@lovrozagar/honey 0.6.8 → 0.7.0

package/src/crypto.ts

@@ -1,5 +1,3 @@
-const encoder = new TextEncoder()
-
 let cachedKey: CryptoKey | null = null
 
 async function getKey(): Promise<CryptoKey> {
@@ -9,8 +7,32 @@ async function getKey(): Promise<CryptoKey> {
 	return cachedKey
 }
 
-export async function timingSafeEqual(a: string, b: string): Promise<boolean> {
+/**
+ * Strings are compared by UTF-16 code unit, not by their UTF-8 encoding: UTF-8
+ * replaces every lone surrogate with U+FFFD, so two different strings would
+ * compare equal.
+ */
+function toBytes(value: string | Uint8Array): Uint8Array<ArrayBuffer> {
+	if (typeof value !== "string") return new Uint8Array(value)
+	const bytes = new Uint8Array(value.length * 2)
+	for (let i = 0; i < value.length; i++) {
+		const unit = value.charCodeAt(i)
+		bytes[i * 2] = unit >> 8
+		bytes[i * 2 + 1] = unit & 0xff
+	}
+	return bytes
+}
+
+/**
+ * Constant-time equality. Both sides are MACed with a per-process random key and
+ * the MACs are compared by `crypto.subtle.verify`, so neither content nor length
+ * leaks through timing.
+ */
+export async function timingSafeEqual(a: string | Uint8Array, b: string | Uint8Array): Promise<boolean> {
+	/* A string never equals bytes: tag the kind so "ab" and its code units differ. */
+	const aIsString = typeof a === "string"
+	if (aIsString !== (typeof b === "string")) return false
 	const key = await getKey()
-	const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(a))
-	return crypto.subtle.verify("HMAC", key, sig, encoder.encode(b))
+	const sig = await crypto.subtle.sign("HMAC", key, toBytes(a))
+	return crypto.subtle.verify("HMAC", key, sig, toBytes(b))
 }

package/src/csrf.ts

@@ -4,11 +4,15 @@ import type { MiddlewareFn } from "./middleware.ts"
 import { EK, SK } from "./types.ts"
 
 type CSRFOptions = {
+	/**
+	 * Cross-origin callers allowed to make unsafe requests, matched against the
+	 * full `Origin` (`https://app.example.com`). Same-origin requests never need
+	 * to be listed.
+	 */
 	origin?: ((origin: string) => boolean) | string | string[]
 }
 
-const safeMethodRe = /^(GET|HEAD|OPTIONS)$/
-const formContentTypeRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"])
 
 function matchOrigin(origin: string, config: CSRFOptions["origin"]): boolean {
 	if (config === undefined) return false
@@ -17,37 +21,65 @@ function matchOrigin(origin: string, config: CSRFOptions["origin"]): boolean {
 	return config(origin)
 }
 
-export function csrf(options?: CSRFOptions): MiddlewareFn<{ req: Request }, {}> {
-	const opts = options ?? {}
+/** Host of the request as the client addressed it: `Host`, else the URL's host. */
+function requestHost(req: Request): string | null {
+	const host = req.headers.get("host")
+	if (host !== null && host !== "") return host.toLowerCase()
+	try {
+		return new URL(req.url).host.toLowerCase()
+	} catch {
+		return null
+	}
+}
 
-	const mw: MiddlewareFn<{ req: Request }, {}> = (ctx, next) => {
-		const req = ctx.req
+function originHost(origin: string): string | null {
+	if (origin === "null") return null
+	try {
+		return new URL(origin).host.toLowerCase()
+	} catch {
+		return null
+	}
+}
 
-		if (safeMethodRe.test(req.method)) {
-			return next()
-		}
+function reject(): never {
+	throw new HoneyError({ errorKey: EK.forbidden, status: SK.forbidden })
+}
 
