Requests and responses as maps, and the functions that send them.

The client is java.net.http on the JVM, node:http in Node and fetch in a
browser. A request moves no more bytes than its purpose needs.

Futures on the JVM and promises in ClojureScript behind one set of
functions, so that you write code that waits for answers only once. The
functions take a value, a future or a promise alike.

(ns my.app
  (:require ["@capacitor/core" :refer [CapacitorHttp]]
            [dk.simongray.wary-fetch.capacitor :as capacitor]))

(def send (capacitor/sender CapacitorHttp))

A :send over CapacitorHttp, the plugin that sends the requests of a
Capacitor app from native code, where CORS doesn't stop them.

    (ns my.app
      (:require ["@capacitor/core" :refer [CapacitorHttp]]
                [dk.simongray.wary-fetch.capacitor :as capacitor]))

    (def send (capacitor/sender CapacitorHttp))

The sender sends a request as send! does, with the same limits, and
returns the same response. It follows redirects itself, so that
:allow-pred checks each URL. It decodes text by its charset, since the
plugin decodes all text as UTF-8. The plugin hands over a body whole, so
the sender suits feeds and API calls rather than episodes, which the
plugin's docs leave to a plugin for file transfers. Capacitor's HTTP API
is at https://capacitorjs.com/docs/apis/http

;; main process
(.handle ipcMain "wary-fetch" (electron/handler))

;; preload script
(.exposeInMainWorld contextBridge "waryFetch"
                    #js {:send #(.invoke ipcRenderer "wary-fetch" %)})

;; page
(def send (electron/sender (.. js/window -waryFetch -send)))

A :send for the page of an Electron app, which sends each request
through the main process, where Node sends it and CORS doesn't stop it.

The main process answers with handler, and the page sends with sender
over Electron's IPC, which the preload script exposes to the page:

    ;; main process
    (.handle ipcMain "wary-fetch" (electron/handler))

    ;; preload script
    (.exposeInMainWorld contextBridge "waryFetch"
                        #js {:send #(.invoke ipcRenderer "wary-fetch" %)})

    ;; page
    (def send (electron/sender (.. js/window -waryFetch -send)))

The main process applies its own limits, so a page can't reach what the
handler doesn't allow, e.g. the app's own network. A request and its
response cross the IPC as plain data without functions, so a page's
:sink or :allow-pred stays in the page.

The values of HTTP headers as data: the header maps of responses, links,
byte ranges, the If-Range that resumes a download, and when to ask
again.

A map of headers has lower-case names, and each value is a string or a
vector of strings.

JSON on both platforms, without a library: a strict reader by RFC 8259
on the JVM, and JavaScript's JSON in ClojureScript.

An object reads as a map with keyword keys (unless a :key-fn says
otherwise) and an array as a vector. A number reads as a long when it's
an integer that fits, and else as a double. On the JVM, a longer integer
reads as a bigint, and read-json returns nil for a text with an integer
of more than max-digits digits. In JavaScript every number is a double,
so an integer past 2^53 loses its last digits there.

A proxy on your own server for the requests of a web page, since most
servers don't let a page of another origin read their answers.

The proxy fetches any public URL for whoever can reach it, so put it
behind your login. Its answers come from other sites but have your
site's origin, so it refuses to be opened as a page. When a browser
opens an answer anyway, it runs no scripts in it.

Texts that print as #<secret> (e.g. a password or a token) so that a log
or a REPL doesn't show them.

The reader can't read #<secret>. So when you write a map with a secret
to a file as EDN, it fails to read back rather than coming back without
the secret. A debugger or a browser's console still shows the text,
since it shows the fields of an object.

URLs and the hosts that they name, the same way on both platforms.

This covers percent-encoding and query strings, resolving a URL against
the document that it's in (as a browser does it), and the scheme and
the origin of a URL. It also checks whether a URL's host is on the
public internet, e.g. before you fetch a URL that a stranger gave you.

The library parses URLs with whatwg-url, which implements the URL
Standard, so it parses a host as a browser does, e.g. 0x7f.1 as
127.0.0.1.