@volter/world-runtime 2.0.5 → 2.0.7

package/dist/src/pglite-host.mjs

@@ -73,7 +73,13 @@
 //   ran once that ended, left no ReadyForQuery, and held the lock forever). All connections share the one
 //   backend session, so session state leaks between them and outlives the
 //   connection that set it: SET (search_path, timezone…), temp tables and
-//   PREPAREd statements are visible to every other connection; session
+//   SQL PREPAREd statements are visible to every other connection (a
+//   statement prepared over the protocol is the connection's own: a name
+//   another live connection holds is renamed for it, and its own SQL
+//   EXECUTE/DEALLOCATE of that name is renamed with it; scopeNames — except
+//   in CREATE TABLE … AS EXECUTE, a comment between the verb and the name,
+//   a Query holding a backslash, and a DEALLOCATE sent through Parse, which
+//   reach the name as the backend holds it); session
 //   advisory locks do NOT exclude (a second connection's
 //   pg_try_advisory_lock on a held key returns true); a NOTIFY is delivered
 //   to the connection that sent it, not to the one that ran LISTEN.
@@ -236,6 +242,220 @@ function readOnlySql(text) {
 const text = (data, from) => data.subarray(from, data.indexOf(0, from)).toString('utf8');
 const asBuffer = (m) => Buffer.from(m.buffer, m.byteOffset, m.byteLength);
 
+/** Prepared statements' protocol names each connection gives, kept apart where they would collide.
+ *  Every connection shares the one backend session, and a client names its statements per connection: Prisma's engine
+ *  starts each process at `s0`, so a second process's first Parse met "prepared statement "s0" already exists" (Postiz
+ *  walk postiz-2: sign-up, and the post workflow's first read, which left no timer to publish the post). A name no other
+ *  live connection holds goes to the backend as the client gave it, so SQL on it works as on Postgres; one another
+ *  live connection holds goes as a short name of the host's own (`volter_s<N>`), and the connection's own simple-Query
+ *  DEALLOCATE or EXECUTE of it is rewritten to match (sqlNames). Names are compared on their first 63 bytes, as Postgres compares them
+ *  (NAMEDATALEN), and handled as bytes, never decoded. A closed connection's statements are closed on the next turn
+ *  that begins outside any transaction (flushClosed). */
+const NAMEDATALEN = 63;
+/** backend statement name (latin1 of its bytes, first 63) -> the session holding it */
+const heldStatements = new Map();
+/** backend statement names of closed connections, closed at the next clean turn */
+const closedStatements = [];
+let renamed = 0;
+/** A name no statement has: what another connection's statement name is, to a connection that never prepared it. */
+const UNPREPARED = Buffer.from('volter_unprepared', 'latin1');
+const nameKey = (bytes) => bytes.subarray(0, NAMEDATALEN).toString('latin1');
+
+/** The name at `from` (its bytes, to the NUL) and where the field after it starts. */
+function cstring(data, from) {
+  const end = data.indexOf(0, from);
+  return { bytes: data.subarray(from, end), next: end + 1 };
+}
+
+/** The backend's name for a statement this connection names `bytes`; `claim` (a Parse on the connection's turn) takes
+ *  one for a new statement, anything else only looks its name up. */
+function statementName(session, bytes, claim) {
+  if (bytes.length === 0) return bytes;
+  const own = session.names.get(bytes.toString('latin1'));
+  if (own) return own;
+  if (!claim) {
+    // a statement it never prepared: the backend answers as Postgres does, never with another live connection's
+    // statement of that name (it would not exist in this connection's own session)
+    const holder = heldStatements.get(nameKey(bytes));
+    return holder && holder !== session && !holder.closed ? UNPREPARED : bytes;
+  }
+  const key = nameKey(bytes);
+  const holder = heldStatements.get(key);
+  const backend = holder && holder !== session ? Buffer.from(`volter_s${(renamed += 1)}`, 'latin1') : bytes;
+  heldStatements.set(nameKey(backend), session);
+  session.names.set(bytes.toString('latin1'), backend);
+  return backend;
+}
+
+/** The message with its statement names as the backend knows them. Portals keep the client's names: a named portal
+ *  lives only inside its transaction, and one transaction runs at a time. */
+function scopeNames(session, message, claim) {
+  const data = asBuffer(message);
+  const kind = data[0];
+  let parts;
+  if (kind === 0x50 /* P */) {
+    const name = cstring(data, 5);
+    parts = [statementName(session, name.bytes, claim), Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x42 /* B */) {
+    const portal = cstring(data, 5);
+    const statement = cstring(data, portal.next);
+    parts = [data.subarray(5, portal.next), statementName(session, statement.bytes, false), Buffer.from([0]), data.subarray(statement.next)];
+  } else if ((kind === 0x44 /* D */ || kind === 0x43 /* C */) && data[5] === 0x53 /* S */) {
+    const name = cstring(data, 6);
+    const backend = statementName(session, name.bytes, false);
+    parts = [data.subarray(5, 6), backend, Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x51 /* Q */ && claim) {
+    return sqlNames(session, message);
+  } else {
+    return message;
+  }
+  const body = Buffer.concat(parts);
+  if (body.length === data.length - 5 && body.equals(data.subarray(5))) return message;
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = kind;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** A statement of a simple Query that DEALLOCATEs or EXECUTEs one statement, at the statement's start: the verb
+ *  (EXPLAIN's options before EXECUTE included) and the name, quoted or not. */
+const STATEMENT_NAMED = /^((?:EXPLAIN\s+(?:\([^)]*\)\s*)?(?:ANALYZE\s+)?(?:VERBOSE\s+)?)?(?:DEALLOCATE\s+(?:PREPARE\s+)?|EXECUTE\s+))(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))(?=[\s(;]|$)/i;
+/** a quoted name as it is; an unquoted one folds to lower case, as Postgres folds it */
