nix hash convert --to nix32 "$hashAlgo:$hashFromGit")" = "$caFromNix" ]]
+}
+
+test0 () {
+    rm -rf "$TEST_ROOT/hash-path"
+    echo "Hello World" > "$TEST_ROOT/hash-path"
+}
+
+test1 () {
+    rm -rf "$TEST_ROOT/hash-path"
+    mkdir "$TEST_ROOT/hash-path"
+    echo "Hello World" > "$TEST_ROOT/hash-path/hello"
+    echo "Run Hello World" > "$TEST_ROOT/hash-path/executable"
+    chmod +x "$TEST_ROOT/hash-path/executable"
+}
+
+test2 () {
+    rm -rf "$repo/dummy1"
+    echo Hello World! > "$repo/dummy1"
+}
+
+test3 () {
+    rm -rf "$repo/dummy2"
+    mkdir -p "$repo/dummy2"
+    echo Hello World! > "$repo/dummy2/hello"
+}
+
+test4 () {
+    rm -rf "$repo/dummy3"
+    mkdir -p "$repo/dummy3"
+    mkdir -p "$repo/dummy3/dir"
+    touch "$repo/dummy3/dir/file"
+    echo Hello World! > "$repo/dummy3/dir/file"
+    touch "$repo/dummy3/dir/executable"
+    chmod +x "$repo/dummy3/dir/executable"
+    echo Run Hello World! > "$repo/dummy3/dir/executable"
+}
+
+test5 () {
+    rm -rf "$repo/dummy4"
+    mkdir -p "$repo/dummy4"
+    mkdir -p "$repo/dummy4/dir"
+    touch "$repo/dummy4/dir/file"
+    ln -s './hello/world.txt' "$repo/dummy4/dir/symlink"
+}
diff --git a/tests/functional/git-hashing/simple-sha1.sh b/tests/functional/git-hashing/simple-sha1.sh
new file mode 100755
index 000000000..a883ea848
--- /dev/null
+++ b/tests/functional/git-hashing/simple-sha1.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+hashAlgo=sha1
+
+source simple-common.sh
+
+initRepo
+
+# blob
+test0
+try "557db03de997c86a4a028e1ebd3a1ceb225be238"
+
+# tree with children
+test1
+try "e5c0a11a556801a5c9dcf330ca9d7e2c572697f4"
+
+test2
+try2 dummy1 "980a0d5f19a64b4b30a87d4206aade58726b60e3"
+
+test3
+try2 dummy2 "8b8e43b937854f4083ea56777821abda2799e850"
+
+test4
+try2 dummy3 "f227adfaf60d2778aabbf93df6dd061272d2dc85"
+
+test5
+try2 dummy4 "06f3e789820fc488d602358f03e3a1cbf993bf33"
diff --git a/tests/functional/git-hashing/simple-sha256.sh b/tests/functional/git-hashing/simple-sha256.sh
new file mode 100755
index 000000000..c7da71e00
--- /dev/null
+++ b/tests/functional/git-hashing/simple-sha256.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+hashAlgo=sha256
+
+source simple-common.sh
+
+requireDaemonNewerThan 2.31pre20250724
+
+initRepo
+
+# blob
+test0
+try "7c5c8610459154bdde4984be72c48fb5d9c1c4ac793a6b5976fe38fd1b0b1284"
+
+# tree with children
+test1
+try "cd79952f42462467d0ea574b0283bb6eb77e15b2b86891e29f2b981650365474"
+
+test2
+try2 dummy1 "f5b5cec05fb6f9302b507a48c1573e6f36075e954d97caa8667f784e9cdb0d13"
+
+test3
+try2 dummy2 "399d851c74ceac2c2b61b53b13dcf5e88df3b6135c7df1f248a323c3c2f9aa78"
+
+test4
+try2 dummy3 "d3ae8fc87e76b9b871bd06a58c925c5fb5f83b5393f9f58e4f6dba3f59470289"
+
+test5
+try2 dummy4 "8c090dd057e8e01ffe1fec24a3133dfe52ba4eda822e67ee7fefc2af7c6a2906"
diff --git a/tests/functional/git-hashing/simple.sh b/tests/functional/git-hashing/simple.sh
deleted file mode 100755
index e02d8b297..000000000
--- a/tests/functional/git-hashing/simple.sh
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-
-source common.sh
-
-repo="$TEST_ROOT/scratch"
-git init "$repo"
-
-git -C "$repo" config user.email "you@example.com"
-git -C "$repo" config user.name "Your Name"
-
-# Compare Nix's and git's implementation of git hashing
-try () {
-    local hash=$(nix hash path --mode git --format base16 --algo sha1 $TEST_ROOT/hash-path)
-    [[ "$hash" == "$1" ]]
-
-    git -C "$repo" rm -rf hash-path || true
-    cp -r "$TEST_ROOT/hash-path" "$TEST_ROOT/scratch/hash-path"
-    git -C "$repo" add hash-path
-    git -C "$repo" commit -m "x"
-    git -C "$repo" status
-    local hash2=$(git -C "$TEST_ROOT/scratch" rev-parse HEAD:hash-path)
-    [[ "$hash2" = "$1" ]]
-}
-
-# blob
-rm -rf $TEST_ROOT/hash-path
-echo "Hello World" > $TEST_ROOT/hash-path
-try "557db03de997c86a4a028e1ebd3a1ceb225be238"
-
-# tree with children
-rm -rf $TEST_ROOT/hash-path
-mkdir $TEST_ROOT/hash-path
-echo "Hello World" > $TEST_ROOT/hash-path/hello
-echo "Run Hello World" > $TEST_ROOT/hash-path/executable
-chmod +x $TEST_ROOT/hash-path/executable
-try "e5c0a11a556801a5c9dcf330ca9d7e2c572697f4"
-
-# Check Nix added object has matching git hash
-try2 () {
-    local hashPath="$1"
-    local expected="$2"
-
-    local path=$(nix store add --mode git --hash-algo sha1 "$repo/$hashPath")
-
-    git -C "$repo" add "$hashPath"
-    git -C "$repo" commit -m "x"
-    git -C "$repo" status
-    local hashFromGit=$(git -C "$repo" rev-parse "HEAD:$hashPath")
-    [[ "$hashFromGit" == "$2" ]]
-
-    local caFromNix=$(nix path-info --json "$path" | jq -r ".[] | .ca")
-    [[ "fixed:git:sha1:$(nix hash convert --to nix32 "sha1:$hashFromGit")" = "$caFromNix" ]]
-}
-
-rm -rf "$repo/dummy1"
-echo Hello World! > "$repo/dummy1"
-try2 dummy1 "980a0d5f19a64b4b30a87d4206aade58726b60e3"
-
-rm -rf "$repo/dummy2"
-mkdir -p "$repo/dummy2"
-echo Hello World! > "$repo/dummy2/hello"
-try2 dummy2 "8b8e43b937854f4083ea56777821abda2799e850"
-
-rm -rf "$repo/dummy3"
-mkdir -p "$repo/dummy3"
-mkdir -p "$repo/dummy3/dir"
-touch "$repo/dummy3/dir/file"
-echo Hello World! > "$repo/dummy3/dir/file"
-touch "$repo/dummy3/dir/executable"
-chmod +x "$repo/dummy3/dir/executable"
-echo Run Hello World! > "$repo/dummy3/dir/executable"
-try2 dummy3 "f227adfaf60d2778aabbf93df6dd061272d2dc85"
-
-rm -rf "$repo/dummy4"
-mkdir -p "$repo/dummy4"
-mkdir -p "$repo/dummy4/dir"
-touch "$repo/dummy4/dir/file"
-ln -s './hello/world.txt' "$repo/dummy4/dir/symlink"
-try2 dummy4 "06f3e789820fc488d602358f03e3a1cbf993bf33"
diff --git a/tests/functional/git/meson.build b/tests/functional/git/meson.build
new file mode 100644
index 000000000..af6882698
--- /dev/null
+++ b/tests/functional/git/meson.build
@@ -0,0 +1,6 @@
+suites += {
+  'name' : 'git',
+  'deps' : [],
+  'tests' : [ 'packed-refs-no-cache.sh' ],
+  'workdir' : meson.current_source_dir(),
+}
diff --git a/tests/functional/git/packed-refs-no-cache.sh b/tests/functional/git/packed-refs-no-cache.sh
new file mode 100644
index 000000000..54e0ab901
--- /dev/null
+++ b/tests/functional/git/packed-refs-no-cache.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+
+# Please see https://github.com/NixOS/nix/issues/13457
+# for a higher description of the purpose of the test.
+# tl;dr;fetchGit will utilize the git cache and avoid refetching when possible.
+# It relies on the presence of either the commit when rev is provided
+# or checks if the ref refs/heads/<ref_name> if ref is provided.
+#
+# Unfortunately, git can occasionally "pack references" which moves the references
+# from individual files to a single unifies file.
+# When this occurs, nix can no longer check for the presence of the ref to check
+# for the mtime and will refetch unnecessarily.
+
+source ../common.sh
+
+requireGit
+
+clearStoreIfPossible
+
+# Intentionally not in a canonical form
+# See https://github.com/NixOS/nix/issues/6195
+repo=$TEST_ROOT/./git
+
+export _NIX_FORCE_HTTP=1
+
+rm -rf "$repo" "${repo}-tmp" "$TEST_HOME/.cache/nix"
+
+git init --initial-branch="master" "$repo"
+git -C "$repo" config user.email "nix-tests@example.com"
+git -C "$repo" config user.name "Nix Tests"
+
+echo "hello world" > "$repo/hello_world"
+git -C "$repo" add hello_world
+git -C "$repo" commit -m 'My first commit.'
+
+# We now do an eval
+nix eval --impure --raw --expr "builtins.fetchGit { url = file://$repo; }"
+
+# test that our eval even worked by checking for the presence of the file
+[[ $(nix eval --impure --raw --expr "builtins.readFile ((builtins.fetchGit { url = file://$repo; }) + \"/hello_world\")") = 'hello world' ]]
+
+# Validate that refs/heads/master exists
+shopt -s nullglob
+matches=("$TEST_HOME/.cache/nix/gitv3/*/refs/heads/master")
+shopt -u nullglob
+
+if [[ ${#matches[@]} -eq 0 ]]; then
+  echo "refs/heads/master does not exist."
+  exit 1
+fi
+# pack refs
+git -C "$TEST_HOME"/.cache/nix/gitv3/*/ pack-refs --all
+
+shopt -s nullglob
+matches=("$TEST_HOME"/.cache/nix/gitv3/*/refs/heads/master)
+shopt -u nullglob
+
+# ensure refs/heads/master is now gone
+if [[ ${#matches[@]} -ne 0 ]]; then
+  echo "refs/heads/master still exists after pack-refs"
+  exit 1
+fi
+
+# create a new commit
+echo "hello again" > "$repo/hello_again"
+git -C "$repo" add hello_again
+git -C "$repo" commit -m 'Second commit.'
+
+# re-eval — this should return the path to the cached version
+store_path=$(nix eval --tarball-ttl 3600 --impure --raw --expr "(builtins.fetchGit { url = file://$repo; }).outPath")
+echo "Fetched store path: $store_path"
+
+# Validate that the new file is *not* there
+# FIXME: This is a broken test case and we should swap the assertion here.
+if [[ -e "$store_path/hello_again" ]]; then
+  echo "ERROR: Cached fetchGit should not include the new commit."
+  exit 0
+else
+  echo "PASS: New commit was not fetched due to caching (as expected)."
+  exit 1
+fi
diff --git a/tests/functional/lang/eval-fail-fromTOML-overflow.err.exp b/tests/functional/lang/eval-fail-fromTOML-overflow.err.exp
new file mode 100644
index 000000000..14b0e31c1
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fromTOML-overflow.err.exp
@@ -0,0 +1,13 @@
+error:
+       … while calling the 'fromTOML' builtin
+         at /pwd/lang/eval-fail-fromTOML-overflow.nix:1:1:
+            1| builtins.fromTOML ''attr = 9223372036854775808''
+             | ^
+            2|
+
+       error: while parsing TOML: [error] toml::parse_dec_integer: too large integer: current max digits = 2^63
+        --> fromTOML
+          |
+        1 | attr = 9223372036854775808
+          |                           ^-- must be < 2^63
+       
diff --git a/tests/functional/lang/eval-fail-fromTOML-overflow.nix b/tests/functional/lang/eval-fail-fromTOML-overflow.nix
new file mode 100644
index 000000000..17f0448b3
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fromTOML-overflow.nix
@@ -0,0 +1 @@
+builtins.fromTOML ''attr = 9223372036854775808''
diff --git a/tests/functional/lang/eval-fail-fromTOML-underflow.err.exp b/tests/functional/lang/eval-fail-fromTOML-underflow.err.exp
new file mode 100644
index 000000000..28f1079dc
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fromTOML-underflow.err.exp
@@ -0,0 +1,13 @@
+error:
+       … while calling the 'fromTOML' builtin
+         at /pwd/lang/eval-fail-fromTOML-underflow.nix:1:1:
+            1| builtins.fromTOML ''attr = -9223372036854775809''
+             | ^
+            2|
+
+       error: while parsing TOML: [error] toml::parse_dec_integer: too large integer: current max digits = 2^63
+        --> fromTOML
+          |
+        1 | attr = -9223372036854775809
+          |                            ^-- must be < 2^63
+       
diff --git a/tests/functional/lang/eval-fail-fromTOML-underflow.nix b/tests/functional/lang/eval-fail-fromTOML-underflow.nix
new file mode 100644
index 000000000..923fdf354
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fromTOML-underflow.nix
@@ -0,0 +1 @@
+builtins.fromTOML ''attr = -9223372036854775809''
diff --git a/tests/functional/lang/eval-fail-missing-arg-import.err.exp b/tests/functional/lang/eval-fail-missing-arg-import.err.exp
new file mode 100644
index 000000000..45774f003
--- /dev/null
+++ b/tests/functional/lang/eval-fail-missing-arg-import.err.exp
@@ -0,0 +1,12 @@
+error:
+       … from call site
+         at /pwd/lang/eval-fail-missing-arg-import.nix:1:1:
+            1| import ./non-eval-trivial-lambda-formals.nix { }
+             | ^
+            2|
+
+       error: function 'anonymous lambda' called without required argument 'a'
+       at /pwd/lang/non-eval-trivial-lambda-formals.nix:1:1:
+            1| { a }: a
+             | ^
+            2|
diff --git a/tests/functional/lang/eval-fail-missing-arg-import.nix b/tests/functional/lang/eval-fail-missing-arg-import.nix
new file mode 100644
index 000000000..7cb33f2b5
--- /dev/null
+++ b/tests/functional/lang/eval-fail-missing-arg-import.nix
@@ -0,0 +1 @@
+import ./non-eval-trivial-lambda-formals.nix { }
diff --git a/tests/functional/lang/eval-fail-undeclared-arg-import.err.exp b/tests/functional/lang/eval-fail-undeclared-arg-import.err.exp
new file mode 100644
index 000000000..ca797d3ec
--- /dev/null
+++ b/tests/functional/lang/eval-fail-undeclared-arg-import.err.exp
@@ -0,0 +1,13 @@
+error:
+       … from call site
+         at /pwd/lang/eval-fail-undeclared-arg-import.nix:1:1:
+            1| import ./non-eval-trivial-lambda-formals.nix {
+             | ^
+            2|   a = "a";
+
+       error: function 'anonymous lambda' called with unexpected argument 'b'
+       at /pwd/lang/non-eval-trivial-lambda-formals.nix:1:1:
+            1| { a }: a
+             | ^
+            2|
+       Did you mean a?
diff --git a/tests/functional/lang/eval-fail-undeclared-arg-import.nix b/tests/functional/lang/eval-fail-undeclared-arg-import.nix
new file mode 100644
index 000000000..e8454c725
--- /dev/null
+++ b/tests/functional/lang/eval-fail-undeclared-arg-import.nix
@@ -0,0 +1,4 @@
+import ./non-eval-trivial-lambda-formals.nix {
+  a = "a";
+  b = "b";
+}
diff --git a/tests/functional/lang/eval-okay-attrnames.nix b/tests/functional/lang/eval-okay-attrnames.nix
index 085e78084..7cdb41538 100644
--- a/tests/functional/lang/eval-okay-attrnames.nix
+++ b/tests/functional/lang/eval-okay-attrnames.nix
@@ -2,16 +2,15 @@ with import ./lib.nix;
 
