proof-harness 0.1.0-next.7 → 0.1.0-next.8

package/COMPATIBILITY.md

@@ -11,7 +11,7 @@ Consumers must pin an exact prerelease version, for example:
 ```json
 {
   "devDependencies": {
-    "proof-harness": "0.1.0-next.6"
+    "proof-harness": "0.1.0-next.7"
   }
 }
 ```
@@ -27,9 +27,146 @@ versions rather than guessing how to interpret them.
 
 ## Prerelease migration notes
 
-### Unreleased audit hardening
+### 0.1.0-next.8
 
-Release candidate `0.1.0-next.7` tightens acceptance behavior; it has not been published. Trace
+Release candidate prepared for publication. Publish from `main` with workflow
+input `0.1.0-next.8` after this version change is merged. Consumers can pin
+`proof-harness@0.1.0-next.8` after the publish workflow succeeds.
+
+#### Direct RLS clients and Auth administration (#18)
+
+The scanner recognizes immutable local bindings returned by
+`createSupabaseRLSClient`, including named-import aliases and awaited calls.
+Their table writes are assessed as RLS writes, never recorded as service-role
+writes. Binding identity is local to its scope: shadowed identifiers,
+reassignment, escaped clients/builders, and unresolved privilege still fail.
+This remains convention-based discovery of the named consumer factories, not
+verification of their implementation or arbitrary wrapper/dataflow analysis.
+
+Direct `serviceClient.auth.admin.deleteUser(...)` is recorded in the additive
+capability field `serviceRoleAuthOperations: ["deleteUser"]`, separate from
+`serviceRoleMutations`. This does not pretend the Auth API is a SQL DELETE
+(and does not infer whether its optional soft-delete argument is true).
+Other administrative methods, dynamic method names, detached calls, and
+unresolved administrative privilege remain unassessed.
+
+Regenerate capabilities. Changes to Auth operations participate in drift under
+`service_role_mutations_changed`. Coverage requires a package-origin denial
+assertion and an allowed-path control for a user-facing Auth-admin action,
+even when it has no workspace input or voluntary invariant declaration.
+Existing explicit action-gap policy handling remains unchanged; a recognized
+operation alone is not passing authorization evidence. Trace, mission and
+health protocol versions are unchanged; capability schema remains additive v1.
+
+#### Catalog providers and rollback INSERT controls (#19, #20)
+
+These changes are not in the published `0.1.0-next.7`. They are opt-in; the
+default SQL parser and REST INSERT/DELETE control remain available. No trace,
+mission, or health protocol version changes. Pin exactly `0.1.0-next.8` only
+after it is released.
+
+#### Catalog assessment
+
+Set `schemaProvider: "scripts/proof/catalog-provider.mjs"` in the protected
+`proof.config.mjs`. `parse`, the parse step of `build`, and both sides of
+`drift` use it instead of the conservative SQL parser. ALTER and DROP are then
+evaluated by PostgreSQL, not inferred from historical CREATE statements.
+
+The module must export a default async function receiving:
+
+- `protocolVersion: 1`, `rootDir` for the tree being assessed;
+- `migrations`: ordered `{ path, sql, sha256 }` entries from the configured
+  migration directory (top-level `.sql` files), and their combined `inputHash`;
+- `withLocalPostgres(connectionUrl, callback)` and
+  `readPostgresCatalog(client, schemas = ["public"])` from `proof-harness/node`.
+  These are injected so the archived base needs no installed dependencies to
+  import these helpers. Keep the provider's own imports dependency-free.
+
+The consumer provider must create an empty disposable database, apply its
+versioned platform bootstrap and every supplied migration in order, read the
+catalog, and drop the database in `finally`. Fail on migration or cleanup
+errors. Return `{ protocolVersion: 1, assessed: true, issues: [], tables }` only
+after successful evaluation and cleanup; `tables` is the helper's result.
+The connection helper restricts connections to loopback hosts. The consumer
+owns the local database URL, creation privileges, platform bootstrap, migration
+ordering, schema selection, and any required role setup. Never use the live
+head database as the base catalog, clone an application-populated database,
