postgrejs 3.12.2 → 3.14.0

package/README.md

@@ -98,6 +98,32 @@ Each adapter hands the compiled SQL straight to this client, with no `pg` left a
 compared query by query against the driver it replaces - and, where the project ships a suite of its own, run
 against that too. So adopting one is a change to how the connection is created and nothing else.
 
+### 🌍 Runs Where You Run
+
+<!-- Same card shape as the adapters above, for the same reason: GitHub strips CSS, and a table
+     is the one layout that survives everywhere the README is read. -->
+<table>
+  <tr>
+    <td align="center" width="230" valign="top">
+      <a href="https://www.postgrejs.com/docs/getting-started/benchmarks"><img src="https://www.postgrejs.com/img/nodejs-logo.svg" alt="Node.js" height="46"></a><br><br>
+      <b><a href="https://www.postgrejs.com/docs/getting-started/benchmarks">Node.js</a></b><br>
+    </td>
+    <td align="center" width="230" valign="top">
+      <a href="https://www.postgrejs.com/docs/getting-started/benchmarks-bun"><img src="https://www.postgrejs.com/img/bun-logo.svg" alt="Bun" height="46"></a><br><br>
+      <b><a href="https://www.postgrejs.com/docs/getting-started/benchmarks-bun">Bun</a></b><br>
+    </td>
+    <td align="center" width="230" valign="top">
+      <a href="https://www.postgrejs.com/docs/guides/cloudflare-workers"><img src="https://www.postgrejs.com/img/cloudflare-logo.svg" alt="Cloudflare Workers" height="46"></a><br><br>
+      <b><a href="https://www.postgrejs.com/docs/guides/cloudflare-workers">Cloudflare Workers</a></b><br>
+    </td>
+  </tr>
+</table>
+
+Node and Bun run **the same test suite** in CI on every push - Node across 20, 22, 24 and 26 against PostgreSQL 12,
+16 and 18, Bun against 18 - so neither is a target that merely ought to work. Workers is not in that matrix yet: it
+was measured by hand against PostgreSQL 18, a plain connection and a TLS one, and what the runtime does and does not
+allow is written down in [doc/CLOUDFLARE-WORKERS.md](doc/CLOUDFLARE-WORKERS.md).
+
 ## Installation
 
 ```bash
@@ -133,6 +159,7 @@ in · 🟡 partial or needs a separate package · ❌ not supported.
 | Packages to install               |           1            |    4 <sup>1</sup>     |        1         |
 | Module system                     |          ESM           |        ESM/CJS        |     ESM/CJS      |
 | Language                          |           TS           |    JS <sup>2</sup>    | JS <sup>3</sup>  |
+| Cloudflare Workers                |    ✅ <sup>28</sup>    |   🟡 <sup>29</sup>    | ✅ <sup>30</sup> |
 | ***Wire protocol***               |                        |                       |                  |
 | Protocol version                  |          3.2           |          3.0          |       3.0        |
 | Simple Query protocol             |           ✅           |          ✅           |        ✅        |
@@ -271,6 +298,25 @@ in · 🟡 partial or needs a separate package · ❌ not supported.
   input parser is what sorts and deduplicates a vector and what defines a query's grammar, so encoding either here
   would make the same text mean one thing written as a literal and another bound as a parameter. They are sent as
   text instead, which is exact.
+- <sup>28</sup> PostgreJS runs on workerd under `nodejs_compat` with nothing installed and no build of its own.
+  Measured end to end: a plain connection against PostgreSQL 18, and a TLS one against a managed PostgreSQL 18 whose
+  certificate comes from Let's Encrypt - the same server refusing the connection outright (`28000 connection is
+  insecure`) when `sslmode` is dropped, which is what makes the encrypted one mean something. TLS opens a socket of
+  the runtime's own and upgrades it with `startTls()`, since `tls.connect({ socket })` is not something workerd can
+  carry out. Three limits are the runtime's, and all three libraries have them: `ca`, `cert` and `rejectUnauthorized`
+  have nowhere to go (workerd's TLS options are `{ expectedServerHostname?: string }`, so a self-signed certificate
+  cannot be trusted and a local server cannot be reached over TLS at all); `sslnegotiation=direct` cannot announce the
+  `postgresql` ALPN protocol, and is refused by name here; and SCRAM channel binding has no server certificate to bind
+  to, so `channelBinding: 'require'` is refused and the default `prefer` authenticates without it. Hyperdrive is the
+  other way in, terminating TLS in Cloudflare's own network - checked here against its binding. See
+  [doc/CLOUDFLARE-WORKERS.md](doc/CLOUDFLARE-WORKERS.md).