+const folded = (quoted, name) => (quoted !== undefined ? quoted.replace(/""/g, '"') : name.toLowerCase());
+const EMPTIES_ALL = /^(?:DEALLOCATE\s+(?:PREPARE\s+)?ALL|DISCARD\s+ALL)\s*;?\s*$/i;
+
+/** Where each statement of a Query begins, outside string literals, quoted identifiers, dollar-quoted bodies and
+ *  comments (a statement's leading comments skipped), so a rewrite never touches a literal's text. */
+function statementStarts(sql) {
+  const starts = [];
+  let atStart = true;
+  for (let i = 0; i < sql.length;) {
+    const c = sql[i];
+    if (/\s/.test(c)) { i += 1; continue; }
+    if (c === '-' && sql[i + 1] === '-') { const end = sql.indexOf('\n', i); i = end < 0 ? sql.length : end + 1; continue; }
+    if (c === '/' && sql[i + 1] === '*') {
+      let depth = 1; let j = i + 2; // Postgres's block comments nest
+      while (j < sql.length && depth > 0) { if (sql.startsWith('/*', j)) { depth += 1; j += 2; } else if (sql.startsWith('*/', j)) { depth -= 1; j += 2; } else j += 1; }
+      i = j; continue;
+    }
+    if (atStart) { starts.push(i); atStart = false; }
+    if (c === ';') { atStart = true; i += 1; continue; }
+    if (c === "'" || c === '"') {
+      // E'…' takes backslash escapes; a plain '…' and "…" end at their quote, a doubled one inside
+      const escapes = c === "'" && /[Ee]/.test(sql[i - 1] ?? '') && !/[A-Za-z0-9_]/.test(sql[i - 2] ?? '');
+      let j = i + 1;
+      while (j < sql.length) {
+        if (escapes && sql[j] === '\\') { j += 2; continue; }
+        if (sql[j] === c) { if (sql[j + 1] === c) { j += 2; continue; } break; }
+        j += 1;
+      }
+      i = j + 1; continue;
+    }
+    // a `$` inside an identifier (`a$b$c`) opens nothing, as Postgres's lexer reads it
+    const dollar = c === '$' && !/[A-Za-z0-9_$]/.test(sql[i - 1] ?? '') ? /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i)) : null;
+    if (dollar) { const end = sql.indexOf(dollar[0], i + dollar[0].length); i = end < 0 ? sql.length : end + dollar[0].length; continue; }
+    i += 1;
+  }
+  return starts;
+}
+
+/** Each statement of the Query that DEALLOCATEs or EXECUTEs one name: where it is, its verb and the name. */
+function namedStatements(sql) {
+  const out = [];
+  for (const at of statementStarts(sql)) {
+    const m = STATEMENT_NAMED.exec(sql.slice(at));
+    if (m) out.push({ at, length: m[0].length, verb: m[1], name: folded(m[2], m[3]) });
+  }
+  return out;
+}
+
+/** A simple Query's DEALLOCATE or EXECUTE of a statement this connection prepared under a name of the host's own
+ *  (another connection held the client's), or of a name another live connection holds: the statement it means, never
+ *  the other connection's. Only statements' own text is rewritten (statementStarts); CREATE TABLE … AS EXECUTE and
+ *  a DEALLOCATE sent through Parse are not. */
+function sqlNames(session, message) {
+  const data = asBuffer(message);
+  const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+  // a backslash can end a plain '…' literal (standard_conforming_strings off, which one connection can set for the
+  // shared session): such a Query is not read, as statementSkeleton does not read one
+  if (sql.includes('\\')) return message;
+  let text = sql;
+  for (const n of namedStatements(sql).reverse()) {
+    const backend = statementName(session, Buffer.from(n.name, 'latin1'), false).toString('latin1');
+    if (backend !== n.name) text = `${text.slice(0, n.at)}${n.verb}"${backend}"${text.slice(n.at + n.length)}`;
+  }
+  if (text === sql) return message;
+  const body = Buffer.concat([Buffer.from(text, 'latin1'), Buffer.from([0])]);
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = 0x51;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** What a client message closes: a statement (Close 'S', or a Query that is one DEALLOCATE), by the client's name,
+ *  or ALL (a Query that is one DEALLOCATE ALL or DISCARD ALL, emptying the one session's statements, every
+ *  connection's, as they did before scoping). */
+const ALL = Symbol('all');
+function closing(message) {
+  const data = asBuffer(message);
+  if (data[0] === 0x43 && data[5] === 0x53) { const name = cstring(data, 6).bytes; return name.length ? name : undefined; }
+  if (data[0] === 0x51) {
+    // one statement alone in its Query (one inside a longer Query settles when the connection closes)
+    const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+    const starts = statementStarts(sql);
+    if (starts.length !== 1 && !(starts.length === 2 && /^;\s*$/.test(sql.slice(starts[1])))) return undefined;
+    if (EMPTIES_ALL.test(sql.slice(starts[0]))) return ALL;
+    const named = namedStatements(sql);
+    if (named.length === 1 && /^DEALLOCATE/i.test(named[0].verb)) return Buffer.from(named[0].name, 'latin1');
+  }
+  return undefined;
+}
+
+/** Free what a message closed once the backend has answered it: CloseComplete ('3') or the DEALLOCATE's
+ *  CommandComplete ('C') first; a Close Postgres skipped (an earlier error in its batch) frees nothing. */
+function settleClose(session, name, response) {
+  if (!name || !response || !response.length || (response[0] !== 0x33 && response[0] !== 0x43)) return;
+  if (name === ALL) {
+    heldStatements.clear();
+    for (const other of sessions.values()) other.names.clear();
+  } else forget(session, name);
+}
+
+/** A statement the connection closed (Close 'S'): its backend name is free again. */
+function forget(session, bytes) {
+  const backend = session.names.get(bytes.toString('latin1'));
+  if (!backend) return;
+  session.names.delete(bytes.toString('latin1'));
+  if (heldStatements.get(nameKey(backend)) === session) heldStatements.delete(nameKey(backend));
+}
+
+/** A closed connection's statements, to close on the next clean turn (a leak otherwise: each connection's statements
+ *  outlived it in the one session, 300 short connections x 20 statements aborted the backend). */
+function releaseStatements(session) {
+  for (const backend of session.names.values()) if (heldStatements.get(nameKey(backend)) === session) closedStatements.push(backend);
+  session.names.clear();