-		const contentType = req.headers.get("content-type")
-		if (contentType === null || !formContentTypeRe.test(contentType)) {
-			return next()
-		}
+/**
+ * Rejects cross-origin unsafe requests, whatever their content type.
+ *
+ * 1. `GET`, `HEAD` and `OPTIONS` pass.
+ * 2. With `Sec-Fetch-Site` (every current browser sends it): `same-origin` and
+ *    `none` (user-initiated) pass. `same-site` and `cross-site` pass only for an
+ *    allow-listed `Origin`. A sibling subdomain is same-site but not trusted.
+ * 3. Without it: no `Origin` passes (curl, server-to-server, old clients that
+ *    cannot be driven cross-site), an `Origin` whose host equals `Host` passes,
+ *    an allow-listed `Origin` passes, anything else is rejected.
+ *
+ * Failure is 403 `forbidden`. This is the algorithm of Go's
+ * `http.CrossOriginProtection`.
+ */
+export function csrf(options?: CSRFOptions): MiddlewareFn<{ req: Request }, {}> {
+	const allow = options?.origin
 
-		/* check Sec-Fetch-Site first (modern browsers, unforgeable) */
-		const secFetchSite = req.headers.get("sec-fetch-site")
-		if (secFetchSite === "same-origin") {
-			return next()
-		}
+	const mw: MiddlewareFn<{ req: Request }, {}> = (ctx, next) => {
+		const req = ctx.req
+		if (SAFE_METHODS.has(req.method)) return next()
 
-		/* fall back to Origin header */
 		const origin = req.headers.get("origin")
-		if (origin !== null && matchOrigin(origin, opts.origin)) {
-			return next()
+		const site = req.headers.get("sec-fetch-site")
+
+		if (site !== null) {
+			if (site === "same-origin" || site === "none") return next()
+			if (origin !== null && matchOrigin(origin, allow)) return next()
+			return reject()
 		}
 
-		throw new HoneyError({
-			errorKey: EK.forbidden,
-			status: SK.forbidden,
-		})
+		if (origin === null) return next()
+		const host = originHost(origin)
+		if (host !== null && host === requestHost(req)) return next()
+		if (matchOrigin(origin, allow)) return next()
+		return reject()
 	}
 
 	return namedMiddleware("csrf", mw)

package/src/curl-logger.ts

@@ -1,6 +1,7 @@
 import { namedMiddleware } from "./middleware.ts"
 import type { MiddlewareFn } from "./middleware.ts"
 import type { LoggerInstance } from "./logger.ts"
+import { shellQuote } from "./request-to-curl.ts"
 
 type BodyOmittedReason = "content-type" | "disabled" | "missing" | "read-error" | "too-large"
 
@@ -15,6 +16,9 @@ type CurlLogData = {
 	status: number
 }
 
+/** What `skip` sees: everything known before the curl command is built. */
+type CurlSkipData = Pick<CurlLogData, "duration" | "method" | "path" | "requestId" | "status">
+
 type CurlLoggerBodyOptions = {
 	allowContentTypes?: string[]
 	maxBytes?: number
@@ -24,17 +28,46 @@ type CurlLoggerOptions = {
 	body?: boolean | CurlLoggerBodyOptions
 	instance?: LoggerInstance
 	log?: (data: CurlLogData) => void
+	/**
+	 * Return the value to log, or null to drop the header. Replaces the default,
+	 * which masks `authorization`, `proxy-authorization`, `cookie`, `set-cookie`
+	 * and API-key/token headers. Call `defaultRedactHeader` to keep it and add more.
+	 */
 	redactHeader?: (name: string, value: string) => string | null
+	/** Same for query parameters. The default masks token-, key-, secret- and password-like names. */
 	redactQueryParam?: (name: string, value: string) => string | null
-	skip?: (data: CurlLogData) => boolean
+	/** Runs before the curl command is built; returning true skips all of that work. */
+	skip?: (data: CurlSkipData) => boolean
 }
 
 const DEFAULT_BODY_CONTENT_TYPES = ["application/json", "application/x-www-form-urlencoded", "application/xml", "text/"]
 