+- <sup>29</sup> pg reaches workerd through `pg-cloudflare`, a separate package it carries as an optional dependency
+  and selects at runtime (`lib/stream.js`, on `navigator.userAgent`). That package wraps `cloudflare:sockets` and
+  upgrades with its own `startTls()`, so TLS is available where PostgreJS's is not - at the cost of a second package
+  and of nothing happening at all if it was not installed.
+- <sup>30</sup> postgres.js ships a build for the runtime: a `workerd` condition in `exports` pointing at `cf/`, whose
+  polyfills shim `net`/`tls` onto `cloudflare:sockets` including `startTls({ servername })`. One package, the right
+  code chosen by the resolver, TLS included.
 
 ## Benchmarks
 
@@ -302,6 +348,9 @@ you open an issue please provide version of NodeJS and PostgreSQL server.
 - Bun - the same test suite runs under Bun in CI against PostgreSQL 18 on every push, so Bun is a supported target
   rather than an untested coincidence. (Coverage is collected on the Node matrix only: `c8` instruments V8's
   coverage APIs, which JavaScriptCore doesn't have.)
+- Cloudflare Workers - with `nodejs_compat`, and without TLS: the runtime has no way to trust a server
+  certificate, so a database behind TLS is reached through Hyperdrive instead. See
+  [doc/CLOUDFLARE-WORKERS.md](doc/CLOUDFLARE-WORKERS.md).
 
 ## License
 

package/connection/connection.js

@@ -5,7 +5,7 @@ import { withAbortSignal } from '../util/abort-signal.js';
 import { normalizeChannelName } from '../util/channel-name.js';
 import { escapeIdentifier } from '../util/escape-identifier.js';
 import { QueryRequest } from '../util/sql-tag.js';
-import { isUnspecifiedParam } from '../util/unspecified-param.js';
+import { isUnspecifiedParam, needsNumericParam, } from '../util/unspecified-param.js';
 import { BindParam } from './bind-param.js';
 import { IntlConnection } from './intl-connection.js';
 import { LargeObject, LargeObjectMode } from './large-object.js';
@@ -807,7 +807,12 @@ export class Connection extends SafeEventEmitter {
                 // out as is written in getBindMessage().
                 isUnspecifiedParam(prm)
                     ? 0
-                    : typeMap.determine(prm));
+                    : // A non-integer is declared numeric rather than the float8
+                        // its value suggests - see `needsNumericParam()` for the
+                        // cast that makes the difference, and what it costs.
