@lovrozagar/honey 0.7.3 → 1.0.0-rc.3

package/src/crypto.ts

@@ -1,38 +0,0 @@
-let cachedKey: CryptoKey | null = null
-
-async function getKey(): Promise<CryptoKey> {
-	if (cachedKey === null) {
-		cachedKey = await crypto.subtle.generateKey({ hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"])
-	}
-	return cachedKey
-}
-
-/**
- * Strings are compared by UTF-16 code unit, not by their UTF-8 encoding: UTF-8
- * replaces every lone surrogate with U+FFFD, so two different strings would
- * compare equal.
- */
-function toBytes(value: string | Uint8Array): Uint8Array<ArrayBuffer> {
-	if (typeof value !== "string") return new Uint8Array(value)
-	const bytes = new Uint8Array(value.length * 2)
-	for (let i = 0; i < value.length; i++) {
-		const unit = value.charCodeAt(i)
-		bytes[i * 2] = unit >> 8
-		bytes[i * 2 + 1] = unit & 0xff
-	}
-	return bytes
-}
-
-/**
- * Constant-time equality. Both sides are MACed with a per-process random key and
- * the MACs are compared by `crypto.subtle.verify`, so neither content nor length
- * leaks through timing.
- */
-export async function timingSafeEqual(a: string | Uint8Array, b: string | Uint8Array): Promise<boolean> {
-	/* A string never equals bytes: tag the kind so "ab" and its code units differ. */
-	const aIsString = typeof a === "string"
-	if (aIsString !== (typeof b === "string")) return false
-	const key = await getKey()
-	const sig = await crypto.subtle.sign("HMAC", key, toBytes(a))
-	return crypto.subtle.verify("HMAC", key, sig, toBytes(b))
-}

package/src/csrf.ts

@@ -1,86 +0,0 @@
-import { namedMiddleware } from "./middleware.ts"
-import { HoneyError } from "./error.ts"
-import type { MiddlewareFn } from "./middleware.ts"
-import { EK, SK } from "./types.ts"
-
-type CSRFOptions = {
-	/**
-	 * Cross-origin callers allowed to make unsafe requests, matched against the
-	 * full `Origin` (`https://app.example.com`). Same-origin requests never need
-	 * to be listed.
-	 */
-	origin?: ((origin: string) => boolean) | string | string[]
-}
-
-const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"])
-
-function matchOrigin(origin: string, config: CSRFOptions["origin"]): boolean {
-	if (config === undefined) return false
-	if (typeof config === "string") return config === origin
-	if (Array.isArray(config)) return config.includes(origin)
-	return config(origin)
-}
-
-/** Host of the request as the client addressed it: `Host`, else the URL's host. */
-function requestHost(req: Request): string | null {
-	const host = req.headers.get("host")
-	if (host !== null && host !== "") return host.toLowerCase()
-	try {
-		return new URL(req.url).host.toLowerCase()
-	} catch {
-		return null
-	}
-}
-
-function originHost(origin: string): string | null {
-	if (origin === "null") return null
-	try {
-		return new URL(origin).host.toLowerCase()
-	} catch {
-		return null
-	}
-}
-
-function reject(): never {
-	throw new HoneyError({ errorKey: EK.forbidden, status: SK.forbidden })
-}
-
-/**
- * Rejects cross-origin unsafe requests, whatever their content type.
- *
- * 1. `GET`, `HEAD` and `OPTIONS` pass.
- * 2. With `Sec-Fetch-Site` (every current browser sends it): `same-origin` and
- *    `none` (user-initiated) pass. `same-site` and `cross-site` pass only for an
- *    allow-listed `Origin`. A sibling subdomain is same-site but not trusted.
- * 3. Without it: no `Origin` passes (curl, server-to-server, old clients that
- *    cannot be driven cross-site), an `Origin` whose host equals `Host` passes,
- *    an allow-listed `Origin` passes, anything else is rejected.
- *
- * Failure is 403 `forbidden`. This is the algorithm of Go's
- * `http.CrossOriginProtection`.
- */
-export function csrf(options?: CSRFOptions): MiddlewareFn<{ req: Request }, {}> {
-	const allow = options?.origin
-
-	const mw: MiddlewareFn<{ req: Request }, {}> = (ctx, next) => {
-		const req = ctx.req
-		if (SAFE_METHODS.has(req.method)) return next()
-
-		const origin = req.headers.get("origin")
-		const site = req.headers.get("sec-fetch-site")
-
-		if (site !== null) {
-			if (site === "same-origin" || site === "none") return next()
-			if (origin !== null && matchOrigin(origin, allow)) return next()
-			return reject()
-		}
-
-		if (origin === null) return next()
-		const host = originHost(origin)
-		if (host !== null && host === requestHost(req)) return next()
-		if (matchOrigin(origin, allow)) return next()
-		return reject()
-	}
-
-	return namedMiddleware("csrf", mw)
-}