+}
+
+/** Close closed connections' statements with the protocol's Close (a SQL DEALLOCATE would replace the unnamed
+ *  statement a batch may still Bind), at the start of a turn outside any transaction. */
+async function flushClosed(db) {
+  while (closedStatements.length) {
+    const backend = closedStatements.shift();
+    const body = Buffer.concat([Buffer.from('S', 'latin1'), backend, Buffer.from([0])]);
+    const close = Buffer.alloc(5 + body.length);
+    close[0] = 0x43;
+    close.writeInt32BE(4 + body.length, 1);
+    body.copy(close, 5);
+    try {
+      await db.execProtocolRaw(new Uint8Array(close));
+      await db.execProtocolRaw(new Uint8Array([0x53, 0, 0, 0, 4])); // Sync
+    } catch { /* the backend's own failure surfaces on the next real message */ }
+    if (heldStatements.get(nameKey(backend))?.closed) heldStatements.delete(nameKey(backend));
+  }
+}
+
 /** Record, per connection, which named statements it prepared read-only (a Parse of its own or a guest's); a
  *  PREPARE/DEALLOCATE/DISCARD sent as SQL forgets them all. */
 function noteStatement(session, message) {
@@ -508,11 +728,13 @@ const server = net.createServer(async (socket) => {
   const token = {};
   let holding = false;
   const session = { socket, busy: false, idleSince: Date.now(), terminated: false, closed: false, status: null, midBatch: false,
-    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map() };
+    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map(),
+    names: new Map() };
   sessions.set(token, session);
   socket.on('close', () => {
     session.closed = true;
     sessions.delete(token);
+    releaseStatements(session);
     if (guestBatch === token) {
       // a guest gone mid-batch: undo what it did in the holder's transaction
       void dbReady
@@ -537,6 +759,11 @@ const server = net.createServer(async (socket) => {
     auth: { method: 'trust' },
     async onMessage(data, { isAuthenticated, clientParams }) {
       if (!isAuthenticated) return undefined; // gateway owns startup/auth traffic
+      const client = data;
+      const closes = closing(client);
+      // looked up, not claimed, while the turn is decided: a Parse claims its name on the connection's own turn,
+      // after the closed connections' names are released (a reconnect's `s0` is its own again)
+      data = scopeNames(session, client, false);
       const db = await dbReady;
       // a guest whose turn ran out: told once, the rest of its batch dropped until its Sync
       if (session.guestExpired) {
@@ -576,6 +803,7 @@ const server = net.createServer(async (socket) => {
           return errorResponse('0A000', 'the containerless Postgres (one session) runs only reads beside another connection\'s open transaction; this batch began with a read and went on to write');
         }
         if (!session.guestOpen) { await quiet(db, 'SAVEPOINT volter_guest'); session.guestOpen = true; }
+        data = scopeNames(session, client, true);
         noteStatement(session, data);
         if (data[0] === 0x50 && text(asBuffer(data), 5) === '') session.guestUnnamed = true;
         let raw;
@@ -587,6 +815,7 @@ const server = net.createServer(async (socket) => {
           process.exit(1);
         }
         const response = withoutEarlyReady(data, raw);
+        settleClose(session, closes, response);
         const status = lastReadyStatus(response);
         if (status === null) { session.guestRunning = false; return response; } // mid-batch: the guest keeps its turn until its Sync
         // the savepoint is gone if the holder's transaction ended meanwhile (its socket closed): quiet, not fatal
@@ -605,6 +834,9 @@ const server = net.createServer(async (socket) => {
       }
       holding = true;
       session.busy = true;
+      // a turn that begins outside any transaction first closes what closed connections left
+      if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(await dbReady);
+      data = scopeNames(session, client, true);
       noteStatement(session, data);
       // libpq's default: no database parameter means the user's name
       const own = clientParams?.database || clientParams?.user;
@@ -621,6 +853,7 @@ const server = net.createServer(async (socket) => {
       session.busy = false;
       session.idleSince = Date.now();
       const response = withoutEarlyReady(data, raw);
+      settleClose(session, closes, response);
       const status = lastReadyStatus(response);
       session.midBatch = status === null;
       if (status !== null) session.status = status;

package/dist/src/served-world.js

@@ -31,7 +31,7 @@ import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
-import { appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow, parentEntries, rebaseBranch, } from '@volter/world-core';
+import { appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow, parentEntries, rebaseBranch, } from '@volter/world-core';
 import { approveWorldChangeset, createWorldChangeset, diffWorld, findWorldChangeset, listWorldChangesets, pushWorldChangeset, verifyWorldChangeset, worldChangesetsDir } from "./changeset.js";
 import { fetchFromOrigin } from "./origin.js";
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart } from "./console-apart.js";
@@ -415,6 +415,9 @@ export class WorldDoors {
         for (const k of also)
             ids.add(k.id);
         this.keepKeys(this.keys().filter((k) => !ids.has(k.id)));
+        // a session a revoked key opened ends with it
+        if (Object.values(this.sessions()).some((x) => x.key !== undefined && ids.has(x.key)))
+            this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, x]) => x.key === undefined || !ids.has(x.key))));
         // the keys are gone whatever a removal answers; a branch that stays is said, not hidden (its parent key no longer opens this World)
         for (const k of [...gone, ...also])
             if (k.branch)
@@ -472,8 +475,10 @@ export class WorldDoors {
             const who = new URL(request.url).searchParams.get('person');
             if (via !== 'token' || !who)
