acrylblends 1.0.3 → 1.0.5

package/lib/app-base-CpRMZL4v.js

@@ -0,0 +1,332 @@
+import { t as compose } from "./compose-BuW2B6PZ.js";
+import { i as getPathNoStrict, l as mergePath, r as getPath } from "./url-BPh4d6j-.js";
+import { t as Context } from "./context-CkOh7Ygv.js";
+import { n as METHODS } from "./router-Be_o6nFu.js";
+import { t as COMPOSED_HANDLER } from "./constants-CBSEudrb.js";
+//#region ../../plugins/acryl-router/src/core/app-base.ts
+/**
+* @module
+* This module is the base module for the Acryl object.
+*/
+const notFoundHandler = (c) => {
+	return c.text("404 Not Found", 404);
+};
+const errorHandler = (err, c) => {
+	if ("getResponse" in err) {
+		const res = err.getResponse();
+		return c.newResponse(res.body, res);
+	}
+	console.error(err);
+	return c.text("Internal Server Error", 500);
+};
+var Acryl = class Acryl {
+	get;
+	post;
+	put;
+	delete;
+	options;
+	patch;
+	query;
+	all;
+	on;
+	use;
+	router;
+	getPath;
+	_basePath = "/";
+	#path = "/";
+	routes = [];
+	constructor(options = {}) {
+		[...METHODS, "all"].forEach((method) => {
+			this[method] = (args1, ...args) => {
+				const methodName = method.toUpperCase();
+				if (typeof args1 === "string") this.#path = args1;
+				else this.#addRoute(methodName, this.#path, args1);
+				args.forEach((handler) => {
+					this.#addRoute(methodName, this.#path, handler);
+				});
+				return this;
+			};
+		});
+		this.on = (method, path, ...handlers) => {
+			for (const p of [path].flat()) {
+				this.#path = p;
+				for (const m of [method].flat()) {
+					const methodName = m.toUpperCase();
+					for (const handler of handlers) this.#addRoute(methodName, this.#path, handler);
+				}
+			}
+			return this;
+		};
+		this.use = (arg1, ...handlers) => {
+			if (typeof arg1 === "string") this.#path = arg1;
+			else {
+				this.#path = "*";
+				handlers.unshift(arg1);
+			}
+			handlers.forEach((handler) => {
+				this.#addRoute("ALL", this.#path, handler);
+			});
+			return this;
+		};
+		const { strict, ...optionsWithoutStrict } = options;
+		Object.assign(this, optionsWithoutStrict);
+		this.getPath = strict ?? true ? options.getPath ?? getPath : getPathNoStrict;
+	}
+	#clone() {
+		const clone = new Acryl({
+			router: this.router,
+			getPath: this.getPath
+		});
+		clone.errorHandler = this.errorHandler;
+		clone.#notFoundHandler = this.#notFoundHandler;
+		clone.routes = this.routes;
+		return clone;
+	}
+	#notFoundHandler = notFoundHandler;
+	errorHandler = errorHandler;
+	/**
+	* `.route()` allows grouping other Acryl instance in routes.
+	*
+	*
+	* @param {string} path - base Path
+	* @param {Acryl} app - other Acryl instance
+	* @returns {Acryl} routed Acryl instance
+	*
+	* @example
+	* ```ts
+	* const app = new Acryl()
+	* const app2 = new Acryl()
+	*
+	* app2.get("/user", (c) => c.text("user"))
+	* app.route("/api", app2) // GET /api/user
+	* ```
+	*/
+	route(path, app) {
+		const subApp = this.basePath(path);
+		app.routes.map((r) => {
+			let handler;
+			if (app.errorHandler === errorHandler) handler = r.handler;
+			else {
+				handler = async (c, next) => (await compose([], app.errorHandler)(c, () => r.handler(c, next))).res;
+				handler[COMPOSED_HANDLER] = r.handler;
+			}
+			subApp.#addRoute(r.method, r.path, handler, r.basePath);
+		});
+		return this;
+	}
+	/**
+	* `.basePath()` allows base paths to be specified.
+	*
+	*
+	* @param {string} path - base Path
+	* @returns {Acryl} changed Acryl instance
+	*
+	* @example
+	* ```ts
+	* const api = new Acryl().basePath('/api')
+	* ```
+	*/
+	basePath(path) {
+		const subApp = this.#clone();
+		subApp._basePath = mergePath(this._basePath, path);
+		return subApp;
+	}
+	/**
+	* `.onError()` handles an error and returns a customized Response.
+	*
+	*
+	* @param {ErrorHandler} handler - request Handler for error
+	* @returns {Acryl} changed Acryl instance
+	*
+	* @example
+	* ```ts
+	* app.onError((err, c) => {
+	*   console.error(`${err}`)
+	*   return c.text('Custom Error Message', 500)
+	* })
+	* ```
+	*/
+	onError = (handler) => {
+		this.errorHandler = handler;
+		return this;
+	};
+	/**
+	* `.notFound()` allows you to customize a Not Found Response.
+	*
+	*
+	* @param {NotFoundHandler} handler - request handler for not-found
+	* @returns {Acryl} changed Acryl instance
+	*
+	* @example
+	* ```ts
+	* app.notFound((c) => {
+	*   return c.text('Custom 404 Message', 404)
+	* })
+	* ```
+	*/
+	notFound = (handler) => {
+		this.#notFoundHandler = handler;
+		return this;
+	};
+	/**
+	* `.mount()` allows you to mount applications built with other frameworks into your Acryl application.
+	*
+	* @deprecated Use `mount()` from `acryl-router/mount` instead. `.mount()` will be removed in v5.
+	*
+	*
+	* @param {string} path - base Path
+	* @param {Function} applicationHandler - other Request Handler
+	* @param {MountOptions} [options] - options of `.mount()`
+	* @returns {Acryl} mounted Acryl instance
+	*
+	* @example
+	* ```ts
+	* import { Router as IttyRouter } from 'itty-router'
+	* import { Acryl } from 'acrylblends'
