better-supabase 0.13.0 → 0.15.0

package/dist/spec/index.js

@@ -1,8 +1,701 @@
 import { r as isPlainObject } from "../clone-CkG0-hlI.js";
-import { a as methodNotAllowed } from "../problem-D0KDiYPk.js";
+import { a as methodNotAllowed } from "../problem-Bf0cJ7tk.js";
+import { t as SPEC_PINS } from "../spec-pins-C1Vm8OBl.js";
 import { t as FUNCTION_DESCRIPTOR } from "../function-contract-pEmsaUIf.js";
-import { o as defineDocumentFormat, t as defineApi } from "../api-CmcTYuFT.js";
-import { a as DEFAULT_ERRORS, i as topicsFrom, l as mergeJson, o as PROBLEM_SCHEMA, t as buildApiModel, u as pointerToken } from "../build-DxzJf79X.js";
+import { n as memoized, t as importOptionalPeer } from "../optional-peer-C1NbBRJm.js";
+import { a as topicsFrom, c as PROBLEM_SCHEMA, d as mergeJson, f as pointerToken, i as safeKey, l as convertStandard, n as publishedResources, o as publishedBlocks, r as CLOUD_EVENT_TRAIT, s as DEFAULT_ERRORS, t as buildApiModel, u as pascal } from "../build-QitPVzzO.js";
+//#region src/spec/format.ts
+/**
+* Identity helper that fixes `apiVersion` and checks that the default version
+* exists.
+*/
+function defineDocumentFormat(format) {
+	if (!Object.hasOwn(format.versions, format.defaultVersion)) throw new TypeError(`Document format "${format.id}": the default version "${format.defaultVersion}" is not in versions`);
+	if (format.versions[format.defaultVersion].status === "preview") throw new TypeError(`Document format "${format.id}": a preview version cannot be the default`);
+	return {
+		...format,
+		apiVersion: 1
+	};
+}
+//#endregion
+//#region src/openapi/schema30.ts
+/** Keywords whose value is one subschema. */
+const SINGLE = /* @__PURE__ */ new Set([
+	"items",
+	"additionalProperties",
+	"not"
+]);
+/** Keywords whose value is a list of subschemas. */
+const LISTS = /* @__PURE__ */ new Set([
+	"allOf",
+	"anyOf",
+	"oneOf"
+]);
+/** 2020-12 keywords the OpenAPI 3.0 Schema Object does not have. */
+const DROPPED = /* @__PURE__ */ new Set([
+	"$schema",
+	"$id",
+	"$anchor",
+	"$dynamicAnchor",
+	"$dynamicRef",
+	"$comment",
+	"$defs",
+	"$vocabulary",
+	"prefixItems",
+	"contains",
+	"minContains",
+	"maxContains",
+	"propertyNames",
+	"patternProperties",
+	"dependentRequired",
+	"dependentSchemas",
+	"unevaluatedItems",
+	"unevaluatedProperties",
+	"if",
+	"then",
+	"else",
+	"contentMediaType",
+	"contentSchema"
+]);
+const isNullSchema = (value) => isPlainObject(value) && value["type"] === "null" && Object.keys(value).length === 1;
+/**
+* Rewrites a JSON Schema 2020-12 schema into the OpenAPI 3.0 Schema Object:
+* `null` in `type` or in an `anyOf`/`oneOf` becomes `nullable`, a type list
+* becomes `anyOf`, `const` becomes a one-value `enum`, `examples` becomes
+* `example`, numeric `exclusiveMinimum`/`exclusiveMaximum` become the boolean
+* form, `contentEncoding: base64` becomes `format: byte`, and a `$ref` with
+* siblings is wrapped in `allOf`. Keywords 3.0 does not have are left out. The
+* input is not changed.
+*/
+function toOpenApi30Schema(schema) {
+	const out = {};
+	let nullable = false;
+	for (const [key, value] of Object.entries(schema)) {
+		if (DROPPED.has(key)) continue;
+		if (key === "properties" && isPlainObject(value)) out[key] = Object.fromEntries(Object.entries(value).map(([name, child]) => [name, isPlainObject(child) ? toOpenApi30Schema(child) : child]));
+		else if (SINGLE.has(key) && isPlainObject(value)) out[key] = toOpenApi30Schema(value);
+		else if (LISTS.has(key) && Array.isArray(value)) {
+			const branches = value;
+			const rest = branches.filter((branch) => !isNullSchema(branch));
+			if (key !== "allOf" && rest.length < branches.length) nullable = true;
+			out[key] = rest.map((branch) => isPlainObject(branch) ? toOpenApi30Schema(branch) : branch);
+		} else if (key === "examples" && Array.isArray(value)) {
+			if (value.length > 0) out["example"] = value[0];
+		} else if ((key === "exclusiveMinimum" || key === "exclusiveMaximum") && typeof value === "number") {
+			out[key === "exclusiveMinimum" ? "minimum" : "maximum"] = value;
+			out[key] = true;
+		} else if (key === "const") out["enum"] = [value];
+		else if (key === "contentEncoding") {
+			if (value === "base64" && schema["format"] === void 0) out["format"] = "byte";
+		} else if (key === "type" && Array.isArray(value)) {
+			const types = value;
+			const rest = types.filter((type) => type !== "null");
+			if (rest.length < types.length) nullable = true;
+			if (rest.length === 1) out["type"] = rest[0];
+			else if (rest.length > 1) out["anyOf"] = rest.map((type) => ({ type }));
+		} else if (key === "type" && value === "null") {
+			nullable = true;
+			out["enum"] = [null];
+		} else out[key] = value;
+	}
+	for (const key of ["anyOf", "oneOf"]) {
+		const branches = out[key];
+		if (!Array.isArray(branches) || branches.length !== 1) continue;
+		const only = branches[0];
+		if (!isPlainObject(only)) continue;
+		delete out[key];
+		if (typeof only["$ref"] === "string") out["allOf"] = [only];
+		else for (const [name, entry] of Object.entries(only)) if (!(name in out)) out[name] = entry;
+	}
+	if (typeof out["$ref"] === "string" && Object.keys(out).length > 1) {
+		const { $ref, ...siblings } = out;
+		return {
+			allOf: [{ $ref }],
+			...siblings,
+			...nullable ? { nullable: true } : {}
+		};
+	}
+	if (nullable) {
+		if (typeof out["$ref"] === "string") return {
+			allOf: [{ $ref: out["$ref"] }],
+			nullable: true
+		};
+		out["nullable"] = true;
+	}
+	return out;
+}
+const mapEntries = (value, convert) => isPlainObject(value) ? Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, isPlainObject(entry) ? convert(entry) : entry])) : value;
+const withSchema = (holder) => {
+	const out = { ...holder };
+	for (const key of ["schema", "x-oai-itemSchema"]) {
+		const schema = out[key];
+		if (isPlainObject(schema)) out[key] = toOpenApi30Schema(schema);
+	}
+	if (isPlainObject(out["content"])) out["content"] = mapEntries(out["content"], withSchema);
+	if (isPlainObject(out["headers"])) out["headers"] = mapEntries(out["headers"], withSchema);
+	return out;
+};
+const lowerParameters = (value) => Array.isArray(value) ? value.map((entry) => isPlainObject(entry) ? withSchema(entry) : entry) : value;
+const lowerOperation$1 = (operation) => {
+	const out = { ...operation };
+	out["parameters"] = lowerParameters(out["parameters"]);
+	if (out["parameters"] === void 0) delete out["parameters"];
+	if (isPlainObject(out["requestBody"])) out["requestBody"] = withSchema(out["requestBody"]);
+	if (isPlainObject(out["responses"])) out["responses"] = mapEntries(out["responses"], withSchema);
+	return out;
+};
+const PATH_ITEM_LISTS = /* @__PURE__ */ new Set(["parameters"]);
+const lowerPathItem = (item) => {
+	const out = {};
+	for (const [key, value] of Object.entries(item)) if (PATH_ITEM_LISTS.has(key)) out[key] = lowerParameters(value);
+	else if (isPlainObject(value) && !key.startsWith("x-") && key !== "servers") out[key] = lowerOperation$1(value);
+	else out[key] = value;
+	return out;
+};
+/**
+* Lowers every Schema Object position of an OpenAPI document to the 3.0
+* dialect.
+*/
+function lowerDocumentSchemas30(document) {
+	const out = { ...document };
+	if (isPlainObject(out["paths"])) out["paths"] = mapEntries(out["paths"], lowerPathItem);
+	const components = out["components"];
+	if (isPlainObject(components)) {
+		const lowered = {
+			...components,
+			schemas: mapEntries(components["schemas"], toOpenApi30Schema)
+		};
+		for (const key of [
+			"responses",
+			"parameters",
+			"requestBodies",
+			"headers"
+		]) if (isPlainObject(components[key])) lowered[key] = mapEntries(components[key], withSchema);
+		if (lowered["schemas"] === void 0) delete lowered["schemas"];
+		out["components"] = lowered;
+	}
+	return out;
+}
+//#endregion
+//#region src/openapi/types.ts
+/** The `openapi` field `3.3-preview` emits, as in the v3.3-dev branch. */
+const OPENAPI_33_PREVIEW_VERSION = "3.3.0";
+/** The file name `openapiFormat` writes for every version. */
+const OPENAPI_FILE_NAME = "openapi.json";
+//#endregion
+//#region src/openapi/format.ts
+const DIALECT = "https://json-schema.org/draft/2020-12/schema";
+const OPENAPI_FIELD = {
+	"3.0": SPEC_PINS.openapi30,
+	"3.1": SPEC_PINS.openapi31,
+	"3.2": SPEC_PINS.openapi32,
+	"3.3-preview": OPENAPI_33_PREVIEW_VERSION
+};
+/** Path Item fields that hold an Operation Object. */
+const METHODS = /* @__PURE__ */ new Set([
+	"get",
+	"put",
+	"post",
+	"delete",
+	"options",
+	"head",
+	"patch",
+	"trace",
+	"query"
+]);
+const omitUndefined$2 = (value) => Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0));
+function lowerContent(content, features) {
+	return Object.fromEntries(Object.entries(content).map(([type, media]) => [type, omitUndefined$2({
+		schema: media.schema,
+		[features.native32 ? "itemSchema" : "x-oai-itemSchema"]: media.itemSchema,
+		examples: media.examples ? Object.fromEntries(Object.entries(media.examples).map(([name, example]) => [name, omitUndefined$2({ ...example })])) : void 0
+	})]));
+}
+function lowerResponse(response, features) {
+	return omitUndefined$2({
+		[features.native32 ? "summary" : "x-oai-summary"]: response.summary,
+		description: response.description,
+		headers: response.headers ? Object.fromEntries(Object.entries(response.headers).map(([name, header]) => [name, omitUndefined$2({ ...header })])) : void 0,
+		content: response.content ? lowerContent(response.content, features) : void 0
+	});
+}
+const lowerResponseOrRef = (response, features) => "ref" in response ? { $ref: `#/components/responses/${response.ref}` } : lowerResponse(response, features);
+const lowerParameter = (parameter) => omitUndefined$2({ ...parameter });
+function lowerSecurity(requirements, features) {
+	return requirements.filter((requirement) => Object.keys(requirement).every((name) => !features.dropped.has(name))).map((requirement) => ({ ...requirement }));
+}
+function lowerScheme$1(scheme, features) {
+	switch (scheme.type) {
+		case "http":
+		case "apiKey":
+		case "openIdConnect": return omitUndefined$2({ ...scheme });
+		case "oauth2": {
+			const { metadataUrl, ...rest } = scheme;
+			return omitUndefined$2({
+				...rest,
+				[features.native32 ? "oauth2MetadataUrl" : `${features.prefix}oauth2MetadataUrl`]: metadataUrl
+			});
+		}
+		case "profile": return features.is33 ? omitUndefined$2({ ...scheme }) : void 0;
+		default: return scheme;
+	}
+}
+function lowerOperation(operation, features) {
+	return omitUndefined$2({
+		operationId: operation.id,
+		summary: operation.summary,
+		description: operation.description,
+		tags: operation.tags.length > 0 ? [...operation.tags] : void 0,
+		deprecated: operation.deprecated,
+		parameters: operation.parameters.length > 0 ? operation.parameters.map(lowerParameter) : void 0,
+		requestBody: operation.requestBody ? omitUndefined$2({
+			description: operation.requestBody.description,
+			required: operation.requestBody.required,
+			content: lowerContent(operation.requestBody.content, features)
+		}) : void 0,
+		responses: Object.fromEntries(Object.entries(operation.responses).map(([status, response]) => [status, lowerResponseOrRef(response, features)])),
+		servers: operation.servers ? lowerServers(operation.servers, features) : void 0,
+		security: operation.security ? lowerSecurity(operation.security, features) : void 0,
+		...operation.extensions
+	});
+}
+function lowerServers(servers, features) {
+	return servers.length > 0 ? servers.map((server) => omitUndefined$2({
+		url: server.url,
+		description: server.description,
+		[features.native32 ? "name" : "x-oai-name"]: server.name
+	})) : void 0;
+}
+const sameJson = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/**
+* Builds one Path Item. Path parameters every operation shares move to the Path
+* Item; in 3.3 a `security` every operation shares does too.