 let
 
-  attrs =
-    {
-      y = "y";
-      x = "x";
-      foo = "foo";
-    }
-    // rec {
-      x = "newx";
-      bar = x;
-    };
+  attrs = {
+    y = "y";
+    x = "x";
+    foo = "foo";
+  }
+  // rec {
+    x = "newx";
+    bar = x;
+  };
 
   names = builtins.attrNames attrs;
 
diff --git a/tests/functional/lang/eval-okay-attrs.nix b/tests/functional/lang/eval-okay-attrs.nix
index 787b9a933..0350e6e72 100644
--- a/tests/functional/lang/eval-okay-attrs.nix
+++ b/tests/functional/lang/eval-okay-attrs.nix
@@ -1,15 +1,14 @@
 let {
-  as =
-    {
-      x = 123;
-      y = 456;
-    }
-    // {
-      z = 789;
-    }
-    // {
-      z = 987;
-    };
+  as = {
+    x = 123;
+    y = 456;
+  }
+  // {
+    z = 789;
+  }
+  // {
+    z = 987;
+  };
 
   body =
     if as ? a then
diff --git a/tests/functional/lang/eval-okay-attrs2.nix b/tests/functional/lang/eval-okay-attrs2.nix
index 0896f9cf1..234ed1be7 100644
--- a/tests/functional/lang/eval-okay-attrs2.nix
+++ b/tests/functional/lang/eval-okay-attrs2.nix
@@ -1,15 +1,14 @@
 let {
-  as =
-    {
-      x = 123;
-      y = 456;
-    }
-    // {
-      z = 789;
-    }
-    // {
-      z = 987;
-    };
+  as = {
+    x = 123;
+    y = 456;
+  }
+  // {
+    z = 789;
+  }
+  // {
+    z = 987;
+  };
 