                 return Response.json({ error: 'DELETE /keys?person=<subject>, with the World\'s token' }, { status: via !== 'token' ? 403 : 400 });
-            // their keys, the parent keys of the branches they made, and those branches
-            return Response.json({ revoked: await this.revokeKeys((k) => person(k) === who) });
+            // their keys, the parent keys of the branches they made, and those branches; and the sessions their passes opened
+            const revoked = await this.revokeKeys((k) => person(k) === who);
+            this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, s]) => s.sub !== who)));
+            return Response.json({ revoked });
         }
         if (id && request.method === 'DELETE') {
             const found = this.keys().find((k) => k.id === id);
@@ -1053,21 +1058,29 @@ export class WorldDoors {
             return Response.json({ twin: name, state, view: cut.view, position: cut.position, tree: readTree(state, controlRoot, { view: cut.view }) });
         }
         if (kind === 'changesets' && request.method === 'GET') {
+            // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
             if (name) {
                 const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name });
-                return Response.json(l.changeset);
+                return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset) });
             }
-            return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset) });
+            return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => ({ ...l.changeset, currentHash: changesetContentHash(l.changeset) })) });
         }
         if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
             const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
             return Response.json(outcome);
         }
         if (kind === 'changesets' && name && verb === 'approve' && request.method === 'POST') {
-            const body = (await request.json());
-            if (!body.as)
-                return Response.json({ error: 'approve: { as, note? }' }, { status: 400 });
-            return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal: body.as, ...(body.note ? { note: body.note } : {}) }));
+            const body = (await request.json().catch(() => ({})));
+            // a browser's session signs as whom it was opened for (a platform's pass names the person; this machine's own page
+            // is the person at it), never as whatever the page says; a token or a key names its principal, as before, and so
+            // does a session the World's write token opened (it is that token's holder, who names themselves)
+            const held = via === 'session' ? this.sessions()[this.credential(request).session ?? ''] : undefined;
+            const named = typeof body.as === 'string' && body.as.trim() ? body.as.trim().slice(0, 80) : undefined;
+            const tokenSession = held !== undefined && !held.who && held.key === undefined && held.scope === 'write';
+            const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : named;
+            if (!principal)
+                return Response.json({ error: via === 'session' && !tokenSession ? 'this session names no person to sign as: open the World from its platform, or approve with its token' : 'approve: { as, note? } — name who approves' }, { status: via === 'session' && !tokenSession ? 403 : 400 });
+            return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
         }
         if (kind === 'links' && !name && request.method === 'GET')
             return Response.json({ links: this.links() });
@@ -1361,8 +1374,10 @@ export class WorldDoors {
         const cookie = this.sessionCookie(url, held ?? this.openSession(scope, undefined, key));
         const who = held ? this.sessions()[held]?.who : undefined;
         const issuer = held ? this.sessions()[held]?.issuer : undefined;
-        // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out
-        return Response.json({ world: this.served, scope, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
+        // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out;
+        // `signsAs`: whom an approval from this session is recorded as, or null when the page must name them (a token's)
+        const signsAs = who ?? (this.host.localTrust?.() ? 'this machine' : null);
+        return Response.json({ world: this.served, scope, signsAs, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
     }
     /** THE CLOCK: the frozen instant every twin stamps from, kept in the World's store. It moves only
      *  forward once the World has entries (a twin's catch-up stamps each move at its due time, so a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -68,7 +68,7 @@
   },
   "peerDependencies": {
     "@volter/world-core": "2.0.4",
-    "@volter/world-console": "2.0.5"
+    "@volter/world-console": "2.0.6"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",

package/src/pglite-host.mjs

@@ -73,7 +73,13 @@
 //   ran once that ended, left no ReadyForQuery, and held the lock forever). All connections share the one
 //   backend session, so session state leaks between them and outlives the
 //   connection that set it: SET (search_path, timezone…), temp tables and
-//   PREPAREd statements are visible to every other connection; session
+//   SQL PREPAREd statements are visible to every other connection (a
+//   statement prepared over the protocol is the connection's own: a name
+//   another live connection holds is renamed for it, and its own SQL
+//   EXECUTE/DEALLOCATE of that name is renamed with it; scopeNames — except
+//   in CREATE TABLE … AS EXECUTE, a comment between the verb and the name,
+//   a Query holding a backslash, and a DEALLOCATE sent through Parse, which
+//   reach the name as the backend holds it); session
 //   advisory locks do NOT exclude (a second connection's
 //   pg_try_advisory_lock on a held key returns true); a NOTIFY is delivered
 //   to the connection that sent it, not to the one that ran LISTEN.
