@volter/world-runtime 2.0.6 → 2.0.7

package/dist/src/pglite-host.mjs

@@ -73,7 +73,13 @@
 //   ran once that ended, left no ReadyForQuery, and held the lock forever). All connections share the one
 //   backend session, so session state leaks between them and outlives the
 //   connection that set it: SET (search_path, timezone…), temp tables and
-//   PREPAREd statements are visible to every other connection; session
+//   SQL PREPAREd statements are visible to every other connection (a
+//   statement prepared over the protocol is the connection's own: a name
+//   another live connection holds is renamed for it, and its own SQL
+//   EXECUTE/DEALLOCATE of that name is renamed with it; scopeNames — except
+//   in CREATE TABLE … AS EXECUTE, a comment between the verb and the name,
+//   a Query holding a backslash, and a DEALLOCATE sent through Parse, which
+//   reach the name as the backend holds it); session
 //   advisory locks do NOT exclude (a second connection's
 //   pg_try_advisory_lock on a held key returns true); a NOTIFY is delivered
 //   to the connection that sent it, not to the one that ran LISTEN.
@@ -236,6 +242,220 @@ function readOnlySql(text) {
 const text = (data, from) => data.subarray(from, data.indexOf(0, from)).toString('utf8');
 const asBuffer = (m) => Buffer.from(m.buffer, m.byteOffset, m.byteLength);
 
+/** Prepared statements' protocol names each connection gives, kept apart where they would collide.
+ *  Every connection shares the one backend session, and a client names its statements per connection: Prisma's engine
+ *  starts each process at `s0`, so a second process's first Parse met "prepared statement "s0" already exists" (Postiz
+ *  walk postiz-2: sign-up, and the post workflow's first read, which left no timer to publish the post). A name no other
+ *  live connection holds goes to the backend as the client gave it, so SQL on it works as on Postgres; one another
+ *  live connection holds goes as a short name of the host's own (`volter_s<N>`), and the connection's own simple-Query
+ *  DEALLOCATE or EXECUTE of it is rewritten to match (sqlNames). Names are compared on their first 63 bytes, as Postgres compares them
+ *  (NAMEDATALEN), and handled as bytes, never decoded. A closed connection's statements are closed on the next turn
+ *  that begins outside any transaction (flushClosed). */
+const NAMEDATALEN = 63;
+/** backend statement name (latin1 of its bytes, first 63) -> the session holding it */
+const heldStatements = new Map();
+/** backend statement names of closed connections, closed at the next clean turn */
+const closedStatements = [];
+let renamed = 0;
+/** A name no statement has: what another connection's statement name is, to a connection that never prepared it. */
+const UNPREPARED = Buffer.from('volter_unprepared', 'latin1');
+const nameKey = (bytes) => bytes.subarray(0, NAMEDATALEN).toString('latin1');
+
+/** The name at `from` (its bytes, to the NUL) and where the field after it starts. */
+function cstring(data, from) {
+  const end = data.indexOf(0, from);
+  return { bytes: data.subarray(from, end), next: end + 1 };
+}
+
+/** The backend's name for a statement this connection names `bytes`; `claim` (a Parse on the connection's turn) takes
+ *  one for a new statement, anything else only looks its name up. */
+function statementName(session, bytes, claim) {
+  if (bytes.length === 0) return bytes;
+  const own = session.names.get(bytes.toString('latin1'));
+  if (own) return own;
+  if (!claim) {
+    // a statement it never prepared: the backend answers as Postgres does, never with another live connection's
+    // statement of that name (it would not exist in this connection's own session)
+    const holder = heldStatements.get(nameKey(bytes));
+    return holder && holder !== session && !holder.closed ? UNPREPARED : bytes;
+  }
+  const key = nameKey(bytes);
+  const holder = heldStatements.get(key);
+  const backend = holder && holder !== session ? Buffer.from(`volter_s${(renamed += 1)}`, 'latin1') : bytes;
+  heldStatements.set(nameKey(backend), session);
+  session.names.set(bytes.toString('latin1'), backend);
+  return backend;
+}
+
+/** The message with its statement names as the backend knows them. Portals keep the client's names: a named portal
+ *  lives only inside its transaction, and one transaction runs at a time. */
+function scopeNames(session, message, claim) {
+  const data = asBuffer(message);
+  const kind = data[0];