   A = "a";
   Z = "z";
diff --git a/tests/functional/lang/eval-okay-fromTOML-timestamps.exp b/tests/functional/lang/eval-okay-fromTOML-timestamps.exp
index 08b3c69a6..56e610533 100644
--- a/tests/functional/lang/eval-okay-fromTOML-timestamps.exp
+++ b/tests/functional/lang/eval-okay-fromTOML-timestamps.exp
@@ -1 +1 @@
-{ "1234" = "value"; "127.0.0.1" = "value"; a = { b = { c = { }; }; }; arr1 = [ 1 2 3 ]; arr2 = [ "red" "yellow" "green" ]; arr3 = [ [ 1 2 ] [ 3 4 5 ] ]; arr4 = [ "all" "strings" "are the same" "type" ]; arr5 = [ [ 1 2 ] [ "a" "b" "c" ] ]; arr7 = [ 1 2 3 ]; arr8 = [ 1 2 ]; bare-key = "value"; bare_key = "value"; bin1 = 214; bool1 = true; bool2 = false; "character encoding" = "value"; d = { e = { f = { }; }; }; dog = { "tater.man" = { type = { name = "pug"; }; }; }; flt1 = 1; flt2 = 3.1415; flt3 = -0.01; flt4 = 5e+22; flt5 = 1e+06; flt6 = -0.02; flt7 = 6.626e-34; flt8 = 9.22462e+06; fruit = [ { name = "apple"; physical = { color = "red"; shape = "round"; }; variety = [ { name = "red delicious"; } { name = "granny smith"; } ]; } { name = "banana"; variety = [ { name = "plantain"; } ]; } ]; g = { h = { i = { }; }; }; hex1 = 3735928559; hex2 = 3735928559; hex3 = 3735928559; int1 = 99; int2 = 42; int3 = 0; int4 = -17; int5 = 1000; int6 = 5349221; int7 = 12345; j = { "ʞ" = { l = { }; }; }; key = "value"; key2 = "value"; ld1 = { _type = "timestamp"; value = "1979-05-27"; }; ldt1 = { _type = "timestamp"; value = "1979-05-27T07:32:00"; }; ldt2 = { _type = "timestamp"; value = "1979-05-27T00:32:00.999999"; }; lt1 = { _type = "timestamp"; value = "07:32:00"; }; lt2 = { _type = "timestamp"; value = "00:32:00.999999"; }; name = "Orange"; oct1 = 342391; oct2 = 493; odt1 = { _type = "timestamp"; value = "1979-05-27T07:32:00Z"; }; odt2 = { _type = "timestamp"; value = "1979-05-27T00:32:00-07:00"; }; odt3 = { _type = "timestamp"; value = "1979-05-27T00:32:00.999999-07:00"; }; odt4 = { _type = "timestamp"; value = "1979-05-27T07:32:00Z"; }; physical = { color = "orange"; shape = "round"; }; products = [ { name = "Hammer"; sku = 738594937; } { } { color = "gray"; name = "Nail"; sku = 284758393; } ]; "quoted \"value\"" = "value"; site = { "google.com" = true; }; str = "I'm a string. \"You can quote me\". Name\tJosé\nLocation\tSF."; table-1 = { key1 = "some string"; key2 = 123; }; table-2 = { key1 = "another string"; key2 = 456; }; x = { y = { z = { w = { animal = { type = { name = "pug"; }; }; name = { first = "Tom"; last = "Preston-Werner"; }; point = { x = 1; y = 2; }; }; }; }; }; "ʎǝʞ" = "value"; }
+{ "1234" = "value"; "127.0.0.1" = "value"; a = { b = { c = { }; }; }; arr1 = [ 1 2 3 ]; arr2 = [ "red" "yellow" "green" ]; arr3 = [ [ 1 2 ] [ 3 4 5 ] ]; arr4 = [ "all" "strings" "are the same" "type" ]; arr5 = [ [ 1 2 ] [ "a" "b" "c" ] ]; arr7 = [ 1 2 3 ]; arr8 = [ 1 2 ]; bare-key = "value"; bare_key = "value"; bin1 = 214; bool1 = true; bool2 = false; "character encoding" = "value"; d = { e = { f = { }; }; }; dog = { "tater.man" = { type = { name = "pug"; }; }; }; flt1 = 1; flt2 = 3.1415; flt3 = -0.01; flt4 = 5e+22; flt5 = 1e+06; flt6 = -0.02; flt7 = 6.626e-34; flt8 = 9.22462e+06; fruit = [ { name = "apple"; physical = { color = "red"; shape = "round"; }; variety = [ { name = "red delicious"; } { name = "granny smith"; } ]; } { name = "banana"; variety = [ { name = "plantain"; } ]; } ]; g = { h = { i = { }; }; }; hex1 = 3735928559; hex2 = 3735928559; hex3 = 3735928559; int1 = 99; int2 = 42; int3 = 0; int4 = -17; int5 = 1000; int6 = 5349221; int7 = 12345; j = { "ʞ" = { l = { }; }; }; key = "value"; key2 = "value"; ld1 = { _type = "timestamp"; value = "1979-05-27"; }; ldt1 = { _type = "timestamp"; value = "1979-05-27T07:32:00"; }; ldt10 = { _type = "timestamp"; value = "1979-05-27T00:32:00.123456789"; }; ldt11 = { _type = "timestamp"; value = "1979-05-27T00:32:00.123456789"; }; ldt2 = { _type = "timestamp"; value = "1979-05-27T07:32:00.100"; }; ldt3 = { _type = "timestamp"; value = "1979-05-27T07:32:00.120"; }; ldt4 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123"; }; ldt5 = { _type = "timestamp"; value = "1979-05-27T00:32:00.123400"; }; ldt6 = { _type = "timestamp"; value = "1979-05-27T00:32:00.123450"; }; ldt7 = { _type = "timestamp"; value = "1979-05-27T00:32:00.123456"; }; ldt8 = { _type = "timestamp"; value = "1979-05-27T00:32:00.123456700"; }; ldt9 = { _type = "timestamp"; value = "1979-05-27T00:32:00.123456780"; }; lt1 = { _type = "timestamp"; value = "07:32:00"; }; lt10 = { _type = "timestamp"; value = "00:32:00.123456789"; }; lt11 = { _type = "timestamp"; value = "00:32:00.123456789"; }; lt2 = { _type = "timestamp"; value = "00:32:00.100"; }; lt3 = { _type = "timestamp"; value = "00:32:00.120"; }; lt4 = { _type = "timestamp"; value = "00:32:00.123"; }; lt5 = { _type = "timestamp"; value = "00:32:00.123400"; }; lt6 = { _type = "timestamp"; value = "00:32:00.123450"; }; lt7 = { _type = "timestamp"; value = "00:32:00.123456"; }; lt8 = { _type = "timestamp"; value = "00:32:00.123456700"; }; lt9 = { _type = "timestamp"; value = "00:32:00.123456780"; }; name = "Orange"; oct1 = 342391; oct2 = 493; odt1 = { _type = "timestamp"; value = "1979-05-27T07:32:00Z"; }; odt10 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123456Z"; }; odt11 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123456700Z"; }; odt12 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123456780Z"; }; odt13 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123456789Z"; }; odt14 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123456789Z"; }; odt2 = { _type = "timestamp"; value = "1979-05-27T00:32:00-07:00"; }; odt3 = { _type = "timestamp"; value = "1979-05-27T00:32:00.999999-07:00"; }; odt4 = { _type = "timestamp"; value = "1979-05-27T07:32:00Z"; }; odt5 = { _type = "timestamp"; value = "1979-05-27T07:32:00.100Z"; }; odt6 = { _type = "timestamp"; value = "1979-05-27T07:32:00.120Z"; }; odt7 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123Z"; }; odt8 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123400Z"; }; odt9 = { _type = "timestamp"; value = "1979-05-27T07:32:00.123450Z"; }; physical = { color = "orange"; shape = "round"; }; products = [ { name = "Hammer"; sku = 738594937; } { } { color = "gray"; name = "Nail"; sku = 284758393; } ]; "quoted \"value\"" = "value"; site = { "google.com" = true; }; str = "I'm a string. \"You can quote me\". Name\tJosé\nLocation\tSF."; table-1 = { key1 = "some string"; key2 = 123; }; table-2 = { key1 = "another string"; key2 = 456; }; x = { y = { z = { w = { animal = { type = { name = "pug"; }; }; name = { first = "Tom"; last = "Preston-Werner"; }; point = { x = 1; y = 2; }; }; }; }; }; "ʎǝʞ" = "value"; }
diff --git a/tests/functional/lang/eval-okay-fromTOML-timestamps.nix b/tests/functional/lang/eval-okay-fromTOML-timestamps.nix
index 74cff9470..d8f3a03e9 100644
--- a/tests/functional/lang/eval-okay-fromTOML-timestamps.nix
+++ b/tests/functional/lang/eval-okay-fromTOML-timestamps.nix
@@ -55,11 +55,53 @@ builtins.fromTOML ''
   odt2 = 1979-05-27T00:32:00-07:00
   odt3 = 1979-05-27T00:32:00.999999-07:00
   odt4 = 1979-05-27 07:32:00Z
+  # milliseconds
+  odt5 = 1979-05-27 07:32:00.1Z
+  odt6 = 1979-05-27 07:32:00.12Z
+  odt7 = 1979-05-27 07:32:00.123Z
+  # microseconds
+  odt8 = 1979-05-27t07:32:00.1234Z
+  odt9 = 1979-05-27t07:32:00.12345Z
+  odt10 = 1979-05-27t07:32:00.123456Z
+  # nanoseconds
+  odt11 = 1979-05-27 07:32:00.1234567Z
+  odt12 = 1979-05-27 07:32:00.12345678Z
+  odt13 = 1979-05-27 07:32:00.123456789Z
+  # no more precision after nanoseconds
+  odt14 = 1979-05-27t07:32:00.1234567891Z
+
   ldt1 = 1979-05-27T07:32:00
-  ldt2 = 1979-05-27T00:32:00.999999
+  # milliseconds
+  ldt2 = 1979-05-27T07:32:00.1
+  ldt3 = 1979-05-27T07:32:00.12
+  ldt4 = 1979-05-27T07:32:00.123
+  # microseconds
+  ldt5 = 1979-05-27t00:32:00.1234
+  ldt6 = 1979-05-27t00:32:00.12345
+  ldt7 = 1979-05-27t00:32:00.123456
+  # nanoseconds
+  ldt8 = 1979-05-27 00:32:00.1234567
+  ldt9 = 1979-05-27 00:32:00.12345678
+  ldt10 = 1979-05-27 00:32:00.123456789
+  # no more precision after nanoseconds
+  ldt11 = 1979-05-27t00:32:00.1234567891
+
   ld1 = 1979-05-27
   lt1 = 07:32:00
-  lt2 = 00:32:00.999999
+  # milliseconds
+  lt2 = 00:32:00.1
+  lt3 = 00:32:00.12
+  lt4 = 00:32:00.123
+  # microseconds
+  lt5 = 00:32:00.1234
+  lt6 = 00:32:00.12345
+  lt7 = 00:32:00.123456
+  # nanoseconds
+  lt8 = 00:32:00.1234567
+  lt9 = 00:32:00.12345678
+  lt10 = 00:32:00.123456789
+  # no more precision after nanoseconds
+  lt11 = 00:32:00.1234567891
 
   arr1 = [ 1, 2, 3 ]
   arr2 = [ "red", "yellow", "green" ]
diff --git a/tests/functional/lang/eval-okay-import.nix b/tests/functional/lang/eval-okay-import.nix
index 484dccac0..9558b7ffc 100644
--- a/tests/functional/lang/eval-okay-import.nix
+++ b/tests/functional/lang/eval-okay-import.nix
@@ -6,7 +6,8 @@ let
     scopedImport = attrs: fn: scopedImport (overrides // attrs) fn;
 
     builtins = builtins // overrides;
-  } // import ./lib.nix;
+  }
+  // import ./lib.nix;
 
 in
 scopedImport overrides ./imported.nix
diff --git a/tests/functional/lang/non-eval-trivial-lambda-formals.nix b/tests/functional/lang/non-eval-trivial-lambda-formals.nix
new file mode 100644
index 000000000..46a7ea4f4
--- /dev/null
+++ b/tests/functional/lang/non-eval-trivial-lambda-formals.nix
@@ -0,0 +1 @@
+{ a }: a
diff --git a/tests/functional/local-overlay-store/meson.build b/tests/functional/local-overlay-store/meson.build
index b7ba5a323..6db2c728d 100644
--- a/tests/functional/local-overlay-store/meson.build
+++ b/tests/functional/local-overlay-store/meson.build
@@ -1,7 +1,7 @@
 suites += {
-  'name': 'local-overlay-store',
-  'deps': [],
-  'tests': [
+  'name' : 'local-overlay-store',
+  'deps' : [],
+  'tests' : [
     'check-post-init.sh',
     'redundant-add.sh',
     'build.sh',
@@ -14,5 +14,5 @@ suites += {
     'optimise.sh',
     'stale-file-handle.sh',
   ],
-  'workdir': meson.current_source_dir(),
+  'workdir' : meson.current_source_dir(),
 }
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index cd1bc6319..54e13b26d 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -1,7 +1,8 @@
-project('nix-functional-tests',
+project(
+  'nix-functional-tests',
   version : files('.version'),
   default_options : [
-    'cpp_std=c++2a',
+    'cpp_std=c++23',
     # TODO(Qyriad): increase the warning level
     'warning_level=1',
     'errorlogs=true', # Please print logs for tests that fail
@@ -23,14 +24,16 @@ dot = find_program('dot', native : true, required : false)
 
 nix_bin_dir = fs.parent(nix.full_path())
 
+subdir('nix-meson-build-support/default-system-cpu')
+
 test_confdata = {
-  'bindir': nix_bin_dir,
-  'coreutils': fs.parent(coreutils.full_path()),
-  'dot': dot.found() ? dot.full_path() : '',
-  'bash': bash.full_path(),
-  'sandbox_shell': busybox.found() ? busybox.full_path() : '',
-  'PACKAGE_VERSION': meson.project_version(),
-  'system': host_machine.cpu_family() + '-' + host_machine.system(),
+  'bindir' : nix_bin_dir,
+  'coreutils' : fs.parent(coreutils.full_path()),
+  'dot' : dot.found() ? dot.full_path() : '',
+  'bash' : bash.full_path(),
+  'sandbox_shell' : busybox.found() ? busybox.full_path() : '',
+  'PACKAGE_VERSION' : meson.project_version(),
+  'system' : nix_system_cpu + '-' + host_machine.system(),
 }
 
 # Just configures `common/vars-and-functions.sh.in`.
@@ -46,8 +49,8 @@ configure_file(
 suites = [
   {
     'name' : 'main',
-    'deps': [],
-    'tests': [
+    'deps' : [],
+    'tests' : [
       'test-infra.sh',
       'gc.sh',
       'nix-collect-garbage-d.sh',
@@ -110,6 +113,8 @@ suites = [
       'impure-eval.sh',
       'pure-eval.sh',
       'eval.sh',
+      'short-path-literals.sh',
+      'no-url-literals.sh',
       'repl.sh',
       'binary-cache-build-remote.sh',
       'search.sh',
@@ -145,6 +150,7 @@ suites = [
       'placeholders.sh',
       'ssh-relay.sh',
       'build.sh',
+      'build-cores.sh',
       'build-delete.sh',
       'output-normalization.sh',
       'selfref-gc.sh',
@@ -169,7 +175,7 @@ suites = [
       'help.sh',
       'symlinks.sh',
     ],
-    'workdir': meson.current_source_dir(),
+    'workdir' : meson.current_source_dir(),
   },
 ]
 
