akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/plugins/haptics/src/index.ts

@@ -0,0 +1,34 @@
+import { definePlugin } from "../../../packages/core/src/index.ts";
+import { web } from "./web.ts";
+
+/** UIImpactFeedbackGenerator styles: light / medium / heavy by strength, soft is duller, rigid is crisper. */
+export type ImpactStyle = "light" | "medium" | "heavy" | "soft" | "rigid";
+
+export type NotificationType = "success" | "warning" | "error";
+
+/**
+ * Haptic feedback, with the four functions of tauri-plugins-workspace/plugins/haptics/guest-js/index.ts.
+ *
+ * A call resolves once the feedback was handed to the system. Devices without haptic hardware
+ * (iOS simulator, iPads, most Android tablets and desktop browsers) resolve and feel nothing.
+ * Hosts without any haptics API reject UNSUPPORTED: macOS, and browsers without navigator.vibrate
+ * (Safari, so every iOS browser).
+ *
+ * impact, notification and selection are UI feedback: on iOS and Android they follow the user's
+ * system haptics / touch feedback setting.
+ */
+export interface HapticsApi {
+  /** A collision between UI elements, e.g. something snapping into place. Default style "medium". */
+  impact(options?: { style?: ImpactStyle }): Promise<void>;
+  /** The outcome of a task or action. Default type "success". */
+  notification(options?: { type?: NotificationType }): Promise<void>;
+  /** A selection changed, e.g. a picker value while scrolling. */
+  selection(): Promise<void>;
+  /** A plain vibration, for alerts rather than UI feedback. `duration` in ms, 1-10000, default 300. */
+  vibrate(options?: { duration?: number }): Promise<void>;
+}
+
+export const haptics = definePlugin<HapticsApi>("haptics", {
+  methods: ["impact", "notification", "selection", "vibrate"],
+  web,
+});

package/vendor/@akanjs/native/plugins/haptics/src/web.ts

@@ -0,0 +1,53 @@
+import { AkanNativeError, defineWebPlugin } from "../../../packages/core/src/index.ts";
+import type { HapticsApi, ImpactStyle, NotificationType } from "./index.ts";
+
+const IMPACT: Record<ImpactStyle, number> = { light: 10, soft: 10, medium: 20, rigid: 20, heavy: 30 };
+
+const NOTIFICATION: Record<NotificationType, number[]> = {
+  success: [40, 100, 40],
+  warning: [40, 120, 60],
+  error: [60, 100, 40, 80, 50],
+};
+
+const SELECTION = 10;
+
+function vibrator(): (pattern: number | number[]) => boolean {
+  const nav = typeof navigator === "undefined" ? undefined : (navigator as Navigator & { vibrate?: unknown });
+  if (typeof nav?.vibrate !== "function")
+    throw new AkanNativeError("UNSUPPORTED", "navigator.vibrate is not available in this browser");
+  return (pattern) => nav.vibrate(pattern);
+}
+
+function choice<T extends string>(value: unknown, allowed: readonly T[], fallback: T, name: string): T {
+  if (value === undefined || value === null) return fallback;
+  if (typeof value === "string" && (allowed as readonly string[]).includes(value)) return value as T;
+  throw new AkanNativeError("INVALID_ARGS", `${name} must be one of ${allowed.join(", ")}`);
+}
+
+function checkDuration(value: unknown): number {
+  if (value === undefined || value === null) return 300;
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 1 || value > 10000) {
+    throw new AkanNativeError("INVALID_ARGS", "duration must be a number of milliseconds between 1 and 10000");
+  }
+  return Math.round(value);
+}
+
+export const web = defineWebPlugin<HapticsApi>({
+  methods: {
+    async impact(options) {
+      const style = choice(options?.style, ["light", "medium", "heavy", "soft", "rigid"], "medium", "style");
+      vibrator()(IMPACT[style]);
+    },
+    async notification(options) {
+      const type = choice(options?.type, ["success", "warning", "error"], "success", "type");
+      vibrator()(NOTIFICATION[type]);
+    },
+    async selection() {
+      vibrator()(SELECTION);
+    },
+    async vibrate(options) {
+      const duration = checkDuration(options?.duration);
+      vibrator()(duration);
+    },
+  },
+});

package/vendor/@akanjs/native/plugins/http/android/HttpPlugin.kt

@@ -0,0 +1,234 @@
+package com.akanjs.plugins.http
+
+import android.security.NetworkSecurityPolicy
+import com.akanjs.runtime.AkanNativeErrorCode
+import com.akanjs.runtime.AkanNativePluginContext
+import com.akanjs.runtime.AkanNativeReply
+import com.akanjs.runtime.AkanNativeScope
+import java.io.ByteArrayOutputStream
+import java.io.IOException
+import java.io.InputStream
+import java.net.HttpURLConnection
+import java.net.SocketTimeoutException
+import java.net.URI
+import java.util.Base64
+import java.util.concurrent.Executors
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicBoolean
+import java.util.concurrent.atomic.AtomicReference
+
+/**
+ * Native HTTP (WV-5) with the framework's HttpURLConnection (no OkHttp library, no AndroidX): the
+ * request leaves from the app, not the WebView, so CORS does not apply. Capacitor's CapacitorHttp
+ * does the same (capacitor/android/capacitor/src/main/java/com/getcapacitor/plugin/); what akan-native
+ * does differently:
+ * - Redirects are followed here (instanceFollowRedirects off): every hop is checked against the
+ *   app's scope, with fetch's method and credential rules (HttpUrl.kt), and http ↔ https hops
+ *   work, which HttpURLConnection never follows by itself. Capacitor only toggles
+ *   setInstanceFollowRedirects (util/CapacitorHttpUrlConnection.java:145-147).