+  let parts;
+  if (kind === 0x50 /* P */) {
+    const name = cstring(data, 5);
+    parts = [statementName(session, name.bytes, claim), Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x42 /* B */) {
+    const portal = cstring(data, 5);
+    const statement = cstring(data, portal.next);
+    parts = [data.subarray(5, portal.next), statementName(session, statement.bytes, false), Buffer.from([0]), data.subarray(statement.next)];
+  } else if ((kind === 0x44 /* D */ || kind === 0x43 /* C */) && data[5] === 0x53 /* S */) {
+    const name = cstring(data, 6);
+    const backend = statementName(session, name.bytes, false);
+    parts = [data.subarray(5, 6), backend, Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x51 /* Q */ && claim) {
+    return sqlNames(session, message);
+  } else {
+    return message;
+  }
+  const body = Buffer.concat(parts);
+  if (body.length === data.length - 5 && body.equals(data.subarray(5))) return message;
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = kind;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** A statement of a simple Query that DEALLOCATEs or EXECUTEs one statement, at the statement's start: the verb
+ *  (EXPLAIN's options before EXECUTE included) and the name, quoted or not. */
+const STATEMENT_NAMED = /^((?:EXPLAIN\s+(?:\([^)]*\)\s*)?(?:ANALYZE\s+)?(?:VERBOSE\s+)?)?(?:DEALLOCATE\s+(?:PREPARE\s+)?|EXECUTE\s+))(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))(?=[\s(;]|$)/i;
+/** a quoted name as it is; an unquoted one folds to lower case, as Postgres folds it */
+const folded = (quoted, name) => (quoted !== undefined ? quoted.replace(/""/g, '"') : name.toLowerCase());
+const EMPTIES_ALL = /^(?:DEALLOCATE\s+(?:PREPARE\s+)?ALL|DISCARD\s+ALL)\s*;?\s*$/i;
+
+/** Where each statement of a Query begins, outside string literals, quoted identifiers, dollar-quoted bodies and
+ *  comments (a statement's leading comments skipped), so a rewrite never touches a literal's text. */
+function statementStarts(sql) {
+  const starts = [];
+  let atStart = true;
+  for (let i = 0; i < sql.length;) {
+    const c = sql[i];
+    if (/\s/.test(c)) { i += 1; continue; }
+    if (c === '-' && sql[i + 1] === '-') { const end = sql.indexOf('\n', i); i = end < 0 ? sql.length : end + 1; continue; }
+    if (c === '/' && sql[i + 1] === '*') {
+      let depth = 1; let j = i + 2; // Postgres's block comments nest
+      while (j < sql.length && depth > 0) { if (sql.startsWith('/*', j)) { depth += 1; j += 2; } else if (sql.startsWith('*/', j)) { depth -= 1; j += 2; } else j += 1; }
+      i = j; continue;
+    }
+    if (atStart) { starts.push(i); atStart = false; }
+    if (c === ';') { atStart = true; i += 1; continue; }
+    if (c === "'" || c === '"') {
+      // E'…' takes backslash escapes; a plain '…' and "…" end at their quote, a doubled one inside
+      const escapes = c === "'" && /[Ee]/.test(sql[i - 1] ?? '') && !/[A-Za-z0-9_]/.test(sql[i - 2] ?? '');
+      let j = i + 1;
+      while (j < sql.length) {
+        if (escapes && sql[j] === '\\') { j += 2; continue; }
+        if (sql[j] === c) { if (sql[j + 1] === c) { j += 2; continue; } break; }
+        j += 1;
+      }
+      i = j + 1; continue;
+    }
+    // a `$` inside an identifier (`a$b$c`) opens nothing, as Postgres's lexer reads it
+    const dollar = c === '$' && !/[A-Za-z0-9_$]/.test(sql[i - 1] ?? '') ? /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i)) : null;
+    if (dollar) { const end = sql.indexOf(dollar[0], i + dollar[0].length); i = end < 0 ? sql.length : end + dollar[0].length; continue; }
+    i += 1;
+  }
+  return starts;
+}
+
+/** Each statement of the Query that DEALLOCATEs or EXECUTEs one name: where it is, its verb and the name. */
+function namedStatements(sql) {
+  const out = [];
+  for (const at of statementStarts(sql)) {
+    const m = STATEMENT_NAMED.exec(sql.slice(at));
+    if (m) out.push({ at, length: m[0].length, verb: m[1], name: folded(m[2], m[3]) });
+  }
+  return out;
+}
+
+/** A simple Query's DEALLOCATE or EXECUTE of a statement this connection prepared under a name of the host's own
+ *  (another connection held the client's), or of a name another live connection holds: the statement it means, never
+ *  the other connection's. Only statements' own text is rewritten (statementStarts); CREATE TABLE … AS EXECUTE and
+ *  a DEALLOCATE sent through Parse are not. */
+function sqlNames(session, message) {
+  const data = asBuffer(message);