package/src/curl-logger.ts

@@ -1,258 +0,0 @@
-import { namedMiddleware } from "./middleware.ts"
-import type { MiddlewareFn } from "./middleware.ts"
-import type { LoggerInstance } from "./logger.ts"
-import { shellQuote } from "./request-to-curl.ts"
-
-type BodyOmittedReason = "content-type" | "disabled" | "missing" | "read-error" | "too-large"
-
-type CurlLogData = {
-	bodyIncluded: boolean
-	bodyOmittedReason: BodyOmittedReason | null
-	curl: string
-	duration: number
-	method: string
-	path: string
-	requestId: string | null
-	status: number
-}
-
-/** What `skip` sees: everything known before the curl command is built. */
-type CurlSkipData = Pick<CurlLogData, "duration" | "method" | "path" | "requestId" | "status">
-
-type CurlLoggerBodyOptions = {
-	allowContentTypes?: string[]
-	maxBytes?: number
-}
-
-type CurlLoggerOptions = {
-	body?: boolean | CurlLoggerBodyOptions
-	instance?: LoggerInstance
-	log?: (data: CurlLogData) => void
-	/**
-	 * Return the value to log, or null to drop the header. Replaces the default,
-	 * which masks `authorization`, `proxy-authorization`, `cookie`, `set-cookie`
-	 * and API-key/token headers. Call `defaultRedactHeader` to keep it and add more.
-	 */
-	redactHeader?: (name: string, value: string) => string | null
-	/** Same for query parameters. The default masks token-, key-, secret- and password-like names. */
-	redactQueryParam?: (name: string, value: string) => string | null
-	/** Runs before the curl command is built; returning true skips all of that work. */
-	skip?: (data: CurlSkipData) => boolean
-}
-
-const DEFAULT_BODY_CONTENT_TYPES = ["application/json", "application/x-www-form-urlencoded", "application/xml", "text/"]
-
-const DEFAULT_MAX_BODY_BYTES = 16_384
-
-const REDACTED = "[REDACTED]"
-
-const SENSITIVE_HEADERS = new Set([
-	"authorization",
-	"cookie",
-	"proxy-authorization",
-	"set-cookie",
-	"x-api-key",
-	"x-auth-token",
-	"x-csrf-token",
-	"x-xsrf-token",
-])
-const SENSITIVE_HEADER_RE = /(?:^|-)(?:token|secret|api-?key|password|session)(?:$|-)/i
-const SENSITIVE_PARAM_RE =
-	/(?:^|[_.-])(?:access_?token|refresh_?token|id_?token|token|secret|client_?secret|password|passwd|pwd|api_?key|apikey|key|sig|signature|auth|code|session|jwt)$/i
-
-function defaultRedactHeader(name: string, value: string): string | null {
-	const lower = name.toLowerCase()
-	if (SENSITIVE_HEADERS.has(lower) || SENSITIVE_HEADER_RE.test(lower)) return REDACTED
-	return value
-}
-
-function defaultRedactQueryParam(name: string, value: string): string | null {
-	return SENSITIVE_PARAM_RE.test(name) ? REDACTED : value
-}
-
-function defaultLog(data: CurlLogData): void {
-	console.log(data.curl)
-}
-
-function shouldIncludeBody(contentType: string | null, allowContentTypes: string[]): boolean {
-	if (contentType === null || contentType.length === 0) return false
-	const lower = contentType.toLowerCase()
-	return allowContentTypes.some((allowed) => lower.startsWith(allowed.toLowerCase()))
-}
-
-function redactUrl(rawUrl: string, redactQueryParam: (name: string, value: string) => string | null): string {
-	let url: URL
-	try {
-		url = new URL(rawUrl)
-	} catch {
-		/* a malformed Host (Node builds the URL from it) must not fail the request */
-		return rawUrl.split("?")[0] ?? rawUrl
-	}
-	if (url.search.length === 0) return url.toString()
-	const params = new URLSearchParams()
-	for (const [name, value] of url.searchParams) {
-		const nextValue = redactQueryParam(name, value)
-		if (nextValue !== null) params.append(name, nextValue)
-	}
-	url.search = params.toString()
-	return url.toString()
-}
-
-type BodyResult = { body: string | null; omittedReason: BodyOmittedReason | null }
-
-/**
- * A second, independent reader of the request body. On Node the request is
- * re-pointed at one branch of a tee (the same hook `bodyLimit` uses) rather
- * than `clone()`d, so later body readers keep working.
- */
-function teeBody(request: Request): ReadableStream<Uint8Array> | null {
-	const body = request.body
-	if (body === null) return null
-	const replaceBody = (request as unknown as Record<symbol, unknown>)[Symbol.for("honey.replaceBody")]
-	if (typeof replaceBody === "function") {
-		const [forRequest, forLog] = body.tee()
-		;(replaceBody as (stream: ReadableStream<Uint8Array>) => void).call(request, forRequest)
-		return forLog
-	}
-	return request.clone().body
-}
-
-/** Never rejects: a body that cannot be read is logged as omitted. */
-async function readBodyWithinLimit(request: Request, maxBytes: number): Promise<BodyResult> {
-	try {
-		if (request.body === null) return { body: null, omittedReason: "missing" }
-
-		const contentLength = request.headers.get("content-length")
-		if (contentLength !== null) {
-			const parsedLength = Number.parseInt(contentLength, 10)