 const DEFAULT_MAX_BODY_BYTES = 16_384
 
-function shellEscape(value: string): string {
-	return value.replace(/'/g, "'\\''")
+const REDACTED = "[REDACTED]"
+
+const SENSITIVE_HEADERS = new Set([
+	"authorization",
+	"cookie",
+	"proxy-authorization",
+	"set-cookie",
+	"x-api-key",
+	"x-auth-token",
+	"x-csrf-token",
+	"x-xsrf-token",
+])
+const SENSITIVE_HEADER_RE = /(?:^|-)(?:token|secret|api-?key|password|session)(?:$|-)/i
+const SENSITIVE_PARAM_RE =
+	/(?:^|[_.-])(?:access_?token|refresh_?token|id_?token|token|secret|client_?secret|password|passwd|pwd|api_?key|apikey|key|sig|signature|auth|code|session|jwt)$/i
+
+function defaultRedactHeader(name: string, value: string): string | null {
+	const lower = name.toLowerCase()
+	if (SENSITIVE_HEADERS.has(lower) || SENSITIVE_HEADER_RE.test(lower)) return REDACTED
+	return value
+}
+
+function defaultRedactQueryParam(name: string, value: string): string | null {
+	return SENSITIVE_PARAM_RE.test(name) ? REDACTED : value
 }
 
 function defaultLog(data: CurlLogData): void {
@@ -43,175 +76,183 @@ function defaultLog(data: CurlLogData): void {
 
 function shouldIncludeBody(contentType: string | null, allowContentTypes: string[]): boolean {
 	if (contentType === null || contentType.length === 0) return false
-	return allowContentTypes.some((allowed) => contentType.startsWith(allowed))
+	const lower = contentType.toLowerCase()
+	return allowContentTypes.some((allowed) => lower.startsWith(allowed.toLowerCase()))
 }
 
-function redactUrl(url: URL, redactQueryParam?: (name: string, value: string) => string | null): string {
-	if (redactQueryParam === undefined || url.search.length === 0) return url.toString()
-
-	const redacted = new URL(url.toString())
-	redacted.search = ""
-
-	for (const [name, value] of url.searchParams.entries()) {
+function redactUrl(rawUrl: string, redactQueryParam: (name: string, value: string) => string | null): string {
+	let url: URL
+	try {
+		url = new URL(rawUrl)
+	} catch {
+		/* a malformed Host (Node builds the URL from it) must not fail the request */
+		return rawUrl.split("?")[0] ?? rawUrl
+	}
+	if (url.search.length === 0) return url.toString()
+	const params = new URLSearchParams()
+	for (const [name, value] of url.searchParams) {
 		const nextValue = redactQueryParam(name, value)
-		if (nextValue === null) continue
-		redacted.searchParams.append(name, nextValue)
+		if (nextValue !== null) params.append(name, nextValue)
 	}
-
-	return redacted.toString()
+	url.search = params.toString()
+	return url.toString()
 }
 
-async function readBodyWithinLimit(
-	request: Request,
-	maxBytes: number,
-): Promise<{
-	body: string | null
-	omittedReason: BodyOmittedReason | null
-}> {
-	if (request.body === null) {
-		return { body: null, omittedReason: "missing" }
+type BodyResult = { body: string | null; omittedReason: BodyOmittedReason | null }
+
+/**
+ * A second, independent reader of the request body. On Node the request is
+ * re-pointed at one branch of a tee (the same hook `bodyLimit` uses) rather
+ * than `clone()`d, so later body readers keep working.
+ */
+function teeBody(request: Request): ReadableStream<Uint8Array> | null {
+	const body = request.body
+	if (body === null) return null
+	const replaceBody = (request as unknown as Record<symbol, unknown>)[Symbol.for("honey.replaceBody")]
+	if (typeof replaceBody === "function") {
+		const [forRequest, forLog] = body.tee()
+		;(replaceBody as (stream: ReadableStream<Uint8Array>) => void).call(request, forRequest)
+		return forLog
 	}
+	return request.clone().body
+}
 