+or catch a failed migration and return partial facts.
+
+Catalog table facts contain `schema`, `name`, `columns` (names), `rls_enabled`,
+`rls_forced`, and `policies`. Each policy contains `name`, `command`, `roles`,
+`mode`, `using`, and `check`. Classification is package-owned. Drift compares
+column names, RLS state including FORCE, and full policy facts; this does not
+add drift coverage for column types, defaults, functions, triggers, or grants.
+Malformed envelopes/facts and changed migration inputs fail assessment and
+replace stale successful output with an unassessed artifact.
+
+The schema artifact adds `assessment` with provider protocol/path/hash,
+migration paths/hashes, combined input hash, and repository source hash. This
+is source identity, not a signature. The provider, its platform bootstrap,
+configuration, and installed harness remain protected trust inputs.
+
+For generated migrations, retain `driftPrepare` to rebuild them in each tree.
+**Adoption requires a preparatory base commit:** register the provider, its
+platform bootstrap, and config in the consumer before the comparison that
+upgrades the package. Both base and head must declare a provider. Drift rejects
+switching assessment modes across the comparison and never substitutes head
+configuration for a base without the provider. Existing next.7 ignores the new
+keys; registering them does not repair its conservative parser. A consumer
+already blocked on next.7 needs to land this trusted setup separately before
+the candidate's first successful drift run.
+
+#### Append-only INSERT controls
+
+Configure the protected consumer config explicitly, using your local ports:
+
+```js
+insertControl: {
+  mode: "rollback",
+  databaseUrlEnv: "PROOF_DATABASE_URL",
+  role: "service_role",
+  supabaseUrl: "http://127.0.0.1:54321",
+}
+```
+
+Supply the corresponding local PostgreSQL URL through that environment
+variable; never commit its password. The configured REST origin must match
+`NEXT_PUBLIC_SUPABASE_URL`. The database URL must refer to the same stack,
+schema, and migrations as REST; the harness validates the configured origin
+but cannot discover which database a REST server actually serves.
+
+The denied INSERT still executes through the authenticated Supabase client.
+Only after an explicit `42501` denial and a service read confirming no write
+does the harness validate the same payload on one PostgreSQL connection:
+BEGIN, SET LOCAL ROLE, INSERT, force deferred constraints, ROLLBACK. The role
+must have the intended INSERT permission. Missing columns keep their database
+defaults; the harness supplies no tenancy values. An invalid payload, failed
+role change, database error, or unacknowledged rollback fails as incomplete
+evidence. The harness records the control assertion only after success and a
+REST reread confirming no matching row remains. There is no consumer callback
+that can stamp a passing control.
+
+No DELETE privilege is needed for this control. Transactional trigger writes
+also roll back, but sequence advancement and external side effects do not;
+use only a disposable local stack. This control checks database validity under
+the configured role, not REST middleware or an authenticated user's JWT
+context. Templates whose privileged insert depends on that context must supply
+a suitable database design/control strategy rather than treat this mode as
+equivalent. Product authorization errors must still use SQLSTATE `42501`;
+generic exceptions such as `P0001` are not accepted as authorization evidence.
+
+For maintainers, `PROOF_DATABASE_URL=... node tests/postgres-integration.mjs`
+after `pnpm build` exercises a separate temporary database against PostgreSQL,
+including immediate and deferred failures and catalog ALTER/DROP behavior.
+
+### 0.1.0-next.7 — audit hardening
+
+Published release `0.1.0-next.7` tightens acceptance behavior. Trace
+<a id="unreleased-audit-hardening"></a>
+
+### 0.1.0-next.7
+
+Published September 7, 2026. This release tightens acceptance behavior. Trace
 schema remains 2, with additive source/execution identity fields. Version 1
 and unversioned trace shapes remain explicitly readable, but CLI acceptance
 requires current provenance. Required consumer changes:

package/PROOF_SDK_CONTRACT.md

@@ -24,7 +24,7 @@ instead; this document is for anyone _consuming_ the template.
 
 ## Current acceptance semantics
 
-The unreleased audit hardening in [COMPATIBILITY.md](COMPATIBILITY.md#unreleased-audit-hardening)
+The `0.1.0-next.7` audit hardening in [COMPATIBILITY.md](COMPATIBILITY.md#010-next7)
 supersedes older template-specific command examples below. Trace consumers
 must use `decodeTrace`/`decodeTraceBundle` for structural validation and
 `readTraceDirectory` for CLI-equivalent freshness checks. Evidence counts only
@@ -1221,3 +1221,28 @@ a trace version bump.
 `.proof/coverage-policy.json` carries its own `schemaVersion` (currently `1`).
 It is authored, not derived, and is read only by `pnpm proof:coverage`; consumers
 do not need to parse it.
+
+
+## Catalog provider and rollback controls (0.1.0-next.8)
+
+The protected consumer config may opt into `schemaProvider` protocol 1 and
+`insertControl.mode: "rollback"`. See [the setup and migration contract](COMPATIBILITY.md)
+for the exact provider envelope, base-commit requirements, and control configuration.
+`proof-harness/node` exports `withLocalPostgres`, `readPostgresCatalog`,
+`rollbackInsertControl`, and the `PostgresCatalogTable`/`PostgresCatalogPolicy` types.
+Providers own database materialization; the harness validates catalog facts,
+classifies policies, binds source identity, and compares both trees. A rollback
+INSERT control is package-executed and can only record passing control evidence
+after its insert, deferred checks, rollback, and absence reread succeed. The
+original authenticated request remains the primary authorization assertion.
+
+
+## Direct Auth administration (0.1.0-next.8)
+
+Capability schema v1 adds optional `serviceRoleAuthOperations`, currently a
+closed list containing only `"deleteUser"`. It describes direct service-client
+Auth API calls separately from `serviceRoleMutations` (SQL table writes).
+Such user-facing actions require denial and allowed-control evidence in
+coverage even without a workspace input. Changes use the existing
+`service_role_mutations_changed` drift facet. See `COMPATIBILITY.md` for
+supported factory/binding shapes and required consumer regeneration.

package/README.md

@@ -17,13 +17,13 @@ Public prereleases are published under the npm `next` tag. Pin an exact
 prerelease version while the API is stabilizing:
 
 ```sh
-pnpm add proof-harness@0.1.0-next.6
+pnpm add proof-harness@0.1.0-next.7
 ```
 
 The package exposes environment-specific entry points:
 
 - `proof-harness/shared` — portable types and vocabularies
-- `proof-harness/node` — Node mission validation helpers
+- `proof-harness/node` — Node mission validation and local PostgreSQL helpers
 - `proof-harness/playwright` — Playwright proof assertions and traces
 - `proof-harness/server` — server-side fixtures, guards, and service clients
 - `proof-harness/portable-vocabulary` — dependency-free runtime constants
@@ -92,15 +92,21 @@ The package is released from this public repository with npm provenance.
 Prerelease consumers must pin an exact version rather than using `next`, `^`, or
 `~`; see [COMPATIBILITY.md](./COMPATIBILITY.md) for the compatibility policy.
 
-## Audit hardening (0.1.0-next.7, unreleased)
+## Audit hardening (0.1.0-next.7)
 
-The working branch adds shared fail-closed trace ingestion, source freshness,
+This release adds shared fail-closed trace ingestion, source freshness,
 stronger authorization probes, isolated mutation evidence and interruption
 recovery, conservative discovery, and package-owned drift regeneration.
-See [required migration changes](COMPATIBILITY.md#unreleased-audit-hardening)
+See [required migration changes](COMPATIBILITY.md#010-next7--audit-hardening)
 before upgrading a consumer. In particular, existing traces must be rerun and
 unsupported SQL now blocks assessment.
 
+Release candidate `0.1.0-next.8` adds direct RLS client and Auth-admin discovery,
+a consumer-owned catalog provider for full SQL histories, and transactional
+INSERT controls for append-only tables. After publication, pin exactly
+`proof-harness@0.1.0-next.8`. See [compatibility and setup](COMPATIBILITY.md#010-next8)
+for the required consumer changes.
+
 The harness establishes specific tested claims. Acceptance still requires
 consumer-owned requirements and a trusted CI job that controls the harness,
 policies, and evidence. A passing trace is not a general proof of code quality

package/cli/config.mjs

@@ -46,6 +46,8 @@ const DEFAULT_CONFIG = Object.freeze({
   // Optional consumer-owned argv used to prepare generated migration inputs
   // in both the working tree and the archived base before parsing.
   driftPrepare: null,
+  schemaProvider: null,
+  insertControl: null,
   driftSources: ["app", "package.json"],
   mutationCatalog: null,
 });

package/cli/engines/parse_proof_schema.mjs

@@ -40,6 +40,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
+import { assessWithProvider } from "./proof_schema_provider.mjs";
+import { classifyTable } from "./proof_schema_classification.mjs";
 import { loadProofConfig } from "../config.mjs";
 
 const CONFIG = await loadProofConfig();
@@ -283,87 +285,12 @@ function parsePolicies(sql, sourceFile) {
 // Classification
 // ---------------------------------------------------------------------------
 