+ * - One deadline for the whole request: connect and read timeouts are the time left, and a timer
+ *   disconnects the connection when it runs out (a read timeout alone restarts with every packet).
+ *   Capacitor leaves both unset, i.e. no timeout (util/HttpRequestHandler.java:112-113).
+ * - Error statuses read getErrorStream(), which is null for an empty error body (Capacitor then
+ *   calls getInputStream(), which throws: util/HttpRequestHandler.java:241-254).
+ * - The body is read as bytes: UTF-8 text (Capacitor's readLine() rewrites line endings,
+ *   util/HttpRequestHandler.java:362-375) or base64 with NO_WRAP semantics (java.util.Base64;
+ *   Capacitor's Base64.DEFAULT inserts line breaks, :352).
+ * - A body is never sent with GET/HEAD: HttpURLConnection turns a GET with output into a POST.
+ * - Android adds X-Android-* bookkeeping headers to responses; they are left out.
+ * - No cookie handling: CookieHandler.getDefault() is null in an app (Capacitor installs one,
+ *   CapacitorCookies.java:20-27). No cache (useCaches = false).
+ * - http:// needs the app's cleartext permission (android:usesCleartextTraffic or a network
+ *   security config); without it the request is refused up front with PERMISSION_DENIED.
+ * Requests run on a cached thread pool, as Capacitor's (CapacitorHttp.java:28).
+ * Arguments arrive decoded by the generated HttpPluginSpec (PL-10); src/common.ts has the same rules.
+ */
+class HttpPlugin(context: AkanNativePluginContext) : HttpPluginSpec {
+    private val pool = Executors.newCachedThreadPool { Thread(it, "akan-native-http").apply { isDaemon = true } }
+    private val timer = Executors.newSingleThreadScheduledExecutor { Thread(it, "akan-native-http-timeout").apply { isDaemon = true } }
+
+    private class Failure(val code: String, message: String) : Exception(message)
+
+    private class Plan(val url: String, val first: HttpUrl.Hop, val base64: Boolean, val timeout: Long)
+
+    override fun request(args: HttpNativeRequest, reply: AkanNativeReply<HttpNativeResponse>) {
+        val plan = try {
+            plan(args)
+        } catch (e: Failure) {
+            return reply.reject(e.code, e.message ?: "invalid request")
+        }
+        // PL-11 scopes { url }, on the canonical URL; redirects are checked in follow().
+        if (!reply.call.inScope(mapOf("url" to plan.url), urlFields = setOf("url"), what = "request to ${plan.url}")) return
+        val scope = reply.call.scope
+        val current = AtomicReference<HttpURLConnection?>()
+        // The page gave up on the request (AbortSignal) or is gone: the connection is closed.