+                        needsNumericParam(prm)
+                            ? DataTypeOIDs.numeric
+                            : typeMap.determine(prm));
         // A money parameter is written as an int64 of minor units, so the
         // scale has to be known before the Bind goes out - the probe fired
         // at connect answers in time for every result, but not necessarily

package/connection/intl-connection.d.ts

@@ -24,6 +24,7 @@ import { CopyFromStream, CopyToStream } from './copy-stream.js';
 interface PreparedCacheEntry {
     name: string;
     fields?: Protocol.RowDescription[];
+    resolvedParamTypes?: OID[];
 }
 /** See IntlConnection._decodeDeferredRows(). */
 interface DeferredRows {

package/connection/intl-connection.js

@@ -15,6 +15,7 @@ import { escapeLiteral } from '../util/escape-literal.js';
 import { fetchAsStringEqual, fetchAsStringNamesElement, fetchAsStringNamesOid, validateFetchAsString, } from '../util/fetch-as-string.js';
 import { getParsers } from '../util/get-parsers.js';
 import { resolveColumnFormats } from '../util/resolve-column-formats.js';
+import { resolvedBindTypes } from '../util/resolved-bind-type.js';
 import { dataRowBytes, resolveRowDecoder, resolveRowType, } from '../util/row-decoder.js';
 import { requireTimeZone } from '../util/temporal.js';
 import { isTransactionCommand, refusesSavepoint, } from '../util/transaction-command.js';
@@ -983,7 +984,7 @@ export class IntlConnection extends SafeEventEmitter {
             this._preparedCache.delete(key);
             this._preparedCache.set(key, cached);
             try {
-                return await this.executeReused(cached.name, cached.fields, paramTypes, params, options, savepoint);
+                return await this.executeReused(cached.name, cached.fields, resolvedBindTypes(paramTypes, params, cached.resolvedParamTypes), params, options, savepoint);
             }
             catch (e) {
                 if (!isStaleCachedPlan(e))
@@ -1052,8 +1053,8 @@ export class IntlConnection extends SafeEventEmitter {
     _prepareForCache(key, sql, paramTypes) {
         const name = 'C_' + ++this._preparedCounter;
         return (async () => {
-            const { fields } = await this.prepareOnce(sql, paramTypes, name);
-            const entry = { name, fields };
+            const { fields, resolvedParamTypes } = await this.prepareOnce(sql, paramTypes, name);
+            const entry = { name, fields, resolvedParamTypes };
             await this._evictPreparedIfFull();
             this._preparedCache.set(key, entry);
             return entry;

package/constants.d.ts

@@ -1,6 +1,6 @@
 import { Protocol } from './protocol/protocol.js';
 import DataFormat = Protocol.DataFormat;
-export declare const version = "3.12.2";
+export declare const version = "3.14.0";
 export { DataFormat };
 /**
  * What columns come back in unless something asks otherwise.

package/constants.js

@@ -2,7 +2,7 @@ import { Protocol } from './protocol/protocol.js';
 var DataFormat = Protocol.DataFormat;
 // @ts-ignore
 Symbol.asyncDispose ??= Symbol('Symbol.asyncDispose');
-export const version = '3.12.2';
+export const version = '3.14.0';
 export { DataFormat };
 /**
  * What columns come back in unless something asks otherwise.

package/data-types/date-type.js

@@ -28,7 +28,14 @@ export const DateType = {
             ? v.getTime()
             : v.getTime() - v.getTimezoneOffset() * 60 * 1000;
         n = (n - timeShift) / 1000 / 86400;
-        const t = Math.trunc(n + Number.EPSILON);
+        /* Floor, not trunc: a date before 2000-01-01 makes `n` negative, and
+           truncation there rounds *towards* the epoch - every pre-2000
+           instant with a time of day was stored one day late, silently.
+           `1999-12-31T22:00Z` under TZ=UTC went in as 2000-01-01 where the
+           text path, and `pg`, both say 1999-12-31. The epsilon stays: it is
+           what keeps an exact midnight from landing a hair under its own
+           day and flooring to the one before. */
+        const t = Math.floor(n + Number.EPSILON);
         buf.writeInt32BE(t);
     },
     decodeBinary(v, offset = 0, _len, options) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "postgrejs",
   "description": "Professional PostgreSQL client NodeJS",
-  "version": "3.12.2",
+  "version": "3.14.0",
   "author": "Panates",
   "license": "BSD-3-Clause",
   "dependencies": {

package/protocol/frontend.d.ts

@@ -101,7 +101,20 @@ export declare class Frontend {
     getSASLMessage(sasl: SASL.Session): Buffer;
     getSASLFinalMessage(session: SASL.Session): Buffer;
     getParseMessage(args: Frontend.ParseMessageArgs): Buffer;
-    getBindMessage(args: Frontend.BindMessageArgs): Buffer;
+    /**
+     * Bind, carrying the parameter values - the one message in a statement
+     * whose size is the caller's data rather than a few dozen bytes.
+     *
+     * @param args The portal, statement, parameters and result formats.