@@ -178,14 +184,14 @@ if nix_store.found()
   add_languages('cpp')
   subdir('test-libstoreconsumer')
   suites += {
-    'name': 'libstoreconsumer',
-    'deps': [
+    'name' : 'libstoreconsumer',
+    'deps' : [
       libstoreconsumer_tester,
     ],
-    'tests': [
+    'tests' : [
       'test-libstoreconsumer.sh',
     ],
-    'workdir': meson.current_source_dir(),
+    'workdir' : meson.current_source_dir(),
   }
 
 endif
@@ -196,26 +202,39 @@ if nix_expr.found() and get_option('default_library') != 'static'
   add_languages('cpp')
   subdir('plugins')
   suites += {
-    'name': 'plugins',
-    'deps': [
+    'name' : 'plugins',
+    'deps' : [
       libplugintest,
     ],
-    'tests': [
+    'tests' : [
       'plugins.sh',
     ],
-    'workdir': meson.current_source_dir(),
+    'workdir' : meson.current_source_dir(),
   }
 endif
 
 subdir('ca')
 subdir('dyn-drv')
 subdir('flakes')
+subdir('git')
 subdir('git-hashing')
 subdir('local-overlay-store')
 
 foreach suite : suites
   workdir = suite['workdir']
   suite_name = suite['name']
+  # This is workaround until [1] is resolved. When building in a devshell
+  # as a subproject we want the tests to depend on the nix build target, so
+  # that it gets automatically rebuilt.
+  # However, when the functional test suite is built separately (via componentized
+  # builds or in NixOS tests) we can't depend on the nix executable, since it's
+  # an external program. The following is a simple heuristic that suffices for now.
+  # [1]: https://github.com/mesonbuild/meson/issues/13877
+  deps = suite['deps']
+  if meson.is_subproject()
+    nix_subproject = subproject('nix')
+    deps += [ nix ] + nix_subproject.get_variable('nix_symlinks_targets')
+  endif
   foreach script : suite['tests']
     # Turns, e.g., `tests/functional/flakes/show.sh` into a Meson test target called
     # `functional-flakes-show`.
@@ -224,27 +243,28 @@ foreach suite : suites
     test(
       name,
       bash,
-      args: [
+      args : [
         '-x',
         '-e',
         '-u',
-        '-o', 'pipefail',
+        '-o',
+        'pipefail',
         script,
       ],
       suite : suite_name,
       env : {
-        '_NIX_TEST_SOURCE_DIR': meson.current_source_dir(),
-        '_NIX_TEST_BUILD_DIR': meson.current_build_dir(),
-        'TEST_NAME': suite_name / name,
-        'NIX_REMOTE': '',
-        'PS4': '+(${BASH_SOURCE[0]-$0}:$LINENO) ',
+        '_NIX_TEST_SOURCE_DIR' : meson.current_source_dir(),
+        '_NIX_TEST_BUILD_DIR' : meson.current_build_dir(),
+        'TEST_NAME' : suite_name / name,
+        'NIX_REMOTE' : '',
+        'PS4' : '+(${BASH_SOURCE[0]-$0}:$LINENO) ',
       },
       # Some tests take 15+ seconds even on an otherwise idle machine;
       # on a loaded machine this can easily drive them to failure. Give
       # them more time than the default of 30 seconds.
       timeout : 300,
       # Used for target dependency/ordering tracking, not adding compiler flags or anything.
-      depends : suite['deps'],
+      depends : deps,
       workdir : workdir,
     )
   endforeach
diff --git a/tests/functional/misc.sh b/tests/functional/misc.sh
index cb4d4139f..b94a5fc57 100755
--- a/tests/functional/misc.sh
+++ b/tests/functional/misc.sh
@@ -44,3 +44,7 @@ out="$(expectStderr 0 nix-instantiate --option foobar baz --expr '{}')"
 
 out="$(expectStderr 0 nix-instantiate '{}' --option foobar baz --expr )"
 [[ "$(echo "$out" | grep foobar | wc -l)" = 1 ]]
+
+if [[ $(uname) = Linux && $(uname -m) = i686 ]]; then
+    [[ $(nix config show system) = i686-linux ]]
+fi
diff --git a/tests/functional/nested-sandboxing/runner.nix b/tests/functional/nested-sandboxing/runner.nix
index d0d441a82..cc193844d 100644
--- a/tests/functional/nested-sandboxing/runner.nix
+++ b/tests/functional/nested-sandboxing/runner.nix
@@ -6,32 +6,31 @@ mkDerivation {
   name = "nested-sandboxing";
   busybox = builtins.getEnv "busybox";
   EXTRA_SANDBOX = builtins.getEnv "EXTRA_SANDBOX";
-  buildCommand =
-    ''
-      set -x
-      set -eu -o pipefail
-    ''
-    + (
-      if altitude == 0 then
-        ''
-          echo Deep enough! > $out
-        ''
-      else
-        ''
-          cp -r ${../common} ./common
-          cp ${../common.sh} ./common.sh
-          cp ${../config.nix} ./config.nix
-          cp -r ${./.} ./nested-sandboxing
+  buildCommand = ''
+    set -x
+    set -eu -o pipefail
+  ''
+  + (
+    if altitude == 0 then
+      ''
+        echo Deep enough! > $out
+      ''
+    else
+      ''
+        cp -r ${../common} ./common
+        cp ${../common.sh} ./common.sh
+        cp ${../config.nix} ./config.nix
+        cp -r ${./.} ./nested-sandboxing
 
-          export PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
+        export PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
 
-          export _NIX_TEST_SOURCE_DIR=$PWD
-          export _NIX_TEST_BUILD_DIR=$PWD
+        export _NIX_TEST_SOURCE_DIR=$PWD
+        export _NIX_TEST_BUILD_DIR=$PWD
 
-          source common.sh
-          source ./nested-sandboxing/command.sh
+        source common.sh
+        source ./nested-sandboxing/command.sh
 
-          runNixBuild ${storeFun} ${toString altitude} >> $out
-        ''
-    );
+        runNixBuild ${storeFun} ${toString altitude} >> $out
+      ''
+  );
 }
diff --git a/tests/functional/nix-meson-build-support b/tests/functional/nix-meson-build-support
new file mode 120000
index 000000000..0b140f56b
--- /dev/null
+++ b/tests/functional/nix-meson-build-support
@@ -0,0 +1 @@
+../../nix-meson-build-support
\ No newline at end of file
diff --git a/tests/functional/no-url-literals.sh b/tests/functional/no-url-literals.sh
new file mode 100644
index 000000000..fbc6e1cec
--- /dev/null
+++ b/tests/functional/no-url-literals.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+clearStoreIfPossible
+
+# Test 1: By default, unquoted URLs are accepted
+nix eval --expr 'http://example.com' 2>&1 | grepQuietInverse "error: URL literals are disabled"
+
+# Test 2: With the experimental feature enabled, unquoted URLs are rejected
+expect 1 nix eval --extra-experimental-features 'no-url-literals' --expr 'http://example.com' 2>&1 | grepQuiet "error: URL literals are disabled"
+
+# Test 3: Quoted URLs are always accepted
+nix eval --extra-experimental-features 'no-url-literals' --expr '"http://example.com"' 2>&1 | grepQuietInverse "error: URL literals are disabled"
+
+# Test 4: URLs with parameters (which must be quoted) are accepted
+nix eval --extra-experimental-features 'no-url-literals' --expr '"http://example.com?foo=bar"' 2>&1 | grepQuietInverse "error: URL literals are disabled"
+
+# Test 5: The feature can be enabled via NIX_CONFIG
+expect 1 env NIX_CONFIG='extra-experimental-features = no-url-literals' nix eval --expr 'http://example.com' 2>&1 | grepQuiet "error: URL literals are disabled"
+
+# Test 6: The feature can be enabled via CLI even if not set in config
+expect 1 env NIX_CONFIG='' nix eval --extra-experimental-features 'no-url-literals' --expr 'http://example.com' 2>&1 | grepQuiet "error: URL literals are disabled"
+
+# Test 7: Evaluation still works for quoted URLs
+nix eval --raw --extra-experimental-features no-url-literals --expr '"http://example.com"' | grepQuiet "^http://example.com$"
+
+echo "no-url-literals test passed!"
diff --git a/tests/functional/package.nix b/tests/functional/package.nix
index 43f2f25a2..1f1d10ea8 100644
--- a/tests/functional/package.nix
+++ b/tests/functional/package.nix
@@ -39,6 +39,7 @@ mkMesonDerivation (
 
     workDir = ./.;
     fileset = fileset.unions [
+      ../../nix-meson-build-support
       ../../scripts/nix-profile.sh.in
       ../../.version
       ../../tests/functional
@@ -46,26 +47,25 @@ mkMesonDerivation (
     ];
 
     # Hack for sake of the dev shell
-    passthru.externalNativeBuildInputs =
-      [
-        meson
-        ninja
-        pkg-config
+    passthru.externalNativeBuildInputs = [
+      meson
+      ninja
+      pkg-config
 
-        jq
-        git
-        mercurial
-        unixtools.script
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isLinux [
-        # For various sandboxing tests that needs a statically-linked shell,
-        # etc.
-        busybox-sandbox-shell
-        # For Overlay FS tests need `mount`, `umount`, and `unshare`.
-        # For `script` command (ensuring a TTY)
-        # TODO use `unixtools` to be precise over which executables instead?
-        util-linux
-      ];
+      jq
+      git
+      mercurial
+      unixtools.script
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # For various sandboxing tests that needs a statically-linked shell,
+      # etc.
+      busybox-sandbox-shell
+      # For Overlay FS tests need `mount`, `umount`, and `unshare`.
+      # For `script` command (ensuring a TTY)
+      # TODO use `unixtools` to be precise over which executables instead?
+      util-linux
+    ];
 
     nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
       nix-cli
diff --git a/tests/functional/plugins/meson.build b/tests/functional/plugins/meson.build
index 41050ffc1..ae66e3036 100644
--- a/tests/functional/plugins/meson.build
+++ b/tests/functional/plugins/meson.build
@@ -3,7 +3,6 @@ libplugintest = shared_module(
   'plugintest.cc',
   dependencies : [
     dependency('nix-expr'),
-    # hack for trailing newline
   ],
   build_by_default : false,
 )
diff --git a/tests/functional/plugins/plugintest.cc b/tests/functional/plugins/plugintest.cc
index 0b1a01a6e..e8f80a4aa 100644
--- a/tests/functional/plugins/plugintest.cc
+++ b/tests/functional/plugins/plugintest.cc
@@ -5,15 +5,14 @@ using namespace nix;
 
 struct MySettings : Config
 {
-    Setting<bool> settingSet{this, false, "setting-set",
-        "Whether the plugin-defined setting was set"};
+    Setting<bool> settingSet{this, false, "setting-set", "Whether the plugin-defined setting was set"};
 };
 