+	* // Create itty-router application
+	* const ittyRouter = IttyRouter()
+	* // GET /itty-router/hello
+	* ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
+	*
+	* const app = new Acryl()
+	* app.mount('/itty-router', ittyRouter.handle)
+	* ```
+	*
+	* @example
+	* ```ts
+	* const app = new Acryl()
+	* // Send the request to another application without modification.
+	* app.mount('/app', anotherApp, {
+	*   replaceRequest: (req) => req,
+	* })
+	* ```
+	*/
+	mount(path, applicationHandler, options) {
+		let replaceRequest;
+		let optionHandler;
+		if (options) if (typeof options === "function") optionHandler = options;
+		else {
+			optionHandler = options.optionHandler;
+			if (options.replaceRequest === false) replaceRequest = (request) => request;
+			else replaceRequest = options.replaceRequest;
+		}
+		const getOptions = optionHandler ? (c) => {
+			const options = optionHandler(c);
+			return Array.isArray(options) ? options : [options];
+		} : (c) => {
+			let executionContext = void 0;
+			try {
+				executionContext = c.executionCtx;
+			} catch {}
+			return [c.env, executionContext];
+		};
+		replaceRequest ||= (() => {
+			const mergedPath = mergePath(this._basePath, path);
+			const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
+			return (request) => {
+				const url = new URL(request.url);
+				url.pathname = this.getPath(request).slice(pathPrefixLength) || "/";
+				return new Request(url, request);
+			};
+		})();
+		const handler = async (c, next) => {
+			const res = await applicationHandler(replaceRequest(c.req.raw), ...getOptions(c));
+			if (res) return res;
+			await next();
+		};
+		this.#addRoute("ALL", mergePath(path, "*"), handler);
+		return this;
+	}
+	#addRoute(method, path, handler, baseRoutePath) {
+		path = mergePath(this._basePath, path);
+		const r = {
+			basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
+			path,
+			method,
+			handler
+		};
+		this.router.add(method, path, [handler, r]);
+		this.routes.push(r);
+	}
+	#handleError(err, c) {
+		if (err instanceof Error) return this.errorHandler(err, c);
+		throw err;
+	}
+	#dispatch(request, executionCtx, env, method) {
+		if (method === "HEAD") return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
+		const path = this.getPath(request, { env });
+		const matchResult = this.router.match(method, path);
+		const c = new Context(request, {
+			path,
+			matchResult,
+			env,
+			executionCtx,
+			notFoundHandler: this.#notFoundHandler
+		});
+		if (matchResult[0].length === 1) {
+			let res;
+			try {
+				res = matchResult[0][0][0][0](c, async () => {
+					c.res = await this.#notFoundHandler(c);
+				});
+			} catch (err) {
+				return this.#handleError(err, c);
+			}
+			return res instanceof Promise ? res.then((resolved) => resolved || (c.finalized ? c.res : this.#notFoundHandler(c))).catch((err) => this.#handleError(err, c)) : res ?? this.#notFoundHandler(c);
+		}
+		const composed = compose(matchResult[0], this.errorHandler, this.#notFoundHandler);
+		return (async () => {
+			try {
+				const context = await composed(c);
+				if (!context.finalized) throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");
+				return context.res;
+			} catch (err) {
+				return this.#handleError(err, c);
+			}
+		})();
+	}
+	/**
+	* `.fetch()` will be entry point of your app.
+	*
+	*
+	* @param {Request} request - request Object of request
+	* @param {Env} env - env Object
+	* @param {ExecutionContext} executionCtx - context of execution
+	* @returns {Response | Promise<Response>} response of request
+	*
+	*/
+	fetch = (request, ...rest) => {
+		return this.#dispatch(request, rest[1], rest[0], request.method);
+	};
+	/**
+	* `.request()` is a useful method for testing.
+	* You can pass a URL or pathname to send a GET request.
+	* app will return a Response object.
+	* ```ts
+	* test('GET /hello is ok', async () => {
+	*   const res = await app.request('/hello')
+	*   expect(res.status).toBe(200)
+	* })
+	* ```
+	*/
+	request = (input, requestInit, Env, executionCtx) => {
+		if (input instanceof Request) return this.fetch(requestInit ? new Request(input, requestInit) : input, Env, executionCtx);
+		input = input.toString();
+		return this.fetch(new Request(/^https?:\/\//.test(input) ? input : `http://localhost${mergePath("/", input)}`, requestInit), Env, executionCtx);
+	};
+	/**
+	* `.fire()` automatically adds a global fetch event listener.
+	* This can be useful for environments that adhere to the Service Worker API, such as non-ES module Cloudflare Workers.
+	* @deprecated
+	* ACRYL ships no service-worker adapter: mount the app with `ctx.router.route(path, app)` and serve it through an ACRYL adapter instead.
+	* @see https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API
+	* @see https://developers.cloudflare.com/workers/reference/migrate-to-module-workers/
+	*/
+	fire = () => {
+		addEventListener("fetch", (event) => {
+			event.respondWith(this.#dispatch(event.request, event, void 0, event.request.method));
+		});
+	};
+};
+//#endregion
+export { Acryl as t };