+     * @param copy When false, the returned buffer is a view into the
+     * shared send buffer rather than a copy of it. It stays valid only
+     * until the next message is written, so a caller passing false must
+     * consume it - `Buffer.concat()`, a write - before building anything
+     * else, and must never hand it to the socket, which does not copy
+     * synchronously.
+     * @returns The Bind message.
+     */
+    getBindMessage(args: Frontend.BindMessageArgs, copy?: boolean): Buffer;
     getDescribeMessage(args: Frontend.DescribeMessageArgs): Buffer;
     getExecuteMessage(args: Frontend.ExecuteMessageArgs): Buffer;
     getCloseMessage(args: Frontend.CloseMessageArgs): Buffer;

package/protocol/frontend.js

@@ -4,6 +4,7 @@ import { arrayLeaf } from '../util/array-leaf.js';
 import { encodeBinaryArray } from '../util/encode-binaryarray.js';
 import { formatDateParam } from '../util/format-datetime.js';
 import { writeArrayLiteral } from '../util/stringify-arrayliteral.js';
+import { resolveToPostgres, unspecifiedText, } from '../util/unspecified-value.js';
 import { Protocol } from './protocol.js';
 import { SmartBuffer } from './smart-buffer.js';
 const DataFormat = Protocol.DataFormat;
@@ -131,7 +132,28 @@ export class Frontend {
         }
         return setLengthAndFlush(io, 1);
     }
-    getBindMessage(args) {
+    /**
+     * Bind, carrying the parameter values - the one message in a statement
+     * whose size is the caller's data rather than a few dozen bytes.
+     *
+     * @param args The portal, statement, parameters and result formats.
+     * @param copy When false, the returned buffer is a view into the
+     * shared send buffer rather than a copy of it. It stays valid only
+     * until the next message is written, so a caller passing false must
+     * consume it - `Buffer.concat()`, a write - before building anything
+     * else, and must never hand it to the socket, which does not copy
+     * synchronously.
+     * @returns The Bind message.
+     */
+    /* The copy exists for buffer reuse, not for the socket: every message
+       is built in this one SmartBuffer, so message N+1's start() would
+       overwrite N's bytes before they were assembled. Nothing flushed here
+       ever reaches socket.write() - only the concat of them does, which is
+       checked in a test. So a caller that builds the small messages first
+       and this one last can take a view and let the concat read it, which
+       is one copy of the payload rather than two: measured on a 100 000
+       element int4[], 2148 KB of copying a call against 1074. */
+    getBindMessage(args, copy = true) {
         if (args.portal && args.portal.length > 63)
             throw new Error('Portal name length must be lower than 63');
         if (args.statement && args.statement.length > 63)
@@ -166,6 +188,18 @@ export class Frontend {
                 }
                 const dataTypeOid = paramTypes ? paramTypes[i] : undefined;
                 const dt = dataTypeOid ? args.typeMap.get(dataTypeOid) : undefined;
+                // No declared type: the value writes itself if it knows how, and
+                // what it hands back decides which branch below takes it - a
+                // toPostgres() returning a Date belongs in the Date branch, not
+                // in `'' + v`. A declared type is left alone; it owns its own
+                // encoding.
+                if (!dt) {
+                    v = resolveToPostgres(v);
+                    if (v === null || v === undefined) {
+                        io.writeInt32BE(-1);
+                        continue;
+                    }
+                }
                 if (dt) {
                     if (typeof dt.encodeAsNull === 'function' &&
                         dt.encodeAsNull(v, queryOptions)) {
@@ -220,7 +254,7 @@ export class Frontend {
                     io.buffer.writeInt32BE(io.size - dataOffset, dataOffset - 4); // Update length
                 }
                 else {
-                    io.writeLString('' + v, 'utf8');
+                    io.writeLString(unspecifiedText(v), 'utf8');
                 }
             }
         }
@@ -242,7 +276,7 @@ export class Frontend {
         }
         else
             io.writeUInt16BE(0);
-        return setLengthAndFlush(io, 1);
+        return setLengthAndFlush(io, 1, copy);
     }
     getDescribeMessage(args) {
         if (args.name && args.name.length > 63) {
@@ -348,7 +382,7 @@ export class Frontend {
         return StaticSyncBuffer;
     }
 }
-function setLengthAndFlush(io, lengthOffset) {
+function setLengthAndFlush(io, lengthOffset, copy = true) {
     io.buffer.writeUInt32BE(io.size - lengthOffset, lengthOffset);
-    return io.flush();
+    return io.flush(copy);
 }

package/protocol/pg-socket.d.ts

@@ -1,4 +1,3 @@
-import net from 'node:net';
 import tls from 'node:tls';
 import { ConnectionState } from '../constants.js';
 import type { ConnectionConfiguration } from '../interfaces/database-connection-params.js';
@@ -20,6 +19,29 @@ export interface SocketError extends Error {
  * is asked for, and a queue that pairs each response with whoever sent
  * the statement that caused it.