 MySettings mySettings;
 
 static GlobalConfig::Register rs(&mySettings);
 
-static void prim_anotherNull (EvalState & state, const PosIdx pos, Value ** args, Value & v)
+static void prim_anotherNull(EvalState & state, const PosIdx pos, Value ** args, Value & v)
 {
     if (mySettings.settingSet)
         v.mkNull();
diff --git a/tests/functional/read-only-store.sh b/tests/functional/read-only-store.sh
index f6b6eaf32..ea96bba41 100755
--- a/tests/functional/read-only-store.sh
+++ b/tests/functional/read-only-store.sh
@@ -42,7 +42,8 @@ chmod -R -w $TEST_ROOT/var
 
 # Make sure we fail on add operations on the read-only store
 # This is only for adding files that are not *already* in the store
-expectStderr 1 nix-store --add eval.nix | grepQuiet "error: opening lock file '$(readlink -e $TEST_ROOT)/var/nix/db/big-lock'"
+# Should show enhanced error message with helpful context
+expectStderr 1 nix-store --add eval.nix | grepQuiet "This command may have been run as non-root in a single-user Nix installation"
 expectStderr 1 nix-store --store local?read-only=true --add eval.nix | grepQuiet "Permission denied"
 
 # Test the same operations from before should again succeed
diff --git a/tests/functional/shell.sh b/tests/functional/shell.sh
index 51032ff1b..9769c90d1 100755
--- a/tests/functional/shell.sh
+++ b/tests/functional/shell.sh
@@ -34,11 +34,13 @@ nix shell -f shell-hello.nix hello -c env > "$TEST_ROOT/actual-env"
 # - we unset TMPDIR on macOS if it contains /var/folders
 # - _ is set by bash and is expectedf to differ because it contains the original command
 # - __CF_USER_TEXT_ENCODING is set by macOS and is beyond our control
+# - __LLVM_PROFILE_RT_INIT_ONCE - implementation detail of LLVM source code coverage collection
 sed -i \
   -e 's/PATH=.*/PATH=.../' \
   -e 's/_=.*/_=.../' \
   -e '/^TMPDIR=\/var\/folders\/.*/d' \
   -e '/^__CF_USER_TEXT_ENCODING=.*$/d' \
+  -e '/^__LLVM_PROFILE_RT_INIT_ONCE=.*$/d' \
   "$TEST_ROOT/expected-env" "$TEST_ROOT/actual-env"
 sort "$TEST_ROOT/expected-env" > "$TEST_ROOT/expected-env.sorted"
 sort "$TEST_ROOT/actual-env" > "$TEST_ROOT/actual-env.sorted"
diff --git a/tests/functional/short-path-literals.sh b/tests/functional/short-path-literals.sh
new file mode 100644
index 000000000..f74044dda
--- /dev/null
+++ b/tests/functional/short-path-literals.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+clearStoreIfPossible
+
+# Test 1: Without the setting (default), no warnings should be produced
+nix eval --expr 'test/subdir' 2>"$TEST_ROOT"/stderr
+grepQuietInverse < "$TEST_ROOT/stderr" -E "relative path|path literal" || fail "Should not produce warnings by default"
+
+# Test 2: With the setting enabled, warnings should be produced for short path literals
+nix eval --warn-short-path-literals --expr 'test/subdir' 2>"$TEST_ROOT"/stderr
+grepQuiet "relative path literal 'test/subdir' should be prefixed with '.' for clarity: './test/subdir'" "$TEST_ROOT/stderr"
+
+# Test 3: Different short path literals should all produce warnings
+nix eval --warn-short-path-literals --expr 'foo/bar' 2>"$TEST_ROOT"/stderr
+grepQuiet "relative path literal 'foo/bar' should be prefixed with '.' for clarity: './foo/bar'" "$TEST_ROOT/stderr"
+
+nix eval --warn-short-path-literals --expr 'a/b/c/d' 2>"$TEST_ROOT"/stderr
+grepQuiet "relative path literal 'a/b/c/d' should be prefixed with '.' for clarity: './a/b/c/d'" "$TEST_ROOT/stderr"
+
+# Test 4: Paths starting with ./ should NOT produce warnings
+nix eval --warn-short-path-literals --expr './test/subdir' 2>"$TEST_ROOT"/stderr
+grepQuietInverse "relative path literal" "$TEST_ROOT/stderr"
+
+# Test 5: Paths starting with ../ should NOT produce warnings
+nix eval --warn-short-path-literals --expr '../test/subdir' 2>"$TEST_ROOT"/stderr
+grepQuietInverse "relative path literal" "$TEST_ROOT/stderr"
+
+# Test 6: Absolute paths should NOT produce warnings
+nix eval --warn-short-path-literals --expr '/absolute/path' 2>"$TEST_ROOT"/stderr
+grepQuietInverse "relative path literal" "$TEST_ROOT/stderr"
+
+# Test 7: Test that the warning is at the correct position
+nix eval --warn-short-path-literals --expr 'foo/bar' 2>"$TEST_ROOT"/stderr
+grepQuiet "at «string»:1:1:" "$TEST_ROOT/stderr"
+
+# Test 8: Test that evaluation still works correctly despite the warning
+result=$(nix eval --warn-short-path-literals --expr 'test/subdir' 2>/dev/null)
+expected="$PWD/test/subdir"
+[[ "$result" == "$expected" ]] || fail "Evaluation result should be correct despite warning"
+
+# Test 9: Test with nix-instantiate as well
+nix-instantiate --warn-short-path-literals --eval -E 'foo/bar' 2>"$TEST_ROOT"/stderr
+grepQuiet "relative path literal 'foo/bar' should be prefixed" "$TEST_ROOT/stderr"
+
+# Test 10: Test that the setting can be set via configuration
+NIX_CONFIG='warn-short-path-literals = true' nix eval --expr 'test/file' 2>"$TEST_ROOT"/stderr
+grepQuiet "relative path literal 'test/file' should be prefixed" "$TEST_ROOT/stderr"
+
+# Test 11: Test that command line flag overrides config
+NIX_CONFIG='warn-short-path-literals = true' nix eval --no-warn-short-path-literals --expr 'test/file' 2>"$TEST_ROOT"/stderr
+grepQuietInverse "relative path literal" "$TEST_ROOT/stderr"
+
+echo "short-path-literals test passed!"
diff --git a/tests/functional/store-info.sh b/tests/functional/store-info.sh
index b1e0772b5..adaee5dfe 100755
--- a/tests/functional/store-info.sh
+++ b/tests/functional/store-info.sh
@@ -2,12 +2,67 @@
 
 source common.sh
 
+# Different versions of the Nix daemon normalize or don't normalize
+# store URLs, plus NIX_REMOTE (per the test suite) might not be using on
+# store URL in normal form, so the easiest thing to do is normalize URLs
+# after the fact before comparing them for equality.
+normalize_nix_store_url () {
+    local url="$1"
+    case "$url" in
+        'auto' )
+            # Need to actually ask Nix in this case
+            echo "$defaultStore"
+            ;;
+        local | 'local://' )
+            echo 'local'
+            ;;
+        daemon | 'unix://' )
+            echo 'daemon'
+            ;;
+        'local://'* )
+            # To not be captured by next pattern
+            echo "$url"
+            ;;
+        'local?'* )
+            echo "local://${url#local}"
+            ;;
+        'daemon?'* )
+            echo "unix://${url#daemon}"
+            ;;
+        * )
+            echo "$url"
+            ;;
+    esac
+}
+
 STORE_INFO=$(nix store info 2>&1)
 LEGACY_STORE_INFO=$(nix store ping 2>&1) # alias to nix store info
 STORE_INFO_JSON=$(nix store info --json)
 
-echo "$STORE_INFO" | grep "Store URL: ${NIX_REMOTE}"
-echo "$LEGACY_STORE_INFO" | grep "Store URL: ${NIX_REMOTE}"
+defaultStore="$(normalize_nix_store_url "$(echo "$STORE_INFO_JSON" | jq -r ".url")")"
+
+# Test cases for `normalize_nix_store_url` itself
+
+# Normalize local store
+[[ "$(normalize_nix_store_url "local://")" = "local" ]]
+[[ "$(normalize_nix_store_url "local")" = "local" ]]
+[[ "$(normalize_nix_store_url "local?foo=bar")" = "local://?foo=bar" ]]
+
+# Normalize unix domain socket remote store
+[[ "$(normalize_nix_store_url "unix://")" = "daemon" ]]
+[[ "$(normalize_nix_store_url "daemon")" = "daemon" ]]
+[[ "$(normalize_nix_store_url "daemon?x=y")" = "unix://?x=y" ]]
+
+# otherwise unchanged
+[[ "$(normalize_nix_store_url "https://site")" = "https://site" ]]
+
+nixRemoteOrDefault=$(normalize_nix_store_url "${NIX_REMOTE:-"auto"}")
+
+check_human_readable () {
+    [[ "$(normalize_nix_store_url "$(echo "$1" | grep 'Store URL:' | sed 's^Store URL: ^^')")" = "${nixRemoteOrDefault}" ]]
+}
+check_human_readable "$STORE_INFO"
+check_human_readable "$LEGACY_STORE_INFO"
 
 if [[ -v NIX_DAEMON_PACKAGE ]] && isDaemonNewer "2.7.0pre20220126"; then
     DAEMON_VERSION=$("$NIX_DAEMON_PACKAGE"/bin/nix daemon --version | cut -d' ' -f3)
@@ -21,4 +76,4 @@ expect 127 NIX_REMOTE=unix:"$PWD"/store nix store info || \
 
 TODO_NixOS
 
-[[ "$(echo "$STORE_INFO_JSON" | jq -r ".url")" == "${NIX_REMOTE:-local}" ]]
+[[ "$(normalize_nix_store_url "$(echo "$STORE_INFO_JSON" | jq -r ".url")")" == "${nixRemoteOrDefault}" ]]
diff --git a/tests/functional/test-libstoreconsumer/main.cc b/tests/functional/test-libstoreconsumer/main.cc
index 0dc5a5a46..a372886ea 100644
--- a/tests/functional/test-libstoreconsumer/main.cc
+++ b/tests/functional/test-libstoreconsumer/main.cc
@@ -5,7 +5,7 @@
 
 using namespace nix;
 
-int main (int argc, char **argv)
+int main(int argc, char ** argv)
 {
     try {
         if (argc != 2) {
@@ -21,12 +21,8 @@ int main (int argc, char **argv)
 
