Postgres parity from 250 real project migrations: transactional DDL, type checking, RLS fixes

[sanketsahu]

What

tools/corpus-diff runs real RapidNative project migrations and seeds through pg-mem and PGlite side by side. It compares migration and seed outcomes, the catalogue reads the agent validator makes, data, RLS as anon/user/stranger (including primary-key lookups), triggers, cascades, and generated probes that Postgres must reject. PGlite (real Postgres) is the oracle. The corpus is user project code and is never committed; the README covers sampling it.

Set of 50 projects	before	after
A	50/50 diverge	0/50
B	50/50	0/50
C	50/50	0/50
D (fresh, scored once: 3/50 before its fixes)	—	0/50
E (fresh, scored once: 2/50 before its fix)	—	0/50

The five sets add up to about 46k checks. Every set after A was also used to fix things, so the honest held-out signal is the score each one got the first time it was run (C 3/50, D 3/50, E 2/50).

Validator strictness (pg-mem accepted what Postgres rejects)

• Typed values no longer cross type categories implicitly: uuid = text, the bug that sent the agent validator to PGlite. bool = text, IN, COALESCE, LIKE and function arguments are covered too. Untyped literals and parameters still coerce. date/timestamptz and int/bigint now widen.
• CREATE POLICY binds its predicates: unknown columns, bad operators, non-boolean predicates, USING on INSERT, WITH CHECK on SELECT/DELETE.
• ALTER COLUMN TYPE and DROP COLUMN refuse columns that a policy (on any table, scope-aware) or an FK depends on.
• CREATE TRIGGER resolves its function. GRANT and CREATE POLICY ... TO check that the role exists.
• int2/int4/int8 range checks; strict text-to-number parsing.
• "infinite recursion detected in policy for relation", following Postgres' expansion rules.

Correctness

• DDL is transactional. A failed call, ROLLBACK, or ROLLBACK TO SAVEPOINT undoes schema changes. schema-snapshot.ts captures schema metadata before a transaction's first DDL; row data already rolled back with the transaction.
• BEGIN … ROLLBACK across separate query calls actually rolls back, and aborted blocks behave like Postgres.
• Referential actions run breadth-first, like Postgres RI triggers (ri-queue.ts).
• Security: RLS was skipped on index lookups. select … where id = 2 returned rows no policy allowed, and UPDATE/DELETE … WHERE <pk> reached them.
• SECURITY DEFINER runs as the owner.
• plpgsql: ->> inside bodies, %ROWTYPE/%TYPE.
• now()/current_date are transaction-stable.
• Postgres constraint and index names: create table if not exists on an existing table, NULL IN (...), and CREATE OR REPLACE TRIGGER.
• information_schema.columns reports Postgres type names and pg_get_expr-style defaults.
• Timestamp/date arithmetic, interval::text, record::text, jsonb ? ?| ?&.
• text → numeric stores the canonical decimal (this fixes "text.trim is not a function").

Footprint (Node 24, real projects; the agent validator's workload)

	PGlite	pg-mem
first ready instance	~670 ms, +590–830 MB RSS	~33 ms, +40 MB
each extra concurrent session	~+255 MB	~+7 MB
browser download (gz)	~6.7 MB	~0.19 MB

Before merging

• Depends on @tinbase/pgsql-ast-parser 12.2.0 (Supabase DDL found in real project migrations (12.2.0) sanketsahu/pgsql-ast-parser#1). package.json already points at ^12.2.0, so install fails until that's published. bun.lockb needs regenerating after.
• Behaviour changes that existing users of pg-mem may notice: typed text no longer silently compares to uuid/bool/numbers; numeric/bigint read back as strings regardless of insert path (as node-postgres returns them); a ROLLBACK in a multi-statement call now also undoes DDL from that call; a failed DDL statement leaves no partial schema.

Tests: 1320 passing. src/tests/corpus-parity.spec.ts has a minimal repro for each gap, with expected values checked against PGlite.

🤖 Generated with Claude Code