+  const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+  // a backslash can end a plain '…' literal (standard_conforming_strings off, which one connection can set for the
+  // shared session): such a Query is not read, as statementSkeleton does not read one
+  if (sql.includes('\\')) return message;
+  let text = sql;
+  for (const n of namedStatements(sql).reverse()) {
+    const backend = statementName(session, Buffer.from(n.name, 'latin1'), false).toString('latin1');
+    if (backend !== n.name) text = `${text.slice(0, n.at)}${n.verb}"${backend}"${text.slice(n.at + n.length)}`;
+  }
+  if (text === sql) return message;
+  const body = Buffer.concat([Buffer.from(text, 'latin1'), Buffer.from([0])]);
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = 0x51;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** What a client message closes: a statement (Close 'S', or a Query that is one DEALLOCATE), by the client's name,
+ *  or ALL (a Query that is one DEALLOCATE ALL or DISCARD ALL, emptying the one session's statements, every
+ *  connection's, as they did before scoping). */
+const ALL = Symbol('all');
+function closing(message) {
+  const data = asBuffer(message);
+  if (data[0] === 0x43 && data[5] === 0x53) { const name = cstring(data, 6).bytes; return name.length ? name : undefined; }
+  if (data[0] === 0x51) {
+    // one statement alone in its Query (one inside a longer Query settles when the connection closes)
+    const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+    const starts = statementStarts(sql);
+    if (starts.length !== 1 && !(starts.length === 2 && /^;\s*$/.test(sql.slice(starts[1])))) return undefined;
+    if (EMPTIES_ALL.test(sql.slice(starts[0]))) return ALL;
+    const named = namedStatements(sql);
+    if (named.length === 1 && /^DEALLOCATE/i.test(named[0].verb)) return Buffer.from(named[0].name, 'latin1');
+  }
+  return undefined;
+}
+
+/** Free what a message closed once the backend has answered it: CloseComplete ('3') or the DEALLOCATE's
+ *  CommandComplete ('C') first; a Close Postgres skipped (an earlier error in its batch) frees nothing. */
+function settleClose(session, name, response) {
+  if (!name || !response || !response.length || (response[0] !== 0x33 && response[0] !== 0x43)) return;
+  if (name === ALL) {
+    heldStatements.clear();
+    for (const other of sessions.values()) other.names.clear();
+  } else forget(session, name);
+}
+
+/** A statement the connection closed (Close 'S'): its backend name is free again. */
+function forget(session, bytes) {
+  const backend = session.names.get(bytes.toString('latin1'));
+  if (!backend) return;
+  session.names.delete(bytes.toString('latin1'));
+  if (heldStatements.get(nameKey(backend)) === session) heldStatements.delete(nameKey(backend));
+}
+
+/** A closed connection's statements, to close on the next clean turn (a leak otherwise: each connection's statements
+ *  outlived it in the one session, 300 short connections x 20 statements aborted the backend). */
+function releaseStatements(session) {
+  for (const backend of session.names.values()) if (heldStatements.get(nameKey(backend)) === session) closedStatements.push(backend);
+  session.names.clear();
+}
+
+/** Close closed connections' statements with the protocol's Close (a SQL DEALLOCATE would replace the unnamed
+ *  statement a batch may still Bind), at the start of a turn outside any transaction. */
+async function flushClosed(db) {
+  while (closedStatements.length) {
+    const backend = closedStatements.shift();
+    const body = Buffer.concat([Buffer.from('S', 'latin1'), backend, Buffer.from([0])]);
+    const close = Buffer.alloc(5 + body.length);
+    close[0] = 0x43;
+    close.writeInt32BE(4 + body.length, 1);
+    body.copy(close, 5);
+    try {
+      await db.execProtocolRaw(new Uint8Array(close));
+      await db.execProtocolRaw(new Uint8Array([0x53, 0, 0, 0, 4])); // Sync
+    } catch { /* the backend's own failure surfaces on the next real message */ }
+    if (heldStatements.get(nameKey(backend))?.closed) heldStatements.delete(nameKey(backend));
+  }
+}
+
 /** Record, per connection, which named statements it prepared read-only (a Parse of its own or a guest's); a
  *  PREPARE/DEALLOCATE/DISCARD sent as SQL forgets them all. */
 function noteStatement(session, message) {
@@ -508,11 +728,13 @@ const server = net.createServer(async (socket) => {
   const token = {};
   let holding = false;