+        reply.onCancel { pool.execute { current.get()?.disconnect() } }
+        pool.execute {
+            val timedOut = AtomicBoolean(false)
+            val alarm = timer.schedule(Runnable {
+                timedOut.set(true)
+                current.get()?.disconnect()
+            }, plan.timeout, TimeUnit.MILLISECONDS)
+            try {
+                reply.resolve(follow(plan, scope, current, timedOut))
+            } catch (e: Failure) {
+                reply.reject(e.code, e.message ?: "request failed")
+            } catch (e: Exception) {
+                if (timedOut.get() || e is SocketTimeoutException) {
+                    reply.reject(AkanNativeErrorCode.INTERNAL, "request to ${plan.url} timed out after ${plan.timeout} ms")
+                } else {
+                    reply.reject(AkanNativeErrorCode.INTERNAL, "request to ${plan.url} failed: ${e.message ?: e.toString()}")
+                }
+            } finally {
+                alarm.cancel(false)
+                current.get()?.disconnect()
+            }
+        }
+    }
+
+    override fun destroy() {
+        pool.shutdownNow()
+        timer.shutdownNow()
+    }
+
+    private fun plan(args: HttpNativeRequest): Plan {
+        val url = HttpUrl.canonical(args.url) ?: throw Failure(AkanNativeErrorCode.INVALID_ARGS, "${args.url} is not an http or https URL akan-native can request")
+        val method = args.method?.json ?: "GET"
+        val headers = ArrayList<Pair<String, String>>()
+        val seen = HashSet<String>()
+        for ((name, value) in (args.headers ?: emptyMap()).entries.sortedBy { it.key }) {
+            if (name.isEmpty() || !name.all { it.code < 0x80 && (it.isLetterOrDigit() || it in TOKEN_EXTRA) }) {
+                throw Failure(AkanNativeErrorCode.INVALID_ARGS, "header name \"$name\" is not valid")
+            }
+            val lower = name.lowercase()
+            if (lower in RESERVED) throw Failure(AkanNativeErrorCode.INVALID_ARGS, "header $name is set by the HTTP stack")
+            if (!seen.add(lower)) throw Failure(AkanNativeErrorCode.INVALID_ARGS, "header $name is given twice")
+            if (value.any { it == '\r' || it == '\n' || it == '\u0000' }) throw Failure(AkanNativeErrorCode.INVALID_ARGS, "headers.$name must not contain CR, LF or NUL")
+            headers.add(name to value.trim(' ', '\t'))
+        }
+        var body: ByteArray? = null
+        args.body?.let { text ->
+            if (method == "GET" || method == "HEAD") throw Failure(AkanNativeErrorCode.INVALID_ARGS, "a $method request cannot have a body")
+            val base64 = args.bodyEncoding == HttpBodyEncoding.BASE64
+            body = if (base64) decodeBase64(text) else text.toByteArray(Charsets.UTF_8)
+            if ("content-type" !in seen) headers.add("Content-Type" to if (base64) "application/octet-stream" else "text/plain;charset=UTF-8")
+        }
+        val timeout = args.timeout ?: 60_000.0
+        if (!(timeout > 0 && timeout <= Int.MAX_VALUE)) throw Failure(AkanNativeErrorCode.INVALID_ARGS, "timeout must be a number of milliseconds between 1 and 2147483647")
+        return Plan(url, HttpUrl.Hop(method, headers, body), args.responseType == HttpNativeResponseType.BASE64, Math.ceil(timeout).toLong())
+    }
+
+    /** Standard alphabet, padding optional, no whitespace (src/common.ts base64ToBytes); java.util.Base64 is strict. */
+    private fun decodeBase64(text: String): ByteArray {
+        if (!BASE64.matches(text) || text.length % 4 == 1 || (text.contains('=') && text.length % 4 != 0)) {
+            throw Failure(AkanNativeErrorCode.INVALID_ARGS, "body is not valid base64")
+        }
+        return Base64.getDecoder().decode(text)
+    }
+
+    private fun follow(plan: Plan, scope: AkanNativeScope?, current: AtomicReference<HttpURLConnection?>, timedOut: AtomicBoolean): HttpNativeResponse {
+        val deadline = System.nanoTime() + TimeUnit.MILLISECONDS.toNanos(plan.timeout)
+        var url = plan.url
+        var hop = plan.first
+        var count = 0
+        while (true) {
+            val target = URI(url).toURL()
+            if (target.protocol == "http" && !NetworkSecurityPolicy.getInstance().isCleartextTrafficPermitted(target.host)) {
+                throw Failure(
+                    AkanNativeErrorCode.PERMISSION_DENIED,
+                    "cleartext HTTP to ${target.host} is blocked by Android's network security policy: use https, or allow cleartext for the app (android:usesCleartextTraffic)",
+                )
+            }
+            val left = TimeUnit.NANOSECONDS.toMillis(deadline - System.nanoTime())
+            if (left <= 0 || timedOut.get()) throw SocketTimeoutException()
+            val connection = target.openConnection() as HttpURLConnection