+*/
+function pathItem(operations, features) {
+	const pathParameters = (operation) => Array.isArray(operation["parameters"]) ? operation["parameters"].filter((parameter) => isPlainObject(parameter) && parameter["in"] === "path") : [];
+	const first = operations[0];
+	const shared = first ? pathParameters(first.operation) : [];
+	const hoist = shared.length > 0 && operations.every(({ operation }) => sameJson(pathParameters(operation), shared));
+	const firstSecurity = first?.operation["security"];
+	const hoistSecurity = features.is33 && firstSecurity !== void 0 && operations.every(({ operation }) => sameJson(operation["security"], firstSecurity));
+	const item = {};
+	if (hoist) item["parameters"] = shared;
+	if (hoistSecurity) item["security"] = firstSecurity;
+	for (const { method, operation } of operations) {
+		const out = { ...operation };
+		if (hoist) {
+			const rest = Array.isArray(out["parameters"]) ? out["parameters"].filter((parameter) => !isPlainObject(parameter) || parameter["in"] !== "path") : [];
+			if (rest.length > 0) out["parameters"] = rest;
+			else delete out["parameters"];
+		}
+		if (hoistSecurity) delete out["security"];
+		item[method] = out;
+	}
+	return item;
+}
+const STANDARD_WEBHOOK_HEADERS$1 = [
+	{
+		name: "webhook-id",
+		in: "header",
+		required: true,
+		description: "Unique message id; the same on every retry.",
+		schema: { type: "string" }
+	},
+	{
+		name: "webhook-timestamp",
+		in: "header",
+		required: true,
+		description: "Unix time in seconds when the message was sent.",
+		schema: {
+			type: "string",
+			pattern: "^[0-9]+$"
+		}
+	},
+	{
+		name: "webhook-signature",
+		in: "header",
+		required: true,
+		description: "Space-separated signatures of `id.timestamp.body`, each `v1,<base64>`.",
+		schema: { type: "string" }
+	}
+];
+function lowerWebhook(webhook) {
+	return { post: omitUndefined$2({
+		operationId: `on${pascal(webhook.id.replaceAll(".", "_"))}`,
+		summary: webhook.summary,
+		description: webhook.description,
+		parameters: webhook.standardWebhooks ? STANDARD_WEBHOOK_HEADERS$1.map((header) => ({ ...header })) : void 0,
+		requestBody: {
+			required: true,
+			content: { "application/json": { schema: webhook.payload } }
+		},
+		responses: { "2XX": { description: "The receiver accepted the event." } }
+	}) };
+}
+function lowerTags(model, features) {
+	return model.tags.map((tag) => features.native32 ? omitUndefined$2({ ...tag }) : omitUndefined$2({
+		name: tag.name,
+		description: tag.description,
+		[`${features.prefix}summary`]: tag.summary,
+		[`${features.prefix}parent`]: tag.parent,
+		[`${features.prefix}kind`]: tag.kind
+	}));
+}
+function lowerOpenApi(model, version, ctx) {
+	const is33 = version === "3.3-preview";
+	const dropped = new Set(is33 ? [] : Object.entries(model.securitySchemes).filter(([, scheme]) => scheme.type === "profile").map(([name]) => name));
+	const features = {
+		version,
+		native32: version === "3.2" || is33,
+		is30: version === "3.0",
+		is33,
+		prefix: model.extensionPrefix,
+		dropped
+	};
+	for (const name of dropped) ctx.report({
+		code: "preview-only",
+		severity: "info",
+		message: `Security scheme "${name}" uses Security Profiles, which only 3.3-preview emits; it and the requirements that name it are left out`,
+		pointer: `/components/securitySchemes/${pointerToken(name)}`
+	});
+	const grouped = /* @__PURE__ */ new Map();
+	const placed = [];
+	for (const operation of model.operations) {
+		if (operation.method === "query" && !features.native32) {
+			ctx.report({
+				code: "method-unsupported",
+				severity: "warning",
+				message: `Operation "${operation.id}" uses the QUERY method, which OpenAPI ${version} cannot describe; it is left out`,
+				pointer: `/paths/${pointerToken(operation.path)}`
+			});
+			continue;
+		}
+		const list = grouped.get(operation.path) ?? [];
+		list.push({
+			method: operation.method,
+			operation: lowerOperation(operation, features)
+		});
+		grouped.set(operation.path, list);
+		placed.push(operation);
+	}
+	const paths = {};
+	for (const [path, operations] of grouped) paths[path] = pathItem(operations, features);
+	const securitySchemes = {};
+	for (const [name, scheme] of Object.entries(model.securitySchemes)) {
+		const lowered = lowerScheme$1(scheme, features);
+		if (lowered) securitySchemes[name] = lowered;
+	}
+	const components = {
+		schemas: structuredClone(model.schemas),
+		responses: Object.fromEntries(Object.entries(model.responses).map(([name, response]) => [name, lowerResponse(response, features)])),
+		securitySchemes
+	};
+	if (is33 && model.securityProfileRequirements) components["securityProfileRequirements"] = structuredClone(model.securityProfileRequirements);
+	let webhooks;
+	if (model.webhooks.length > 0) {
+		if (features.is30) ctx.report({
+			code: "webhooks-unsupported",
+			severity: "warning",
+			message: `OpenAPI 3.0 has no webhooks; ${model.webhooks.length} webhook(s) are left out`
+		});
+		else webhooks = Object.fromEntries(model.webhooks.map((webhook) => [webhook.id, lowerWebhook(webhook)]));
+	}
+	const info = features.is30 ? omitUndefined$2({
+		...model.info,
+		summary: void 0,
+		license: model.info.license ? omitUndefined$2({
+			...model.info.license,
+			identifier: void 0
+		}) : void 0
+	}) : omitUndefined$2({ ...model.info });
+	let document = omitUndefined$2({
+		openapi: OPENAPI_FIELD[version],
+		[features.native32 ? "$self" : "x-oai-$self"]: model.self,
+		info: structuredClone(info),
+		jsonSchemaDialect: features.is30 ? void 0 : DIALECT,
+		servers: lowerServers(model.servers, features),
+		tags: lowerTags(model, features),
+		security: lowerSecurity(model.security, features),
+		paths,
+		webhooks,
+		components,
+		[`${features.prefix}preview`]: is33 ? SPEC_PINS.openapi33Preview : void 0
+	});
+	for (const [index, fragment] of model.fragments.entries()) document = mergeJson(document, fragment, (pointer) => {
+		ctx.report({
+			code: "fragment-conflict",
+			severity: "warning",
+			message: `Fragment ${index} replaces a generated value`,
+			pointer
+		});
+	});
+	for (const operation of placed) {
+		if (!operation.extend) continue;
+		const patch = { paths: { [operation.path]: { [operation.method]: operation.extend } } };
+		document = mergeJson(document, patch);
+	}
+	if (features.is30) document = lowerDocumentSchemas30(document);
+	if (!isOpenApiDocument(document)) throw new TypeError("better-supabase/spec: a fragment removed a required document field");
+	return document;
+}
+/** The fields every OpenAPI document this format renders has. */
+function isOpenApiDocument(value) {
+	return typeof value["openapi"] === "string" && isPlainObject(value["info"]) && isPlainObject(value["paths"]) && isPlainObject(value["components"]) && Array.isArray(value["tags"]) && Array.isArray(value["security"]);
+}
+const PATH_PARAM = /\{([^}]+)\}/g;
+function resolves(document, ref) {
+	if (!ref.startsWith("#")) return true;
+	let node = document;
+	for (const raw of ref.slice(2).split("/")) {
+		if (raw === "" && ref === "#") break;
+		const key = raw.replaceAll("~1", "/").replaceAll("~0", "~");
+		if (Array.isArray(node)) node = node[Number(key)];
+		else if (isPlainObject(node)) node = node[key];
+		else return false;
+		if (node === void 0) return false;
+	}
+	return true;
+}
+function collectRefs$1(value, pointer, out) {
+	if (Array.isArray(value)) for (const [index, item] of value.entries()) collectRefs$1(item, `${pointer}/${index}`, out);
+	else if (isPlainObject(value)) for (const [key, item] of Object.entries(value)) if (key === "$ref" && typeof item === "string") out.push([pointer, item]);
+	else collectRefs$1(item, `${pointer}/${pointerToken(key)}`, out);
+}
+/**
+* The keys of `value[key]` when it is an object; documents read from disk may
+* omit any field.
+*/
+function keysAt(value, key) {
+	if (!isPlainObject(value)) return [];
+	const child = value[key];
+	return isPlainObject(child) ? Object.keys(child) : [];
+}
+function lintOpenApi(document) {
+	const diagnostics = [];
+	const ids = /* @__PURE__ */ new Map();
+	const components = document.components;
+	const schemes = new Set(keysAt(components, "securitySchemes"));
+	const checkSecurity = (requirements, pointer) => {
+		if (!Array.isArray(requirements)) return;
+		const list = requirements;
+		for (const requirement of list) {
+			if (!isPlainObject(requirement)) continue;
+			for (const name of Object.keys(requirement)) if (!schemes.has(name)) diagnostics.push({
+				code: "security-unresolved",
+				severity: "error",
+				message: `Security requirement names an unknown scheme "${name}"`,
+				pointer
+			});
+		}
+	};
+	checkSecurity(document.security, "/security");
+	const paths = document.paths;
+	for (const [path, item] of Object.entries(isPlainObject(paths) ? paths : {})) {
+		if (!isPlainObject(item)) continue;
+		const base = `/paths/${pointerToken(path)}`;
+		const templated = new Set([...path.matchAll(PATH_PARAM)].map((match) => match[1] ?? ""));
+		const shared = Array.isArray(item["parameters"]) ? item["parameters"] : [];
+		checkSecurity(item["security"], `${base}/security`);
+		for (const [method, operation] of Object.entries(item)) {
+			if (!METHODS.has(method) || !isPlainObject(operation)) continue;
+			const pointer = `${base}/${method}`;
+			const id = operation["operationId"];
+			if (typeof id === "string") {
+				const seen = ids.get(id);
+				if (seen) diagnostics.push({
+					code: "operation-id-duplicate",
+					severity: "error",
+					message: `operationId "${id}" is also used at ${seen}`,
+					pointer
+				});
+				else ids.set(id, pointer);
+			}
+			checkSecurity(operation["security"], `${pointer}/security`);
+			const own = Array.isArray(operation["parameters"]) ? operation["parameters"] : [];
+			const declared = /* @__PURE__ */ new Set();
+			for (const parameter of [...shared, ...own]) {
+				if (!isPlainObject(parameter) || parameter["in"] !== "path") continue;
+				const name = String(parameter["name"]);
+				declared.add(name);
+				if (!templated.has(name)) diagnostics.push({
+					code: "path-param-unknown",
+					severity: "error",
+					message: `Path parameter "${name}" is not in the path template`,
+					pointer
+				});
+			}
+			for (const name of templated) if (!declared.has(name)) diagnostics.push({
+				code: "path-param-missing",
+				severity: "error",
+				message: `Path template parameter "${name}" has no parameter`,
+				pointer
+			});
+		}
+	}
+	const refs = [];
+	collectRefs$1(document, "", refs);
+	for (const [pointer, ref] of refs) if (!resolves(document, ref)) diagnostics.push({
+		code: "ref-unresolved",
+		severity: "error",
+		message: `$ref "${ref}" does not resolve inside the document`,
+		pointer
+	});
+	return diagnostics;
+}
+/**
+* OpenAPI as a `DocumentFormat`. 3.1 is the default; 3.0 is legacy (schemas
+* lowered to the 3.0 Schema Object); 3.2 has native `$self`, nested tags,
+* `itemSchema`, `oauth2MetadataUrl` and `query`; `3.3-preview` follows the
+* v3.3-dev branch at `SPEC_PINS.openapi33Preview`, with Path Item `security`
+* and the Security Profiles proposal. Below 3.2, the 3.2 fields travel as the
+* registered `x-oai-*` extensions where one exists, and as the model's prefixed
+* extensions otherwise.
+*/
+const openapiFormat = defineDocumentFormat({
+	id: "openapi",
+	versions: {
+		"3.0": {
+			pin: SPEC_PINS.openapi30,
+			status: "legacy"
+		},
+		"3.1": {
+			pin: SPEC_PINS.openapi31,
+			status: "stable"
+		},
+		"3.2": {
+			pin: SPEC_PINS.openapi32,
+			status: "stable"
+		},
+		"3.3-preview": {
+			pin: SPEC_PINS.openapi33Preview,
+			status: "preview"
+		}
+	},
+	defaultVersion: "3.1",
+	lower: lowerOpenApi,
+	lint: lintOpenApi,
+	fileName: () => OPENAPI_FILE_NAME
+});
+//#endregion
+//#region src/spec/api.ts
+function dedupe(diagnostics) {
+	const seen = /* @__PURE__ */ new Set();
+	return diagnostics.filter((diagnostic) => {
+		const key = `${diagnostic.code}\u0000${diagnostic.pointer ?? ""}\u0000${diagnostic.message}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+/**
+* The API model for a `defineSupabase()` result, and the documents it renders.