   const session = { socket, busy: false, idleSince: Date.now(), terminated: false, closed: false, status: null, midBatch: false,
-    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map() };
+    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map(),
+    names: new Map() };
   sessions.set(token, session);
   socket.on('close', () => {
     session.closed = true;
     sessions.delete(token);
+    releaseStatements(session);
     if (guestBatch === token) {
       // a guest gone mid-batch: undo what it did in the holder's transaction
       void dbReady
@@ -537,6 +759,11 @@ const server = net.createServer(async (socket) => {
     auth: { method: 'trust' },
     async onMessage(data, { isAuthenticated, clientParams }) {
       if (!isAuthenticated) return undefined; // gateway owns startup/auth traffic
+      const client = data;
+      const closes = closing(client);
+      // looked up, not claimed, while the turn is decided: a Parse claims its name on the connection's own turn,
+      // after the closed connections' names are released (a reconnect's `s0` is its own again)
+      data = scopeNames(session, client, false);
       const db = await dbReady;
       // a guest whose turn ran out: told once, the rest of its batch dropped until its Sync
       if (session.guestExpired) {
@@ -576,6 +803,7 @@ const server = net.createServer(async (socket) => {
           return errorResponse('0A000', 'the containerless Postgres (one session) runs only reads beside another connection\'s open transaction; this batch began with a read and went on to write');
         }
         if (!session.guestOpen) { await quiet(db, 'SAVEPOINT volter_guest'); session.guestOpen = true; }
+        data = scopeNames(session, client, true);
         noteStatement(session, data);
         if (data[0] === 0x50 && text(asBuffer(data), 5) === '') session.guestUnnamed = true;
         let raw;
@@ -587,6 +815,7 @@ const server = net.createServer(async (socket) => {
           process.exit(1);
         }
         const response = withoutEarlyReady(data, raw);
+        settleClose(session, closes, response);
         const status = lastReadyStatus(response);
         if (status === null) { session.guestRunning = false; return response; } // mid-batch: the guest keeps its turn until its Sync
         // the savepoint is gone if the holder's transaction ended meanwhile (its socket closed): quiet, not fatal
@@ -605,6 +834,9 @@ const server = net.createServer(async (socket) => {
       }
       holding = true;
       session.busy = true;
+      // a turn that begins outside any transaction first closes what closed connections left
+      if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(await dbReady);
+      data = scopeNames(session, client, true);
       noteStatement(session, data);
       // libpq's default: no database parameter means the user's name
       const own = clientParams?.database || clientParams?.user;
@@ -621,6 +853,7 @@ const server = net.createServer(async (socket) => {
       session.busy = false;
       session.idleSince = Date.now();
       const response = withoutEarlyReady(data, raw);
+      settleClose(session, closes, response);
       const status = lastReadyStatus(response);
       session.midBatch = status === null;
       if (status !== null) session.status = status;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",

package/src/pglite-host.mjs

@@ -73,7 +73,13 @@
 //   ran once that ended, left no ReadyForQuery, and held the lock forever). All connections share the one
 //   backend session, so session state leaks between them and outlives the
 //   connection that set it: SET (search_path, timezone…), temp tables and
-//   PREPAREd statements are visible to every other connection; session
+//   SQL PREPAREd statements are visible to every other connection (a
+//   statement prepared over the protocol is the connection's own: a name
+//   another live connection holds is renamed for it, and its own SQL
+//   EXECUTE/DEALLOCATE of that name is renamed with it; scopeNames — except
+//   in CREATE TABLE … AS EXECUTE, a comment between the verb and the name,
+//   a Query holding a backslash, and a DEALLOCATE sent through Parse, which
+//   reach the name as the backend holds it); session
 //   advisory locks do NOT exclude (a second connection's
 //   pg_try_advisory_lock on a held key returns true); a NOTIFY is delivered
 //   to the connection that sent it, not to the one that ran LISTEN.