@@ -236,6 +242,220 @@ function readOnlySql(text) {
 const text = (data, from) => data.subarray(from, data.indexOf(0, from)).toString('utf8');
 const asBuffer = (m) => Buffer.from(m.buffer, m.byteOffset, m.byteLength);
 
+/** Prepared statements' protocol names each connection gives, kept apart where they would collide.
+ *  Every connection shares the one backend session, and a client names its statements per connection: Prisma's engine
+ *  starts each process at `s0`, so a second process's first Parse met "prepared statement "s0" already exists" (Postiz
+ *  walk postiz-2: sign-up, and the post workflow's first read, which left no timer to publish the post). A name no other
+ *  live connection holds goes to the backend as the client gave it, so SQL on it works as on Postgres; one another
+ *  live connection holds goes as a short name of the host's own (`volter_s<N>`), and the connection's own simple-Query
+ *  DEALLOCATE or EXECUTE of it is rewritten to match (sqlNames). Names are compared on their first 63 bytes, as Postgres compares them
+ *  (NAMEDATALEN), and handled as bytes, never decoded. A closed connection's statements are closed on the next turn
+ *  that begins outside any transaction (flushClosed). */
+const NAMEDATALEN = 63;
+/** backend statement name (latin1 of its bytes, first 63) -> the session holding it */
+const heldStatements = new Map();
+/** backend statement names of closed connections, closed at the next clean turn */
+const closedStatements = [];
+let renamed = 0;
+/** A name no statement has: what another connection's statement name is, to a connection that never prepared it. */
+const UNPREPARED = Buffer.from('volter_unprepared', 'latin1');
+const nameKey = (bytes) => bytes.subarray(0, NAMEDATALEN).toString('latin1');
+
+/** The name at `from` (its bytes, to the NUL) and where the field after it starts. */
+function cstring(data, from) {
+  const end = data.indexOf(0, from);
+  return { bytes: data.subarray(from, end), next: end + 1 };
+}
+
+/** The backend's name for a statement this connection names `bytes`; `claim` (a Parse on the connection's turn) takes
+ *  one for a new statement, anything else only looks its name up. */
+function statementName(session, bytes, claim) {
+  if (bytes.length === 0) return bytes;
+  const own = session.names.get(bytes.toString('latin1'));
+  if (own) return own;
+  if (!claim) {
+    // a statement it never prepared: the backend answers as Postgres does, never with another live connection's
+    // statement of that name (it would not exist in this connection's own session)
+    const holder = heldStatements.get(nameKey(bytes));
+    return holder && holder !== session && !holder.closed ? UNPREPARED : bytes;
+  }
+  const key = nameKey(bytes);
+  const holder = heldStatements.get(key);
+  const backend = holder && holder !== session ? Buffer.from(`volter_s${(renamed += 1)}`, 'latin1') : bytes;
+  heldStatements.set(nameKey(backend), session);
+  session.names.set(bytes.toString('latin1'), backend);
+  return backend;
+}
+
+/** The message with its statement names as the backend knows them. Portals keep the client's names: a named portal
+ *  lives only inside its transaction, and one transaction runs at a time. */
+function scopeNames(session, message, claim) {
+  const data = asBuffer(message);
+  const kind = data[0];
+  let parts;
+  if (kind === 0x50 /* P */) {
+    const name = cstring(data, 5);
+    parts = [statementName(session, name.bytes, claim), Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x42 /* B */) {
+    const portal = cstring(data, 5);
+    const statement = cstring(data, portal.next);
+    parts = [data.subarray(5, portal.next), statementName(session, statement.bytes, false), Buffer.from([0]), data.subarray(statement.next)];
+  } else if ((kind === 0x44 /* D */ || kind === 0x43 /* C */) && data[5] === 0x53 /* S */) {
+    const name = cstring(data, 6);
+    const backend = statementName(session, name.bytes, false);
+    parts = [data.subarray(5, 6), backend, Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x51 /* Q */ && claim) {
+    return sqlNames(session, message);
+  } else {
+    return message;
+  }
+  const body = Buffer.concat(parts);
+  if (body.length === data.length - 5 && body.equals(data.subarray(5))) return message;
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = kind;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** A statement of a simple Query that DEALLOCATEs or EXECUTEs one statement, at the statement's start: the verb
+ *  (EXPLAIN's options before EXECUTE included) and the name, quoted or not. */
+const STATEMENT_NAMED = /^((?:EXPLAIN\s+(?:\([^)]*\)\s*)?(?:ANALYZE\s+)?(?:VERBOSE\s+)?)?(?:DEALLOCATE\s+(?:PREPARE\s+)?|EXECUTE\s+))(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))(?=[\s(;]|$)/i;
+/** a quoted name as it is; an unquoted one folds to lower case, as Postgres folds it */
+const folded = (quoted, name) => (quoted !== undefined ? quoted.replace(/""/g, '"') : name.toLowerCase());
+const EMPTIES_ALL = /^(?:DEALLOCATE\s+(?:PREPARE\s+)?ALL|DISCARD\s+ALL)\s*;?\s*$/i;
+
+/** Where each statement of a Query begins, outside string literals, quoted identifiers, dollar-quoted bodies and
+ *  comments (a statement's leading comments skipped), so a rewrite never touches a literal's text. */
+function statementStarts(sql) {
+  const starts = [];
+  let atStart = true;
+  for (let i = 0; i < sql.length;) {
+    const c = sql[i];
+    if (/\s/.test(c)) { i += 1; continue; }
+    if (c === '-' && sql[i + 1] === '-') { const end = sql.indexOf('\n', i); i = end < 0 ? sql.length : end + 1; continue; }