+* The model is built once per options object; each format and version is
+* lowered once and copied for every render.
+*
+* ```ts
+* const api = defineApi(betterSupabase, {
+*   info: { title: "CRM API", version: "1.0.0" },
+*   resources: { customers: { list: customerList } },
+* });
+* ```
+*
+* Without `resources` it publishes every table, and without `blocks` every
+* block instance `betterSupabase.blocks(set)` registered:
+*
+* ```ts
+* const api = defineApi(betterSupabase, { info, basePath: "/api" });
+* export const { procedures } = bsb.router(api, { meta: openapi });
+* const { document } = api.openapi({ version: "3.2" });
+* ```
+*/
+function defineApi(source, options) {
+	const built = buildApiModel(source, options);
+	const lowered = /* @__PURE__ */ new WeakMap();
+	const lower = (format, version) => {
+		let byVersion = lowered.get(format);
+		if (!byVersion) {
+			byVersion = /* @__PURE__ */ new Map();
+			lowered.set(format, byVersion);
+		}
+		let hit = byVersion.get(version);
+		if (!hit) {
+			const diagnostics = [];
+			hit = {
+				document: format.lower(built.model, version, { report: (diagnostic) => {
+					diagnostics.push(diagnostic);
+				} }),
+				diagnostics
+			};
+			byVersion.set(version, hit);
+		}
+		return hit;
+	};
+	const render = (format, renderOptions = {}) => {
+		const fallback = format.defaultVersion;
+		const version = renderOptions.version ?? fallback;
+		const status = format.versions[version];
+		if (!status) throw new TypeError(`Document format "${format.id}" has no version "${String(version)}"`);
+		const diagnostics = [...built.diagnostics];
+		if (status.status === "preview") diagnostics.push({
+			code: "preview-version",
+			severity: "warning",
+			message: `${format.id} ${String(version)} follows a draft (${status.pin}); its fields may change before release`
+		});
+		const base = lower(format, version);
+		diagnostics.push(...base.diagnostics);
+		let document = structuredClone(base.document);
+		if (renderOptions.transform) {
+			const rendered = {
+				format: format.id,
+				version,
+				document
+			};
+			document = renderOptions.transform(rendered) ?? document;
+		}
+		const overlays = renderOptions.overlays ?? [];
+		if (overlays.length > 0) {
+			const engine = renderOptions.applyOverlays ?? options.applyOverlays;
+			if (!engine) throw new TypeError("better-supabase/spec: overlays need applyOverlays (from better-supabase/spec)");
+			const result = engine(document, overlays);
+			document = result.document;
+			diagnostics.push(...result.diagnostics ?? []);
+		}
+		diagnostics.push(...format.lint?.(document, version) ?? []);
+		return {
+			format: format.id,
+			version,
+			document,
+			diagnostics: dedupe(diagnostics),
+			fileName: format.fileName(version)
+		};
+	};
+	return {
+		model: built.model,
+		basePath: (options.basePath ?? "").replace(/\/$/, ""),
+		resources: publishedResources(source.meta, options),
+		blocks: publishedBlocks(source.options?.blocks, options.blocks),
+		diagnostics: built.diagnostics,
+		render,
+		openapi(openapiOptions = {}) {
+			const { transform, version, overlays, applyOverlays } = openapiOptions;
+			const renderOptions = {
+				...version === void 0 ? {} : { version },
+				...overlays === void 0 ? {} : { overlays },
+				...applyOverlays === void 0 ? {} : { applyOverlays },
+				...transform === void 0 ? {} : { transform: (rendered) => transform(rendered) }
+			};
+			const result = render(openapiFormat, renderOptions);
+			return {
+				format: "openapi",
+				version: result.version,
+				document: result.document,
+				diagnostics: result.diagnostics,
+				fileName: result.fileName
+			};
+		}
+	};
+}
+//#endregion
 //#region src/spec/function-route.ts
 function isDescriptor(value) {
 	return typeof value === "object" && value !== null && "input" in value;
@@ -18,7 +711,7 @@ function descriptorOf(fn) {
 * `basePath` goes in front of it like any other route.
 *
 * ```ts
-* defineApi(bs, { routes: [functionRoute("send-invite", sendInvite)] });
+* defineApi(bsb, { routes: [functionRoute("send-invite", sendInvite)] });
 * ```
 */
 function functionRoute(name, fn, options = {}) {
@@ -388,4 +1081,1793 @@ function scalarPreset(document, options = {}) {
 	return copy;
 }
 //#endregion
-export { DEFAULT_ERRORS, PROBLEM_SCHEMA, SPEC_UIS, SPEC_UI_PACKAGES, buildApiModel, defineApi, defineDocumentFormat, functionRoute, mergeJson, pointerToken, scalarPreset, serializeDocument, specReference, specReferenceCsp, specReferenceHtml, specResponse, topicsFrom };
+//#region src/openapi/create.ts
+/**
+* An OpenAPI document for REST resources over your tables, with schemas from
+* the generated metadata, list-query parameters, Supabase security schemes and
+* Problem Details errors. Throws when building or checking the document finds
+* an error; use `defineApi` to read every finding instead.
+*
+* ```ts
+* const doc = createOpenApi(betterSupabase, {
+*   info: { title: "CRM API", version: "1.0.0" },
+*   resources: {
+*     customers: { list: customerList },
+*     notes: { operations: ["list", "get"] },
+*   },
+* });
+* ```
+*/
+function createOpenApi(betterSupabase, options) {
+	const { version, transform, overlays, onDiagnostic, ...apiOptions } = options;
+	const api = defineApi(betterSupabase, apiOptions);
+	const engine = options.applyOverlays;
+	const result = api.openapi({
+		...version === void 0 ? {} : { version },
+		...transform === void 0 ? {} : { transform },
+		...overlays === void 0 ? {} : { overlays },
+		...engine === void 0 ? {} : { applyOverlays: engine }
+	});
+	const errors = result.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+	if (errors.length > 0) throw new TypeError(`createOpenApi: ${errors.map((error) => `${error.code}: ${error.message}${error.pointer ? ` (${error.pointer})` : ""}`).join("; ")}`);
+	if (onDiagnostic) for (const diagnostic of result.diagnostics) onDiagnostic(diagnostic);
+	return result.document;
+}
+//#endregion
+//#region src/asyncapi/types.ts
+/**
+* The file name `asyncapiFormat` writes; Arazzo source descriptions point at
+* it.
+*/
+const ASYNCAPI_FILE_NAME = "asyncapi.json";
+//#endregion
+//#region src/asyncapi/format.ts
+const ASYNCAPI_FIELD = {
+	"3.0": SPEC_PINS.asyncapi30,
+	"3.1": SPEC_PINS.asyncapi31
+};
+const SCHEMA_PREFIX = "#/components/schemas/";
+const KEY = /^[A-Za-z0-9_-]+$/;
+const PARAM = /\{([^}]+)\}/g;
+/** JSON Schema 2020-12 keywords the AsyncAPI Schema Object (draft-07) lacks. */
+const KEYWORDS_2020 = /* @__PURE__ */ new Set([
+	"$defs",
+	"$anchor",
+	"$dynamicRef",
+	"$dynamicAnchor",
+	"prefixItems",
+	"dependentSchemas",
+	"dependentRequired",
+	"unevaluatedProperties",
+	"unevaluatedItems"
+]);
+/** The query Supabase Realtime reads on the websocket upgrade. */
+const WS_BINDING = { ws: {
+	method: "GET",
+	query: {
+		type: "object",
+		required: ["apikey"],
+		properties: {
+			apikey: {
+				type: "string",
+				description: "The project's publishable (anon) key."
+			},
+			vsn: {
+				type: "string",
+				description: "Realtime protocol version."
+			}
+		}
+	},
+	bindingVersion: "0.1.0"
+} };
+const STANDARD_WEBHOOK_HEADERS = {
+	type: "object",
+	required: [
+		"webhook-id",
+		"webhook-timestamp",
+		"webhook-signature"
+	],
+	properties: {
+		"webhook-id": {
+			type: "string",
+			description: "Unique message id; the same on every retry."
+		},
+		"webhook-timestamp": {
+			type: "string",
+			pattern: "^[0-9]+$",
+			description: "Unix time in seconds when the message was sent."
+		},
+		"webhook-signature": {
+			type: "string",
+			description: "Space-separated signatures of `id.timestamp.body`, each `v1,<base64>`."
+		}
+	}
+};
+const omitUndefined$1 = (value) => Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0));
+function collectRefs(value, out) {
+	if (Array.isArray(value)) for (const item of value) collectRefs(item, out);
+	else if (isPlainObject(value)) for (const [key, item] of Object.entries(value)) if (key === "$ref" && typeof item === "string") out.add(item);
+	else collectRefs(item, out);
+}
+function uses2020(value) {
+	if (Array.isArray(value)) return value.some(uses2020);
+	if (!isPlainObject(value)) return false;
+	return Object.entries(value).some(([key, item]) => KEYWORDS_2020.has(key) || uses2020(item));
+}
+/** Component names a set of values references, with everything they reference. */
+function referencedSchemas(model, roots) {
+	const out = {};
+	const pending = [];
+	const visit = (value) => {
+		const refs = /* @__PURE__ */ new Set();
+		collectRefs(value, refs);
+		for (const ref of refs) {
+			if (!ref.startsWith(SCHEMA_PREFIX)) continue;
+			const name = ref.slice(21).replaceAll("~1", "/").replaceAll("~0", "~");
+			if (name in out || !model.schemas[name]) continue;
+			out[name] = model.schemas[name];
+			pending.push(name);
+		}
+	};
+	for (const root of roots) visit(root);
+	while (pending.length > 0) {
+		const name = pending.pop();
+		if (name !== void 0) visit(out[name]);
+	}
+	const sorted = {};
+	for (const name of Object.keys(out).toSorted()) {
+		const schema = out[name];
+		if (schema) sorted[name] = structuredClone(schema);
+	}
+	return sorted;
+}
+function lowerScheme(name, scheme, ctx) {
+	switch (scheme.type) {
+		case "http": return omitUndefined$1({ ...scheme });
+		case "apiKey": return omitUndefined$1({
+			type: "httpApiKey",
+			name: scheme.name,
+			in: scheme.in,
+			description: scheme.description
+		});
+		case "openIdConnect": return omitUndefined$1({ ...scheme });
+		case "oauth2": {
+			const flows = {};
+			for (const [flow, value] of Object.entries(scheme.flows)) {
+				const { scopes, ...rest } = value;
+				flows[flow] = omitUndefined$1({
+					...rest,
+					availableScopes: { ...scopes }
+				});
+			}
+			return omitUndefined$1({
+				type: "oauth2",
+				description: scheme.description,
+				flows
+			});
+		}
+		case "profile":
+			ctx.report({
+				code: "asyncapi-security-unsupported",
+				severity: "info",
+				message: `Security scheme "${name}" uses Security Profiles, which AsyncAPI cannot describe; it is left out`,
+				pointer: `/components/securitySchemes/${pointerToken(name)}`
+			});
+			return;
+		default: return scheme;
+	}
+}
+function lowerMessage(message, prefix) {
+	return omitUndefined$1({
+		name: message.name,
+		title: message.title,
+		summary: message.summary,
+		description: message.description,
+		contentType: message.contentType,
+		headers: message.headers ? structuredClone(message.headers) : void 0,
+		payload: structuredClone(message.payload),
+		correlationId: message.correlationId ? { location: message.correlationId } : void 0,
+		traits: message.traits?.map((trait) => ({ $ref: `#/components/messageTraits/${safeKey(trait)}` })),
+		...Object.fromEntries(Object.entries(message.extensions ?? {}).map(([key, value]) => [key.startsWith("x-") ? key : `${prefix}${key}`, value]))
+	});
+}
+function lowerTrait(trait) {
+	return omitUndefined$1({
+		...trait,
+		headers: trait.headers ? structuredClone(trait.headers) : void 0
+	});
+}
+function webhookMessage(webhook) {
+	return {
+		id: `webhook${safeKey(pascal(webhook.id))}`,
+		name: webhook.id,
+		title: webhook.id,
+		...webhook.summary ? { summary: webhook.summary } : {},
+		...webhook.description ? { description: webhook.description } : {},
+		contentType: "application/json",
+		...webhook.standardWebhooks ? { headers: STANDARD_WEBHOOK_HEADERS } : {},
+		payload: webhook.payload
+	};
+}
+/** A server from a URL: `host` and `pathname` split, the scheme as protocol. */
+function serverFrom(url, fields, wsDefault) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return;
+	}
+	const scheme = parsed.protocol.slice(0, -1);
+	const protocol = wsDefault ? scheme === "http" || scheme === "ws" ? "ws" : "wss" : scheme;
+	const pathname = parsed.pathname === "/" ? void 0 : parsed.pathname;
+	return omitUndefined$1({
+		host: parsed.host,
+		protocol,
+		pathname,
+		...fields
+	});
+}
+function lowerAsyncApi(model, version, ctx) {
+	const prefix = model.extensionPrefix;
+	const keyOf = (id, where) => {
+		if (KEY.test(id)) return id;
+		const key = safeKey(id);
+		ctx.report({
+			code: "asyncapi-key-invalid",
+			severity: "info",
+			message: `${where} "${id}" is written as "${key}"; AsyncAPI keys allow letters, digits, "_" and "-"`
+		});
+		return key;
+	};
+	const securitySchemes = {};
+	for (const [name, scheme] of Object.entries(model.securitySchemes)) {
+		const lowered = lowerScheme(name, scheme, ctx);
+		if (lowered) securitySchemes[safeKey(name)] = lowered;
+	}
+	const security = [];
+	for (const requirement of model.security) {
+		const names = Object.keys(requirement);
+		if (names.length > 1) ctx.report({
+			code: "asyncapi-security-combined",
+			severity: "info",