         // build the derivation
 
-        std::vector<DerivedPath> paths {
-            DerivedPath::Built {
-                .drvPath = makeConstantStorePathRef(store->parseStorePath(drvPath)),
-                .outputs = OutputsSpec::Names{"out"}
-            }
-        };
+        std::vector<DerivedPath> paths{DerivedPath::Built{
+            .drvPath = makeConstantStorePathRef(store->parseStorePath(drvPath)), .outputs = OutputsSpec::Names{"out"}}};
 
         const auto results = store->buildPathsWithResults(paths, bmNormal, store);
 
diff --git a/tests/functional/test-libstoreconsumer/meson.build b/tests/functional/test-libstoreconsumer/meson.build
index ce566035f..e5a1cc182 100644
--- a/tests/functional/test-libstoreconsumer/meson.build
+++ b/tests/functional/test-libstoreconsumer/meson.build
@@ -3,7 +3,6 @@ libstoreconsumer_tester = executable(
   'main.cc',
   dependencies : [
     dependency('nix-store'),
-    # hack for trailing newline
   ],
   build_by_default : false,
 )
diff --git a/tests/nixos/authorization.nix b/tests/nixos/authorization.nix
index 6540e9fa3..ee3be7504 100644
--- a/tests/nixos/authorization.nix
+++ b/tests/nixos/authorization.nix
@@ -84,7 +84,7 @@
           su --login mallory -c '
             nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
             (! nix store sign --key-file sk1 ${pathFour} 2>&1)' | tee diag 1>&2
-          grep -F "cannot open connection to remote store 'daemon'" diag
+          grep -F "cannot open connection to remote store 'unix://'" diag
       """)
 
       machine.succeed("""
diff --git a/tests/nixos/ca-fd-leak/sender.c b/tests/nixos/ca-fd-leak/sender.c
index 2ec79947a..639b88900 100644
--- a/tests/nixos/ca-fd-leak/sender.c
+++ b/tests/nixos/ca-fd-leak/sender.c
@@ -9,7 +9,8 @@
 #include <string.h>
 #include <assert.h>
 
-int main(int argc, char **argv) {
+int main(int argc, char ** argv)
+{
 
     assert(argc == 2);
 
@@ -25,12 +26,12 @@ int main(int argc, char **argv) {
     // executed in, just busyloop here.
     int res = -1;
     while (res < 0) {
-        res = connect(sock, (const struct sockaddr *)&data,
-            offsetof(struct sockaddr_un, sun_path)
-              + strlen(argv[1])
-              + 1);
-        if (res < 0 && errno != ECONNREFUSED) perror("connect");
-        if (errno != ECONNREFUSED) break;
+        res = connect(
+            sock, (const struct sockaddr *) &data, offsetof(struct sockaddr_un, sun_path) + strlen(argv[1]) + 1);
+        if (res < 0 && errno != ECONNREFUSED)
+            perror("connect");
+        if (errno != ECONNREFUSED)
+            break;
     }
 
     // Write our message header.
@@ -39,27 +40,28 @@ int main(int argc, char **argv) {
     msg.msg_controllen = 128;
 
     // Write an SCM_RIGHTS message containing the output path.
-    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
+    struct cmsghdr * hdr = CMSG_FIRSTHDR(&msg);
     hdr->cmsg_len = CMSG_LEN(sizeof(int));
     hdr->cmsg_level = SOL_SOCKET;
     hdr->cmsg_type = SCM_RIGHTS;
     int fd = open(getenv("out"), O_RDWR | O_CREAT, 0640);
-    memcpy(CMSG_DATA(hdr), (void *)&fd, sizeof(int));
+    memcpy(CMSG_DATA(hdr), (void *) &fd, sizeof(int));
 
     msg.msg_controllen = CMSG_SPACE(sizeof(int));
 
     // Write a single null byte too.
-    msg.msg_iov = (struct iovec*) malloc(sizeof(struct iovec));
-    msg.msg_iov[0].iov_base = (void*) "";
+    msg.msg_iov = (struct iovec *) malloc(sizeof(struct iovec));
+    msg.msg_iov[0].iov_base = (void *) "";
     msg.msg_iov[0].iov_len = 1;
     msg.msg_iovlen = 1;
 
     // Send it to the othher side of this connection.
     res = sendmsg(sock, &msg, 0);
-    if (res < 0) perror("sendmsg");
+    if (res < 0)
+        perror("sendmsg");
     int buf;
 
     // Wait for the server to close the socket, implying that it has
     // received the commmand.
-    recv(sock, (void *)&buf, sizeof(int), 0);
+    recv(sock, (void *) &buf, sizeof(int), 0);
 }
diff --git a/tests/nixos/ca-fd-leak/smuggler.c b/tests/nixos/ca-fd-leak/smuggler.c
index 7279c48bf..655b8f8f1 100644
--- a/tests/nixos/ca-fd-leak/smuggler.c
+++ b/tests/nixos/ca-fd-leak/smuggler.c
@@ -7,7 +7,8 @@
 #include <assert.h>
 #include <string.h>
 
-int main(int argc, char **argv) {
+int main(int argc, char ** argv)
+{
 
     assert(argc == 2);
 
@@ -18,21 +19,21 @@ int main(int argc, char **argv) {
     data.sun_family = AF_UNIX;
     data.sun_path[0] = 0;
     strncpy(data.sun_path + 1, argv[1], sizeof(data.sun_path) - 1);
-    int res = bind(sock, (const struct sockaddr *)&data,
-        offsetof(struct sockaddr_un, sun_path)
-        + strlen(argv[1])
-        + 1);
-    if (res < 0) perror("bind");
+    int res = bind(sock, (const struct sockaddr *) &data, offsetof(struct sockaddr_un, sun_path) + strlen(argv[1]) + 1);
+    if (res < 0)
+        perror("bind");
 
     res = listen(sock, 1);
-    if (res < 0) perror("listen");
+    if (res < 0)
+        perror("listen");
 
     int smuggling_fd = -1;
 
     // Accept the connection a first time to receive the file descriptor.
     fprintf(stderr, "%s\n", "Waiting for the first connection");
     int a = accept(sock, 0, 0);
-    if (a < 0) perror("accept");
+    if (a < 0)
+        perror("accept");
 
     struct msghdr msg = {0};
     msg.msg_control = malloc(128);
@@ -41,13 +42,12 @@ int main(int argc, char **argv) {
     // Receive the file descriptor as sent by the smuggler.
     recvmsg(a, &msg, 0);
 
-    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
+    struct cmsghdr * hdr = CMSG_FIRSTHDR(&msg);
     while (hdr) {
-        if (hdr->cmsg_level == SOL_SOCKET
-          && hdr->cmsg_type == SCM_RIGHTS) {
+        if (hdr->cmsg_level == SOL_SOCKET && hdr->cmsg_type == SCM_RIGHTS) {
 
             // Grab the copy of the file descriptor.
-            memcpy((void *)&smuggling_fd, CMSG_DATA(hdr), sizeof(int));
+            memcpy((void *) &smuggling_fd, CMSG_DATA(hdr), sizeof(int));
         }
 
         hdr = CMSG_NXTHDR(&msg, hdr);
@@ -58,11 +58,14 @@ int main(int argc, char **argv) {
     // Wait for a second connection, which will tell us that the build is
     // done
     a = accept(sock, 0, 0);
-    if (a < 0) perror("accept");
+    if (a < 0)
+        perror("accept");
     fprintf(stderr, "%s\n", "Got a second connection, rewriting the file");
     // Write a new content to the file
-    if (ftruncate(smuggling_fd, 0)) perror("ftruncate");
+    if (ftruncate(smuggling_fd, 0))
+        perror("ftruncate");
     const char * new_content = "Pwned\n";
     int written_bytes = write(smuggling_fd, new_content, strlen(new_content));
-    if (written_bytes != strlen(new_content)) perror("write");
+    if (written_bytes != strlen(new_content))
+        perror("write");
 }
diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index f0b1a8865..2031e02a4 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -1,7 +1,8 @@
 {
   lib,
+  pkgs,
+  nixComponents,
   nixpkgs,
-  nixpkgsFor,
   nixpkgs-23-11,
 }:
 
@@ -19,27 +20,28 @@ let
     );
 
   # https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests
-  runNixOSTestFor =
-    system: test:
+  runNixOSTest =
+    test:
     (nixos-lib.runTest {
       imports = [
         test
       ];
 
-      hostPkgs = nixpkgsFor.${system}.native;
+      hostPkgs = pkgs;
       defaults = {
-        nixpkgs.pkgs = nixpkgsFor.${system}.native;
+        nixpkgs.pkgs = pkgs;
         nix.checkAllErrors = false;
         # TODO: decide which packaging stage to use. `nix-cli` is efficient, but not the same as the user-facing `everything.nix` package (`default`). Perhaps a good compromise is `everything.nix` + `noTests` defined above?
-        nix.package = nixpkgsFor.${system}.native.nixComponents2.nix-cli;
+        nix.package = nixComponents.nix-cli;
 
         # Evaluate VMs faster
         documentation.enable = false;
         # this links against nix and might break with our git version.
         system.tools.nixos-option.enable = false;
       };
+      _module.args.nixComponents = nixComponents;
       _module.args.nixpkgs = nixpkgs;
-      _module.args.system = system;
+      _module.args.system = pkgs.system;
     })
     // {
       # allow running tests against older nix versions via `nix eval --apply`
@@ -47,13 +49,13 @@ let
       #   nix build "$(nix eval --raw --impure .#hydraJobs.tests.fetch-git --apply 't: (t.forNix "2.19.2").drvPath')^*"
       forNix =
         nixVersion:
-        runNixOSTestFor system {
+        runNixOSTest {
           imports = [ test ];
           defaults.nixpkgs.overlays = [
             (curr: prev: {
               nix =
                 let
-                  packages = (builtins.getFlake "nix/${nixVersion}").packages.${system};
+                  packages = (builtins.getFlake "nix/${nixVersion}").packages.${pkgs.system};
                 in
                 packages.nix-cli or packages.nix;
             })
@@ -77,7 +79,15 @@ let
     { lib, pkgs, ... }:
     {
       imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
+      nix.package = lib.mkForce (
+        pkgs.nixVersions.nix_2_3.overrideAttrs (o: {
+          meta = o.meta // {
+            # This version shouldn't be used by end-users, but we run tests against
+            # it to ensure we don't break protocol compatibility.
+            knownVulnerabilities = [ ];
+          };
+        })
+      );
     };
 
   otherNixes.nix_2_13.setNixPackage =
@@ -88,6 +98,8 @@ let
         nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs
           (o: {
             meta = o.meta // {
+              # This version shouldn't be used by end-users, but we run tests against
+              # it to ensure we don't break protocol compatibility.
               knownVulnerabilities = [ ];
             };
           })
@@ -97,18 +109,18 @@ let
 in
 
 {
-  authorization = runNixOSTestFor "x86_64-linux" ./authorization.nix;
+  authorization = runNixOSTest ./authorization.nix;
 
-  remoteBuilds = runNixOSTestFor "x86_64-linux" ./remote-builds.nix;
+  remoteBuilds = runNixOSTest ./remote-builds.nix;
 
-  remoteBuildsSshNg = runNixOSTestFor "x86_64-linux" ./remote-builds-ssh-ng.nix;
+  remoteBuildsSshNg = runNixOSTest ./remote-builds-ssh-ng.nix;
 
 }
 // lib.concatMapAttrs (
   nixVersion:
   { setNixPackage, ... }:
   {
-    "remoteBuilds_remote_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+    "remoteBuilds_remote_${nixVersion}" = runNixOSTest {
       name = "remoteBuilds_remote_${nixVersion}";
       imports = [ ./remote-builds.nix ];
       builders.config =
@@ -118,7 +130,7 @@ in
         };
     };
 
-    "remoteBuilds_local_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+    "remoteBuilds_local_${nixVersion}" = runNixOSTest {
       name = "remoteBuilds_local_${nixVersion}";
       imports = [ ./remote-builds.nix ];
       nodes.client =
@@ -128,7 +140,7 @@ in
         };
     };
 