-			if (!Number.isNaN(parsedLength) && parsedLength > maxBytes) {
-				return { body: null, omittedReason: "too-large" }
-			}
-		}
-
-		const stream = teeBody(request)
-		if (stream === null) return { body: null, omittedReason: "missing" }
-
-		const reader = stream.getReader()
-		const chunks: Uint8Array[] = []
-		let totalBytes = 0
-		while (true) {
-			const { done, value } = await reader.read()
-			if (done) break
-			totalBytes += value.byteLength
-			if (totalBytes > maxBytes) {
-				await reader.cancel().catch(() => {})
-				return { body: null, omittedReason: "too-large" }
-			}
-			chunks.push(value)
-		}
-
-		const bytes = new Uint8Array(totalBytes)
-		let offset = 0
-		for (const chunk of chunks) {
-			bytes.set(chunk, offset)
-			offset += chunk.byteLength
-		}
-		return { body: new TextDecoder().decode(bytes), omittedReason: null }
-	} catch {
-		return { body: null, omittedReason: "read-error" }
-	}
-}
-
-type ResolvedOptions = {
-	redactHeader: (name: string, value: string) => string | null
-	redactQueryParam: (name: string, value: string) => string | null
-}
-
-function formatCurl(request: Request, body: BodyResult | null, opts: ResolvedOptions): string {
-	const parts: string[] = ["curl", "-X", shellQuote(request.method)]
-	for (const [name, value] of request.headers.entries()) {
-		const redactedValue = opts.redactHeader(name, value)
-		if (redactedValue === null) continue
-		parts.push("-H", shellQuote(`${name}: ${redactedValue}`))
-	}
-	if (body !== null && body.body !== null) parts.push("--data-raw", shellQuote(body.body))
-	parts.push(shellQuote(redactUrl(request.url, opts.redactQueryParam)))
-	return parts.join(" ")
-}
-
-/** Start reading the body (if logged) now, before a handler consumes it. */
-function startBodyRead(request: Request, body: CurlLoggerOptions["body"]): Promise<BodyResult> {
-	if (body !== true && typeof body !== "object") {
-		return Promise.resolve({ body: null, omittedReason: "disabled" })
-	}
-	const bodyOptions = typeof body === "object" ? body : {}
-	const allowContentTypes = bodyOptions.allowContentTypes ?? DEFAULT_BODY_CONTENT_TYPES
-	if (!shouldIncludeBody(request.headers.get("content-type"), allowContentTypes)) {
-		return Promise.resolve({ body: null, omittedReason: request.body === null ? "missing" : "content-type" })
-	}
-	return readBodyWithinLimit(request, bodyOptions.maxBytes ?? DEFAULT_MAX_BODY_BYTES)
-}
-
-async function buildCurlLogData(
-	request: Request,
-	options?: Pick<CurlLoggerOptions, "body" | "redactHeader" | "redactQueryParam">,
-): Promise<Pick<CurlLogData, "bodyIncluded" | "bodyOmittedReason" | "curl">> {
-	const resolved: ResolvedOptions = {
-		redactHeader: options?.redactHeader ?? defaultRedactHeader,
-		redactQueryParam: options?.redactQueryParam ?? defaultRedactQueryParam,
-	}
-	const body = await startBodyRead(request, options?.body)
-	return {
-		bodyIncluded: body.body !== null,
-		bodyOmittedReason: body.omittedReason,
-		curl: formatCurl(request, body, resolved),
-	}
-}
-
-function curlLogger(options?: CurlLoggerOptions): MiddlewareFn<{ path: string; req: Request }, {}> {
-	const log = options?.log ?? defaultLog
-	const skip = options?.skip
-	const resolved: ResolvedOptions = {
-		redactHeader: options?.redactHeader ?? defaultRedactHeader,
-		redactQueryParam: options?.redactQueryParam ?? defaultRedactQueryParam,
-	}
-
-	return namedMiddleware("curlLogger", async (ctx, next) => {
-		const start = performance.now()
-		const request = ctx.req
-		const method = request.method
-		const path = ctx.path
-		const rid = ((ctx as Record<string, unknown>)["requestId"] as string | null) ?? null
-		/* the only work before `next()`: the body must be teed before a handler reads it */
-		const bodyPromise = startBodyRead(request, options?.body)
-
-		const response = await next()
-		const skipData: CurlSkipData = {
-			duration: performance.now() - start,
-			method,
-			path,
-			requestId: rid,
-			status: response.status,
-		}
-
-		/* a failing redact callback, skip or sink never turns the response into a 500 */
-		try {
-			if (skip?.(skipData)) return response
-			const body = await bodyPromise
-			const data: CurlLogData = {
-				...skipData,
-				bodyIncluded: body.body !== null,
-				bodyOmittedReason: body.omittedReason,
-				curl: formatCurl(request, body, resolved),
-			}
-			if (options?.instance) {
-				options.instance.info({ ...data }, "request curl")
-			} else {
-				log(data)
-			}
-		} catch (err) {
-			console.error("curlLogger: failed to log request", err)
-		}
-
-		return response
-	})
-}
-
-export { buildCurlLogData, curlLogger, defaultRedactHeader, defaultRedactQueryParam }
-export type { BodyOmittedReason, CurlLogData, CurlLoggerBodyOptions, CurlLoggerOptions, CurlSkipData }