+			message: `A requirement that needs ${names.join(" and ")} together is listed as alternatives; AsyncAPI security lists have no AND`,
+			pointer: "/security"
+		});
+		for (const name of names) {
+			const key = safeKey(name);
+			if (key in securitySchemes && !security.some((entry) => entry["$ref"] === `#/components/securitySchemes/${key}`)) security.push({ $ref: `#/components/securitySchemes/${key}` });
+		}
+	}
+	const webhookMessages = model.webhooks.map(webhookMessage);
+	const allMessages = { ...model.messages };
+	for (const message of webhookMessages) allMessages[message.id] = message;
+	const channels = [...model.channels];
+	if (webhookMessages.length > 0) channels.push({
+		id: "webhooks",
+		address: "",
+		title: "Outgoing webhooks",
+		description: "Webhooks the app sends to each receiver's URL, signed per Standard Webhooks when the headers are listed.",
+		protocol: "http",
+		messages: webhookMessages.map((message) => message.id),
+		operations: model.webhooks.map((webhook, index) => ({
+			id: `send${safeKey(pascal(webhook.id))}Webhook`,
+			action: "send",
+			...webhook.summary ? { summary: webhook.summary } : {},
+			messages: [webhookMessages[index]?.id ?? webhook.id]
+		}))
+	});
+	const servers = {};
+	const wsServers = [];
+	const httpServers = [];
+	const hasWs = channels.some((channel) => channel.protocol === "ws");
+	const hasHttp = channels.some((channel) => channel.protocol === "http");
+	if (hasWs && model.realtimeUrl) {
+		const server = serverFrom(model.realtimeUrl, {
+			title: "Supabase Realtime",
+			description: "The Realtime websocket. Private channels need the user's access token.",
+			security: security.length > 0 ? security : void 0
+		}, true);
+		if (server) {
+			servers["realtime"] = server;
+			wsServers.push({ $ref: "#/servers/realtime" });
+		} else ctx.report({
+			code: "asyncapi-realtime-url-invalid",
+			severity: "error",
+			message: `realtimeUrl "${model.realtimeUrl}" is not an absolute URL`,
+			pointer: "/servers/realtime"
+		});
+	} else if (hasWs) ctx.report({
+		code: "asyncapi-server-missing",
+		severity: "warning",
+		message: "Realtime channels are described without a server; set realtimeUrl to add the Realtime websocket",
+		pointer: "/servers"
+	});
+	if (hasHttp) for (const [index, entry] of model.servers.entries()) {
+		const key = safeKey(entry.name ?? (index === 0 ? "api" : `api${String(index + 1)}`));
+		const server = serverFrom(entry.url, omitUndefined$1({ description: entry.description }), false);
+		if (!server || key in servers) continue;
+		servers[key] = server;
+		httpServers.push({ $ref: `#/servers/${key}` });
+	}
+	const messageKeys = /* @__PURE__ */ new Map();
+	const messages = {};
+	for (const [id, message] of Object.entries(allMessages)) {
+		const key = keyOf(id, "Message");
+		messageKeys.set(id, key);
+		messages[key] = lowerMessage(message, prefix);
+		if (uses2020(message.payload) || uses2020(message.headers)) ctx.report({
+			code: "asyncapi-schema-dialect",
+			severity: "warning",
+			message: `Message "${id}" uses JSON Schema 2020-12 keywords that the AsyncAPI Schema Object (draft-07) does not define`,
+			pointer: `/components/messages/${pointerToken(key)}`
+		});
+	}
+	const channelObjects = {};
+	const operations = {};
+	const placed = [];
+	const addOperation = (key, operation, pointer) => {
+		if (key in operations) {
+			ctx.report({
+				code: "asyncapi-operation-id-duplicate",
+				severity: "error",
+				message: `Two operations have the id "${key}"; the first one is kept`,
+				pointer
+			});
+			return;
+		}
+		operations[key] = operation;
+	};
+	for (const channel of channels) {
+		const key = keyOf(channel.id, "Channel");
+		if (key in channelObjects) {
+			ctx.report({
+				code: "asyncapi-channel-id-duplicate",
+				severity: "error",
+				message: `Two channels have the id "${key}"; the first one is kept`,
+				pointer: `/channels/${pointerToken(key)}`
+			});
+			continue;
+		}
+		placed.push({
+			key,
+			channel
+		});
+		const channelMessages = {};
+		for (const id of channel.messages) {
+			const messageKey = messageKeys.get(id);
+			if (messageKey === void 0) {
+				ctx.report({
+					code: "asyncapi-message-unknown",
+					severity: "error",
+					message: `Channel "${channel.id}" lists an unknown message "${id}"`,
+					pointer: `/channels/${pointerToken(key)}/messages`
+				});
+				continue;
+			}
+			channelMessages[messageKey] = { $ref: `#/components/messages/${messageKey}` };
+		}
+		const names = [...channel.address.matchAll(PARAM)].map((match) => match[1] ?? "");
+		const parameters = names.length > 0 ? Object.fromEntries(names.map((name) => [name, omitUndefined$1({ ...channel.parameters?.[name] })])) : void 0;
+		const serverRefs = channel.protocol === "ws" ? wsServers : httpServers;
+		channelObjects[key] = omitUndefined$1({
+			address: channel.address === "" ? null : channel.address,
+			title: channel.title,
+			summary: channel.summary,
+			description: channel.description,
+			servers: serverRefs.length > 0 ? serverRefs.map((ref) => ({ ...ref })) : void 0,
+			parameters,
+			messages: channelMessages,
+			bindings: channel.protocol === "ws" ? structuredClone(WS_BINDING) : void 0,
+			...channel.extensions
+		});
+		for (const operation of channel.operations) {
+			const operationKey = keyOf(operation.id, "Operation");
+			const refs = [];
+			for (const id of operation.messages ?? []) {
+				const messageKey = messageKeys.get(id);
+				if (messageKey === void 0 || !channel.messages.includes(id)) {
+					ctx.report({
+						code: "asyncapi-operation-message-unknown",
+						severity: "error",
+						message: `Operation "${operation.id}" lists "${id}", which is not a message of channel "${channel.id}"`,
+						pointer: `/operations/${pointerToken(operationKey)}`
+					});
+					continue;
+				}
+				refs.push({ $ref: `#/channels/${key}/messages/${messageKey}` });
+			}
+			addOperation(operationKey, omitUndefined$1({
+				action: operation.action,
+				channel: { $ref: `#/channels/${key}` },
+				summary: operation.summary,
+				description: operation.description,
+				messages: operation.messages ? refs : void 0,
+				[`${prefix}permission`]: operation.permission,
+				...operation.extensions
+			}), `/operations/${pointerToken(operationKey)}`);
+		}
+	}
+	for (const operation of model.operations) {
+		const emits = operation.extensions[`${prefix}emits`];
+		if (!Array.isArray(emits)) continue;
+		const byChannel = /* @__PURE__ */ new Map();
+		for (const event of emits) {
+			if (typeof event !== "string") continue;
+			const target = placed.find(({ channel }) => channel.messages.some((id) => {
+				const message = allMessages[id];
+				return id === event || message?.name === event || message?.name?.endsWith(`.${event}`) === true;
+			}));
+			const id = target?.channel.messages.find((candidate) => {
+				const message = allMessages[candidate];
+				return candidate === event || message?.name === event || message?.name?.endsWith(`.${event}`) === true;
+			});
+			if (!target || id === void 0) {
+				ctx.report({
+					code: "asyncapi-emits-unknown",
+					severity: "warning",
+					message: `Operation "${operation.id}" emits "${event}", which no message describes`,
+					pointer: `/operations/${pointerToken(operation.id)}`
+				});
+				continue;
+			}
+			const list = byChannel.get(target.key) ?? [];
+			list.push(messageKeys.get(id) ?? id);
+			byChannel.set(target.key, list);
+		}
+		const many = byChannel.size > 1;
+		for (const [channelKey, keys] of byChannel) {
+			const operationKey = safeKey(many ? `${operation.id}Emits${pascal(channelKey)}` : `${operation.id}Emits`);
+			addOperation(operationKey, {
+				action: "send",
+				channel: { $ref: `#/channels/${channelKey}` },
+				summary: `Events sent by ${operation.method.toUpperCase()} ${operation.path}`,
+				messages: [...new Set(keys)].map((messageKey) => ({ $ref: `#/channels/${channelKey}/messages/${messageKey}` })),
+				[`${prefix}operation`]: operation.id
+			}, `/operations/${pointerToken(operationKey)}`);
+		}
+	}
+	const traits = {};
+	for (const [name, trait] of Object.entries(model.messageTraits ?? {})) traits[safeKey(name)] = lowerTrait(trait);
+	const schemas = referencedSchemas(model, [Object.values(messages), Object.values(traits)]);
+	const { info } = model;
+	const document = omitUndefined$1({
+		asyncapi: ASYNCAPI_FIELD[version],
+		info: omitUndefined$1({
+			title: info.title,
+			version: info.version,
+			description: info.description ?? info.summary,
+			termsOfService: info.termsOfService,
+			contact: info.contact ? omitUndefined$1({ ...info.contact }) : void 0,
+			license: info.license ? omitUndefined$1({
+				name: info.license.name,
+				url: info.license.url
+			}) : void 0
+		}),
+		defaultContentType: "application/json",
+		servers: Object.keys(servers).length > 0 ? servers : void 0,
+		channels: channelObjects,
+		operations,
+		components: omitUndefined$1({
+			schemas: Object.keys(schemas).length > 0 ? schemas : void 0,
+			messages: Object.keys(messages).length > 0 ? messages : void 0,
+			messageTraits: Object.keys(traits).length > 0 ? traits : void 0,
+			securitySchemes: Object.keys(securitySchemes).length > 0 ? securitySchemes : void 0
+		})
+	});
+	if (!isAsyncApiDocument(document)) throw new TypeError("better-supabase/spec: lowering lost a required field");
+	return document;
+}
+function isAsyncApiDocument(value) {
+	return typeof value["asyncapi"] === "string" && isPlainObject(value["info"]) && isPlainObject(value["channels"]) && isPlainObject(value["operations"]) && isPlainObject(value["components"]);
+}
+function resolve$1(document, ref) {
+	if (!ref.startsWith("#/")) return;
+	let node = document;
+	for (const raw of ref.slice(2).split("/")) {
+		const key = raw.replaceAll("~1", "/").replaceAll("~0", "~");
+		if (!isPlainObject(node)) return;
+		node = node[key];
+	}
+	return node;
+}
+function refOf(value) {
+	return isPlainObject(value) && typeof value["$ref"] === "string" ? value["$ref"] : void 0;
+}
+function lintAsyncApi(document) {
+	const diagnostics = [];
+	const refs = /* @__PURE__ */ new Set();
+	collectRefs(document, refs);
+	for (const ref of refs) if (ref.startsWith("#") && resolve$1(document, ref) === void 0) diagnostics.push({
+		code: "asyncapi-ref-unresolved",
+		severity: "error",
+		message: `$ref "${ref}" does not resolve inside the document`
+	});
+	for (const [key, channel] of Object.entries(document.channels)) {
+		const pointer = `/channels/${pointerToken(key)}`;
+		if (!KEY.test(key)) diagnostics.push({
+			code: "asyncapi-key-invalid",
+			severity: "error",
+			message: `Channel id "${key}" has characters AsyncAPI keys do not allow`,
+			pointer
+		});
+		const address = channel["address"];
+		const names = new Set(typeof address === "string" ? [...address.matchAll(PARAM)].map((match) => match[1] ?? "") : []);
+		const parameters = isPlainObject(channel["parameters"]) ? Object.keys(channel["parameters"]) : [];
+		for (const name of parameters) if (!names.has(name)) diagnostics.push({
+			code: "asyncapi-parameter-unknown",
+			severity: "error",
+			message: `Parameter "${name}" is not in the address of channel "${key}"`,
+			pointer: `${pointer}/parameters`
+		});
+		for (const name of names) if (!parameters.includes(name)) diagnostics.push({
+			code: "asyncapi-parameter-missing",
+			severity: "error",
+			message: `Address expression "{${name}}" of channel "${key}" has no parameter`,
+			pointer: `${pointer}/parameters`
+		});
+	}
+	for (const [key, operation] of Object.entries(document.operations)) {
+		const pointer = `/operations/${pointerToken(key)}`;
+		const channelRef = refOf(operation["channel"]);
+		if (!channelRef?.startsWith("#/channels/")) {
+			diagnostics.push({
+				code: "asyncapi-operation-channel-unknown",
+				severity: "error",
+				message: `Operation "${key}" does not reference a root channel`,
+				pointer: `${pointer}/channel`
+			});
+			continue;
+		}
+		const list = Array.isArray(operation["messages"]) ? operation["messages"] : [];
+		for (const entry of list) if (!refOf(entry)?.startsWith(`${channelRef}/messages/`)) diagnostics.push({
+			code: "asyncapi-operation-message-unknown",
+			severity: "error",
+			message: `Operation "${key}" lists a message outside its channel`,
+			pointer: `${pointer}/messages`
+		});
+	}
+	return diagnostics;
+}
+/**
+* AsyncAPI as a `DocumentFormat`, for the events the API model describes:
+* Realtime table change signals and broadcast topics on the Supabase Realtime
+* websocket (`ws` bindings), CloudEvents (headers as the `cloudEvent` message
+* trait), outgoing webhooks over HTTP and the events HTTP operations emit. 3.0
+* is the default; 3.1 only adds `ros2` bindings, so the two documents differ in
+* the `asyncapi` field.