-    "remoteBuildsSshNg_remote_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+    "remoteBuildsSshNg_remote_${nixVersion}" = runNixOSTest {
       name = "remoteBuildsSshNg_remote_${nixVersion}";
       imports = [ ./remote-builds-ssh-ng.nix ];
       builders.config =
@@ -140,7 +152,7 @@ in
 
     # FIXME: these tests don't work yet
 
-    # "remoteBuildsSshNg_local_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+    # "remoteBuildsSshNg_local_${nixVersion}" = runNixOSTest {
     #   name = "remoteBuildsSshNg_local_${nixVersion}";
     #   imports = [ ./remote-builds-ssh-ng.nix ];
     #   nodes.client = { lib, pkgs, ... }: {
@@ -151,49 +163,49 @@ in
 ) otherNixes
 // {
 
-  nix-copy-closure = runNixOSTestFor "x86_64-linux" ./nix-copy-closure.nix;
+  nix-copy-closure = runNixOSTest ./nix-copy-closure.nix;
 
-  nix-copy = runNixOSTestFor "x86_64-linux" ./nix-copy.nix;
+  nix-copy = runNixOSTest ./nix-copy.nix;
 
-  nix-docker = runNixOSTestFor "x86_64-linux" ./nix-docker.nix;
+  nix-docker = runNixOSTest ./nix-docker.nix;
 
-  nssPreload = runNixOSTestFor "x86_64-linux" ./nss-preload.nix;
+  nssPreload = runNixOSTest ./nss-preload.nix;
 
-  githubFlakes = runNixOSTestFor "x86_64-linux" ./github-flakes.nix;
+  githubFlakes = runNixOSTest ./github-flakes.nix;
 
-  gitSubmodules = runNixOSTestFor "x86_64-linux" ./git-submodules.nix;
+  gitSubmodules = runNixOSTest ./git-submodules.nix;
 
-  sourcehutFlakes = runNixOSTestFor "x86_64-linux" ./sourcehut-flakes.nix;
+  sourcehutFlakes = runNixOSTest ./sourcehut-flakes.nix;
 
-  tarballFlakes = runNixOSTestFor "x86_64-linux" ./tarball-flakes.nix;
+  tarballFlakes = runNixOSTest ./tarball-flakes.nix;
 
-  containers = runNixOSTestFor "x86_64-linux" ./containers/containers.nix;
+  containers = runNixOSTest ./containers/containers.nix;
 
-  setuid = lib.genAttrs [ "x86_64-linux" ] (system: runNixOSTestFor system ./setuid.nix);
+  setuid = runNixOSTest ./setuid.nix;
 
-  fetch-git = runNixOSTestFor "x86_64-linux" ./fetch-git;
+  fetch-git = runNixOSTest ./fetch-git;
 
-  ca-fd-leak = runNixOSTestFor "x86_64-linux" ./ca-fd-leak;
+  ca-fd-leak = runNixOSTest ./ca-fd-leak;
 
-  gzip-content-encoding = runNixOSTestFor "x86_64-linux" ./gzip-content-encoding.nix;
+  gzip-content-encoding = runNixOSTest ./gzip-content-encoding.nix;
 
-  functional_user = runNixOSTestFor "x86_64-linux" ./functional/as-user.nix;
+  functional_user = runNixOSTest ./functional/as-user.nix;
 
-  functional_trusted = runNixOSTestFor "x86_64-linux" ./functional/as-trusted-user.nix;
+  functional_trusted = runNixOSTest ./functional/as-trusted-user.nix;
 
-  functional_root = runNixOSTestFor "x86_64-linux" ./functional/as-root.nix;
+  functional_root = runNixOSTest ./functional/as-root.nix;
 
-  functional_symlinked-home = runNixOSTestFor "x86_64-linux" ./functional/symlinked-home.nix;
+  functional_symlinked-home = runNixOSTest ./functional/symlinked-home.nix;
 
-  user-sandboxing = runNixOSTestFor "x86_64-linux" ./user-sandboxing;
+  user-sandboxing = runNixOSTest ./user-sandboxing;
 
-  s3-binary-cache-store = runNixOSTestFor "x86_64-linux" ./s3-binary-cache-store.nix;
+  s3-binary-cache-store = runNixOSTest ./s3-binary-cache-store.nix;
 
-  fsync = runNixOSTestFor "x86_64-linux" ./fsync.nix;
+  fsync = runNixOSTest ./fsync.nix;
 
-  cgroups = runNixOSTestFor "x86_64-linux" ./cgroups;
+  cgroups = runNixOSTest ./cgroups;
 
-  fetchurl = runNixOSTestFor "x86_64-linux" ./fetchurl.nix;
+  fetchurl = runNixOSTest ./fetchurl.nix;
 
-  chrootStore = runNixOSTestFor "x86_64-linux" ./chroot-store.nix;
+  chrootStore = runNixOSTest ./chroot-store.nix;
 }
diff --git a/tests/nixos/fetch-git/test-cases/lfs/default.nix b/tests/nixos/fetch-git/test-cases/lfs/default.nix
index 686796fcc..289c37709 100644
--- a/tests/nixos/fetch-git/test-cases/lfs/default.nix
+++ b/tests/nixos/fetch-git/test-cases/lfs/default.nix
@@ -224,5 +224,25 @@
         """)
 
     client.succeed(f"cmp {repo.path}/beeg {fetched_self_lfs}/beeg >&2")
+
+
+    with subtest("Ensure fetching with SSH generates the same output"):
+      client.succeed(f"{repo.git} push origin-ssh main >&2")
+      client.succeed("rm -rf ~/.cache/nix") # Avoid using the cached output of the http fetch
+
+      fetchGit_ssh_expr = f"""
+        builtins.fetchGit {{
+          url = "{repo.remote_ssh}";
+          rev = "{lfs_file_rev}";
+          ref = "main";
+          lfs = true;
+        }}
+      """
+      fetched_ssh = client.succeed(f"""
+        nix eval --debug --impure --raw --expr '({fetchGit_ssh_expr}).outPath'
+      """)
+
+      assert fetched_ssh == fetched_lfs, \
+        f"fetching with ssh (store path {fetched_ssh}) yielded a different result than using http (store path {fetched_lfs})"
   '';
 }
diff --git a/tests/nixos/fetch-git/testsupport/gitea-repo.nix b/tests/nixos/fetch-git/testsupport/gitea-repo.nix
index c8244207f..826ae52f9 100644
--- a/tests/nixos/fetch-git/testsupport/gitea-repo.nix
+++ b/tests/nixos/fetch-git/testsupport/gitea-repo.nix
@@ -49,19 +49,15 @@ in
           self.name = name
           self.path = "/tmp/repos/" + name
           self.remote = "http://gitea:3000/test/" + name
-          self.remote_ssh = "ssh://gitea/root/" + name
+          self.remote_ssh = "ssh://gitea:3001/test/" + name
           self.git = f"git -C {self.path}"
           self.private = private
           self.create()
 
         def create(self):
-          # create ssh remote repo
+          # create remote repo
           gitea.succeed(f"""
-            git init --bare -b main /root/{self.name}
-          """)
-          # create http remote repo
-          gitea.succeed(f"""
-            curl --fail -X POST http://{gitea_admin}:{gitea_admin_password}@gitea:3000/api/v1/user/repos \
+            curl --fail -X POST http://{gitea_user}:{gitea_password}@gitea:3000/api/v1/user/repos \
               -H 'Accept: application/json' -H 'Content-Type: application/json' \
               -d {shlex.quote( f'{{"name":"{self.name}", "default_branch": "main", "private": {boolToJSON(self.private)}}}' )}
           """)
@@ -70,7 +66,7 @@ in
             mkdir -p {self.path} \
             && git init -b main {self.path} \
             && {self.git} remote add origin {self.remote} \
-            && {self.git} remote add origin-ssh root@gitea:{self.name}
+            && {self.git} remote add origin-ssh {self.remote_ssh}
           """)
     '';
   };
diff --git a/tests/nixos/fetch-git/testsupport/gitea.nix b/tests/nixos/fetch-git/testsupport/gitea.nix
index e63182639..ad88d4ff0 100644
--- a/tests/nixos/fetch-git/testsupport/gitea.nix
+++ b/tests/nixos/fetch-git/testsupport/gitea.nix
@@ -35,28 +35,20 @@ in
           server = {
             DOMAIN = "gitea";
             HTTP_PORT = 3000;
+            SSH_PORT = 3001;
+            START_SSH_SERVER = true;
           };
           log.LEVEL = "Info";
           database.LOG_SQL = false;
         };
-        services.openssh.enable = true;
-        networking.firewall.allowedTCPPorts = [ 3000 ];
+        networking.firewall.allowedTCPPorts = [
+          3000
+          3001
+        ];
         environment.systemPackages = [
           pkgs.git
           pkgs.gitea
         ];
-
-        users.users.root.openssh.authorizedKeys.keys = [ clientPublicKey ];
-
-        # TODO: remove this after updating to nixos-23.11
-        nixpkgs.pkgs = lib.mkForce (
-          import nixpkgs {
-            inherit system;
-            config.permittedInsecurePackages = [
-              "gitea-1.19.4"
-            ];
-          }
-        );
       };
     client =
       { pkgs, ... }:
@@ -67,38 +59,33 @@ in
         ];
       };
   };
-  defaults =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = [ pkgs.jq ];
-    };
 
   setupScript = ''
     import shlex
 
     gitea.wait_for_unit("gitea.service")
 
-    gitea_admin = "test"
-    gitea_admin_password = "test123test"
+    gitea_user = "test"
+    gitea_password = "test123test"
 
     gitea.succeed(f"""
       gitea --version >&2
       su -l gitea -c 'GITEA_WORK_DIR=/var/lib/gitea gitea admin user create \
-        --username {gitea_admin} --password {gitea_admin_password} --email test@client'
+        --username {gitea_user} --password {gitea_password} --email test@client'
     """)
 
     client.wait_for_unit("multi-user.target")
     gitea.wait_for_open_port(3000)
+    gitea.wait_for_open_port(3001)
 