package/src/detect-runtime.ts

@@ -1,17 +0,0 @@
-export type ServeRuntime = "bun" | "cloudflare" | "deno" | "node"
-
-type DetectGlobal = {
-	Bun?: unknown
-	Deno?: unknown
-	navigator?: { userAgent?: string }
-	process?: { versions?: { node?: string } }
-}
-
-export function detectRuntime(g: DetectGlobal = globalThis): ServeRuntime {
-	if (typeof g.Bun !== "undefined") return "bun"
-	if (typeof g.Deno !== "undefined") return "deno"
-	const ua = g.navigator?.userAgent ?? ""
-	if (ua.includes("Cloudflare-Workers") || ua.includes("workerd")) return "cloudflare"
-	if (g.process?.versions?.node) return "node"
-	throw new Error('Honey.serve() could not detect a runtime. Pass runtime: "bun" | "node" | "deno".')
-}

package/src/dict.ts

@@ -1,12 +0,0 @@
-/**
- * An object for keys that come from request data: search params, form fields, header views,
- * validation field maps. It has no prototype, so a key named `__proto__`, `constructor` or
- * `toString` is plain data — it cannot hit `Object.prototype`, replace the object's prototype,
- * or turn a missing key into a function.
- *
- * Read keys with `key in obj`, `obj[key] !== undefined` or `Object.hasOwn(obj, key)`; the
- * object has no `hasOwnProperty` method of its own.
- */
-export function dict<T>(): Record<string, T> {
-	return Object.create(null) as Record<string, T>
-}