+            current.getAndSet(connection)?.disconnect()
+            if (timedOut.get()) throw SocketTimeoutException()
+            connection.instanceFollowRedirects = false
+            connection.useCaches = false
+            connection.connectTimeout = left.toInt()
+            connection.readTimeout = left.toInt()
+            connection.requestMethod = hop.method
+            for ((name, value) in hop.headers) connection.setRequestProperty(name, value)
+            val payload = hop.body ?: if (hop.method in BODY_METHODS) ByteArray(0) else null
+            if (payload != null) {
+                connection.doOutput = true
+                connection.setFixedLengthStreamingMode(payload.size)
+                connection.outputStream.use { it.write(payload) }
+            }
+            val status = connection.responseCode
+            if (status < 0) throw Failure(AkanNativeErrorCode.INTERNAL, "$url did not answer with valid HTTP")
+            val location = if (status in REDIRECTS) connection.getHeaderField("Location") else null
+            if (location != null) {
+                connection.disconnect()
+                if (count == MAX_REDIRECTS) throw Failure(AkanNativeErrorCode.INTERNAL, "${plan.url} redirected more than $MAX_REDIRECTS times")
+                count++
+                val next = HttpUrl.redirectTarget(location, url) ?: throw Failure(AkanNativeErrorCode.INTERNAL, "cannot follow the redirect from $url to $location")
+                if (scope != null && !scope.permits(mapOf("url" to next), urlFields = setOf("url"))) throw Failure(AkanNativeErrorCode.NOT_ALLOWED, "redirect to $next is outside the app's capabilities")
+                hop = HttpUrl.redirected(status, hop, url, next)
+                url = next
+                continue
+            }
+            val bytes = if (hop.method == "HEAD" || status == 204 || status == 304) ByteArray(0) else read(connection, status)
+            val headers = headers(connection)
+            return HttpNativeResponse(
+                status = status.toDouble(),
+                headers = headers,
+                data = if (plan.base64) Base64.getEncoder().encodeToString(bytes) else text(bytes),
+                url = url,
+            )
+        }
+    }
+
+    private fun read(connection: HttpURLConnection, status: Int): ByteArray {
+        val stream: InputStream? = if (status >= 400) {
+            connection.errorStream
+        } else {
+            try {
+                connection.inputStream
+            } catch (e: IOException) {
+                connection.errorStream ?: throw e
+            }
+        }
+        if (stream == null) return ByteArray(0)
+        return stream.use { input ->
+            val out = ByteArrayOutputStream()
+            val buffer = ByteArray(64 * 1024)
+            while (true) {
+                val n = input.read(buffer)
+                if (n < 0) break
+                out.write(buffer, 0, n)
+            }
+            out.toByteArray()
+        }
+    }
+
+    /** Lowercase names, repeated headers joined with ", ", no X-Android-* bookkeeping; see src/common.ts responseHeaders. */
+    private fun headers(connection: HttpURLConnection): Map<String, String> {
+        val out = LinkedHashMap<String, String>()
+        for ((key, values) in connection.headerFields) {
+            val name = key?.lowercase() ?: continue // null: the status line
+            if (name.startsWith("x-android-")) continue
+            val value = values.joinToString(", ")
+            out[name] = out[name]?.let { "$it, $value" } ?: value
+        }
+        val encoding = out["content-encoding"]
+        if (encoding != null && !encoding.equals("identity", ignoreCase = true)) {
+            out.remove("content-encoding")
+            out.remove("content-length")
+        }
+        return out
+    }
+
+    /** UTF-8 with invalid bytes as U+FFFD and without a byte order mark, as fetch's text(). */
+    private fun text(bytes: ByteArray): String = String(bytes, Charsets.UTF_8).removePrefix("")
+
+    private companion object {
+        const val MAX_REDIRECTS = 20
+        val REDIRECTS = setOf(301, 302, 303, 307, 308)
+        val BODY_METHODS = setOf("POST", "PUT", "PATCH")
+        val RESERVED = setOf("host", "content-length", "transfer-encoding", "connection", "keep-alive", "upgrade", "te", "trailer", "expect", "accept-encoding")
+        const val TOKEN_EXTRA = "!#$%&'*+-.^_`|~"
+        val BASE64 = Regex("^[A-Za-z0-9+/]*={0,2}$")
+    }
+}

package/vendor/@akanjs/native/plugins/http/android/HttpUrl.kt

@@ -0,0 +1,182 @@
+package com.akanjs.plugins.http
+
+/**
+ * URL and redirect rules of the http plugin, the same as src/common.ts (canonicalUrl, redirected)
+ * and ios/HttpUrl.swift. Free of Android classes, so it can be checked on a plain JVM.