+*/
+const asyncapiFormat = defineDocumentFormat({
+	id: "asyncapi",
+	versions: {
+		"3.0": {
+			pin: SPEC_PINS.asyncapi30,
+			status: "stable"
+		},
+		"3.1": {
+			pin: SPEC_PINS.asyncapi31,
+			status: "stable"
+		}
+	},
+	defaultVersion: "3.0",
+	lower: lowerAsyncApi,
+	lint: lintAsyncApi,
+	fileName: () => ASYNCAPI_FILE_NAME
+});
+//#endregion
+//#region src/asyncapi/create.ts
+/**
+* An AsyncAPI document for the app's events: Realtime table change signals and
+* broadcast topics, CloudEvents for row and block events, outgoing webhooks and
+* the events HTTP operations emit. Pass `events` (and `realtimeUrl` for the
+* websocket server). Throws when building or checking the document finds an
+* error; use `defineApi(...).render(asyncapiFormat)` to read every finding
+* instead.
+*
+* ```ts
+* const doc = createAsyncApi(betterSupabase, {
+*   info: { title: "CRM events", version: "1.0.0" },
+*   realtimeUrl: "wss://example.supabase.co/realtime/v1/websocket",
+*   events: {
+*     tables: ["customers"],
+*     cloudEvents: { source: "/crm", blocks: { "support.started": true } },
+*   },
+* });
+* ```
+*/
+function createAsyncApi(betterSupabase, options) {
+	const { version, transform, overlays, onDiagnostic, ...apiOptions } = options;
+	const result = defineApi(betterSupabase, apiOptions).render(asyncapiFormat, {
+		...version === void 0 ? {} : { version },
+		...transform === void 0 ? {} : { transform: (rendered) => transform(rendered) },
+		...overlays === void 0 ? {} : { overlays }
+	});
+	const errors = result.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+	if (errors.length > 0) throw new TypeError(`createAsyncApi: ${errors.map((error) => `${error.code}: ${error.message}${error.pointer ? ` (${error.pointer})` : ""}`).join("; ")}`);
+	if (onDiagnostic) for (const diagnostic of result.diagnostics) onDiagnostic(diagnostic);
+	return result.document;
+}
+//#endregion
+//#region src/arazzo/format.ts
+const ARAZZO_FIELD = {
+	"1.0": SPEC_PINS.arazzo10,
+	"1.1": SPEC_PINS.arazzo11
+};
+const ID = /^[A-Za-z0-9_-]+$/;
+const STEP_OUTPUT = /\$steps\.([A-Za-z0-9_-]+)\.outputs\.([A-Za-z0-9_-]+)/g;
+const INPUT = /\$inputs\.([A-Za-z0-9_-]+)/g;
+const SOURCE = /\$sourceDescriptions\.([A-Za-z0-9_-]+)\./g;
+const omitUndefined = (value) => Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0));
+function firstSuccess(operation) {
+	return Object.keys(operation.responses).filter((status) => /^2\d\d$/.test(status)).toSorted()[0];
+}
+function stripActionParameters(actions, version, report, pointer) {
+	if (!actions) return;
+	return actions.map((action, index) => {
+		const copy = structuredClone({ ...action });
+		if (version === "1.0" && "parameters" in copy) {
+			delete copy["parameters"];
+			report(`${pointer}/${String(index)}/parameters`);
+		}
+		return copy;
+	});
+}
+function lowerStep(step, pointer, state) {
+	const { ctx, version } = state;
+	const operation = step.operationId === void 0 ? void 0 : state.operations.get(step.operationId);
+	let target = {};
+	if (step.operationId !== void 0) {
+		if (!operation) ctx.report({
+			code: "arazzo-operation-unknown",
+			severity: "error",
+			message: `Step "${step.id}" calls operation "${step.operationId}", which the API does not have`,
+			pointer: `${pointer}/operationId`
+		});
+		target = { operationId: state.qualify ? `$sourceDescriptions.${state.apiName}.${step.operationId}` : step.operationId };
+	} else if (step.workflowId !== void 0) target = { workflowId: step.workflowId };
+	else if (step.channel) {
+		if (version === "1.0") {
+			ctx.report({
+				code: "arazzo-channel-step-unsupported",
+				severity: "error",
+				message: `Step "${step.id}" uses an AsyncAPI channel, which needs Arazzo 1.1; the step is left out`,
+				pointer
+			});
+			return;
+		}
+		if (!state.channels.has(step.channel.id)) ctx.report({
+			code: "arazzo-channel-unknown",
+			severity: "error",
+			message: `Step "${step.id}" uses channel "${step.channel.id}", which the API does not have`,
+			pointer: `${pointer}/channelPath`
+		});
+		target = {
+			channelPath: `{$sourceDescriptions.${state.eventsName}.url}#/channels/${safeKey(step.channel.id)}`,
+			action: step.channel.action,
+			...step.channel.correlationId === void 0 ? {} : { correlationId: step.channel.correlationId }
+		};
+	}
+	const parameters = step.parameters?.map((parameter, index) => {
+		const location = parameter.in ?? operation?.parameters.find((candidate) => candidate.name === parameter.name)?.in;
+		if (location === void 0 && step.operationId !== void 0) ctx.report({
+			code: "arazzo-parameter-in-missing",
+			severity: "error",
+			message: `Parameter "${parameter.name}" of step "${step.id}" has no "in", and operation "${step.operationId}" has no parameter by that name`,
+			pointer: `${pointer}/parameters/${String(index)}`
+		});
+		return omitUndefined({
+			name: parameter.name,
+			in: location,
+			value: structuredClone(parameter.value)
+		});
+	});
+	const contentType = operation?.requestBody ? Object.keys(operation.requestBody.content)[0] : void 0;
+	const success = operation ? firstSuccess(operation) : void 0;
+	const successCriteria = step.successCriteria?.map((criterion) => ({ ...criterion })) ?? (success === void 0 ? void 0 : [{ condition: `$statusCode == ${success}` }]);
+	const reportParameters = (where) => {
+		ctx.report({
+			code: "arazzo-action-parameters-unsupported",
+			severity: "warning",
+			message: `Action parameters need Arazzo 1.1; they are left out of step "${step.id}"`,
+			pointer: where
+		});
+	};
+	const onSuccess = stripActionParameters(step.onSuccess, version, reportParameters, `${pointer}/onSuccess`);
+	const onFailure = stripActionParameters(step.onFailure, version, reportParameters, `${pointer}/onFailure`);
+	return {
+		stepId: step.id,
+		...step.description === void 0 ? {} : { description: step.description },
+		...target,
+		...parameters === void 0 ? {} : { parameters },
+		...step.requestBody ? { requestBody: omitUndefined({
+			contentType,
+			payload: structuredClone(step.requestBody.payload)
+		}) } : {},
+		...successCriteria === void 0 ? {} : { successCriteria },
+		...onSuccess === void 0 ? {} : { onSuccess },
+		...onFailure === void 0 ? {} : { onFailure },
+		...step.outputs ? { outputs: { ...step.outputs } } : {}
+	};
+}
+function lowerWorkflow(workflow, index, state) {
+	const pointer = `/workflows/${String(index)}`;
+	const steps = workflow.steps.flatMap((step, stepIndex) => {
+		const lowered = lowerStep(step, `${pointer}/steps/${String(stepIndex)}`, state);
+		return lowered ? [lowered] : [];
+	});
+	return {
+		workflowId: workflow.id,
+		...workflow.summary === void 0 ? {} : { summary: workflow.summary },
+		...workflow.description === void 0 ? {} : { description: workflow.description },
+		...workflow.inputs ? { inputs: structuredClone(workflow.inputs) } : {},
+		steps,
+		...workflow.outputs ? { outputs: { ...workflow.outputs } } : {}
+	};
+}
+function lowerArazzo(options, model, version, ctx) {
+	const apiName = options.openapi?.name ?? "api";
+	const eventsName = options.asyncapi?.name ?? "events";
+	const usesChannels = version === "1.1" && model.workflows.some((workflow) => workflow.steps.some((step) => step.channel !== void 0));
+	const usesOperations = model.workflows.some((workflow) => workflow.steps.some((step) => step.operationId !== void 0));
+	const sources = [];
+	if (usesOperations || !usesChannels) sources.push({
+		name: apiName,
+		url: options.openapi?.url ?? model.self ?? "openapi.json",
+		type: "openapi"
+	});
+	if (usesChannels) sources.push({
+		name: eventsName,
+		url: options.asyncapi?.url ?? "asyncapi.json",
+		type: "asyncapi"
+	});
+	const state = {
+		model,
+		version,
+		ctx,
+		operations: new Map(model.operations.map((operation) => [operation.id, operation])),
+		channels: new Set(model.channels.map((channel) => channel.id)),
+		apiName,
+		eventsName,
+		qualify: sources.length > 1
+	};
+	if (model.workflows.length === 0) ctx.report({
+		code: "arazzo-workflows-empty",
+		severity: "error",
+		message: "The API has no workflows; an Arazzo document needs at least one (pass workflows, or a built-in such as paginationWorkflows())",
+		pointer: "/workflows"
+	});
+	const { info } = model;
+	return {
+		arazzo: ARAZZO_FIELD[version],
+		info: {
+			title: info.title,
+			version: info.version,
+			...info.summary === void 0 ? {} : { summary: info.summary },
+			...info.description === void 0 ? {} : { description: info.description }
+		},
+		sourceDescriptions: sources,
+		workflows: model.workflows.map((workflow, index) => lowerWorkflow(workflow, index, state))
+	};
+}
+function strings(value, out) {
+	if (typeof value === "string") out.push(value);
+	else if (Array.isArray(value)) for (const item of value) strings(item, out);
+	else if (isPlainObject(value)) for (const item of Object.values(value)) strings(item, out);
+}
+function inputNames(inputs) {
+	if (!inputs || !isPlainObject(inputs["properties"])) return;
+	return new Set(Object.keys(inputs["properties"]));
+}
+function lintWorkflow(workflow, index, workflowIds, sourceNames, diagnostics) {
+	const pointer = `/workflows/${String(index)}`;
+	const stepIndex = /* @__PURE__ */ new Map();
+	const outputsOf = /* @__PURE__ */ new Map();
+	for (const [position, step] of workflow.steps.entries()) {
+		if (stepIndex.has(step.stepId)) diagnostics.push({
+			code: "arazzo-step-id-duplicate",
+			severity: "error",
+			message: `Workflow "${workflow.workflowId}" has two steps "${step.stepId}"`,
+			pointer: `${pointer}/steps/${String(position)}`
+		});
+		else stepIndex.set(step.stepId, position);
+		outputsOf.set(step.stepId, new Set(Object.keys(step.outputs ?? {})));
+	}
+	const inputs = inputNames(workflow.inputs);
+	const checkExpressions = (value, where, position) => {
+		const texts = [];
+		strings(value, texts);
+		for (const text of texts) {
+			for (const [, stepId = "", output = ""] of text.matchAll(STEP_OUTPUT)) {
+				const target = stepIndex.get(stepId);
+				if (target === void 0 || !outputsOf.get(stepId)?.has(output)) diagnostics.push({
+					code: "arazzo-step-output-unknown",
+					severity: "error",
+					message: `"$steps.${stepId}.outputs.${output}" names an output no step "${stepId}" declares`,
+					pointer: where
+				});
+				else if (position !== void 0 && target >= position) diagnostics.push({
+					code: "arazzo-step-output-order",
+					severity: "error",
+					message: `"$steps.${stepId}.outputs.${output}" is read before step "${stepId}" runs`,
+					pointer: where
+				});
+			}
+			if (inputs) {
+				for (const [, name = ""] of text.matchAll(INPUT)) if (!inputs.has(name)) diagnostics.push({
+					code: "arazzo-input-undeclared",
+					severity: "warning",
+					message: `"$inputs.${name}" is not a property of workflow "${workflow.workflowId}" inputs`,
+					pointer: where
+				});
+			}
+			for (const [, name = ""] of text.matchAll(SOURCE)) if (!sourceNames.has(name)) diagnostics.push({
+				code: "arazzo-source-unknown",
+				severity: "error",
+				message: `"$sourceDescriptions.${name}" is not a listed source description`,
+				pointer: where
+			});
+		}
+	};
+	for (const [position, step] of workflow.steps.entries()) {
+		const where = `${pointer}/steps/${String(position)}`;
+		if (!ID.test(step.stepId)) diagnostics.push({
+			code: "arazzo-id-invalid",
+			severity: "error",
+			message: `Step id "${step.stepId}" has characters Arazzo ids do not allow`,
+			pointer: where
+		});
+		if ([
+			step.operationId,
+			step.operationPath,
+			step.channelPath,
+			step.workflowId
+		].filter((target) => target !== void 0).length !== 1) diagnostics.push({
+			code: "arazzo-step-target",
+			severity: "error",
+			message: `Step "${step.stepId}" needs exactly one of operationId, operationPath, channelPath or workflowId`,
+			pointer: where
+		});
+		if (step.workflowId !== void 0 && !workflowIds.has(step.workflowId)) diagnostics.push({
+			code: "arazzo-workflow-unknown",
+			severity: "error",
+			message: `Step "${step.stepId}" calls workflow "${step.workflowId}", which the document does not have`,
+			pointer: `${where}/workflowId`
+		});
+		checkExpressions([
+			step.operationId,
+			step.channelPath,
+			step.parameters,
+			step.requestBody,
+			step.successCriteria
+		], where, position);
+		checkExpressions([
+			step.outputs,
+			step.onSuccess,
+			step.onFailure
+		], where);
+		for (const action of [...step.onSuccess ?? [], ...step.onFailure ?? []]) {
+			if (action["type"] !== "goto" && action["type"] !== "retry") continue;
+			const stepId = action["stepId"];
+			const workflowId = action["workflowId"];
+			if (typeof stepId === "string" && !stepIndex.has(stepId) || typeof workflowId === "string" && !workflowIds.has(workflowId) && !workflowId.startsWith("$sourceDescriptions.")) diagnostics.push({
+				code: "arazzo-goto-unknown",
+				severity: "error",
+				message: `Action "${String(action["name"])}" of step "${step.stepId}" goes to a step or workflow that does not exist`,
+				pointer: where
+			});
+		}
+	}
+	checkExpressions(workflow.outputs, `${pointer}/outputs`);
+}
+function lintArazzo(document) {
+	const diagnostics = [];
+	const workflowIds = /* @__PURE__ */ new Set();
+	for (const [index, workflow] of document.workflows.entries()) {
+		if (!ID.test(workflow.workflowId)) diagnostics.push({
+			code: "arazzo-id-invalid",
+			severity: "error",
+			message: `Workflow id "${workflow.workflowId}" has characters Arazzo ids do not allow`,
+			pointer: `/workflows/${String(index)}`
+		});
+		if (workflowIds.has(workflow.workflowId)) diagnostics.push({
+			code: "arazzo-workflow-id-duplicate",
+			severity: "error",
+			message: `Two workflows have the id "${workflow.workflowId}"`,
+			pointer: `/workflows/${String(index)}`
+		});
+		workflowIds.add(workflow.workflowId);
+	}
+	const sourceNames = new Set(document.sourceDescriptions.map((source) => source.name));
+	for (const [index, workflow] of document.workflows.entries()) lintWorkflow(workflow, index, workflowIds, sourceNames, diagnostics);
+	return diagnostics;
+}
+/**
+* An Arazzo format whose source descriptions point at your OpenAPI and AsyncAPI
+* URLs. `arazzoFormat` is this with the defaults: `api` at the model's `self`
+* or `openapi.json`, and `events` at `asyncapi.json`.