-	const contentLength = request.headers.get("content-length")
-	if (contentLength !== null) {
-		const parsedLength = Number.parseInt(contentLength, 10)
-		if (!Number.isNaN(parsedLength) && parsedLength > maxBytes) {
-			return { body: null, omittedReason: "too-large" }
-		}
-	}
+/** Never rejects: a body that cannot be read is logged as omitted. */
+async function readBodyWithinLimit(request: Request, maxBytes: number): Promise<BodyResult> {
+	try {
+		if (request.body === null) return { body: null, omittedReason: "missing" }
 
-	const clone = request.clone()
-	if (clone.body === null) {
-		return { body: null, omittedReason: "missing" }
-	}
+		const contentLength = request.headers.get("content-length")
+		if (contentLength !== null) {
+			const parsedLength = Number.parseInt(contentLength, 10)
+			if (!Number.isNaN(parsedLength) && parsedLength > maxBytes) {
+				return { body: null, omittedReason: "too-large" }
+			}
+		}
 
-	const reader = clone.body.getReader()
-	const chunks: Uint8Array[] = []
-	let totalBytes = 0
+		const stream = teeBody(request)
+		if (stream === null) return { body: null, omittedReason: "missing" }
 
-	try {
+		const reader = stream.getReader()
+		const chunks: Uint8Array[] = []
+		let totalBytes = 0
 		while (true) {
 			const { done, value } = await reader.read()
 			if (done) break
 			totalBytes += value.byteLength
 			if (totalBytes > maxBytes) {
-				await reader.cancel()
+				await reader.cancel().catch(() => {})
 				return { body: null, omittedReason: "too-large" }
 			}
 			chunks.push(value)
 		}
+
+		const bytes = new Uint8Array(totalBytes)
+		let offset = 0
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset)
+			offset += chunk.byteLength
+		}
+		return { body: new TextDecoder().decode(bytes), omittedReason: null }
 	} catch {
 		return { body: null, omittedReason: "read-error" }
 	}
+}
 
-	const bytes = new Uint8Array(totalBytes)
-	let offset = 0
+type ResolvedOptions = {
+	redactHeader: (name: string, value: string) => string | null
+	redactQueryParam: (name: string, value: string) => string | null
+}
 
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset)
-		offset += chunk.byteLength
+function formatCurl(request: Request, body: BodyResult | null, opts: ResolvedOptions): string {
+	const parts: string[] = ["curl", "-X", shellQuote(request.method)]
+	for (const [name, value] of request.headers.entries()) {
+		const redactedValue = opts.redactHeader(name, value)
+		if (redactedValue === null) continue
+		parts.push("-H", shellQuote(`${name}: ${redactedValue}`))
 	}
+	if (body !== null && body.body !== null) parts.push("--data-raw", shellQuote(body.body))
+	parts.push(shellQuote(redactUrl(request.url, opts.redactQueryParam)))
+	return parts.join(" ")
+}
 
-	return {
-		body: new TextDecoder().decode(bytes),
-		omittedReason: null,
+/** Start reading the body (if logged) now, before a handler consumes it. */
+function startBodyRead(request: Request, body: CurlLoggerOptions["body"]): Promise<BodyResult> {
+	if (body !== true && typeof body !== "object") {
+		return Promise.resolve({ body: null, omittedReason: "disabled" })
 	}
+	const bodyOptions = typeof body === "object" ? body : {}
+	const allowContentTypes = bodyOptions.allowContentTypes ?? DEFAULT_BODY_CONTENT_TYPES
+	if (!shouldIncludeBody(request.headers.get("content-type"), allowContentTypes)) {
+		return Promise.resolve({ body: null, omittedReason: request.body === null ? "missing" : "content-type" })
+	}
+	return readBodyWithinLimit(request, bodyOptions.maxBytes ?? DEFAULT_MAX_BODY_BYTES)
 }
 