+ */
+object HttpUrl {
+    /** Path segments that mean "this" or "parent" (WHATWG also reads %2e as "."). */
+    private val DOT = setOf(".", "%2e")
+    private val DOT_DOT = setOf("..", "%2e%2e", ".%2e", "%2e.")
+    private const val HEX = "0123456789ABCDEF"
+    private const val SUB_DELIMS = "-._~!$&'()*+,;="
+
+    private fun isHex(b: Int) = (b in 0x30..0x39) || (b in 0x41..0x46) || (b in 0x61..0x66)
+
+    private fun isAlnum(b: Int) = (b in 0x30..0x39) || (b in 0x41..0x5A) || (b in 0x61..0x7A)
+
+    /** RFC 3986 unreserved and sub-delims. */
+    private fun isUnreservedOrSubDelim(b: Int) = isAlnum(b) || (b < 0x80 && SUB_DELIMS.indexOf(b.toChar()) >= 0)
+
+    /** What RFC 3986 allows unescaped in a path and query. */
+    private fun isPathChar(b: Int) = isUnreservedOrSubDelim(b) || b == ':'.code || b == '@'.code || b == '/'.code || b == '?'.code
+
+    /**
+     * The canonical form (src/common.ts canonicalUrl): lowercase scheme and host, no default
+     * port, "/" for an empty path, no fragment, path and query percent-encoded where RFC 3986
+     * needs it. null for anything that is not an absolute http(s) URL, has credentials, a
+     * malformed host or port, or dot segments.
+     */
+    fun canonical(input: String): String? {
+        val text = input.substringBefore('#')
+        val scheme = when {
+            text.regionMatches(0, "http://", 0, 7, ignoreCase = true) -> "http"
+            text.regionMatches(0, "https://", 0, 8, ignoreCase = true) -> "https"
+            else -> return null
+        }
+        val rest = text.substring(scheme.length + 3)
+        val end = rest.indexOfFirst { it == '/' || it == '?' }.let { if (it < 0) rest.length else it }
+        val authority = rest.substring(0, end)
+        if (authority.isEmpty() || '@' in authority) return null
+
+        val host: String
+        var port = ""
+        if (authority.startsWith("[")) {
+            val close = authority.indexOf(']')
+            if (close < 0) return null
+            host = authority.substring(0, close + 1)
+            val after = authority.substring(close + 1)
+            if (after.isNotEmpty()) {
+                if (!after.startsWith(":")) return null
+                port = after.substring(1)
+            }
+            val inside = host.substring(1, host.length - 1)
+            if (inside.isEmpty() || !inside.all { isHex(it.code) || it == ':' || it == '.' }) return null
+        } else {
+            val colon = authority.lastIndexOf(':')
+            host = if (colon < 0) authority else authority.substring(0, colon)
+            port = if (colon < 0) "" else authority.substring(colon + 1)
+            // No percent escapes in a host: a deny of a host must not be passed by escaping a letter.
+            if (host.isEmpty() || !host.all { isUnreservedOrSubDelim(it.code) }) return null
+        }
+        var portPart = ""
+        if (port.isNotEmpty()) {
+            if (port.length > 5 || !port.all { it in '0'..'9' }) return null
+            val n = port.toInt()
+            if (n > 65535) return null
+            if (!((scheme == "http" && n == 80) || (scheme == "https" && n == 443))) portPart = ":$n"
+        }
+
+        val bytes = rest.substring(end).toByteArray(Charsets.UTF_8)
+        val tail = StringBuilder()
+        var i = 0
+        while (i < bytes.size) {
+            val b = bytes[i].toInt() and 0xFF
+            if (b == '%'.code && i + 2 < bytes.size && isHex(bytes[i + 1].toInt() and 0xFF) && isHex(bytes[i + 2].toInt() and 0xFF)) {
+                tail.append(b.toChar()).append((bytes[i + 1].toInt() and 0xFF).toChar()).append((bytes[i + 2].toInt() and 0xFF).toChar())
+                i += 3
+                continue
+            }
+            if (b < 0x80 && isPathChar(b)) tail.append(b.toChar()) else tail.append('%').append(HEX[b shr 4]).append(HEX[b and 0x0F])
+            i++
+        }
+        val q = tail.indexOf("?")