+*/
+function createArazzoFormat(options = {}) {
+	return defineDocumentFormat({
+		id: "arazzo",
+		versions: {
+			"1.0": {
+				pin: SPEC_PINS.arazzo10,
+				status: "stable"
+			},
+			"1.1": {
+				pin: SPEC_PINS.arazzo11,
+				status: "stable"
+			}
+		},
+		defaultVersion: "1.0",
+		lower: (model, version, ctx) => lowerArazzo(options, model, version, ctx),
+		lint: lintArazzo,
+		fileName: () => "arazzo.json"
+	});
+}
+/**
+* Arazzo as a `DocumentFormat`, for the model's `workflows`. 1.0 is the
+* default; channel steps (AsyncAPI send and receive) and action `parameters`
+* need 1.1.
+*/
+const arazzoFormat = createArazzoFormat();
+//#endregion
+//#region src/arazzo/create.ts
+/**
+* An Arazzo document for the API's workflows: your `defineWorkflow` workflows
+* and the built-ins (`paginationWorkflows()`, `createThenGetWorkflows()`,
+* `authWorkflow()`), checked against the operations the API has. Throws when
+* building or checking the document finds an error; use
+* `defineApi(...).render(arazzoFormat)` to read every finding instead.
+*
+* ```ts
+* const doc = createArazzo(betterSupabase, {
+*   info: { title: "CRM workflows", version: "1.0.0" },
+*   resources: { customers: { pagination: "cursor" } },
+*   workflows: [paginationWorkflows(), createThenGetWorkflows()],
+* });
+* ```
+*/
+function createArazzo(betterSupabase, options) {
+	const { version, transform, overlays, onDiagnostic, openapi, asyncapi, ...apiOptions } = options;
+	const format = createArazzoFormat({
+		...openapi === void 0 ? {} : { openapi },
+		...asyncapi === void 0 ? {} : { asyncapi }
+	});
+	const result = defineApi(betterSupabase, apiOptions).render(format, {
+		...version === void 0 ? {} : { version },
+		...transform === void 0 ? {} : { transform: (rendered) => transform(rendered) },
+		...overlays === void 0 ? {} : { overlays }
+	});
+	const errors = result.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+	if (errors.length > 0) throw new TypeError(`createArazzo: ${errors.map((error) => `${error.code}: ${error.message}${error.pointer ? ` (${error.pointer})` : ""}`).join("; ")}`);
+	if (onDiagnostic) for (const diagnostic of result.diagnostics) onDiagnostic(diagnostic);
+	return result.document;
+}
+//#endregion
+//#region src/arazzo/builtins.ts
+const resourceOf = (operations, table, operation) => operations.find((candidate) => candidate.source.kind === "resource" && candidate.source.table === table && candidate.source.operation === operation);
+const tablesOf = (operations) => [...new Set(operations.flatMap((operation) => operation.source.kind === "resource" ? [operation.source.table] : []))];
+const inputParameter = (parameter) => ({
+	name: parameter.name,
+	in: "path",
+	value: `$inputs.${parameter.name}`
+});
+const pathParameter = (operation) => operation.parameters.find((parameter) => parameter.in === "path")?.name;
+/**
+* One workflow per cursor-paginated list: read the first page, then the next
+* one from its `nextCursor` when `hasMore` is true. Repeat the second step with
+* its own `nextCursor` to walk the rest.
+*/
+function paginationWorkflows(options = {}) {
+	return (operations) => tablesOf(operations).filter((table) => !options.tables || options.tables.includes(table)).flatMap((table) => {
+		const list = resourceOf(operations, table, "list");
+		if (!list?.parameters.some((parameter) => parameter.name === "after" && parameter.in === "query")) return [];
+		return [{
+			id: `paginate${pascal(table)}`,
+			summary: `Read ${table} page by page`,
+			description: "Reads the first page, then the next one with the cursor the first page returned. Repeat `nextPage` with its own `nextCursor` until `hasMore` is false.",
+			inputs: {
+				type: "object",
+				properties: { size: {
+					type: "integer",
+					minimum: 1,
+					description: "Page size."
+				} }
+			},
+			steps: [{
+				id: "firstPage",
+				operationId: list.id,
+				parameters: [{
+					name: "size",
+					in: "query",
+					value: "$inputs.size"
+				}],
+				successCriteria: [{ condition: "$statusCode == 200" }],
+				outputs: {
+					items: "$response.body#/items",
+					nextCursor: "$response.body#/nextCursor",
+					hasMore: "$response.body#/hasMore"
+				},
+				onSuccess: [{
+					name: "lastPage",
+					type: "end",
+					criteria: [{ condition: "$response.body#/hasMore == false" }]
+				}]
+			}, {
+				id: "nextPage",
+				operationId: list.id,
+				parameters: [{
+					name: "size",
+					in: "query",
+					value: "$inputs.size"
+				}, {
+					name: "after",
+					in: "query",
+					value: "$steps.firstPage.outputs.nextCursor"
+				}],
+				successCriteria: [{ condition: "$statusCode == 200" }],
+				outputs: {
+					items: "$response.body#/items",
+					nextCursor: "$response.body#/nextCursor",
+					hasMore: "$response.body#/hasMore"
+				}
+			}],
+			outputs: {
+				firstPage: "$steps.firstPage.outputs.items",
+				nextCursor: "$steps.nextPage.outputs.nextCursor"
+			}
+		}];
+	});
+}
+/**
+* One workflow per resource with `create` and `get`: create a row, then read it
+* back by its key.
+*/
+function createThenGetWorkflows(options = {}) {
+	return (operations) => tablesOf(operations).filter((table) => !options.tables || options.tables.includes(table)).flatMap((table) => {
+		const create = resourceOf(operations, table, "create");
+		const get = resourceOf(operations, table, "get");
+		const key = get ? pathParameter(get) : void 0;
+		if (!create || !get || key === void 0) return [];
+		return [{
+			id: `createThenGet${pascal(table)}`,
+			summary: `Create a ${table} row, then read it back`,
+			inputs: {
+				type: "object",
+				required: ["row"],
+				properties: { row: {
+					type: "object",
+					description: "The row to insert."
+				} }
+			},
+			steps: [{
+				id: "create",
+				operationId: create.id,
+				requestBody: { payload: "$inputs.row" },
+				successCriteria: [{ condition: "$statusCode == 201" }],
+				outputs: { key: `$response.body#/${key}` }
+			}, {
+				id: "get",
+				operationId: get.id,
+				parameters: [{
+					name: key,
+					in: "path",
+					value: "$steps.create.outputs.key"
+				}],
+				successCriteria: [{ condition: "$statusCode == 200" }],
+				outputs: { row: "$response.body" }
+			}],
+			outputs: { row: "$steps.get.outputs.row" }
+		}];
+	});
+}
+/**
+* Sign in, then call an operation with the access token as a bearer token. A
+* 403 Problem Details answer with code `APPROVAL_REQUIRED` ends the workflow
+* (the `approvalRequired` failure action), so a client can wait for the
+* approval instead of retrying.
+*/
+function authWorkflow(options) {
+	const signIn = options.signIn ?? "signIn";
+	const pointer = options.tokenPointer ?? "/access_token";
+	return (operations) => {
+		const pathParameters = operations.find((operation) => operation.id === options.call)?.parameters.filter((parameter) => parameter.in === "path") ?? [];
+		return [{
+			id: options.id ?? `signInThen${pascal(options.call)}`,
+			summary: `Sign in, then call ${options.call}`,
+			inputs: {
+				type: "object",
+				required: [
+					"email",
+					"password",
+					...pathParameters.map((p) => p.name)
+				],
+				properties: {
+					email: {
+						type: "string",
+						format: "email"
+					},
+					password: {
+						type: "string",
+						format: "password"
+					},
+					...Object.fromEntries(pathParameters.map((parameter) => [parameter.name, { type: "string" }]))
+				}
+			},
+			steps: [{
+				id: "signIn",
+				operationId: signIn,
+				requestBody: { payload: {
+					email: "$inputs.email",
+					password: "$inputs.password"
+				} },
+				successCriteria: [{ condition: "$statusCode == 200" }],
+				outputs: { accessToken: `$response.body#${pointer}` }
+			}, {
+				id: "call",
+				operationId: options.call,
+				parameters: [{
+					name: "Authorization",
+					in: "header",
+					value: "Bearer {$steps.signIn.outputs.accessToken}"
+				}, ...pathParameters.map(inputParameter)],
+				outputs: { body: "$response.body" },
+				onFailure: [{
+					name: "approvalRequired",
+					type: "end",
+					criteria: [{ condition: "$statusCode == 403" }, {
+						context: "$response.body",
+						condition: "$.code == 'APPROVAL_REQUIRED'",
+						type: "jsonpath"
+					}]
+				}]
+			}],
+			outputs: { body: "$steps.call.outputs.body" }
+		}];
+	};
+}
+//#endregion
+//#region src/arazzo/workflow.ts
+function isStandard(value) {
+	return typeof value === "object" && value !== null && "~standard" in value && typeof value["~standard"] === "object";
+}
+function inputsOf(inputs) {
+	if (!isStandard(inputs)) return inputs;
+	const converted = convertStandard(inputs, "input");
+	if (!converted) throw new TypeError("defineWorkflow: inputs is a Standard Schema without Standard JSON Schema; pass a JSON Schema instead");
+	return converted.schema;
+}
+function parametersOf(parameters) {
+	if (parameters === void 0) return;
+	if (Array.isArray(parameters)) return parameters.map((parameter) => parameter.in === void 0 ? {
+		name: parameter.name,
+		value: parameter.value
+	} : {
+		name: parameter.name,
+		in: parameter.in,
+		value: parameter.value
+	});
+	return Object.entries(parameters).map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+function criterionOf(criterion) {
+	return typeof criterion === "string" ? { condition: criterion } : { ...criterion };
+}
+function stepOf(step) {
+	const parameters = parametersOf(step.parameters);
+	let target = {};
+	if (step.operationId) target = { operationId: step.operationId };
+	else if (step.workflowId) target = { workflowId: step.workflowId };
+	else if (step.channel) target = { channel: step.channel };
+	return {
+		id: step.id,
+		...step.description === void 0 ? {} : { description: step.description },
+		...target,
+		...parameters === void 0 ? {} : { parameters },
+		...step.requestBody === void 0 ? {} : { requestBody: { payload: step.requestBody } },
+		...step.successCriteria === void 0 ? {} : { successCriteria: step.successCriteria.map(criterionOf) },
+		...step.outputs === void 0 ? {} : { outputs: { ...step.outputs } },
+		...step.onSuccess === void 0 ? {} : { onSuccess: step.onSuccess },
+		...step.onFailure === void 0 ? {} : { onFailure: step.onFailure }
+	};
+}
+/**
+* A workflow for `defineApi`'s `workflows`, rendered by `arazzoFormat`. Steps
+* name operations by operationId; pass the ids as `Op` (for example
+* `ResourceOperationIds<"customers">`) to type them. Rendering reports unknown
+* operationIds, steps that read outputs of later or unknown steps, and channel
+* steps outside Arazzo 1.1.