package/lib/{audit-BXnYsLge.d.ts → audit-D5z9uwOP.d.ts}

@@ -1,4 +1,4 @@
-import { _ as UiResult, g as UiRequest, n as ChannelToHost, t as AuditEntry } from "./protocol-BizVt4J6.js";
+import { _ as UiRequest, n as AuditEntry, r as ChannelToHost, v as UiResult } from "./protocol-C37gPePD.js";
 
 //#region ../../plugins/acryl-door/src/host/channel.d.ts
 /** The slice of a page's stream the channel needs, so tests can supply their own. */
@@ -12,6 +12,8 @@ declare class UiChannel {
   private nextId;
   private clock;
   private closed;
+  /** Callers waiting for a page to (re)connect: each is told once, by the next stream that attaches. */
+  private readonly attachWaiters;
   /**
    * Register a page's stream. A stream already open for the same window is closed first, and its calls settle as `disconnected`.
    * @returns the function to call when this stream ends.
@@ -34,6 +36,17 @@ declare class UiChannel {
     signal?: AbortSignal;
     timeoutMs?: number;
   }): Promise<UiResult>;
+  /**
+   * A promise for the next time a page connects (a page that reloaded or moved opens a new stream). Ask for it BEFORE the call that makes the page leave, or a fast page is missed.
+   * @returns whether a page connected within `timeoutMs`.
+   */
+  expectAttach(timeoutMs: number, count?: number): Promise<boolean>;
+  /**
+   * Ask every connected page to reload (the app just changed under them) and wait, up to `timeoutMs`, for them to come back. Best effort: a page that does not come back
+   * (it was closed, or it moved to a page without the door) is not an error here.
+   * @returns how many pages were asked.
+   */
+  reloadAll(timeoutMs?: number): Promise<number>;
   /** Close every page's stream and settle every pending call as `unloaded`. */
   close(): void;
   private byRecency;