  */
+/**
+ * What this client needs a socket to be, whoever provides one.
+ *
+ * `net.Socket`, its TLS upgrade, and `WorkerdSocket` all satisfy it.
+ */
+interface ClientSocket {
+    readonly destroyed: boolean;
+    readonly writable: boolean;
+    write(data: any, cb?: (err?: Error | null) => void): boolean;
+    destroy(err?: Error): any;
+    end(...args: any[]): any;
+    pause(): any;
+    resume(): any;
+    cork(): void;
+    uncork(): void;
+    setNoDelay(enable?: boolean): any;
+    setKeepAlive(enable?: boolean): any;
+    setTimeout(ms: number, cb?: () => void): any;
+    connect(...args: any[]): any;
+    on(event: string, listener: (...args: any[]) => void): any;
+    once(event: string, listener: (...args: any[]) => void): any;
+    removeAllListeners(event?: string): any;
+}
 export declare class PgSocket extends SafeEventEmitter {
     options: ConnectionConfiguration;
     private _state;
@@ -29,6 +51,7 @@ export declare class PgSocket extends SafeEventEmitter {
      * bare. Cleared by _reset().
      */
     private _closeReason?;
+    /** Whichever kind of socket this runtime connects with. */
     private _socket?;
     private _backend;
     private _frontend;
@@ -65,10 +88,10 @@ export declare class PgSocket extends SafeEventEmitter {
      * afterwards. Resolves `onReady` with whichever socket ends up ready to
      * speak the PostgreSQL protocol: the plain one, or its TLS upgrade.
      */
-    protected _negotiateTls(socket: net.Socket, target: {
+    protected _negotiateTls(socket: ClientSocket, target: {
         host: string;
         port?: number;
-    }, onReady: (socket: net.Socket | tls.TLSSocket) => void, onError: (err: Error) => void): void;
+    }, onReady: (socket: ClientSocket) => void, onError: (err: Error) => void): void;
     /**
      * Asks the server to cancel whatever this session is currently running.
      *
@@ -337,3 +360,4 @@ export declare class PgSocket extends SafeEventEmitter {
      */
     protected _sendCopy(data: Buffer | Buffer[], cb?: Callback): boolean;
 }
+export {};

package/protocol/pg-socket.js

@@ -6,6 +6,7 @@ import DoublyLinked from 'doublylinked';
 import promisify from 'putil-promisify';
 import { ConnectionState } from '../constants.js';
 import { SafeEventEmitter } from '../safe-event-emitter.js';
+import { isWorkerd } from '../util/runtime.js';
 import { Backend } from './backend.js';
 import { signatureHashOfCertificate } from './cert-signature.js';
 import { ConnectionLostError } from './connection-lost-error.js';
@@ -13,13 +14,20 @@ import { DatabaseError } from './database-error.js';
 import { Frontend } from './frontend.js';
 import { Protocol } from './protocol.js';
 import { SASL } from './sasl.js';
+import { WorkerdSocket } from './workerd-socket.js';
 const DEFAULT_PORT_NUMBER = 5432;
 const COMMAND_RESULT_PATTERN = /^([^\d]+)(?: (\d+)(?: (\d+))?)?$/;
 /**
- * The connected socket: the handshake, the authentication, TLS where it
- * is asked for, and a queue that pairs each response with whoever sent
- * the statement that caused it.