@@ -236,6 +242,220 @@ function readOnlySql(text) {
 const text = (data, from) => data.subarray(from, data.indexOf(0, from)).toString('utf8');
 const asBuffer = (m) => Buffer.from(m.buffer, m.byteOffset, m.byteLength);
 
+/** Prepared statements' protocol names each connection gives, kept apart where they would collide.
+ *  Every connection shares the one backend session, and a client names its statements per connection: Prisma's engine
+ *  starts each process at `s0`, so a second process's first Parse met "prepared statement "s0" already exists" (Postiz
+ *  walk postiz-2: sign-up, and the post workflow's first read, which left no timer to publish the post). A name no other
+ *  live connection holds goes to the backend as the client gave it, so SQL on it works as on Postgres; one another
+ *  live connection holds goes as a short name of the host's own (`volter_s<N>`), and the connection's own simple-Query
+ *  DEALLOCATE or EXECUTE of it is rewritten to match (sqlNames). Names are compared on their first 63 bytes, as Postgres compares them
+ *  (NAMEDATALEN), and handled as bytes, never decoded. A closed connection's statements are closed on the next turn
+ *  that begins outside any transaction (flushClosed). */
+const NAMEDATALEN = 63;
+/** backend statement name (latin1 of its bytes, first 63) -> the session holding it */
+const heldStatements = new Map();
+/** backend statement names of closed connections, closed at the next clean turn */
+const closedStatements = [];
+let renamed = 0;
+/** A name no statement has: what another connection's statement name is, to a connection that never prepared it. */
+const UNPREPARED = Buffer.from('volter_unprepared', 'latin1');
+const nameKey = (bytes) => bytes.subarray(0, NAMEDATALEN).toString('latin1');
+
+/** The name at `from` (its bytes, to the NUL) and where the field after it starts. */
+function cstring(data, from) {
+  const end = data.indexOf(0, from);
+  return { bytes: data.subarray(from, end), next: end + 1 };
+}
+
+/** The backend's name for a statement this connection names `bytes`; `claim` (a Parse on the connection's turn) takes
+ *  one for a new statement, anything else only looks its name up. */
+function statementName(session, bytes, claim) {
+  if (bytes.length === 0) return bytes;
+  const own = session.names.get(bytes.toString('latin1'));
+  if (own) return own;
+  if (!claim) {
+    // a statement it never prepared: the backend answers as Postgres does, never with another live connection's
+    // statement of that name (it would not exist in this connection's own session)
+    const holder = heldStatements.get(nameKey(bytes));
+    return holder && holder !== session && !holder.closed ? UNPREPARED : bytes;
+  }
+  const key = nameKey(bytes);
+  const holder = heldStatements.get(key);
+  const backend = holder && holder !== session ? Buffer.from(`volter_s${(renamed += 1)}`, 'latin1') : bytes;
+  heldStatements.set(nameKey(backend), session);
+  session.names.set(bytes.toString('latin1'), backend);
+  return backend;
+}
+
+/** The message with its statement names as the backend knows them. Portals keep the client's names: a named portal
+ *  lives only inside its transaction, and one transaction runs at a time. */
+function scopeNames(session, message, claim) {
+  const data = asBuffer(message);
+  const kind = data[0];
+  let parts;
+  if (kind === 0x50 /* P */) {
+    const name = cstring(data, 5);
+    parts = [statementName(session, name.bytes, claim), Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x42 /* B */) {
+    const portal = cstring(data, 5);
+    const statement = cstring(data, portal.next);
+    parts = [data.subarray(5, portal.next), statementName(session, statement.bytes, false), Buffer.from([0]), data.subarray(statement.next)];
+  } else if ((kind === 0x44 /* D */ || kind === 0x43 /* C */) && data[5] === 0x53 /* S */) {
+    const name = cstring(data, 6);