-function policyIndicatesWorkspace(policy) {
-  const body = `${policy.using} ${policy.check}`.toLowerCase();
-  if (body.includes("get_user_workspace_ids(")) return true;
-  if (
-    /workspace_id\s+in\s*\(\s*select\s+workspace_id\s+from\s+workspace_members/i.test(
-      `${policy.using} ${policy.check}`,
-    )
-  ) {
-    return true;
-  }
-  return false;
-}
-
-function policyIndicatesUser(policy) {
-  const body = `${policy.using} ${policy.check}`;
-  // user_id = auth.uid() OR auth.uid() = user_id OR owner/created_by variants
-  const patterns = [
-    /\b(user_id|owner_id|created_by|invited_by)\s*=\s*\(?\s*(select\s+)?auth\.uid\(\)/i,
-    /\bauth\.uid\(\)\s*=\s*(user_id|owner_id|created_by|invited_by)\b/i,
-    /\(\s*select\s+auth\.uid\(\)\s*\)\s*=\s*(user_id|owner_id|created_by|invited_by)\b/i,
-    /\b(user_id|owner_id|created_by|invited_by)\s*=\s*\(\s*select\s+auth\.uid\(\)\s*\)/i,
-  ];
-  return patterns.some((re) => re.test(body));
-}
-
-function policyIsPublicRead(policy) {
-  if (policy.command !== "SELECT") return false;
-  const body = policy.using.trim().toLowerCase();
-  return body === "true";
-}
-
-function classifyTable(policies) {
-  // No policies at all → admin_only (assumes RLS-enabled Supabase table
-  // without authenticated access).
-  if (policies.length === 0) return "admin_only";
-
-  // A policy with no TO clause defaults to `TO public` in Postgres, so
-  // treat an empty `roles` list as implicit public (i.e. authenticated
-  // users are subject to it). This matches the common
-  // `CREATE POLICY foo ON t FOR SELECT USING (...)` pattern.
-  const isAuthFacing = (p) =>
-    p.roles.length === 0 ||
-    p.roles.some((r) => r === "authenticated" || r === "public");
-  const authPolicies = policies.filter(isAuthFacing);
-  const serviceOnly =
-    authPolicies.length === 0 &&
-    policies.length > 0 &&
-    policies.every(
-      (p) => p.roles.length === 1 && p.roles[0] === "service_role",
-    );
-
-  if (serviceOnly) return "service_only";
-
-  // Check workspace first (most specific).
-  if (authPolicies.some(policyIndicatesWorkspace)) return "workspace_scoped";
-  if (authPolicies.some(policyIndicatesUser)) return "user_scoped";
-
-  // public_read: every authenticated-accessible policy is SELECT with
-  // USING (true). (Don't classify as public_read if any write policy
-  // targets authenticated, that's a different pattern.)
-  const readPolicies = authPolicies.filter(
-    (p) => p.command === "SELECT" || p.command === "ALL",
-  );
-  if (
-    readPolicies.length > 0 &&
-    readPolicies.every(policyIsPublicRead) &&
-    authPolicies.every((p) => p.command === "SELECT")
-  ) {
-    return "public_read";
-  }
-
-  if (authPolicies.length === 0) return "admin_only";
-
-  return "unclassified";
-}
-
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 
-export function main() {
+export async function main() {
+  if (CONFIG.schemaProvider) return assessWithProvider(CONFIG);
   const sources = readAllMigrations();
   const unsupported = [];
   const enabledTables = new Set();
@@ -487,5 +414,5 @@ const invokedDirectly =
   import.meta.url === pathToFileURL(process.argv[1]).href;
 
