Requests and responses as maps, and the functions that send them.

The client is java.net.http on the JVM, node:http in Node and fetch in a
browser. A request moves no more bytes than its purpose needs.

Futures on the JVM and promises in ClojureScript behind one set of
functions so that code that waits for answers is written once. The
functions take a value, a future or a promise alike.

Bytes on both platforms, a byte array on the JVM and a Uint8Array in
JavaScript, with the encodings, hashes and randomness that requests and
their signatures need.

The hashes are synchronous on both platforms. In JavaScript they come
from the Closure Library rather than WebCrypto, whose digests only come
as promises.

The values of HTTP headers as data: the header maps of responses, links,
media types, byte ranges, and when to ask again.

A map of headers has lower-case names, and each value is a string or a
vector of strings.

JSON on both platforms, without a library: a strict reader by RFC 8259
on the JVM, and the JSON of JavaScript in ClojureScript.

An object reads as a map with keyword keys, unless a :key-fn says
otherwise, an array as a vector, and a number as a long when it's an
integer that fits, or else as a double. In JavaScript every number is a
double, so an integer past 2^53 loses its last digits there.

A proxy on your own server for the requests of a web page, since most
servers don't let a page of another site read their answers.

The proxy fetches any public URL for whoever can reach it, so put it
behind your login. Its answers come from other sites but have the
origin of yours, so it refuses to be opened as a page, and no answer
runs scripts when a browser opens it anyway.

Texts that print as #<secret> (e.g. a password or a token) so that a log
or a REPL doesn't show them.

The reader can't read #<secret>. So a map with a hidden text that goes to
a file as EDN fails to read back instead of coming back without its
secret. A debugger or a browser's console still shows the text because
it shows the fields of an object.

URLs, and the hosts that they name, the same way on both platforms.

This covers percent-encoding and query strings, a URL made absolute
against the document that it's in, as a browser does it, and the scheme
and the origin of a URL. It also tells whether the host of a URL is on
the public internet, which is what a request that a stranger chose must
check.