package/lib/{base-NSN_SNv-.js → base-D_6kfOr-.js}

@@ -1,4 +1,4 @@
-import { escapeToBuffer, raw, resolveCallbackSync, stringBufferToString } from "./utils/html.js";
+import { a as resolveCallbackSync, n as escapeToBuffer, o as stringBufferToString, r as raw } from "./html-DGExBFNg.js";
 import { i as DOM_RENDERER, n as DOM_INTERNAL_TAG, o as PERMALINK, r as DOM_MEMO, t as DOM_ERROR_HANDLER } from "./constants-BR9jM9BC.js";
 import "node:module";
 //#region \0rolldown/runtime.js

package/lib/basic-auth-C0HTRpXh.js

@@ -0,0 +1,20 @@
+import { t as decodeBase64 } from "./encode-BhbNLrjp.js";
+//#region ../../plugins/acryl-router/src/core/utils/basic-auth.ts
+const CREDENTIALS_REGEXP = /^ *(?:[Bb][Aa][Ss][Ii][Cc]) +([A-Za-z0-9._~+/-]+=*) *$/;
+const USER_PASS_REGEXP = /^([^:]*):(.*)$/;
+const utf8Decoder = new TextDecoder();
+const auth = (req) => {
+	const match = CREDENTIALS_REGEXP.exec(req.headers.get("Authorization") || "");
+	if (!match) return;
+	let userPass = void 0;
+	try {
+		userPass = USER_PASS_REGEXP.exec(utf8Decoder.decode(decodeBase64(match[1])));
+	} catch {}
+	if (!userPass) return;
+	return {
+		username: userPass[1],
+		password: userPass[2]
+	};
+};
+//#endregion
+export { auth as t };