 if (invokedDirectly) {
-  main();
+  await main();
 }

package/cli/engines/proof_coverage.mjs

@@ -352,6 +352,8 @@ function buildReport() {
   // user_scoped by their owner policy, but a service-role action accepting an
   // arbitrary workspaceId still needs an action-layer cross-tenant probe.
   //
+  // Auth administrative operations require this boundary independently of
+  // workspace inputs because their target may be another user.
   // A denial alone is not enough. A broken/unregistered action also refuses
   // everyone, so the same action target needs a passing allowed-path control.
   const denialKinds = new Set(["authorization", "tenant_isolation"]);
@@ -366,14 +368,17 @@ function buildReport() {
     `${a.module}:${a.name}`.localeCompare(`${b.module}:${b.name}`),
   )) {
     if (
-      capability.acceptsWorkspaceId !== true ||
+      (capability.acceptsWorkspaceId !== true &&
+        !(capability.serviceRoleAuthOperations ?? []).length) ||
       capability.internalOnly === true
     ) {
       continue;
     }
 
     const workspaceMutations = capability.serviceRoleMutations ?? [];
-    if (workspaceMutations.length === 0) continue;
+    const authOperations = capability.serviceRoleAuthOperations ?? [];
+    if (workspaceMutations.length === 0 && authOperations.length === 0)
+      continue;
 
     const action = `${capability.module}:${capability.name}`;
     const denialEvidence = assertions.filter(
@@ -404,6 +409,7 @@ function buildReport() {
       action,
       tables: [...new Set(workspaceMutations.map((m) => m.table))].sort(),
       mutations: workspaceMutations,
+      authOperations,
       denial: denialProven ? "proven" : "gap",
       control: controlProven ? "proven" : "gap",
       status: proven ? "proven" : acceptance ? "accepted_gap" : "gap",
@@ -593,13 +599,20 @@ function printReport(report) {
     );
     heading(
       "SERVICE-ROLE ACTION BOUNDARIES",
-      "Derived from caller-controlled workspaceId inputs plus service-role mutations. Each action needs both an unauthorized/cross-tenant refusal and an allowed-path control; withProof metadata is not consulted.",
+      "Derived from workspace-targeted service-role writes or privileged Auth operations. Each action needs both an unauthorized/cross-tenant refusal and an allowed-path control; withProof metadata is not consulted.",
     );
     console.log("");
     printTable(
       [
         { header: "action", get: (r) => r.action },
-        { header: "tables", get: (r) => r.tables.join(",") },
+        {
+          header: "effects",
+          get: (r) =>
+            [
+              ...r.tables,
+              ...r.authOperations.map((op) => `auth.admin.${op}`),
+            ].join(","),
+        },
         { header: "denial", get: (r) => r.denial },
         { header: "control", get: (r) => r.control },
         { header: "status", get: (r) => r.status },
@@ -767,7 +780,7 @@ gap or an unproven action requirement.`);
   if (serviceRoleActionGaps.length > 0) {
     problems.push({
       line:
-        `[PROOF_FAIL] service_role_action_gap: ${serviceRoleActionGaps.length} workspace-targeted service-role action(s) lack mandatory action evidence: ` +
+        `[PROOF_FAIL] service_role_action_gap: ${serviceRoleActionGaps.length} privileged action(s) lack mandatory action evidence: ` +
         serviceRoleActionGaps
           .map((g) => {
             const missing = [

package/cli/engines/proof_drift.mjs

@@ -162,8 +162,14 @@ function actionChanges(base, head) {
 
   const mutationKey = (m) => `${m.table}:${m.operation}`;
   const mutations = setDiff(
-    (base.serviceRoleMutations ?? []).map(mutationKey),
-    (head.serviceRoleMutations ?? []).map(mutationKey),
+    [
+      ...(base.serviceRoleMutations ?? []).map(mutationKey),
+      ...(base.serviceRoleAuthOperations ?? []).map((op) => `auth.admin:${op}`),
+    ],
+    [
+      ...(head.serviceRoleMutations ?? []).map(mutationKey),
+      ...(head.serviceRoleAuthOperations ?? []).map((op) => `auth.admin:${op}`),
+    ],
   );
   if (mutations.added.length > 0 || mutations.removed.length > 0) {
     facets.push("service_role_mutations_changed");
@@ -279,11 +285,12 @@ export function diffSchema(baseArtifact, headArtifact) {
     const facets = [];
     if (
       baseTable.rls_classification !== headTable.rls_classification ||
-      baseTable.rls_enabled !== headTable.rls_enabled
+      baseTable.rls_enabled !== headTable.rls_enabled ||
+      Boolean(baseTable.rls_forced) !== Boolean(headTable.rls_forced)
     ) {
       facets.push("rls_classification_changed");
       notes.push(
-        `rls_classification: ${baseTable.rls_classification} -> ${headTable.rls_classification}`,
+        `RLS: ${baseTable.rls_classification} -> ${headTable.rls_classification}; enabled ${baseTable.rls_enabled} -> ${headTable.rls_enabled}; forced ${Boolean(baseTable.rls_forced)} -> ${Boolean(headTable.rls_forced)}`,
       );
     }
     const columns = setDiff(baseTable.columns, headTable.columns);
@@ -584,6 +591,10 @@ async function generateBaseArtifacts(baseSha, tmpDir) {
     cwd: treeDir,
     configPath: baseConfigPath,
   });
+  if (Boolean(baseConfig.schemaProvider) !== Boolean(CONFIG.schemaProvider))
+    throw new Error(
+      "schema provider adoption requires a preparatory base commit: register the provider and platform bootstrap in both trees before switching assessment modes; head configuration is never substituted for the base",
+    );
   const relocated = { ...baseConfig, rootDir: treeDir };
   for (const group of ["artifacts", "roots", "repository"]) {
     for (const value of Object.values(relocated[group])) {