+    const backend = statementName(session, name.bytes, false);
+    parts = [data.subarray(5, 6), backend, Buffer.from([0]), data.subarray(name.next)];
+  } else if (kind === 0x51 /* Q */ && claim) {
+    return sqlNames(session, message);
+  } else {
+    return message;
+  }
+  const body = Buffer.concat(parts);
+  if (body.length === data.length - 5 && body.equals(data.subarray(5))) return message;
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = kind;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** A statement of a simple Query that DEALLOCATEs or EXECUTEs one statement, at the statement's start: the verb
+ *  (EXPLAIN's options before EXECUTE included) and the name, quoted or not. */
+const STATEMENT_NAMED = /^((?:EXPLAIN\s+(?:\([^)]*\)\s*)?(?:ANALYZE\s+)?(?:VERBOSE\s+)?)?(?:DEALLOCATE\s+(?:PREPARE\s+)?|EXECUTE\s+))(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))(?=[\s(;]|$)/i;
+/** a quoted name as it is; an unquoted one folds to lower case, as Postgres folds it */
+const folded = (quoted, name) => (quoted !== undefined ? quoted.replace(/""/g, '"') : name.toLowerCase());
+const EMPTIES_ALL = /^(?:DEALLOCATE\s+(?:PREPARE\s+)?ALL|DISCARD\s+ALL)\s*;?\s*$/i;
+
+/** Where each statement of a Query begins, outside string literals, quoted identifiers, dollar-quoted bodies and
+ *  comments (a statement's leading comments skipped), so a rewrite never touches a literal's text. */
+function statementStarts(sql) {
+  const starts = [];
+  let atStart = true;
+  for (let i = 0; i < sql.length;) {
+    const c = sql[i];
+    if (/\s/.test(c)) { i += 1; continue; }
+    if (c === '-' && sql[i + 1] === '-') { const end = sql.indexOf('\n', i); i = end < 0 ? sql.length : end + 1; continue; }
+    if (c === '/' && sql[i + 1] === '*') {
+      let depth = 1; let j = i + 2; // Postgres's block comments nest
+      while (j < sql.length && depth > 0) { if (sql.startsWith('/*', j)) { depth += 1; j += 2; } else if (sql.startsWith('*/', j)) { depth -= 1; j += 2; } else j += 1; }
+      i = j; continue;
+    }
+    if (atStart) { starts.push(i); atStart = false; }
+    if (c === ';') { atStart = true; i += 1; continue; }
+    if (c === "'" || c === '"') {
+      // E'…' takes backslash escapes; a plain '…' and "…" end at their quote, a doubled one inside
+      const escapes = c === "'" && /[Ee]/.test(sql[i - 1] ?? '') && !/[A-Za-z0-9_]/.test(sql[i - 2] ?? '');
+      let j = i + 1;
+      while (j < sql.length) {
+        if (escapes && sql[j] === '\\') { j += 2; continue; }
+        if (sql[j] === c) { if (sql[j + 1] === c) { j += 2; continue; } break; }
+        j += 1;
+      }
+      i = j + 1; continue;
+    }
+    // a `$` inside an identifier (`a$b$c`) opens nothing, as Postgres's lexer reads it
+    const dollar = c === '$' && !/[A-Za-z0-9_$]/.test(sql[i - 1] ?? '') ? /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i)) : null;
+    if (dollar) { const end = sql.indexOf(dollar[0], i + dollar[0].length); i = end < 0 ? sql.length : end + dollar[0].length; continue; }
+    i += 1;
+  }
+  return starts;
+}
+
+/** Each statement of the Query that DEALLOCATEs or EXECUTEs one name: where it is, its verb and the name. */
+function namedStatements(sql) {
+  const out = [];
+  for (const at of statementStarts(sql)) {
+    const m = STATEMENT_NAMED.exec(sql.slice(at));
+    if (m) out.push({ at, length: m[0].length, verb: m[1], name: folded(m[2], m[3]) });
+  }
+  return out;
+}
+
+/** A simple Query's DEALLOCATE or EXECUTE of a statement this connection prepared under a name of the host's own
+ *  (another connection held the client's), or of a name another live connection holds: the statement it means, never
+ *  the other connection's. Only statements' own text is rewritten (statementStarts); CREATE TABLE … AS EXECUTE and
+ *  a DEALLOCATE sent through Parse are not. */
+function sqlNames(session, message) {
+  const data = asBuffer(message);