+        val path = (if (q < 0) tail.toString() else tail.substring(0, q)).ifEmpty { "/" }
+        val query = if (q < 0) "" else tail.substring(q)
+        if (path.split('/').any { it.lowercase() in DOT || it.lowercase() in DOT_DOT }) return null
+        return "$scheme://${host.lowercase()}$portPart$path$query"
+    }
+
+    /** The origin of a canonical URL (whose path always starts with "/"). */
+    fun origin(url: String): String {
+        val slash = url.indexOf('/', url.indexOf("://") + 3)
+        return if (slash < 0) url else url.substring(0, slash)
+    }
+
+    /**
+     * RFC 3986 5.2.4 on an absolute path: "." and ".." (also %2e forms, as WHATWG) resolved,
+     * ".." above the root dropped. java.net.URI.normalize() keeps a leading "..", which would
+     * leave the URL unusable.
+     */
+    private fun removeDotSegments(path: String): String {
+        val segments = path.split('/')
+        val out = ArrayList<String>()
+        for (i in 1 until segments.size) {
+            val segment = segments[i].lowercase()
+            val last = i == segments.lastIndex
+            when (segment) {
+                in DOT -> if (last) out.add("")
+                in DOT_DOT -> {
+                    if (out.isNotEmpty()) out.removeAt(out.lastIndex)
+                    if (last) out.add("")
+                }
+                else -> out.add(segments[i])
+            }
+        }
+        return "/" + out.joinToString("/")
+    }
+
+    /** RFC 3986 appendix B: scheme, authority, path, query of a URI reference. */
+    private val REFERENCE = Regex("^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#.*)?$", RegexOption.DOT_MATCHES_ALL)
+
+    /**
+     * A redirect target: Location resolved against the current URL by RFC 3986 5.2.2, canonical.
+     * java.net.URI.resolve (RFC 2396) turns "?page=2" against /list?page=1 into /?page=2.
+     */
+    fun redirectTarget(location: String, current: String): String? {
+        val r = REFERENCE.find(location.trim(' ', '\t', '\n', '\r')) ?: return null
+        val base = REFERENCE.find(current) ?: return null
+        val baseScheme = base.groups[2]?.value ?: return null
+        val baseAuthority = base.groups[4]?.value ?: return null
+        val basePath = base.groups[5]?.value.orEmpty()
+        val refPath = r.groups[5]?.value.orEmpty()
+        val refQuery = r.groups[7]?.value
+        val scheme: String
+        val authority: String
+        val path: String
+        var query = refQuery
+        when {
+            r.groups[2] != null -> {
+                scheme = r.groups[2]!!.value
+                authority = r.groups[4]?.value ?: return null
+                path = removeDotSegments(refPath.ifEmpty { "/" })
+            }
+            r.groups[3] != null -> {
+                scheme = baseScheme
+                authority = r.groups[4]!!.value
+                path = removeDotSegments(refPath.ifEmpty { "/" })
+            }
+            else -> {
+                scheme = baseScheme
+                authority = baseAuthority
+                path = when {
+                    refPath.isEmpty() -> {
+                        if (refQuery == null) query = base.groups[7]?.value
+                        basePath.ifEmpty { "/" }
+                    }
+                    refPath.startsWith("/") -> removeDotSegments(refPath)
+                    else -> removeDotSegments(basePath.substring(0, basePath.lastIndexOf('/') + 1).ifEmpty { "/" } + refPath)
+                }
+            }
+        }
+        return canonical("$scheme://$authority$path${query?.let { "?$it" } ?: ""}")
+    }
+
+    class Hop(val method: String, val headers: List<Pair<String, String>>, val body: ByteArray?)
+
+    /** The fetch standard's HTTP-redirect fetch (src/common.ts redirected). */
+    fun redirected(status: Int, hop: Hop, from: String, to: String): Hop {
+        var method = hop.method
+        var headers = hop.headers
+        var body = hop.body
+        if (((status == 301 || status == 302) && method == "POST") || (status == 303 && method != "GET" && method != "HEAD")) {
+            method = "GET"
+            body = null
+            headers = headers.filter { it.first.lowercase() !in setOf("content-type", "content-encoding", "content-language", "content-location") }
+        }
+        if (origin(from) != origin(to)) {
+            headers = headers.filter { it.first.lowercase() !in setOf("authorization", "cookie", "proxy-authorization") }
+        }
+        return Hop(method, headers, body)
+    }
+}