+*
+* ```ts
+* const onboarding = defineWorkflow<ResourceOperationIds<"customers">>({
+*   id: "onboardCustomer",
+*   inputs: { type: "object", properties: { row: { type: "object" } } },
+*   steps: [
+*     {
+*       id: "create",
+*       operationId: "createCustomers",
+*       requestBody: "$inputs.row",
+*       outputs: { id: "$response.body#/id" },
+*     },
+*     {
+*       id: "get",
+*       operationId: "getCustomers",
+*       parameters: { id: "$steps.create.outputs.id" },
+*     },
+*   ],
+* });
+* ```
+*/
+function defineWorkflow(workflow) {
+	return {
+		id: workflow.id,
+		...workflow.summary === void 0 ? {} : { summary: workflow.summary },
+		...workflow.description === void 0 ? {} : { description: workflow.description },
+		...workflow.inputs === void 0 ? {} : { inputs: inputsOf(workflow.inputs) },
+		steps: workflow.steps.map(stepOf),
+		...workflow.outputs === void 0 ? {} : { outputs: { ...workflow.outputs } }
+	};
+}
+//#endregion
+//#region src/overlay/path.ts
+const ESCAPES = {
+	b: "\b",
+	f: "\f",
+	n: "\n",
+	r: "\r",
+	t: "	",
+	"'": "'",
+	"\\": "\\",
+	"/": "/"
+};
+/**
+* Parses an RFC 9535 normalized path (§ 2.7), such as `$['paths'][0]`, into its
+* segments. Throws for anything else, because the engine promised one.
+*/
+function parseNormalizedPath(path) {
+	if (!path.startsWith("$")) throw new TypeError(`Not a normalized path: ${path}`);
+	const segments = [];
+	let i = 1;
+	while (i < path.length) {
+		if (path[i] !== "[") throw new TypeError(`Not a normalized path: ${path}`);
+		i += 1;
+		if (path[i] === "'") {
+			i += 1;
+			let name = "";
+			while (i < path.length && path[i] !== "'") {
+				const char = path[i] ?? "";
+				if (char !== "\\") {
+					name += char;
+					i += 1;
+					continue;
+				}
+				const next = path[i + 1] ?? "";
+				if (next === "u") {
+					name += String.fromCodePoint(Number.parseInt(path.slice(i + 2, i + 6), 16));
+					i += 6;
+					continue;
+				}
+				const escaped = ESCAPES[next];
+				if (escaped === void 0) throw new TypeError(`Not a normalized path: ${path}`);
+				name += escaped;
+				i += 2;
+			}
+			if (path[i] !== "'" || path[i + 1] !== "]") throw new TypeError(`Not a normalized path: ${path}`);
+			segments.push(name);
+			i += 2;
+			continue;
+		}
+		const end = path.indexOf("]", i);
+		const digits = end === -1 ? "" : path.slice(i, end);
+		if (!/^(?:0|[1-9]\d*)$/.test(digits)) throw new TypeError(`Not a normalized path: ${path}`);
+		segments.push(Number(digits));
+		i = end + 1;
+	}
+	return segments;
+}
+const SHORTHAND = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function quote(name) {
+	let out = "";
+	for (const char of name) {
+		const code = char.codePointAt(0) ?? 0;
+		if (char === "\\") out += "\\\\";
+		else if (char === "'") out += "\\'";
+		else if (char === "\b") out += "\\b";
+		else if (char === "\f") out += "\\f";
+		else if (char === "\n") out += "\\n";
+		else if (char === "\r") out += "\\r";
+		else if (char === "	") out += "\\t";
+		else if (code < 32) out += `\\u${code.toString(16).padStart(4, "0")}`;
+		else out += char;
+	}
+	return `['${out}']`;
+}
+/**
+* Formats segments as a readable RFC 9535 query: member-name shorthand for
+* plain names, bracket notation otherwise (`$.paths['/customers'].get`).
+*/
+function formatPath(segments) {
+	let out = "$";
+	for (const segment of segments) if (typeof segment === "number") out += `[${segment}]`;
+	else if (SHORTHAND.test(segment)) out += `.${segment}`;
+	else out += quote(segment);
+	return out;
+}
+/** Decodes one RFC 6901 reference token. */
+function decodePointerToken(token) {
+	return token.replaceAll("~1", "/").replaceAll("~0", "~");
+}
+//#endregion
+//#region src/overlay/apply.ts
+const ALLOW_EMPTY = "x-better-supabase-allow-empty";
+const REF_PREFIX = "#/components/actions/";
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isArray = (value) => Array.isArray(value);
+const kindOf$1 = (value) => Array.isArray(value) ? "array" : isObject(value) ? "object" : "primitive";
+function readMinor(version) {
+	if (typeof version !== "string") return;
+	const match = /^1\.([012])\.\d+$/.exec(version);
+	if (!match) return;
+	const minor = Number(match[1]);
+	return minor === 0 || minor === 1 || minor === 2 ? minor : void 0;
+}
+/**
+* An Action Object needs a string target; the other fields are read
+* defensively.
+*/
+const isAction = (entry) => typeof entry["target"] === "string";
+function report(reporter, severity, code, message, pointer) {
+	reporter.diagnostics.push({
+		code,
+		severity,
+		message,
+		pointer: `${reporter.prefix}${pointer}`
+	});
+}
+/**
+* Expands a Reusable Action Reference (Overlay 1.2 § 4.5.6) into a plain
+* action: the referenced `fields`, then the reference's own fields on top.
+*/
+function resolveReference(overlay, entry, pointer, reporter) {
+	const { $ref: ref, ...own } = entry;
+	if (typeof ref !== "string" || !ref.startsWith(REF_PREFIX)) {
+		report(reporter, "error", "overlay-ref-unresolved", `The reusable action reference ${String(ref)} does not point under ${REF_PREFIX}`, pointer);
+		return;
+	}
+	const name = decodePointerToken(ref.slice(21));
+	const components = "components" in overlay ? overlay.components : void 0;
+	const reusables = isObject(components) ? components["actions"] : void 0;
+	const reusable = isObject(reusables) && Object.hasOwn(reusables, name) ? reusables[name] : void 0;
+	if (!isObject(reusable)) {
+		report(reporter, "error", "overlay-ref-unresolved", `The reusable action ${ref} does not exist in components.actions`, pointer);
+		return;
+	}
+	const fields = isObject(reusable["fields"]) ? { ...reusable["fields"] } : {};
+	if ("target" in fields) {
+		report(reporter, "warning", "overlay-invalid-action", `The reusable action ${ref} sets target, which only the reference may set; it is ignored`, pointer);
+		delete fields["target"];
+	}
+	return {
+		...fields,
+		...own
+	};
+}
+function resolve(document, segments) {
+	let parent = void 0;
+	let key = void 0;
+	let value = document;
+	for (const segment of segments) {
+		parent = value;
+		key = segment;
+		value = typeof segment === "number" ? Array.isArray(value) ? value[segment] : void 0 : isObject(value) ? value[segment] : void 0;
+	}
+	return {
+		parent,
+		key,
+		value
+	};
+}
+const escapeToken = (segment) => `/${String(segment).replaceAll("~", "~0").replaceAll("/", "~1")}`;
+const toPointer = (segments) => segments.map(escapeToken).join("");
+/**
+* Merges `source` into `target` recursively (§ 4.5.4.1) and collects the
+* conflicting pointers.
+*/
+function mergeInto(target, source, at, conflicts) {
+	for (const [key, value] of Object.entries(source)) {
+		if (!Object.hasOwn(target, key)) {
+			target[key] = value;
+			continue;
+		}
+		const current = target[key];
+		if (kindOf$1(current) !== kindOf$1(value)) {
+			conflicts.push(`${at}${escapeToken(key)}`);
+			continue;
+		}
+		if (isObject(current) && isObject(value)) mergeInto(current, value, `${at}${escapeToken(key)}`, conflicts);
+		else if (isArray(current) && isArray(value)) current.push(...value);
+		else target[key] = value;
+	}
+}
+function select(state, expression, options, reporter, pointer, field) {
+	try {
+		return options.jsonpath.paths(state.document, expression).map(parseNormalizedPath);
+	} catch (error) {
+		report(reporter, "error", "overlay-invalid-target", `The ${field} ${JSON.stringify(expression)} is not a valid RFC 9535 query: ${error instanceof Error ? error.message : String(error)}`, pointer);
+		return;
+	}
+}
+function removeNodes(state, targets, reporter, pointer) {
+	const fromArrays = /* @__PURE__ */ new Map();
+	for (const segments of targets) {
+		const { parent, key } = resolve(state.document, segments);
+		if (key === void 0) {
+			report(reporter, "error", "overlay-invalid-action", "The action removes the document root, which is not allowed", pointer);
+			continue;
+		}
+		if (Array.isArray(parent) && typeof key === "number") {
+			const indexes = fromArrays.get(parent) ?? [];
+			indexes.push(key);
+			fromArrays.set(parent, indexes);
+		} else if (isObject(parent) && typeof key === "string") delete parent[key];
+	}
+	for (const [array, indexes] of fromArrays) for (const index of [...new Set(indexes)].toSorted((a, b) => b - a)) array.splice(index, 1);
+}
+function updateNodes(state, targets, value, reporter, pointer) {
+	const nodes = targets.map((segments) => ({
+		segments,
+		...resolve(state.document, segments)
+	}));
+	const kinds = new Set(nodes.map((node) => kindOf$1(node.value)));
+	if (kinds.size > 1) {
+		report(reporter, "error", "overlay-mixed-targets", `The target selects ${[...kinds].join(" and ")} nodes; an update needs nodes of one kind`, pointer);
+		return;
+	}
+	const valueKind = kindOf$1(value);
+	for (const node of nodes) {
+		const copy = structuredClone(value);
+		const at = toPointer(node.segments) || "the root";
+		if (isArray(node.value)) {
+			if (isArray(copy)) node.value.push(...copy);
+			else node.value.push(copy);
+			continue;
+		}
+		if (isObject(node.value)) {
+			if (!isObject(copy)) {
+				report(reporter, "error", "overlay-merge-conflict", `Cannot merge a${valueKind === "array" ? "n array" : " primitive"} into the object at ${at}`, pointer);
+				continue;
+			}
+			const conflicts = [];
+			mergeInto(node.value, copy, toPointer(node.segments), conflicts);
+			for (const conflict of conflicts) report(reporter, "error", "overlay-merge-conflict", `Cannot merge values of different kinds at ${conflict}`, pointer);
+			continue;
+		}
+		if (valueKind !== "primitive") {
+			report(reporter, "error", "overlay-merge-conflict", `Cannot replace the primitive at ${at} with a${valueKind === "array" ? "n array" : "n object"}`, pointer);
+			continue;
+		}
+		if (node.key === void 0) state.document = copy;
+		else if (Array.isArray(node.parent) && typeof node.key === "number") node.parent[node.key] = copy;
+		else if (isObject(node.parent) && typeof node.key === "string") node.parent[node.key] = copy;
+	}
+}
+function runAction(state, action, minor, options, reporter, pointer) {
+	if (action.remove !== true && action.update === void 0 && action.copy !== void 0 && minor === 0) {
+		report(reporter, "error", "overlay-version-feature", "copy needs Overlay 1.1 or later; the action is skipped", pointer);
+		return;
+	}
+	const targets = select(state, action.target, options, reporter, pointer, "target");
+	if (!targets) return;
+	if (targets.length === 0) {
+		if (action[ALLOW_EMPTY] !== true && options.allowEmpty !== true) report(reporter, "error", "overlay-no-match", `The target ${action.target} selects no nodes; set ${ALLOW_EMPTY}: true on the action if that is expected`, pointer);
+		return;
+	}
+	if (action.remove === true) {
+		removeNodes(state, targets, reporter, pointer);
+		return;
+	}
+	if (action.update !== void 0) {
+		updateNodes(state, targets, action.update, reporter, pointer);
+		return;
+	}
+	if (typeof action.copy === "string") {
+		const sources = select(state, action.copy, options, reporter, pointer, "copy source");
+		if (!sources) return;
+		const [source] = sources;
+		if (sources.length !== 1 || !source) {
+			report(reporter, "error", "overlay-copy-source", `The copy source ${action.copy} selects ${sources.length} nodes; it must select exactly one`, pointer);
+			return;
+		}
+		updateNodes(state, targets, resolve(state.document, source).value, reporter, pointer);
+		return;
+	}
+	report(reporter, "warning", "overlay-empty-action", "The action has no update, copy or remove, so it changes nothing", pointer);
+}
+/** Applies one overlay to `state.document` in place. */
+function applyInPlace(state, overlay, options, reporter) {
+	const minor = readMinor(overlay.overlay);
+	if (minor === void 0) {
+		report(reporter, "error", "overlay-version-unsupported", `Overlay version ${overlay.overlay} is not supported; use 1.0.x, 1.1.x or 1.2.x`, "/overlay");
+		return;
+	}
+	if (!Array.isArray(overlay.actions)) {
+		report(reporter, "error", "overlay-invalid-action", "The overlay has no actions array", "/actions");
+		return;
+	}
+	const actions = overlay.actions;
+	for (const [index, entry] of actions.entries()) {
+		const pointer = `/actions/${index}`;
+		if (!isObject(entry)) {
+			report(reporter, "error", "overlay-invalid-action", "The action is not an object", pointer);
+			continue;
+		}
+		if ("$ref" in entry && minor < 2) report(reporter, "warning", "overlay-version-feature", `Reusable actions need Overlay 1.2; the reference is expanded for this ${overlay.overlay} overlay`, pointer);
+		const action = "$ref" in entry ? resolveReference(overlay, entry, pointer, reporter) : entry;
+		if (!action) continue;
+		if (!isAction(action)) {
+			report(reporter, "error", "overlay-invalid-action", "The action has no target", pointer);
+			continue;
+		}
+		runAction(state, action, minor, options, reporter, pointer);
+	}
+}
+/**
+* Applies an Overlay 1.0, 1.1 or 1.2 document to `document` and returns a new
+* document. The input is cloned once with `structuredClone` and never changed;
+* each target runs once through `options.jsonpath`.