 async function buildCurlLogData(
 	request: Request,
 	options?: Pick<CurlLoggerOptions, "body" | "redactHeader" | "redactQueryParam">,
 ): Promise<Pick<CurlLogData, "bodyIncluded" | "bodyOmittedReason" | "curl">> {
-	const parts: string[] = [`curl -X ${request.method}`]
-
-	for (const [name, value] of request.headers.entries()) {
-		const redactedValue = options?.redactHeader !== undefined ? options.redactHeader(name, value) : value
-		if (redactedValue === null) continue
-		parts.push(`-H '${shellEscape(name)}: ${shellEscape(redactedValue)}'`)
-	}
-
-	let bodyIncluded = false
-	let bodyOmittedReason: BodyOmittedReason | null = null
-
-	if (options?.body === true || typeof options?.body === "object") {
-		const bodyOptions = typeof options.body === "object" ? options.body : {}
-		const allowContentTypes = bodyOptions.allowContentTypes ?? DEFAULT_BODY_CONTENT_TYPES
-		const contentType = request.headers.get("content-type")
-
-		if (shouldIncludeBody(contentType, allowContentTypes) === false) {
-			bodyOmittedReason = request.body === null ? "missing" : "content-type"
-		} else {
-			const result = await readBodyWithinLimit(request, bodyOptions.maxBytes ?? DEFAULT_MAX_BODY_BYTES)
-
-			if (result.body === null) {
-				bodyOmittedReason = result.omittedReason
-			} else {
-				bodyIncluded = true
-				parts.push(`--data-raw '${shellEscape(result.body)}'`)
-			}
-		}
-	} else {
-		bodyOmittedReason = "disabled"
+	const resolved: ResolvedOptions = {
+		redactHeader: options?.redactHeader ?? defaultRedactHeader,
+		redactQueryParam: options?.redactQueryParam ?? defaultRedactQueryParam,
 	}
-
-	parts.push(`'${shellEscape(redactUrl(new URL(request.url), options?.redactQueryParam))}'`)
-
+	const body = await startBodyRead(request, options?.body)
 	return {
-		bodyIncluded,
-		bodyOmittedReason,
-		curl: parts.join(" "),
+		bodyIncluded: body.body !== null,
+		bodyOmittedReason: body.omittedReason,
+		curl: formatCurl(request, body, resolved),
 	}
 }
 
 function curlLogger(options?: CurlLoggerOptions): MiddlewareFn<{ path: string; req: Request }, {}> {
 	const log = options?.log ?? defaultLog
 	const skip = options?.skip
+	const resolved: ResolvedOptions = {
+		redactHeader: options?.redactHeader ?? defaultRedactHeader,
+		redactQueryParam: options?.redactQueryParam ?? defaultRedactQueryParam,
+	}
 
 	return namedMiddleware("curlLogger", async (ctx, next) => {
 		const start = performance.now()
-		const method = ctx.req.method
+		const request = ctx.req
+		const method = request.method
 		const path = ctx.path
 		const rid = ((ctx as Record<string, unknown>)["requestId"] as string | null) ?? null
-		const curlDataPromise = buildCurlLogData(ctx.req, options)
+		/* the only work before `next()`: the body must be teed before a handler reads it */
+		const bodyPromise = startBodyRead(request, options?.body)
 
 		const response = await next()
-		const duration = performance.now() - start
-		const curlData = await curlDataPromise
-
-		const data: CurlLogData = {
-			...curlData,
-			duration,
+		const skipData: CurlSkipData = {
+			duration: performance.now() - start,
 			method,
 			path,
 			requestId: rid,
 			status: response.status,
 		}
 