+  const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+  // a backslash can end a plain '…' literal (standard_conforming_strings off, which one connection can set for the
+  // shared session): such a Query is not read, as statementSkeleton does not read one
+  if (sql.includes('\\')) return message;
+  let text = sql;
+  for (const n of namedStatements(sql).reverse()) {
+    const backend = statementName(session, Buffer.from(n.name, 'latin1'), false).toString('latin1');
+    if (backend !== n.name) text = `${text.slice(0, n.at)}${n.verb}"${backend}"${text.slice(n.at + n.length)}`;
+  }
+  if (text === sql) return message;
+  const body = Buffer.concat([Buffer.from(text, 'latin1'), Buffer.from([0])]);
+  const out = Buffer.alloc(5 + body.length);
+  out[0] = 0x51;
+  out.writeInt32BE(4 + body.length, 1);
+  body.copy(out, 5);
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+
+/** What a client message closes: a statement (Close 'S', or a Query that is one DEALLOCATE), by the client's name,
+ *  or ALL (a Query that is one DEALLOCATE ALL or DISCARD ALL, emptying the one session's statements, every
+ *  connection's, as they did before scoping). */
+const ALL = Symbol('all');
+function closing(message) {
+  const data = asBuffer(message);
+  if (data[0] === 0x43 && data[5] === 0x53) { const name = cstring(data, 6).bytes; return name.length ? name : undefined; }
+  if (data[0] === 0x51) {
+    // one statement alone in its Query (one inside a longer Query settles when the connection closes)
+    const sql = data.subarray(5, data.indexOf(0, 5)).toString('latin1');
+    const starts = statementStarts(sql);
+    if (starts.length !== 1 && !(starts.length === 2 && /^;\s*$/.test(sql.slice(starts[1])))) return undefined;
+    if (EMPTIES_ALL.test(sql.slice(starts[0]))) return ALL;
+    const named = namedStatements(sql);
+    if (named.length === 1 && /^DEALLOCATE/i.test(named[0].verb)) return Buffer.from(named[0].name, 'latin1');
+  }
+  return undefined;
+}
+
+/** Free what a message closed once the backend has answered it: CloseComplete ('3') or the DEALLOCATE's
+ *  CommandComplete ('C') first; a Close Postgres skipped (an earlier error in its batch) frees nothing. */
+function settleClose(session, name, response) {
+  if (!name || !response || !response.length || (response[0] !== 0x33 && response[0] !== 0x43)) return;
+  if (name === ALL) {
+    heldStatements.clear();
+    for (const other of sessions.values()) other.names.clear();
+  } else forget(session, name);
+}
+
+/** A statement the connection closed (Close 'S'): its backend name is free again. */
+function forget(session, bytes) {
+  const backend = session.names.get(bytes.toString('latin1'));
+  if (!backend) return;
+  session.names.delete(bytes.toString('latin1'));
+  if (heldStatements.get(nameKey(backend)) === session) heldStatements.delete(nameKey(backend));
+}
+
+/** A closed connection's statements, to close on the next clean turn (a leak otherwise: each connection's statements
+ *  outlived it in the one session, 300 short connections x 20 statements aborted the backend). */
+function releaseStatements(session) {
+  for (const backend of session.names.values()) if (heldStatements.get(nameKey(backend)) === session) closedStatements.push(backend);
+  session.names.clear();
+}
+
+/** Close closed connections' statements with the protocol's Close (a SQL DEALLOCATE would replace the unnamed
+ *  statement a batch may still Bind), at the start of a turn outside any transaction. */
+async function flushClosed(db) {
+  while (closedStatements.length) {
+    const backend = closedStatements.shift();
+    const body = Buffer.concat([Buffer.from('S', 'latin1'), backend, Buffer.from([0])]);
+    const close = Buffer.alloc(5 + body.length);
+    close[0] = 0x43;
+    close.writeInt32BE(4 + body.length, 1);
+    body.copy(close, 5);
+    try {
+      await db.execProtocolRaw(new Uint8Array(close));