package/lib/basic-auth-DFLflXNe.js

@@ -0,0 +1,95 @@
+import { t as HTTPException } from "./http-exception-MjWkT89V.js";
+import { i as timingSafeEqual } from "./buffer-CkEOJCcY.js";
+import { t as auth } from "./basic-auth-C0HTRpXh.js";
+//#region ../../plugins/acryl-router/src/core/middleware/basic-auth/index.ts
+/**
+* Basic Auth Middleware for Acryl.
+*
+*
+* @param {BasicAuthOptions} options - The options for the basic authentication middleware.
+* @param {string} options.username - The username for authentication.
+* @param {string} options.password - The password for authentication.
+* @param {string} [options.realm="Secure Area"] - The realm attribute for the WWW-Authenticate header.
+* @param {Function} [options.hashFunction] - The hash function used for secure comparison.
+* @param {Function} [options.verifyUser] - The function to verify user credentials.
+* @param {string | object | MessageFunction} [options.invalidUserMessage="Unauthorized"] - The invalid user message.
+* @param {Function} [options.onAuthSuccess] - Callback function called on successful authentication.
+* @returns {MiddlewareHandler} The middleware handler function.
+* @throws {HTTPException} If neither "username and password" nor "verifyUser" options are provided.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use(
+*   '/auth/*',
+*   basicAuth({
+*     username: process.env.BASIC_AUTH_USERNAME,
+*     password: process.env.BASIC_AUTH_PASSWORD,
+*   })
+* )
+*
+* app.get('/auth/page', (c) => {
+*   return c.text('You are authorized')
+* })
+* ```
+*
+* @example
+* ```ts
+* // With onAuthSuccess callback
+* app.use(
+*   '/auth/*',
+*   basicAuth({
+*     username: process.env.BASIC_AUTH_USERNAME,
+*     password: process.env.BASIC_AUTH_PASSWORD,
+*     onAuthSuccess: (c, username) => {
+*       c.set('user', { name: username, role: 'admin' })
+*       console.log(`User ${username} authenticated`)
+*     },
+*   })
+* )
+* ```
+*/
+const basicAuth = (options, ...users) => {
+	const usernamePasswordInOptions = "username" in options && "password" in options;
+	const verifyUserInOptions = "verifyUser" in options;
+	if (!(usernamePasswordInOptions || verifyUserInOptions)) throw new Error("basic auth middleware requires options for \"username and password\" or \"verifyUser\"");
+	if (!options.realm) options.realm = "Secure Area";
+	if (!options.invalidUserMessage) options.invalidUserMessage = "Unauthorized";
+	if (usernamePasswordInOptions) users.unshift({
+		username: options.username,
+		password: options.password
+	});
+	return async function basicAuth(ctx, next) {
+		const requestUser = auth(ctx.req.raw);
+		if (requestUser) if (verifyUserInOptions) {
+			if (await options.verifyUser(requestUser.username, requestUser.password, ctx)) {
+				if (options.onAuthSuccess) await options.onAuthSuccess(ctx, requestUser.username);
+				await next();
+				return;
+			}
+		} else for (const user of users) {
+			const [usernameEqual, passwordEqual] = await Promise.all([timingSafeEqual(user.username, requestUser.username, options.hashFunction), timingSafeEqual(user.password, requestUser.password, options.hashFunction)]);
+			if (usernameEqual && passwordEqual) {
+				if (options.onAuthSuccess) await options.onAuthSuccess(ctx, requestUser.username);
+				await next();
+				return;
+			}
+		}
+		const status = 401;
+		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/"/g, "\\\"") + "\"" };
+		const responseMessage = typeof options.invalidUserMessage === "function" ? await options.invalidUserMessage(ctx) : options.invalidUserMessage;
+		throw new HTTPException(status, { res: typeof responseMessage === "string" ? new Response(responseMessage, {
+			status,
+			headers
+		}) : new Response(JSON.stringify(responseMessage), {
+			status,
+			headers: {
+				...headers,
+				"content-type": "application/json"
+			}
+		}) });
+	};
+};
+//#endregion
+export { basicAuth as t };