-		if (skip?.(data)) {
-			return response
-		}
-
-		if (options?.instance) {
-			options.instance.info(
-				{
-					bodyIncluded: data.bodyIncluded,
-					bodyOmittedReason: data.bodyOmittedReason,
-					curl: data.curl,
-					duration: data.duration,
-					method: data.method,
-					path: data.path,
-					requestId: data.requestId,
-					status: data.status,
-				},
-				"request curl",
-			)
-		} else {
-			log(data)
+		/* a failing redact callback, skip or sink never turns the response into a 500 */
+		try {
+			if (skip?.(skipData)) return response
+			const body = await bodyPromise
+			const data: CurlLogData = {
+				...skipData,
+				bodyIncluded: body.body !== null,
+				bodyOmittedReason: body.omittedReason,
+				curl: formatCurl(request, body, resolved),
+			}
+			if (options?.instance) {
+				options.instance.info({ ...data }, "request curl")
+			} else {
+				log(data)
+			}
+		} catch (err) {
+			console.error("curlLogger: failed to log request", err)
 		}
 
 		return response
 	})
 }
 
-export { buildCurlLogData, curlLogger }
-export type { BodyOmittedReason, CurlLogData, CurlLoggerBodyOptions, CurlLoggerOptions }
+export { buildCurlLogData, curlLogger, defaultRedactHeader, defaultRedactQueryParam }
+export type { BodyOmittedReason, CurlLogData, CurlLoggerBodyOptions, CurlLoggerOptions, CurlSkipData }

package/src/dict.ts

@@ -0,0 +1,12 @@
+/**
+ * An object for keys that come from request data: search params, form fields, header views,
+ * validation field maps. It has no prototype, so a key named `__proto__`, `constructor` or
+ * `toString` is plain data — it cannot hit `Object.prototype`, replace the object's prototype,
+ * or turn a missing key into a function.
+ *
+ * Read keys with `key in obj`, `obj[key] !== undefined` or `Object.hasOwn(obj, key)`; the
+ * object has no `hasOwnProperty` method of its own.
+ */
+export function dict<T>(): Record<string, T> {
+	return Object.create(null) as Record<string, T>
+}

package/src/error.ts

@@ -23,8 +23,10 @@ export class HoneyError extends Error {
 		this.data = opts.data
 		this.errorKey = opts.errorKey
 		this.headers = opts.headers
-		this.statusKey = opts.status
-		this.status = statusKeyToCode[opts.status]
+		/* an unknown status key must not turn an error into a 200 — it is a 500 */
+		const known = Object.hasOwn(statusKeyToCode, opts.status)
+		this.statusKey = known ? opts.status : "internal_server_error"
+		this.status = known ? statusKeyToCode[opts.status] : 500
 		this.fields = opts.fields ?? EMPTY_FIELDS
 		this.vars = opts.vars
 	}

package/src/etag.ts

@@ -1,22 +1,38 @@
-import { namedMiddleware } from "./middleware.ts"
+import { bodyKind, rawBodyOf } from "./body-kind.ts"
 import { replaceResponse } from "./honey-response.ts"
+import { namedMiddleware } from "./middleware.ts"
 import type { MiddlewareFn } from "./middleware.ts"
 
 type ETagOptions = {
 	weak?: boolean
 }
 
-/**
- * FNV-1a 32-bit hash — fast, non-cryptographic, deterministic.
- * Good enough for ETag fingerprinting (not security-critical).
- */
-function fnv1a(data: Uint8Array): string {
-	let hash = 0x811c9dc5
-	for (let i = 0; i < data.length; i++) {
-		hash ^= data[i]
-		hash = Math.imul(hash, 0x01000193)
+const encoder = new TextEncoder()
+
+/** Base64url of the first 16 bytes of SHA-256: collision-resistant enough for a strong validator. */
+async function digest(data: Uint8Array<ArrayBuffer>): Promise<string> {
+	const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", data)).subarray(0, 16)
+	let binary = ""
+	for (let i = 0; i < hash.length; i++) binary += String.fromCharCode(hash[i])
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+}
+
+const ENTITY_TAG_RE = /(?:W\/)?"[^"]*"/g
+
+/** Weak comparison (RFC 9110 §8.8.3.2): opaque tags match regardless of the `W/` prefix. */
+function opaque(tag: string): string {
+	return tag.startsWith("W/") ? tag.slice(2) : tag
+}
+
+/** RFC 9110 §13.1.2: `*` or a list of entity tags, compared weakly. */
+export function ifNoneMatchHits(header: string | null, etag: string): boolean {
+	if (header === null) return false
+	if (header.trim() === "*") return true
+	const target = opaque(etag.trim())
+	for (const tag of header.match(ENTITY_TAG_RE) ?? []) {
+		if (opaque(tag) === target) return true
 	}
-	return (hash >>> 0).toString(16).padStart(8, "0")
+	return false
 }
 