+    if (c === '/' && sql[i + 1] === '*') {
+      let depth = 1; let j = i + 2; // Postgres's block comments nest
+      while (j < sql.length && depth > 0) { if (sql.startsWith('/*', j)) { depth += 1; j += 2; } else if (sql.startsWith('*/', j)) { depth -= 1; j += 2; } else j += 1; }
+      i = j; continue;
+    }
+    if (atStart) { starts.push(i); atStart = false; }
+    if (c === ';') { atStart = true; i += 1; continue; }
+    if (c === "'" || c === '"') {
+      // E'…' takes backslash escapes; a plain '…' and "…" end at their quote, a doubled one inside
+      const escapes = c === "'" && /[Ee]/.test(sql[i - 1] ?? '') && !/[A-Za-z0-9_]/.test(sql[i - 2] ?? '');
+      let j = i + 1;
+      while (j < sql.length) {
+        if (escapes && sql[j] === '\\') { j += 2; continue; }
+        if (sql[j] === c) { if (sql[j + 1] === c) { j += 2; continue; } break; }
+        j += 1;
+      }
+      i = j + 1; continue;
+    }
+    // a `$` inside an identifier (`a$b$c`) opens nothing, as Postgres's lexer reads it
+    const dollar = c === '$' && !/[A-Za-z0-9_$]/.test(sql[i - 1] ?? '') ? /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i)) : null;
+    if (dollar) { const end = sql.indexOf(dollar[0], i + dollar[0].length); i = end < 0 ? sql.length : end + dollar[0].length; continue; }
+    i += 1;
+  }
+  return starts;
+}
+
+/** Each statement of the Query that DEALLOCATEs or EXECUTEs one name: where it is, its verb and the name. */
+function namedStatements(sql) {
+  const out = [];
+  for (const at of statementStarts(sql)) {
+    const m = STATEMENT_NAMED.exec(sql.slice(at));
+    if (m) out.push({ at, length: m[0].length, verb: m[1], name: folded(m[2], m[3]) });
+  }
+  return out;
+}
+
+/** A simple Query's DEALLOCATE or EXECUTE of a statement this connection prepared under a name of the host's own
+ *  (another connection held the client's), or of a name another live connection holds: the statement it means, never
+ *  the other connection's. Only statements' own text is rewritten (statementStarts); CREATE TABLE … AS EXECUTE and
+ *  a DEALLOCATE sent through Parse are not. */
+function sqlNames(session, message) {
+  const data = asBuffer(message);
+  const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+  // a backslash can end a plain '…' literal (standard_conforming_strings off, which one connection can set for the
+  // shared session): such a Query is not read, as statementSkeleton does not read one
+  if (sql.includes('\\')) return message;
+  let text = sql;
+  for (const n of namedStatements(sql).reverse()) {
+    const backend = statementName(session, Buffer.from(n.name, 'latin1'), false).toString('latin1');
+    if (backend !== n.name) text = `${text.slice(0, n.at)}${n.verb}"${backend}"${text.slice(n.at + n.length)}`;
+  }
+  if (text === sql) return message;
+  const body = Buffer.concat([Buffer.from(text, 'latin1'), Buffer.from([0])]);
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = 0x51;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** What a client message closes: a statement (Close 'S', or a Query that is one DEALLOCATE), by the client's name,
+ *  or ALL (a Query that is one DEALLOCATE ALL or DISCARD ALL, emptying the one session's statements, every
+ *  connection's, as they did before scoping). */
+const ALL = Symbol('all');
+function closing(message) {
+  const data = asBuffer(message);
+  if (data[0] === 0x43 && data[5] === 0x53) { const name = cstring(data, 6).bytes; return name.length ? name : undefined; }
+  if (data[0] === 0x51) {
+    // one statement alone in its Query (one inside a longer Query settles when the connection closes)
+    const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+    const starts = statementStarts(sql);
+    if (starts.length !== 1 && !(starts.length === 2 && /^;\s*$/.test(sql.slice(starts[1])))) return undefined;
+    if (EMPTIES_ALL.test(sql.slice(starts[0]))) return ALL;
+    const named = namedStatements(sql);
+    if (named.length === 1 && /^DEALLOCATE/i.test(named[0].verb)) return Buffer.from(named[0].name, 'latin1');
+  }
+  return undefined;
+}
+
+/** Free what a message closed once the backend has answered it: CloseComplete ('3') or the DEALLOCATE's
+ *  CommandComplete ('C') first; a Close Postgres skipped (an earlier error in its batch) frees nothing. */
+function settleClose(session, name, response) {
+  if (!name || !response || !response.length || (response[0] !== 0x33 && response[0] !== 0x43)) return;
+  if (name === ALL) {
+    heldStatements.clear();
+    for (const other of sessions.values()) other.names.clear();
+  } else forget(session, name);
+}
+
+/** A statement the connection closed (Close 'S'): its backend name is free again. */
+function forget(session, bytes) {
+  const backend = session.names.get(bytes.toString('latin1'));
+  if (!backend) return;
+  session.names.delete(bytes.toString('latin1'));
+  if (heldStatements.get(nameKey(backend)) === session) heldStatements.delete(nameKey(backend));
+}
+
+/** A closed connection's statements, to close on the next clean turn (a leak otherwise: each connection's statements
+ *  outlived it in the one session, 300 short connections x 20 statements aborted the backend). */
+function releaseStatements(session) {
+  for (const backend of session.names.values()) if (heldStatements.get(nameKey(backend)) === session) closedStatements.push(backend);
+  session.names.clear();
+}
+
+/** Close closed connections' statements with the protocol's Close (a SQL DEALLOCATE would replace the unnamed