+ * Whether a connection is going to ask for TLS at all.
+ *
+ * @param options The connection's own options.
+ * @returns True when any of the three ways of asking is set.
  */
+/* Read in two places that have to agree: which socket to open, and
+   whether to negotiate once it is open. */
+function wantsTls(options) {
+    return (!!options.ssl || !!options.requireSSL || options.sslNegotiation === 'direct');
+}
 export class PgSocket extends SafeEventEmitter {
     options;
     _state = ConnectionState.CLOSED;
@@ -29,6 +37,7 @@ export class PgSocket extends SafeEventEmitter {
      * bare. Cleared by _reset().
      */
     _closeReason;
+    /** Whichever kind of socket this runtime connects with. */
     _socket;
     _backend = new Backend();
     _frontend;
@@ -86,7 +95,17 @@ export class PgSocket extends SafeEventEmitter {
         this._sessionAttrsChecked = false;
         this._state = ConnectionState.CONNECTING;
         const target = this._hosts[this._hostIndex];
-        const socket = (this._socket = new net.Socket());
+        /* Workerd cannot upgrade a `net.Socket`, and the socket that can be
+           upgraded has to be opened as one from the start - `secureTransport:
+           'starttls'` is a connect-time choice, not a later one. So the kind
+           of socket is decided here, by whether TLS is going to be asked for
+           at all. The plain path stays on `node:net`, which works there. */
+        const socket = (this._socket =
+            isWorkerd() &&
+                wantsTls(this.options) &&
+                this.options.sslNegotiation !== 'direct'
+                ? new WorkerdSocket(true)
+                : new net.Socket());
         const errorHandler = (err) => {
             this._state = ConnectionState.CLOSED;
             this._removeListeners();
@@ -133,7 +152,14 @@ export class PgSocket extends SafeEventEmitter {
     _negotiateTls(socket, target, onReady, onError) {
         const options = this.options;
         const startTls = () => {
-            const tlsOptions = { ...options.ssl, socket };
+            /* Only ever reached off workerd - the branch below hands that
+               runtime to its own upgrade - so the socket here is the
+               `net.Socket` `tls.connect()` wants, which the structural type
+               cannot say on its own. */
+            const tlsOptions = {
+                ...options.ssl,
+                socket: socket,
+            };
             if (target.host && net.isIP(target.host) === 0)
                 tlsOptions.servername = target.host;
             if (options.sslNegotiation === 'direct')
@@ -142,11 +168,51 @@ export class PgSocket extends SafeEventEmitter {
             tlsSocket.once('error', onError);
             tlsSocket.once('secureConnect', () => onReady(tlsSocket));
         };
-        const wantsSSL = !!options.ssl ||
-            !!options.requireSSL ||
-            options.sslNegotiation === 'direct';
-        if (!wantsSSL)
+        if (!wantsTls(options))
             return onReady(socket);
+        /* Workerd upgrades through the socket it already has rather than by
+           wrapping it: `tls.connect({ socket })` does nothing it can carry
+           out, and measured, attempting it answers "Network connection
+           lost." after the server has already agreed to TLS. The exchange
+           either side of the upgrade is the same one as below - this branch
+           exists because the call in the middle is a different call.