 export function etag(options?: ETagOptions): MiddlewareFn<{ req: Request }, {}> {
@@ -30,40 +46,48 @@ export function etag(options?: ETagOptions): MiddlewareFn<{ req: Request }, {}>
 
 		const response = await next()
 
-		/* skip error responses — caching errors is wasteful and misleading */
-		if (response.status >= 400) return response
+		/* Only a 200 has a selected representation a 304 can stand in for. */
+		if (response.status !== 200) return response
 
-		/* skip streaming responses — can't hash without buffering entire stream */
-		if (
-			response.headers.get("transfer-encoding") === "chunked" ||
-			(response.body !== null && !response.headers.has("content-length") && !response.headers.has("content-type"))
-		) {
-			return response
+		const ifNoneMatch = ctx.req.headers.get("if-none-match")
+
+		/* A handler-set ETag is authoritative: never overwrite it or hash the body. */
+		const existing = response.headers.get("etag")
+		if (existing !== null) {
+			if (!ifNoneMatchHits(ifNoneMatch, existing)) return response
+			await response.body?.cancel().catch(() => {})
+			return replaceResponse(response, { body: null, headers: response.headers, status: 304 })
 		}
 
-		/* read body to compute hash */
-		const body = await response.arrayBuffer()
-		if (body.byteLength === 0) return response
+		/* Never buffer a stream: SSE and generate() can be endless. */
+		if (bodyKind(response) !== "buffered") return response
+
+		let bytes: Uint8Array<ArrayBuffer>
+		const raw = rawBodyOf(response)
+		if (raw !== null) {
+			bytes = typeof raw === "string" ? encoder.encode(raw) : new Uint8Array(raw)
+		} else {
+			bytes = new Uint8Array(await response.arrayBuffer())
+		}
 
-		const hash = fnv1a(new Uint8Array(body))
+		/* Nothing to validate; hand back a fresh body (the original may have been read). */
+		if (bytes.byteLength === 0) {
+			return raw === null ? replaceResponse(response, { body: bytes, headers: response.headers }) : response
+		}
+
+		const hash = await digest(bytes)
 		const etagValue = weak ? `W/"${hash}"` : `"${hash}"`
 
-		const headers = new Headers(response.headers)
+		const headers = new Headers(response.headers as HeadersInit)
 		headers.set("etag", etagValue)
 
-		/* check If-None-Match — supports comma-separated list and wildcard per RFC 7232 */
-		const ifNoneMatch = ctx.req.headers.get("if-none-match")
-		if (ifNoneMatch === "*" || ifNoneMatch?.split(",").some((v) => v.trim() === etagValue)) {
-			return replaceResponse(response, {
-				body: null,
-				headers,
-				status: 304,
-			})
+		if (ifNoneMatchHits(ifNoneMatch, etagValue)) {
+			return replaceResponse(response, { body: null, headers, status: 304 })
 		}
 
-		/* return response with ETag header and reconstituted body */
+		/* The original body was read (or is raw): always hand back a fresh one. */
 		return replaceResponse(response, {
-			body,
+			body: typeof raw === "string" ? raw : bytes,
 			headers,
 			status: response.status,
 		})