+      await db.execProtocolRaw(new Uint8Array([0x53, 0, 0, 0, 4])); // Sync
+    } catch { /* the backend's own failure surfaces on the next real message */ }
+    if (heldStatements.get(nameKey(backend))?.closed) heldStatements.delete(nameKey(backend));
+  }
+}
+
 /** Record, per connection, which named statements it prepared read-only (a Parse of its own or a guest's); a
  *  PREPARE/DEALLOCATE/DISCARD sent as SQL forgets them all. */
 function noteStatement(session, message) {
@@ -508,11 +728,13 @@ const server = net.createServer(async (socket) => {
   const token = {};
   let holding = false;
   const session = { socket, busy: false, idleSince: Date.now(), terminated: false, closed: false, status: null, midBatch: false,
-    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map() };
+    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map(),
+    names: new Map() };
   sessions.set(token, session);
   socket.on('close', () => {
     session.closed = true;
     sessions.delete(token);
+    releaseStatements(session);
     if (guestBatch === token) {
       // a guest gone mid-batch: undo what it did in the holder's transaction
       void dbReady
@@ -537,6 +759,11 @@ const server = net.createServer(async (socket) => {
     auth: { method: 'trust' },
     async onMessage(data, { isAuthenticated, clientParams }) {
       if (!isAuthenticated) return undefined; // gateway owns startup/auth traffic
+      const client = data;
+      const closes = closing(client);
+      // looked up, not claimed, while the turn is decided: a Parse claims its name on the connection's own turn,
+      // after the closed connections' names are released (a reconnect's `s0` is its own again)
+      data = scopeNames(session, client, false);
       const db = await dbReady;
       // a guest whose turn ran out: told once, the rest of its batch dropped until its Sync
       if (session.guestExpired) {
@@ -576,6 +803,7 @@ const server = net.createServer(async (socket) => {
           return errorResponse('0A000', 'the containerless Postgres (one session) runs only reads beside another connection\'s open transaction; this batch began with a read and went on to write');
         }
         if (!session.guestOpen) { await quiet(db, 'SAVEPOINT volter_guest'); session.guestOpen = true; }
+        data = scopeNames(session, client, true);
         noteStatement(session, data);
         if (data[0] === 0x50 && text(asBuffer(data), 5) === '') session.guestUnnamed = true;
         let raw;
@@ -587,6 +815,7 @@ const server = net.createServer(async (socket) => {
           process.exit(1);
         }
         const response = withoutEarlyReady(data, raw);
+        settleClose(session, closes, response);
         const status = lastReadyStatus(response);
         if (status === null) { session.guestRunning = false; return response; } // mid-batch: the guest keeps its turn until its Sync
         // the savepoint is gone if the holder's transaction ended meanwhile (its socket closed): quiet, not fatal
@@ -605,6 +834,9 @@ const server = net.createServer(async (socket) => {
       }
       holding = true;
       session.busy = true;
+      // a turn that begins outside any transaction first closes what closed connections left
+      if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(await dbReady);
+      data = scopeNames(session, client, true);
       noteStatement(session, data);
       // libpq's default: no database parameter means the user's name
       const own = clientParams?.database || clientParams?.user;
@@ -621,6 +853,7 @@ const server = net.createServer(async (socket) => {
       session.busy = false;
       session.idleSince = Date.now();
       const response = withoutEarlyReady(data, raw);
+      settleClose(session, closes, response);
       const status = lastReadyStatus(response);
       session.midBatch = status === null;
       if (status !== null) session.status = status;