+    
+           One limit is the runtime's and no client escapes it: workerd's TLS
+           options are `{ expectedServerHostname?: string }` and nothing
+           else, so nothing here can say which certificate to trust, and a
+           server whose certificate does not chain to a public CA cannot be
+           reached over TLS at all - which is every local PostgreSQL with a
+           self-signed certificate. */
+        /* Direct negotiation is TLS from the first byte, and PostgreSQL 17
+           only accepts it when the client announces the `postgresql`
+           protocol over ALPN. Workerd's socket options are
+           `{ secureTransport, allowHalfOpen }` - there is nowhere to say it,
+           and the server answers by closing, which surfaces as an internal
+           error with a reference number. Refused by name instead. */
+        if (isWorkerd() && options.sslNegotiation === 'direct')
+            return onError(new Error('sslNegotiation "direct" is not available on Cloudflare Workers: it needs the ' +
+                '"postgresql" ALPN protocol, which the runtime offers no way to announce. ' +
+                'Leave sslNegotiation unset to negotiate with SSLRequest instead.'));
+        if (socket instanceof WorkerdSocket) {
+            const upgrade = () => {
+                socket.once('error', onError);
+                socket.once('secureConnect', () => onReady(socket));
+                socket.startTls(target.host && net.isIP(target.host) === 0 ? target.host : undefined);
+            };
+            socket.write(this._frontend.getSSLRequestMessage());
+            socket.readOnce((x) => {
+                const command = x?.toString();
+                if (command === 'S')
+                    return upgrade();
+                if (command === 'N') {
+                    if (options.requireSSL)
+                        return onError(new Error('Server does not support SSL connections'));
+                    return onReady(socket);
+                }
+                onError(new Error('Unexpected response from server: ' + command));
+            });
+            return;
+        }
         if (options.sslNegotiation === 'direct') {
             // Straight into the handshake: no SSLRequest, nothing in the clear.
             return startTls();
@@ -250,23 +316,41 @@ export class PgSocket extends SafeEventEmitter {
      * statement/portal at the next Parse/Bind referencing the unnamed name.
      */
     sendExtendedQueryMessages(args, cb) {
+        /* The Bind is built LAST and taken as a view, then concatenated here
+         rather than in _send(): it carries the caller's data, where the
+         other four messages are a few dozen bytes, and the copy flush()
+         makes exists only because this one SmartBuffer is reused for the
+         next message. Building the small ones first leaves nothing to
+         overwrite it before Buffer.concat() reads it, so the payload is
+         copied once instead of twice - measured on a 100 000-element
+         int4[], 2148 KB of copying a call against 1074, with the wire bytes
+         and the stored value unchanged. The view never reaches the socket;
+         only the concat does. */
+        const parse = this._frontend.getParseMessage(args.parse);
+        const describe = this._frontend.getDescribeMessage(args.describe);
+        const execute = this._frontend.getExecuteMessage(args.execute);
+        const sync = this._frontend.getSyncMessage();
         if (!args.before && !args.after) {
-            const data = [
-                this._frontend.getParseMessage(args.parse),
-                this._frontend.getBindMessage(args.bind),
-                this._frontend.getDescribeMessage(args.describe),
-                this._frontend.getExecuteMessage(args.execute),
-                this._frontend.getSyncMessage(),
-            ];
+            const bind = this._frontend.getBindMessage(args.bind, false);
+            const data = Buffer.concat([parse, bind, describe, execute, sync]);
             return this._sendAndCapture(data, cb, 'sendExtendedQueryMessages', args);
         }
-        const data = [];
+        const before = [];
         if (args.before)
-            this._pushUtilityStatement(data, args.before, args.bind);
-        data.push(this._frontend.getParseMessage(args.parse), this._frontend.getBindMessage(args.bind), this._frontend.getDescribeMessage(args.describe), this._frontend.getExecuteMessage(args.execute));
+            this._pushUtilityStatement(before, args.before, args.bind);
+        const after = [];
         if (args.after)
-            this._pushUtilityStatement(data, args.after, args.bind);
-        data.push(this._frontend.getSyncMessage());
+            this._pushUtilityStatement(after, args.after, args.bind);
+        const bind = this._frontend.getBindMessage(args.bind, false);
+        const data = Buffer.concat([
+            ...before,
+            parse,
+            bind,
+            describe,
+            execute,
+            ...after,
+            sync,
+        ]);
         return this._sendAndCapture(data, cb, 'sendExtendedQueryMessages', args);
     }
     /**
@@ -336,21 +420,22 @@ export class PgSocket extends SafeEventEmitter {
      * auto-clears an unnamed portal at the next Bind naming it.
      */
     sendBindExecuteMessages(args, cb) {
+        // See sendExtendedQueryMessages() for why the Bind is built last.