+*
+* Actions run in order, each on the result of the previous one (Overlay §
+* 4.5.1.1). `update` merges objects, concatenates or appends to arrays and
+* replaces primitives; `remove` deletes the selected nodes; `copy` (1.1 and
+* later) uses the value of the single node its query selects. Reusable action
+* references (1.2) are expanded, with a warning when the overlay declares 1.0
+* or 1.1.
+*
+* Problems never throw: they are diagnostics, and the failing action is
+* skipped. A target that selects nothing reports `overlay-no-match` as an error
+* unless the action sets `x-better-supabase-allow-empty: true` or the options
+* set `allowEmpty`. The other codes are `overlay-invalid-target`,
+* `overlay-invalid-action`, `overlay-mixed-targets`, `overlay-merge-conflict`,
+* `overlay-copy-source`, `overlay-ref-unresolved`, `overlay-version-feature`,
+* `overlay-version-unsupported` and `overlay-empty-action`.
+*
+* The result keeps the input's type; an overlay that changes the shape needs
+* the caller to narrow it.
+*
+* @example
+*   const jsonpath = await loadJsonPath();
+*   const { document, diagnostics } = applyOverlay(openapi, overlay, {
+*     jsonpath,
+*   });
+*/
+function applyOverlay(document, overlay, options) {
+	return run(document, [overlay], options, () => "");
+}
+/**
+* Applies overlays in order, each to the result of the previous one, with a
+* single clone of the input. Diagnostic pointers start with the overlay's index
+* (`/1/actions/0`).
+*/
+function applyOverlays(document, overlays, options) {
+	return run(document, overlays, options, (index) => `/${index}`);
+}
+function run(document, overlays, options, prefix) {
+	const state = { document: structuredClone(document) };
+	const diagnostics = [];
+	for (const [index, overlay] of overlays.entries()) applyInPlace(state, overlay, options, {
+		prefix: prefix(index),
+		diagnostics
+	});
+	return {
+		document: state.document,
+		diagnostics
+	};
+}
+//#endregion
+//#region src/overlay/define.ts
+const isReference = (action) => "$ref" in action;
+const isPlain = (action) => !("$ref" in action);
+function defineOverlay(input) {
+	const { overlay: declared, ...rest } = input;
+	if (input.actions.length === 0) throw new TypeError("defineOverlay: an overlay needs at least one action");
+	const references = input.actions.filter(isReference);
+	const uses12 = input.components !== void 0 || input.$self !== void 0 || references.length > 0;
+	const version = declared ?? (uses12 ? "1.2.0" : "1.1.0");
+	if (version !== "1.2.0" && uses12) throw new TypeError(`defineOverlay: reusable actions, components and $self need overlay 1.2.0, not ${version}`);
+	if (version === "1.0.0" && input.actions.some((action) => !isReference(action) && action.copy !== void 0)) throw new TypeError("defineOverlay: copy needs overlay 1.1.0 or later");
+	for (const field of ["extends", "$self"]) if (input[field]?.includes("#")) throw new TypeError(`defineOverlay: ${field} must not contain a fragment`);
+	const reusables = input.components?.actions ?? {};
+	for (const reference of references) {
+		const name = decodePointerToken(reference.$ref.slice(21));
+		if (!Object.hasOwn(reusables, name)) throw new TypeError(`defineOverlay: ${reference.$ref} does not exist in components.actions`);
+	}
+	switch (version) {
+		case "1.2.0": return {
+			overlay: version,
+			...rest
+		};
+		case "1.1.0":
+		case "1.0.0": return {
+			overlay: version,
+			...rest,
+			actions: input.actions.filter(isPlain)
+		};
+		default: throw new TypeError(`defineOverlay: unsupported overlay ${String(version)}`);
+	}
+}
+/**
+* Turns an overlay into an equivalent Overlay 1.1 document for tools that do
+* not read 1.2: every reusable action reference becomes a plain action, and
+* `$self` and `components` are dropped. A reference that does not resolve is
+* left out and reported as `overlay-ref-unresolved`.
+*/
+function expandReusableActions(overlay) {
+	const reporter = {
+		prefix: "",
+		diagnostics: []
+	};
+	const actions = [];
+	const entries = overlay.actions;
+	for (const [index, entry] of entries.entries()) {
+		if (!isObject(entry)) continue;
+		const action = "$ref" in entry ? resolveReference(overlay, entry, `/actions/${index}`, reporter) : entry;
+		if (action && isAction(action)) actions.push(action);
+	}
+	const extensions = Object.fromEntries(Object.entries(overlay).filter(([key]) => key.startsWith("x-")));
+	return {
+		overlay: {
+			overlay: "1.1.0",
+			info: overlay.info,
+			...overlay.extends === void 0 ? {} : { extends: overlay.extends },
+			actions,
+			...extensions
+		},
+		diagnostics: reporter.diagnostics
+	};
+}
+//#endregion
+//#region src/overlay/diff.ts
+const kindOf = (value) => Array.isArray(value) ? "array" : isObject(value) ? "object" : "primitive";
+function equal(a, b) {
+	if (a === b) return true;
+	if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((item, i) => equal(item, b[i]));
+	if (isObject(a) && isObject(b)) {
+		const keys = Object.keys(a);
+		return keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && equal(a[key], b[key]));
+	}
+	return false;
+}
+/**
+* Appends the actions that turn the array `a` into `b`, or returns `false` when
+* the change needs the array replaced as a whole.
+*/
+function diffArray(path, a, b, ctx) {
+	if (b.length >= a.length && a.every((item, i) => equal(item, b[i]))) {
+		if (b.length > a.length) ctx.actions.push({
+			target: formatPath(path),
+			update: b.slice(a.length)
+		});
+		return true;
+	}
+	if (a.length !== b.length) return false;
+	const pending = [];
+	for (const [i, item] of a.entries()) {
+		const next = b[i];
+		if (equal(item, next)) continue;
+		if (!isObject(item) || !isObject(next)) return false;
+		diffObject([...path, i], item, next, {
+			...ctx,
+			actions: pending
+		});
+	}
+	ctx.actions.push(...pending);
+	return true;
+}
+function diffObject(path, a, b, ctx) {
+	const removals = [];
+	const added = {};
+	const nested = [];
+	const replace = (key, value) => {
+		removals.push({
+			target: formatPath([...path, key]),
+			remove: true
+		});
+		added[key] = value;
+	};
+	for (const key of Object.keys(a)) if (!Object.hasOwn(b, key)) removals.push({
+		target: formatPath([...path, key]),
+		remove: true
+	});
+	for (const [key, next] of Object.entries(b)) {
+		if (!Object.hasOwn(a, key)) {
+			added[key] = next;
+			continue;
+		}
+		const current = a[key];
+		if (equal(current, next)) continue;
+		if (kindOf(current) !== kindOf(next)) replace(key, next);
+		else if (isObject(current) && isObject(next)) diffObject([...path, key], current, next, {
+			...ctx,
+			actions: nested
+		});
+		else if (Array.isArray(current) && Array.isArray(next)) {
+			if (!diffArray([...path, key], current, next, {
+				...ctx,
+				actions: nested
+			})) replace(key, next);
+		} else if (ctx.replacePrimitives) nested.push({
+			target: formatPath([...path, key]),
+			update: next
+		});
+		else replace(key, next);
+	}
+	ctx.actions.push(...removals);
+	if (Object.keys(added).length > 0) ctx.actions.push({
+		target: formatPath(path),
+		update: added
+	});
+	ctx.actions.push(...nested);
+}
+/**
+* Writes the Overlay that turns `base` into `enriched`, so other tools can
+* reproduce what hooks and transforms changed. Targets use stable keys
+* (`$.paths['/customers'].get`); array indexes appear only inside arrays of the
+* same length.
+*
+* A deleted key becomes a `remove` action; added keys become one `update` on
+* their parent; a changed primitive becomes an `update` on it (1.1 and later)
+* or a `remove` and re-add (1.0). An array that only grew gets its new items
+* appended; any other array change replaces the array. Applying the result to
+* `base` gives a document equal to `enriched`, though replaced keys move to the
+* end of their object.
+*
+* Throws a `TypeError` when the roots are not both objects, or when the two
+* documents are equal (an overlay needs at least one action).
+*/
+function overlayFromDiff(base, enriched, options = {}) {
+	if (!isObject(base) || !isObject(enriched)) throw new TypeError("overlayFromDiff: both documents must be objects");
+	const version = options.version ?? "1.1.0";
+	const actions = [];
+	diffObject([], base, enriched, {
+		replacePrimitives: version !== "1.0.0",
+		actions
+	});
+	if (actions.length === 0) throw new TypeError("overlayFromDiff: the documents are equal, so there is nothing to write");
+	return {
+		overlay: version,
+		info: options.info ?? {
+			title: "better-supabase changes",
+			version: "1.0.0"
+		},
+		...options.extends === void 0 ? {} : { extends: options.extends },
+		actions
+	};
+}
+//#endregion
+//#region src/overlay/load.ts
+const isEngine = (value) => typeof value === "object" && value !== null && "paths" in value && typeof value.paths === "function";
+/**
+* Imports `jsonpath-rfc9535` on first use. The specifier is a variable so
+* bundlers leave the optional peer out of apps that pass their own engine.
+*/
+const importEngine = () => importOptionalPeer("jsonpath-rfc9535");
+async function load(importer) {
+	const module = await importer();
+	if (!isEngine(module)) throw new TypeError("Overlays need an RFC 9535 JSONPath engine: pnpm add jsonpath-rfc9535, or pass your own { paths(document, expression) }");
+	return module;
+}
+const cachedEngine = memoized(() => load(importEngine));
+/**
+* Loads the optional `jsonpath-rfc9535` peer, an RFC 9535 implementation that
+* passes the JSONPath Compliance Test Suite, for `applyOverlay`. Rejects with
+* an install message when the package is missing. The engine is loaded once per
+* module; `importer` replaces the import in tests.
+*/
+function loadJsonPath(importer) {
+	if (importer) return load(importer);
+	return cachedEngine();
+}
+//#endregion
+export { ASYNCAPI_FILE_NAME, CLOUD_EVENT_TRAIT, DEFAULT_ERRORS, OPENAPI_33_PREVIEW_VERSION, PROBLEM_SCHEMA, SPEC_UIS, SPEC_UI_PACKAGES, applyOverlay, applyOverlays, arazzoFormat, asyncapiFormat, authWorkflow, buildApiModel, createArazzo, createArazzoFormat, createAsyncApi, createOpenApi, createThenGetWorkflows, defineApi, defineDocumentFormat, defineOverlay, defineWorkflow, expandReusableActions, functionRoute, loadJsonPath, mergeJson, openapiFormat, overlayFromDiff, paginationWorkflows, pointerToken, scalarPreset, serializeDocument, specReference, specReferenceCsp, specReferenceHtml, specResponse, toOpenApi30Schema, topicsFrom };