package/src/error.ts

@@ -1,55 +0,0 @@
-import type { FieldError, StatusKey } from "./types.ts"
-import { EMPTY_FIELDS, statusKeyToCode } from "./types.ts"
-
-export class HoneyError extends Error {
-	readonly data?: unknown
-	readonly errorKey: string
-	readonly fields: Record<string, FieldError[]>
-	readonly headers?: Record<string, string>
-	readonly status: number
-	readonly statusKey: StatusKey
-	readonly vars?: Record<string, string | number>
-
-	constructor(opts: {
-		cause?: unknown
-		data?: unknown
-		errorKey: string
-		fields?: Record<string, FieldError[]>
-		headers?: Record<string, string>
-		status: StatusKey
-		vars?: Record<string, string | number>
-	}) {
-		super(opts.errorKey, opts.cause !== undefined ? { cause: opts.cause } : undefined)
-		this.data = opts.data
-		this.errorKey = opts.errorKey
-		this.headers = opts.headers
-		/* an unknown status key must not turn an error into a 200 — it is a 500 */
-		const known = Object.hasOwn(statusKeyToCode, opts.status)
-		this.statusKey = known ? opts.status : "internal_server_error"
-		this.status = known ? statusKeyToCode[opts.status] : 500
-		this.fields = opts.fields ?? EMPTY_FIELDS
-		this.vars = opts.vars
-	}
-
-	static serialize(e: unknown): Record<string, unknown> {
-		if (!(e instanceof Error)) return { message: String(e) }
-
-		const obj: Record<string, unknown> = {
-			message: e.message,
-			name: e.name,
-			stack: e.stack,
-		}
-
-		if (e instanceof HoneyError) {
-			obj["errorKey"] = e.errorKey
-			obj["status"] = e.status
-			obj["statusKey"] = e.statusKey
-			if (Object.keys(e.fields).length > 0) obj["fields"] = e.fields
-			if (e.vars) obj["vars"] = e.vars
-		}
-
-		if (e.cause) obj["cause"] = HoneyError.serialize(e.cause)
-
-		return obj
-	}
-}

package/src/errors.ts

@@ -1,85 +0,0 @@
-import { HoneyError } from "./error.ts"
-import type { ExtractICUVars } from "./i18n.ts"
-import type { FieldError, InferOutput, StandardSchemaLike, StatusKey } from "./types.ts"
-
-type ErrorFactoryOpts<TVars> = {
-	cause?: unknown
-	fields?: Record<string, FieldError[]>
-	headers?: Record<string, string>
-	vars?: TVars
-}
-
-type ErrorDefWithSchema = {
-	schema: StandardSchemaLike
-	status: StatusKey
-}
-
-type ErrorDef = ErrorDefWithSchema | StatusKey
-
-export type ErrorMetaEntry = {
-	schema: StandardSchemaLike | null
-	statusKey: StatusKey
-}
-
-/** Per-key meta — keeps schema + statusKey literals for ComputeErrorsByStatus */
-type ErrorMetaForDef<D extends ErrorDef> = D extends ErrorDefWithSchema
-	? { schema: D["schema"]; statusKey: D["status"] }
-	: D extends StatusKey
-		? { schema: null; statusKey: D }
-		: ErrorMetaEntry
-
-export const ERROR_META: unique symbol = Symbol.for("honey.error.meta")
-
-type ErrorFactoryResult<TMap extends Record<string, ErrorDef>, TTranslations extends Record<string, string>> = {
-	[K in keyof TMap]: TMap[K] extends ErrorDefWithSchema
-		? (data: InferOutput<TMap[K]["schema"]>, opts?: { cause?: unknown; headers?: Record<string, string> }) => HoneyError
-		: K extends keyof TTranslations
-			? (opts?: ErrorFactoryOpts<ExtractICUVars<TTranslations[K]>>) => HoneyError
-			: (opts?: ErrorFactoryOpts<Record<string, string | number>>) => HoneyError
-} & {
-	readonly [ERROR_META]: { [K in keyof TMap]: ErrorMetaForDef<TMap[K]> }
-}
-
-export function defineErrors<
-	TMap extends Record<string, ErrorDef>,
-	TTranslations extends Record<string, string> = Record<string, string>,
->(map: TMap): ErrorFactoryResult<TMap, TTranslations> {
-	const result = Object.create(null) as Record<string, unknown>
-	const meta = Object.create(null) as Record<string, ErrorMetaEntry>
-
-	for (const [key, def] of Object.entries(map)) {
-		if (typeof def === "string") {
-			/* standard error — string status key */
-			meta[key] = { schema: null, statusKey: def }
-			result[key] = (opts?: ErrorFactoryOpts<Record<string, string | number>>) =>
-				new HoneyError({
-					cause: opts?.cause,
-					errorKey: key,
-					fields: opts?.fields,
-					headers: opts?.headers,
-					status: def,
-					vars: opts?.vars,
-				})
-		} else {
-			/* custom schema error — { status, schema } */
-			meta[key] = { schema: def.schema, statusKey: def.status }
-			result[key] = (data: unknown, opts?: { cause?: unknown; headers?: Record<string, string> }) =>
-				new HoneyError({
-					cause: opts?.cause,
-					data,
-					errorKey: key,
-					headers: opts?.headers,
-					status: def.status,
-				})
-		}
-	}
-
-	Object.defineProperty(result, ERROR_META, {
-		configurable: false,
-		enumerable: false,
-		value: meta,
-		writable: false,
-	})
-
-	return result as ErrorFactoryResult<TMap, TTranslations>
-}