+        const execute = this._frontend.getExecuteMessage(args.execute);
+        const sync = this._frontend.getSyncMessage();
         if (!args.before && !args.after) {
-            const data = [
-                this._frontend.getBindMessage(args.bind),
-                this._frontend.getExecuteMessage(args.execute),
-                this._frontend.getSyncMessage(),
-            ];
+            const bind = this._frontend.getBindMessage(args.bind, false);
+            const data = Buffer.concat([bind, execute, sync]);
             return this._sendAndCapture(data, cb, 'sendBindExecuteMessages', args);
         }
-        const data = [];
+        const before = [];
         if (args.before)
-            this._pushUtilityStatement(data, args.before, args.bind);
-        data.push(this._frontend.getBindMessage(args.bind), this._frontend.getExecuteMessage(args.execute));
+            this._pushUtilityStatement(before, args.before, args.bind);
+        const after = [];
         if (args.after)
-            this._pushUtilityStatement(data, args.after, args.bind);
-        data.push(this._frontend.getSyncMessage());
+            this._pushUtilityStatement(after, args.after, args.bind);
+        const bind = this._frontend.getBindMessage(args.bind, false);
+        const data = Buffer.concat([...before, bind, execute, ...after, sync]);
         return this._sendAndCapture(data, cb, 'sendBindExecuteMessages', args);
     }
     /**
@@ -806,15 +891,28 @@ export class PgSocket extends SafeEventEmitter {
                 break;
             case Protocol.AuthenticationMessageKind.SASL: {
                 const mode = this.options.channelBinding || 'prefer';
+                /* Encrypted and "can be bound to" are two questions on workerd,
+                   where they are one on Node. Binding mixes a hash of the
+                   server's certificate into the SCRAM proof, and that runtime
+                   hands out no certificate - so a connection can be perfectly
+                   secure there and still have nothing to bind to. Saying "not
+                   using TLS" for it, which is what the one test used to answer,
+                   sends the reader looking in the wrong place. */
+                const secure = this._socket instanceof tls.TLSSocket ||
+                    (this._socket instanceof WorkerdSocket && this._socket.secure);
                 const tlsSocket = mode !== 'disable' && this._socket instanceof tls.TLSSocket
                     ? this._socket
                     : undefined;
                 const offersBinding = !!msg.mechanisms?.includes('SCRAM-SHA-256-PLUS');
                 const useBinding = !!tlsSocket && offersBinding;
                 if (mode === 'require' && !useBinding) {
-                    throw new Error(tlsSocket
-                        ? 'SASL: channelBinding is "require" but the server does not offer SCRAM-SHA-256-PLUS'
-                        : 'SASL: channelBinding is "require" but the connection is not using TLS');
+                    throw new Error(!secure
+                        ? 'SASL: channelBinding is "require" but the connection is not using TLS'
+                        : !tlsSocket
+                            ? 'SASL: channelBinding is "require", but this runtime does not expose the ' +
+                                'server certificate, so there is nothing to bind to. Cloudflare Workers is ' +
+                                'one; use "prefer", which is the default.'
+                            : 'SASL: channelBinding is "require" but the server does not offer SCRAM-SHA-256-PLUS');
                 }
                 if (!useBinding && !msg.mechanisms?.includes('SCRAM-SHA-256')) {
                     throw new Error('SASL: Only mechanisms SCRAM-SHA-256 and SCRAM-SHA-256-PLUS are supported');

package/protocol/smart-buffer.d.ts

@@ -9,11 +9,12 @@ export interface SmartBufferConfig {
     houseKeepMs?: number;
 }
 /**
- * Adds the PostgreSQL wire format's two string encodings on top of
- * flexy-buffer's `FlexyBuffer`: a NUL-terminated C string, and a
- * length-prefixed string where a `null`/`undefined` value is written as a
- * length of -1 with no bytes following.
+ * The most a buffer may ever hold, given how much memory the machine has.
+ *
+ * @param totalMemory Bytes of memory, or 0 when that cannot be known.
+ * @returns Half of it, capped - or the cap alone when it is unknown.
  */
+export declare function maxSizeFor(totalMemory: number): number;
 export declare class SmartBuffer extends FlexyBuffer {
     static DEFAULT_PAGE_SIZE: number;
     static DEFAULT_MAX_SIZE: number;