package/cli/engines/proof_schema_classification.mjs

@@ -0,0 +1,75 @@
+function policyIndicatesWorkspace(policy) {
+  const body = `${policy.using} ${policy.check}`.toLowerCase();
+  if (body.includes("get_user_workspace_ids(")) return true;
+  if (
+    /workspace_id\s+in\s*\(\s*select\s+workspace_id\s+from\s+workspace_members/i.test(
+      `${policy.using} ${policy.check}`,
+    )
+  ) {
+    return true;
+  }
+  return false;
+}
+
+function policyIndicatesUser(policy) {
+  const body = `${policy.using} ${policy.check}`;
+  // user_id = auth.uid() OR auth.uid() = user_id OR owner/created_by variants
+  const patterns = [
+    /\b(user_id|owner_id|created_by|invited_by)\s*=\s*\(?\s*(select\s+)?auth\.uid\(\)/i,
+    /\bauth\.uid\(\)\s*=\s*(user_id|owner_id|created_by|invited_by)\b/i,
+    /\(\s*select\s+auth\.uid\(\)\s*\)\s*=\s*(user_id|owner_id|created_by|invited_by)\b/i,
+    /\b(user_id|owner_id|created_by|invited_by)\s*=\s*\(\s*select\s+auth\.uid\(\)\s*\)/i,
+  ];
+  return patterns.some((re) => re.test(body));
+}
+
+function policyIsPublicRead(policy) {
+  if (policy.command !== "SELECT") return false;
+  const body = policy.using.trim().toLowerCase();
+  return body === "true";
+}
+
+export function classifyTable(policies) {
+  // No policies at all → admin_only (assumes RLS-enabled Supabase table
+  // without authenticated access).
+  if (policies.length === 0) return "admin_only";
+
+  // A policy with no TO clause defaults to `TO public` in Postgres, so
+  // treat an empty `roles` list as implicit public (i.e. authenticated
+  // users are subject to it). This matches the common
+  // `CREATE POLICY foo ON t FOR SELECT USING (...)` pattern.
+  const isAuthFacing = (p) =>
+    p.roles.length === 0 ||
+    p.roles.some((r) => r === "authenticated" || r === "public");
+  const authPolicies = policies.filter(isAuthFacing);
+  const serviceOnly =
+    authPolicies.length === 0 &&
+    policies.length > 0 &&
+    policies.every(
+      (p) => p.roles.length === 1 && p.roles[0] === "service_role",
+    );
+
+  if (serviceOnly) return "service_only";
+
+  // Check workspace first (most specific).
+  if (authPolicies.some(policyIndicatesWorkspace)) return "workspace_scoped";
+  if (authPolicies.some(policyIndicatesUser)) return "user_scoped";
+
+  // public_read: every authenticated-accessible policy is SELECT with
+  // USING (true). (Don't classify as public_read if any write policy
+  // targets authenticated, that's a different pattern.)
+  const readPolicies = authPolicies.filter(
+    (p) => p.command === "SELECT" || p.command === "ALL",
+  );
+  if (
+    readPolicies.length > 0 &&
+    readPolicies.every(policyIsPublicRead) &&
+    authPolicies.every((p) => p.command === "SELECT")
+  ) {
+    return "public_read";
+  }
+
+  if (authPolicies.length === 0) return "admin_only";
+
+  return "unclassified";
+}