package/src/etag.ts

@@ -1,97 +0,0 @@
-import { bodyKind, rawBodyOf } from "./body-kind.ts"
-import { replaceResponse } from "./honey-response.ts"
-import { namedMiddleware } from "./middleware.ts"
-import type { MiddlewareFn } from "./middleware.ts"
-
-type ETagOptions = {
-	weak?: boolean
-}
-
-const encoder = new TextEncoder()
-
-/** Base64url of the first 16 bytes of SHA-256: collision-resistant enough for a strong validator. */
-async function digest(data: Uint8Array<ArrayBuffer>): Promise<string> {
-	const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", data)).subarray(0, 16)
-	let binary = ""
-	for (let i = 0; i < hash.length; i++) binary += String.fromCharCode(hash[i])
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
-}
-
-const ENTITY_TAG_RE = /(?:W\/)?"[^"]*"/g
-
-/** Weak comparison (RFC 9110 §8.8.3.2): opaque tags match regardless of the `W/` prefix. */
-function opaque(tag: string): string {
-	return tag.startsWith("W/") ? tag.slice(2) : tag
-}
-
-/** RFC 9110 §13.1.2: `*` or a list of entity tags, compared weakly. */
-export function ifNoneMatchHits(header: string | null, etag: string): boolean {
-	if (header === null) return false
-	if (header.trim() === "*") return true
-	const target = opaque(etag.trim())
-	for (const tag of header.match(ENTITY_TAG_RE) ?? []) {
-		if (opaque(tag) === target) return true
-	}
-	return false
-}
-
-export function etag(options?: ETagOptions): MiddlewareFn<{ req: Request }, {}> {
-	const weak = options?.weak !== false
-
-	const mw: MiddlewareFn<{ req: Request }, {}> = async (ctx, next) => {
-		const method = ctx.req.method
-		if (method !== "GET" && method !== "HEAD") {
-			return next()
-		}
-
-		const response = await next()
-
-		/* Only a 200 has a selected representation a 304 can stand in for. */
-		if (response.status !== 200) return response
-
-		const ifNoneMatch = ctx.req.headers.get("if-none-match")
-
-		/* A handler-set ETag is authoritative: never overwrite it or hash the body. */
-		const existing = response.headers.get("etag")
-		if (existing !== null) {
-			if (!ifNoneMatchHits(ifNoneMatch, existing)) return response
-			await response.body?.cancel().catch(() => {})
-			return replaceResponse(response, { body: null, headers: response.headers, status: 304 })
-		}
-
-		/* Never buffer a stream: SSE and generate() can be endless. */
-		if (bodyKind(response) !== "buffered") return response
-
-		let bytes: Uint8Array<ArrayBuffer>
-		const raw = rawBodyOf(response)
-		if (raw !== null) {
-			bytes = typeof raw === "string" ? encoder.encode(raw) : new Uint8Array(raw)
-		} else {
-			bytes = new Uint8Array(await response.arrayBuffer())
-		}
-
-		/* Nothing to validate; hand back a fresh body (the original may have been read). */
-		if (bytes.byteLength === 0) {
-			return raw === null ? replaceResponse(response, { body: bytes, headers: response.headers }) : response
-		}
-
-		const hash = await digest(bytes)
-		const etagValue = weak ? `W/"${hash}"` : `"${hash}"`
-
-		const headers = new Headers(response.headers as HeadersInit)
-		headers.set("etag", etagValue)
-
-		if (ifNoneMatchHits(ifNoneMatch, etagValue)) {
-			return replaceResponse(response, { body: null, headers, status: 304 })
-		}
-
-		/* The original body was read (or is raw): always hand back a fresh one. */
-		return replaceResponse(response, {
-			body: typeof raw === "string" ? raw : bytes,
-			headers,
-			status: response.status,
-		})
-	}
-
-	return namedMiddleware("etag", mw)
-}