+ *  statement a batch may still Bind), at the start of a turn outside any transaction. */
+async function flushClosed(db) {
+  while (closedStatements.length) {
+    const backend = closedStatements.shift();
+    const body = Buffer.concat([Buffer.from('S', 'latin1'), backend, Buffer.from([0])]);
+    const close = Buffer.alloc(5 + body.length);
+    close[0] = 0x43;
+    close.writeInt32BE(4 + body.length, 1);
+    body.copy(close, 5);
+    try {
+      await db.execProtocolRaw(new Uint8Array(close));
+      await db.execProtocolRaw(new Uint8Array([0x53, 0, 0, 0, 4])); // Sync
+    } catch { /* the backend's own failure surfaces on the next real message */ }
+    if (heldStatements.get(nameKey(backend))?.closed) heldStatements.delete(nameKey(backend));
+  }
+}
+
 /** Record, per connection, which named statements it prepared read-only (a Parse of its own or a guest's); a
  *  PREPARE/DEALLOCATE/DISCARD sent as SQL forgets them all. */
 function noteStatement(session, message) {
@@ -508,11 +728,13 @@ const server = net.createServer(async (socket) => {
   const token = {};
   let holding = false;
   const session = { socket, busy: false, idleSince: Date.now(), terminated: false, closed: false, status: null, midBatch: false,
-    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map() };
+    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map(),
+    names: new Map() };
   sessions.set(token, session);
   socket.on('close', () => {
     session.closed = true;
     sessions.delete(token);
+    releaseStatements(session);
     if (guestBatch === token) {
       // a guest gone mid-batch: undo what it did in the holder's transaction
       void dbReady
@@ -537,6 +759,11 @@ const server = net.createServer(async (socket) => {
     auth: { method: 'trust' },
     async onMessage(data, { isAuthenticated, clientParams }) {
       if (!isAuthenticated) return undefined; // gateway owns startup/auth traffic
+      const client = data;
+      const closes = closing(client);
+      // looked up, not claimed, while the turn is decided: a Parse claims its name on the connection's own turn,
+      // after the closed connections' names are released (a reconnect's `s0` is its own again)
+      data = scopeNames(session, client, false);
       const db = await dbReady;
       // a guest whose turn ran out: told once, the rest of its batch dropped until its Sync
       if (session.guestExpired) {
@@ -576,6 +803,7 @@ const server = net.createServer(async (socket) => {
           return errorResponse('0A000', 'the containerless Postgres (one session) runs only reads beside another connection\'s open transaction; this batch began with a read and went on to write');
         }
         if (!session.guestOpen) { await quiet(db, 'SAVEPOINT volter_guest'); session.guestOpen = true; }
+        data = scopeNames(session, client, true);
         noteStatement(session, data);
         if (data[0] === 0x50 && text(asBuffer(data), 5) === '') session.guestUnnamed = true;
         let raw;
@@ -587,6 +815,7 @@ const server = net.createServer(async (socket) => {
           process.exit(1);
         }
         const response = withoutEarlyReady(data, raw);
+        settleClose(session, closes, response);
         const status = lastReadyStatus(response);
         if (status === null) { session.guestRunning = false; return response; } // mid-batch: the guest keeps its turn until its Sync
         // the savepoint is gone if the holder's transaction ended meanwhile (its socket closed): quiet, not fatal
@@ -605,6 +834,9 @@ const server = net.createServer(async (socket) => {
       }
       holding = true;
       session.busy = true;
+      // a turn that begins outside any transaction first closes what closed connections left
+      if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(await dbReady);
+      data = scopeNames(session, client, true);
       noteStatement(session, data);
       // libpq's default: no database parameter means the user's name
       const own = clientParams?.database || clientParams?.user;
@@ -621,6 +853,7 @@ const server = net.createServer(async (socket) => {
       session.busy = false;
       session.idleSince = Date.now();
       const response = withoutEarlyReady(data, raw);
+      settleClose(session, closes, response);
       const status = lastReadyStatus(response);
       session.midBatch = status === null;
       if (status !== null) session.status = status;

package/src/served-world.ts

@@ -32,7 +32,7 @@ import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type Tr
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import {
-  appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow,
+  appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow,
   parentEntries, rebaseBranch, type Changeset, type Entry, type Receipt, type RootConfig,
 } from '@volter/world-core';
 import { approveWorldChangeset, createWorldChangeset, diffWorld, findWorldChangeset, listWorldChangesets, pushWorldChangeset, verifyWorldChangeset, worldChangesetsDir } from './changeset.ts';
@@ -407,6 +407,8 @@ export class WorldDoors {
     const also = this.keys().filter((k) => !ids.has(k.id) && k.madeWith !== undefined && ids.has(k.madeWith)); // branches a revoked key made
     for (const k of also) ids.add(k.id);
     this.keepKeys(this.keys().filter((k) => !ids.has(k.id)));
+    // a session a revoked key opened ends with it
+    if (Object.values(this.sessions()).some((x) => x.key !== undefined && ids.has(x.key))) this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, x]) => x.key === undefined || !ids.has(x.key))));