package/lib/basic-auth.js

@@ -1,95 +1,2 @@
-import { HTTPException } from "./http-exception.js";
-import { timingSafeEqual } from "./utils/buffer.js";
-import { auth } from "./utils/basic-auth.js";
-//#region ../../plugins/acryl-router/src/core/middleware/basic-auth/index.ts
-/**
-* Basic Auth Middleware for Acryl.
-*
-*
-* @param {BasicAuthOptions} options - The options for the basic authentication middleware.
-* @param {string} options.username - The username for authentication.
-* @param {string} options.password - The password for authentication.
-* @param {string} [options.realm="Secure Area"] - The realm attribute for the WWW-Authenticate header.
-* @param {Function} [options.hashFunction] - The hash function used for secure comparison.
-* @param {Function} [options.verifyUser] - The function to verify user credentials.
-* @param {string | object | MessageFunction} [options.invalidUserMessage="Unauthorized"] - The invalid user message.
-* @param {Function} [options.onAuthSuccess] - Callback function called on successful authentication.
-* @returns {MiddlewareHandler} The middleware handler function.
-* @throws {HTTPException} If neither "username and password" nor "verifyUser" options are provided.
-*
-* @example
-* ```ts
-* const app = new Acryl()
-*
-* app.use(
-*   '/auth/*',
-*   basicAuth({
-*     username: process.env.BASIC_AUTH_USERNAME,
-*     password: process.env.BASIC_AUTH_PASSWORD,
-*   })
-* )
-*
-* app.get('/auth/page', (c) => {
-*   return c.text('You are authorized')
-* })
-* ```
-*
-* @example
-* ```ts
-* // With onAuthSuccess callback
-* app.use(
-*   '/auth/*',
-*   basicAuth({
-*     username: process.env.BASIC_AUTH_USERNAME,
-*     password: process.env.BASIC_AUTH_PASSWORD,
-*     onAuthSuccess: (c, username) => {
-*       c.set('user', { name: username, role: 'admin' })
-*       console.log(`User ${username} authenticated`)
-*     },
-*   })
-* )
-* ```
-*/
-const basicAuth = (options, ...users) => {
-	const usernamePasswordInOptions = "username" in options && "password" in options;
-	const verifyUserInOptions = "verifyUser" in options;
-	if (!(usernamePasswordInOptions || verifyUserInOptions)) throw new Error("basic auth middleware requires options for \"username and password\" or \"verifyUser\"");
-	if (!options.realm) options.realm = "Secure Area";
-	if (!options.invalidUserMessage) options.invalidUserMessage = "Unauthorized";
-	if (usernamePasswordInOptions) users.unshift({
-		username: options.username,
-		password: options.password
-	});
-	return async function basicAuth(ctx, next) {
-		const requestUser = auth(ctx.req.raw);
-		if (requestUser) if (verifyUserInOptions) {
-			if (await options.verifyUser(requestUser.username, requestUser.password, ctx)) {
-				if (options.onAuthSuccess) await options.onAuthSuccess(ctx, requestUser.username);
-				await next();
-				return;
-			}
-		} else for (const user of users) {
-			const [usernameEqual, passwordEqual] = await Promise.all([timingSafeEqual(user.username, requestUser.username, options.hashFunction), timingSafeEqual(user.password, requestUser.password, options.hashFunction)]);
-			if (usernameEqual && passwordEqual) {
-				if (options.onAuthSuccess) await options.onAuthSuccess(ctx, requestUser.username);
-				await next();
-				return;
-			}
-		}
-		const status = 401;
-		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/"/g, "\\\"") + "\"" };
-		const responseMessage = typeof options.invalidUserMessage === "function" ? await options.invalidUserMessage(ctx) : options.invalidUserMessage;
-		throw new HTTPException(status, { res: typeof responseMessage === "string" ? new Response(responseMessage, {
-			status,
-			headers
-		}) : new Response(JSON.stringify(responseMessage), {
-			status,
-			headers: {
-				...headers,
-				"content-type": "application/json"
-			}
-		}) });
-	};
-};
-//#endregion
+import { t as basicAuth } from "./basic-auth-DFLflXNe.js";
 export { basicAuth };