-    gitea_admin_token = gitea.succeed(f"""
-      curl --fail -X POST http://{gitea_admin}:{gitea_admin_password}@gitea:3000/api/v1/users/test/tokens \
+    gitea.succeed(f"""
+      curl --fail -X POST http://{gitea_user}:{gitea_password}@gitea:3000/api/v1/user/keys \
         -H 'Accept: application/json' -H 'Content-Type: application/json' \
-        -d {shlex.quote( '{"name":"token", "scopes":["all"]}' )} \
-        | jq -r '.sha1'
-    """).strip()
+        -d {shlex.quote( '{"title":"key", "key":"${clientPublicKey}", "read_only": false}' )} >&2
+    """)
 
     client.succeed(f"""
-      echo "http://{gitea_admin}:{gitea_admin_password}@gitea:3000" >~/.git-credentials-admin
+      echo "http://{gitea_user}:{gitea_password}@gitea:3000" >~/.git-credentials-admin
       git config --global credential.helper 'store --file ~/.git-credentials-admin'
       git config --global user.email "test@client"
       git config --global user.name "Test User"
@@ -118,13 +105,7 @@ in
       echo "Host gitea" >>~/.ssh/config
       echo "  StrictHostKeyChecking no" >>~/.ssh/config
       echo "  UserKnownHostsFile /dev/null" >>~/.ssh/config
-      echo "  User root" >>~/.ssh/config
+      echo "  User gitea" >>~/.ssh/config
     """)
-
-    # ensure ssh from client to gitea works
-    client.succeed("""
-      ssh root@gitea true
-    """)
-
   '';
 }
diff --git a/tests/nixos/functional/common.nix b/tests/nixos/functional/common.nix
index a2067c07d..4d32b7573 100644
--- a/tests/nixos/functional/common.nix
+++ b/tests/nixos/functional/common.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, nixComponents, ... }:
 
 let
   # FIXME (roberth) reference issue
@@ -49,11 +49,11 @@ in
 
               cd ~
 
-              cp -r ${pkgs.nixComponents2.nix-functional-tests.src} nix
+              cp -r ${nixComponents.nix-functional-tests.src} nix
               chmod -R +w nix
 
               chmod u+w nix/.version
-              echo ${pkgs.nixComponents2.version} > nix/.version
+              echo ${nixComponents.version} > nix/.version
 
               export isTestOnNixOS=1
 
diff --git a/tests/nixos/github-flakes.nix b/tests/nixos/github-flakes.nix
index 06142c2ef..91fd6b062 100644
--- a/tests/nixos/github-flakes.nix
+++ b/tests/nixos/github-flakes.nix
@@ -81,7 +81,7 @@ let
     mkdir -p $out/archive
 
     dir=NixOS-nixpkgs-${nixpkgs.shortRev}
-    cp -prd ${nixpkgs} $dir
+    cp -rd --preserve=ownership,timestamps ${nixpkgs} $dir
     # Set the correct timestamp in the tarball.
     find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${
       builtins.substring 12 2 nixpkgs.lastModifiedDate
diff --git a/tests/nixos/remote-builds.nix b/tests/nixos/remote-builds.nix
index fbfff9a7d..ba5fdc2af 100644
--- a/tests/nixos/remote-builds.nix
+++ b/tests/nixos/remote-builds.nix
@@ -18,6 +18,10 @@ let
       services.openssh.enable = true;
       virtualisation.writableStore = true;
       nix.settings.sandbox = true;
+      services.openssh.ports = [
+        22
+      ]
+      ++ lib.optional supportsCustomPort 2222;
 
       # Regression test for use of PID namespaces when /proc has
       # filesystems mounted on top of it
@@ -42,6 +46,7 @@ let
 
   supportsBadShell = lib.versionAtLeast config.nodes.client.nix.package.version "2.25pre";
 
+  supportsCustomPort = lib.versionAtLeast config.nodes.client.nix.package.version "2.31.0pre20250806";
 in
 
 {
@@ -74,7 +79,7 @@ in
           nix.distributedBuilds = true;
           nix.buildMachines = [
             {
-              hostName = "builder1";
+              hostName = "builder1" + (lib.optionalString supportsCustomPort ":2222");
               sshUser = "root";
               sshKey = "/root/.ssh/id_ed25519";
               system = "i686-linux";
diff --git a/tests/nixos/sourcehut-flakes.nix b/tests/nixos/sourcehut-flakes.nix
index 61670ccf3..3f05130d6 100644
--- a/tests/nixos/sourcehut-flakes.nix
+++ b/tests/nixos/sourcehut-flakes.nix
@@ -48,7 +48,7 @@ let
 
   nixpkgs-repo = pkgs.runCommand "nixpkgs-flake" { } ''
     dir=NixOS-nixpkgs-${nixpkgs.shortRev}
-    cp -prd ${nixpkgs} $dir
+    cp -rd --preserve=ownership,timestamps ${nixpkgs} $dir
 
     # Set the correct timestamp in the tarball.
     find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${
diff --git a/tests/nixos/tarball-flakes.nix b/tests/nixos/tarball-flakes.nix
index 7b3638b64..26c20cb1a 100644
--- a/tests/nixos/tarball-flakes.nix
+++ b/tests/nixos/tarball-flakes.nix
@@ -13,7 +13,7 @@ let
 
     set -x
     dir=nixpkgs-${nixpkgs.shortRev}
-    cp -prd ${nixpkgs} $dir
+    cp -rd --preserve=ownership,timestamps ${nixpkgs} $dir
     # Set the correct timestamp in the tarball.
     find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${
       builtins.substring 12 2 nixpkgs.lastModifiedDate
diff --git a/tests/nixos/user-sandboxing/attacker.c b/tests/nixos/user-sandboxing/attacker.c
index 3bd729c04..3377a5fd0 100644
--- a/tests/nixos/user-sandboxing/attacker.c
+++ b/tests/nixos/user-sandboxing/attacker.c
@@ -9,74 +9,74 @@
 
 #define SYS_fchmodat2 452
 
-int fchmodat2(int dirfd, const char *pathname, mode_t mode, int flags) {
-  return syscall(SYS_fchmodat2, dirfd, pathname, mode, flags);
+int fchmodat2(int dirfd, const char * pathname, mode_t mode, int flags)
+{
+    return syscall(SYS_fchmodat2, dirfd, pathname, mode, flags);
 }
 
-int main(int argc, char **argv) {
-  if (argc <= 1) {
-    // stage 1: place the setuid-builder executable
+int main(int argc, char ** argv)
+{
+    if (argc <= 1) {
+        // stage 1: place the setuid-builder executable
 
-    // make the build directory world-accessible first
-    chmod(".", 0755);
+        // make the build directory world-accessible first
+        chmod(".", 0755);
 
-    if (fchmodat2(AT_FDCWD, "attacker", 06755, AT_SYMLINK_NOFOLLOW) < 0) {
-      perror("Setting the suid bit on attacker");
-      exit(-1);
-    }
-
-  } else {
-    // stage 2: corrupt the victim derivation while it's building
-
-    // prevent the kill
-    if (setresuid(-1, -1, getuid())) {
-      perror("setresuid");
-      exit(-1);
-    }
-
-    if (fork() == 0) {
-
-      // wait for the victim to build
-      int fd = inotify_init();
-      inotify_add_watch(fd, argv[1], IN_CREATE);
-      int dirfd = open(argv[1], O_DIRECTORY);
-      if (dirfd < 0) {
-        perror("opening the global build directory");
-        exit(-1);
-      }
-      char buf[4096];
-      fprintf(stderr, "Entering the inotify loop\n");
-      for (;;) {
-        ssize_t len = read(fd, buf, sizeof(buf));
-        struct inotify_event *ev;
-        for (char *pe = buf; pe < buf + len;
-            pe += sizeof(struct inotify_event) + ev->len) {
-          ev = (struct inotify_event *)pe;
-          fprintf(stderr, "folder %s created\n", ev->name);
-          // wait a bit to prevent racing against the creation
-          sleep(1);
-          int builddir = openat(dirfd, ev->name, O_DIRECTORY);
-          if (builddir < 0) {
-            perror("opening the build directory");
-            continue;
-          }
-          int resultfile = openat(builddir, "build/result", O_WRONLY | O_TRUNC);
-          if (resultfile < 0) {
-            perror("opening the hijacked file");
-            continue;
-          }
-          int writeres = write(resultfile, "bad\n", 4);
-          if (writeres < 0) {
-            perror("writing to the hijacked file");
-            continue;
-          }
-          fprintf(stderr, "Hijacked the build for %s\n", ev->name);
-          return 0;
+        if (fchmodat2(AT_FDCWD, "attacker", 06755, AT_SYMLINK_NOFOLLOW) < 0) {
+            perror("Setting the suid bit on attacker");
+            exit(-1);
         }
-      }
+
+    } else {
+        // stage 2: corrupt the victim derivation while it's building
+
+        // prevent the kill
+        if (setresuid(-1, -1, getuid())) {
+            perror("setresuid");
+            exit(-1);
+        }
+
+        if (fork() == 0) {
+
+            // wait for the victim to build
+            int fd = inotify_init();
+            inotify_add_watch(fd, argv[1], IN_CREATE);
+            int dirfd = open(argv[1], O_DIRECTORY);
+            if (dirfd < 0) {
+                perror("opening the global build directory");
+                exit(-1);
+            }
+            char buf[4096];
+            fprintf(stderr, "Entering the inotify loop\n");
+            for (;;) {
+                ssize_t len = read(fd, buf, sizeof(buf));
+                struct inotify_event * ev;
+                for (char * pe = buf; pe < buf + len; pe += sizeof(struct inotify_event) + ev->len) {
+                    ev = (struct inotify_event *) pe;
+                    fprintf(stderr, "folder %s created\n", ev->name);
+                    // wait a bit to prevent racing against the creation
+                    sleep(1);
+                    int builddir = openat(dirfd, ev->name, O_DIRECTORY);
+                    if (builddir < 0) {
+                        perror("opening the build directory");
+                        continue;
+                    }
+                    int resultfile = openat(builddir, "build/result", O_WRONLY | O_TRUNC);
+                    if (resultfile < 0) {
+                        perror("opening the hijacked file");
+                        continue;
+                    }
+                    int writeres = write(resultfile, "bad\n", 4);
+                    if (writeres < 0) {
+                        perror("writing to the hijacked file");
+                        continue;
+                    }
+                    fprintf(stderr, "Hijacked the build for %s\n", ev->name);
+                    return 0;
+                }
+            }
+        }
+
+        exit(0);
     }
-
-    exit(0);
-  }
 }
-
diff --git a/tests/nixos/user-sandboxing/default.nix b/tests/nixos/user-sandboxing/default.nix
index 3f6b575b0..d6899140a 100644
--- a/tests/nixos/user-sandboxing/default.nix
+++ b/tests/nixos/user-sandboxing/default.nix
@@ -104,8 +104,8 @@ in
 
           # Wait for the build to be ready
           # This is OK because it runs as root, so we can access everything
-          machine.wait_until_succeeds("stat /nix/var/nix/builds/nix-build-open-build-dir.drv-*/build/syncPoint")
-          dir = machine.succeed("ls -d /nix/var/nix/builds/nix-build-open-build-dir.drv-*").strip()
+          machine.wait_until_succeeds("stat /nix/var/nix/builds/nix-*/build/syncPoint")
+          dir = machine.succeed("ls -d /nix/var/nix/builds/nix-*").strip()
 
           # But Alice shouldn't be able to access the build directory
           machine.fail(f"su alice -c 'ls {dir}/build'")
@@ -125,8 +125,8 @@ in
                 args = [ (builtins.storePath "${create-hello-world}") ];
             }' >&2 &
           """.strip())
-          machine.wait_until_succeeds("stat /nix/var/nix/builds/nix-build-innocent.drv-*/build/syncPoint")
-          dir = machine.succeed("ls -d /nix/var/nix/builds/nix-build-innocent.drv-*").strip()
+          machine.wait_until_succeeds("stat /nix/var/nix/builds/nix-*/build/syncPoint")
+          dir = machine.succeed("ls -d /nix/var/nix/builds/nix-*").strip()
 
           # The build ran as `nixbld1` (which is the only build user on the
           # machine), but a process running as `nixbld1` outside the sandbox