     // the keys are gone whatever a removal answers; a branch that stays is said, not hidden (its parent key no longer opens this World)
     for (const k of [...gone, ...also]) if (k.branch) await this.host.branches?.remove(k.branch).catch((error: unknown) => { console.error(`${this.served}: branch ${k.branch} stays after its key was revoked: ${error instanceof Error ? error.message : String(error)}`); return false; });
     return [...ids];
@@ -447,8 +449,10 @@ export class WorldDoors {
       // every key made by or for a person: their leaving the org ends what they hold here (the token's act)
       const who = new URL(request.url).searchParams.get('person');
       if (via !== 'token' || !who) return Response.json({ error: 'DELETE /keys?person=<subject>, with the World\'s token' }, { status: via !== 'token' ? 403 : 400 });
-      // their keys, the parent keys of the branches they made, and those branches
-      return Response.json({ revoked: await this.revokeKeys((k) => person(k) === who) });
+      // their keys, the parent keys of the branches they made, and those branches; and the sessions their passes opened
+      const revoked = await this.revokeKeys((k) => person(k) === who);
+      this.keepSessions(Object.fromEntries(Object.entries(this.sessions()).filter(([, s]) => s.sub !== who)));
+      return Response.json({ revoked });
     }
     if (id && request.method === 'DELETE') {
       const found = this.keys().find((k) => k.id === id);
@@ -931,17 +935,25 @@ export class WorldDoors {
       return Response.json({ twin: name, state, view: cut.view, position: cut.position, tree: readTree(state, controlRoot, { view: cut.view }) });
     }
     if (kind === 'changesets' && request.method === 'GET') {
-      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json(l.changeset); }
-      return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset) });
+      // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
+      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset) }); }
+      return Response.json({ changesets: listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => ({ ...l.changeset, currentHash: changesetContentHash(l.changeset) })) });
     }
     if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
       const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
       return Response.json(outcome);
     }
     if (kind === 'changesets' && name && verb === 'approve' && request.method === 'POST') {
-      const body = (await request.json()) as { as?: string; note?: string };
-      if (!body.as) return Response.json({ error: 'approve: { as, note? }' }, { status: 400 });
-      return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal: body.as, ...(body.note ? { note: body.note } : {}) }));
+      const body = (await request.json().catch(() => ({}))) as { as?: string; note?: string };
+      // a browser's session signs as whom it was opened for (a platform's pass names the person; this machine's own page
+      // is the person at it), never as whatever the page says; a token or a key names its principal, as before, and so
+      // does a session the World's write token opened (it is that token's holder, who names themselves)
+      const held = via === 'session' ? this.sessions()[this.credential(request).session ?? ''] : undefined;
+      const named = typeof body.as === 'string' && body.as.trim() ? body.as.trim().slice(0, 80) : undefined;
+      const tokenSession = held !== undefined && !held.who && held.key === undefined && held.scope === 'write';
+      const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : named;
+      if (!principal) return Response.json({ error: via === 'session' && !tokenSession ? 'this session names no person to sign as: open the World from its platform, or approve with its token' : 'approve: { as, note? } — name who approves' }, { status: via === 'session' && !tokenSession ? 403 : 400 });
+      return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
     }
     if (kind === 'links' && !name && request.method === 'GET') return Response.json({ links: this.links() });
     if (kind === 'links' && name && request.method === 'PUT') {
@@ -1165,8 +1177,10 @@ export class WorldDoors {
     if (request.method === 'DELETE') { this.endSession(held); return Response.json({ world: this.served, ended: true }, { headers: { 'set-cookie': this.sessionCookie(url, '', '; Max-Age=0')! } }); }
     const cookie = this.sessionCookie(url, held ?? this.openSession(scope, undefined, key))!;
     const who = held ? this.sessions()[held]?.who : undefined; const issuer = held ? this.sessions()[held]?.issuer : undefined;
-    // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out
-    return Response.json({ world: this.served, scope, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
+    // `local`: this page is the local World's own (localPage), so the console offers no sign-in or sign-out;
+    // `signsAs`: whom an approval from this session is recorded as, or null when the page must name them (a token's)
+    const signsAs = who ?? (this.host.localTrust?.() ? 'this machine' : null);
+    return Response.json({ world: this.served, scope, signsAs, ...(who ? { who } : {}), ...(issuer ? { issuer } : {}), ...(own ? { origin: own } : {}), ...(this.localPage(request, url) ? { local: true } : {}) }, { headers: { 'set-cookie': cookie } });
   }
 
   /** THE CLOCK: the frozen instant every twin stamps from, kept in the World's store. It moves only