package/lib/bearer-auth-Cwxt-vgS.js

@@ -0,0 +1,94 @@
+import { t as HTTPException } from "./http-exception-MjWkT89V.js";
+import { i as timingSafeEqual } from "./buffer-CkEOJCcY.js";
+//#region ../../plugins/acryl-router/src/core/middleware/bearer-auth/index.ts
+const TOKEN_STRINGS = "[A-Za-z0-9._~+/-]+=*";
+const PREFIX = "Bearer";
+const HEADER = "Authorization";
+/**
+* Bearer Auth Middleware for Acryl.
+*
+*
+* @template E - The environment type.
+* @param {BearerAuthOptions} options - The options for the bearer authentication middleware.
+* @param {string | string[]} [options.token] - The string or array of strings to validate the incoming bearer token against.
+* @param {Function} [options.verifyToken] - The function to verify the token.
+* @param {string} [options.realm=""] - The domain name of the realm, as part of the returned WWW-Authenticate challenge header.
+* @param {string} [options.prefix="Bearer"] - The prefix (or known as `schema`) for the Authorization header value. If set to the empty string, no prefix is expected.
+* @param {string} [options.headerName=Authorization] - The header name.
+* @param {Function} [options.hashFunction] - A function to handle hashing for safe comparison of authentication tokens.
+* @param {string | object | MessageFunction} [options.noAuthenticationHeader.message="Unauthorized"] - The no authentication header message.
+* @param {string | object | MessageFunction} [options.noAuthenticationHeader.wwwAuthenticateHeader="Bearer realm=\"\""] - The response header value for the WWW-Authenticate header when no authentication header is provided.
+* @param {string | object | MessageFunction} [options.invalidAuthenticationHeader.message="Bad Request"] - The invalid authentication header message.
+* @param {string | object | MessageFunction} [options.invalidAuthenticationHeader.wwwAuthenticateHeader="Bearer error=\"invalid_request\""] - The response header value for the WWW-Authenticate header when authentication header is invalid.
+* @param {string | object | MessageFunction} [options.invalidToken.message="Unauthorized"] - The invalid token message.
+* @param {string | object | MessageFunction} [options.invalidToken.wwwAuthenticateHeader="Bearer error=\"invalid_token\""] - The response header value for the WWW-Authenticate header when token is invalid.
+* @returns {MiddlewareHandler<E>} The middleware handler function.
+* @throws {Error} If neither "token" nor "verifyToken" options are provided.
+* @throws {HTTPException} If authentication fails, with 401 status code for missing or invalid token, or 400 status code for invalid request.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* const token = process.env.API_TOKEN // never a literal in source
+*
+* app.use('/api/*', bearerAuth({ token }))
+*
+* app.get('/api/page', (c) => {
+*   return c.json({ message: 'You are authorized' })
+* })
+* ```
+*/
+const bearerAuth = (options) => {
+	if (!("token" in options || "verifyToken" in options)) throw new Error("bearer auth middleware requires options for \"token\" or \"verifyToken\"");
+	if (!options.realm) options.realm = "";
+	if (options.prefix === void 0) options.prefix = PREFIX;
+	const realm = options.realm?.replace(/"/g, "\\\"");
+	const prefix = options.prefix;
+	const tokenRegexp = new RegExp(`^${TOKEN_STRINGS}$`);
+	const wwwAuthenticatePrefix = prefix === "" ? "" : `${prefix} `;
+	const throwHTTPException = async (c, status, wwwAuthenticateHeader, messageOption) => {
+		const wwwAuthenticateHeaderValue = typeof wwwAuthenticateHeader === "function" ? await wwwAuthenticateHeader(c) : wwwAuthenticateHeader;
+		const headers = { "WWW-Authenticate": typeof wwwAuthenticateHeaderValue === "string" ? wwwAuthenticateHeaderValue : `${wwwAuthenticatePrefix}${Object.entries(wwwAuthenticateHeaderValue).map(([key, value]) => `${key}="${value}"`).join(",")}` };
+		const responseMessage = typeof messageOption === "function" ? await messageOption(c) : messageOption;
+		throw new HTTPException(status, { res: typeof responseMessage === "string" ? new Response(responseMessage, {
+			status,
+			headers
+		}) : new Response(JSON.stringify(responseMessage), {
+			status,
+			headers: {
+				...headers,
+				"content-type": "application/json"
+			}
+		}) });
+	};
+	return async function bearerAuth(c, next) {
+		const headerToken = c.req.header(options.headerName || HEADER);
+		if (!headerToken) await throwHTTPException(c, 401, options.noAuthenticationHeader?.wwwAuthenticateHeader || `${wwwAuthenticatePrefix}realm="${realm}"`, options.noAuthenticationHeader?.message || options.noAuthenticationHeaderMessage || "Unauthorized");
+		else {
+			let tokenValue;
+			if (prefix === "") tokenValue = headerToken;
+			else {
+				const headerLower = headerToken.toLowerCase();
+				const prefixLower = prefix.toLowerCase();
+				if (headerLower.startsWith(prefixLower) && headerToken[prefix.length] === " ") tokenValue = headerToken.slice(prefix.length).trimStart();
+			}
+			if (!tokenValue || !tokenRegexp.test(tokenValue)) await throwHTTPException(c, 400, options.invalidAuthenticationHeader?.wwwAuthenticateHeader || `${wwwAuthenticatePrefix}error="invalid_request"`, options.invalidAuthenticationHeader?.message || options.invalidAuthenticationHeaderMessage || "Bad Request");
+			else {
+				let equal = false;
+				if ("verifyToken" in options) equal = await options.verifyToken(tokenValue, c);
+				else if (typeof options.token === "string") equal = await timingSafeEqual(options.token, tokenValue, options.hashFunction);
+				else if (Array.isArray(options.token) && options.token.length > 0) {
+					for (const token of options.token) if (await timingSafeEqual(token, tokenValue, options.hashFunction)) {
+						equal = true;
+						break;
+					}
+				}
+				if (!equal) await throwHTTPException(c, 401, options.invalidToken?.wwwAuthenticateHeader || `${wwwAuthenticatePrefix}error="invalid_token"`, options.invalidToken?.message || options.invalidTokenMessage || "Unauthorized");
+			}
+		}
+		await next();
+	};
+};
+//#endregion
+export { bearerAuth as t };