/*
 * Copyright (c) 2022-2023, networkException <networkexception@serenityos.org>
 * Copyright (c) 2024, Tim Ledbetter <timledbetter@gmail.com>
 * Copyright (c) 2024, Shannon Booth <shannon@serenityos.org>
 *
 * SPDX-License-Identifier: BSD-2-Clause
 */

#include <AK/Utf16String.h>
#include <LibCore/EventLoop.h>
#include <LibCrypto/Hash/SHA2.h>
#include <LibGC/Function.h>
#include <LibGC/Root.h>
#include <LibJS/Bytecode/Executable.h>
#include <LibJS/Runtime/ModuleRequest.h>
#include <LibJS/Runtime/SharedFunctionInstanceData.h>
#include <LibJS/RustIntegration.h>
#include <LibJS/SourceCode.h>
#include <LibRequests/RequestClient.h>
#include <LibTextCodec/Decoder.h>
#include <LibThreading/ThreadPool.h>
#include <LibWeb/Bindings/MainThreadVM.h>
#include <LibWeb/Bindings/PrincipalHostDefined.h>
#include <LibWeb/DOM/Document.h>
#include <LibWeb/DOMURL/DOMURL.h>
#include <LibWeb/Fetch/Fetching/Fetching.h>
#include <LibWeb/Fetch/Infrastructure/FetchAlgorithms.h>
#include <LibWeb/Fetch/Infrastructure/HTTP/MIME.h>
#include <LibWeb/Fetch/Infrastructure/HTTP/Requests.h>
#include <LibWeb/Fetch/Infrastructure/HTTP/Responses.h>
#include <LibWeb/Fetch/Infrastructure/URL.h>
#include <LibWeb/HTML/EventLoop/EventLoop.h>
#include <LibWeb/HTML/HTMLScriptElement.h>
#include <LibWeb/HTML/PotentialCORSRequest.h>
#include <LibWeb/HTML/Scripting/ClassicScript.h>
#include <LibWeb/HTML/Scripting/Environments.h>
#include <LibWeb/HTML/Scripting/Fetching.h>
#include <LibWeb/HTML/Scripting/ModuleScript.h>
#include <LibWeb/HTML/Scripting/TemporaryExecutionContext.h>
#include <LibWeb/HTML/Window.h>
#include <LibWeb/Infra/Strings.h>
#include <LibWeb/Loader/ResourceLoader.h>
#include <LibWeb/MimeSniff/MimeType.h>
#include <LibWeb/WebAssembly/WebAssemblyModule.h>

namespace Web::HTML {

struct OffThreadCompiledProgram {
    JS::FFI::ParsedProgram* parsed { nullptr };
    JS::FFI::CompiledProgram* compiled { nullptr };
};

struct BytecodeCacheContext {
    URL::URL url;
    ByteString method;
    NonnullRefPtr<HTTP::HeaderList> request_headers;
    u64 vary_key { 0 };
};

static ::Crypto::Hash::Digest<::Crypto::Hash::SHA256::DigestSize * 8> bytecode_cache_source_hash(JS::SourceCode const& source_code)
{
    return ::Crypto::Hash::SHA256::hash(reinterpret_cast<u8 const*>(source_code.utf16_data()), source_code.length_in_code_units() * sizeof(u16));
}

static Optional<BytecodeCacheContext> bytecode_cache_context_for_request(Fetch::Infrastructure::Request const& request, Fetch::Infrastructure::Response const& response, URL::URL const& response_url)
{
    if (!Fetch::Infrastructure::is_http_or_https_scheme(response_url.scheme()))
        return {};

    if (!ResourceLoader::is_initialized() || !ResourceLoader::the().request_client())
        return {};

    auto vary_key = response.javascript_bytecode_cache_vary_key();
    if (!vary_key.has_value())
        return {};

    return BytecodeCacheContext {
        .url = response_url,
        .method = request.method(),
        .request_headers = HTTP::HeaderList::create(request.header_list()->headers()),
        .vary_key = *vary_key,
    };
}

// Schedule a fresh, fully off-thread compile of the script source for the sole purpose of producing a bytecode cache
// blob to hand to RequestServer. The execution path has already received its (latency-trimmed) compile artifact and is
// running, so this work happens entirely on a background thread and never blocks the main thread on cache generation.
// Reparsing here is intentional: the execution-path compile only eagerly generates top-level bytecode plus direct
// IIFEs, while the cache wants every nested function compiled so that warm loads avoid lazy compile work entirely.
static void schedule_bytecode_cache_generation(JS::SourceCode const& original_source_code, JS::RustIntegration::ProgramType type, size_t line_number_offset, BytecodeCacheContext cache_context)
{
    auto filename = original_source_code.filename();
    auto source_code = original_source_code.code();
    auto event_loop_weak = Core::EventLoop::current_weak();

    Threading::ThreadPool::the().submit([filename = move(filename), source_code = move(source_code), type, line_number_offset, cache_context = move(cache_context), event_loop_weak = move(event_loop_weak)]() mutable {
        auto source = JS::SourceCode::create(move(filename), move(source_code));
        auto* parsed = JS::RustIntegration::parse_program(source->utf16_data(), source->length_in_code_units(), type, line_number_offset);
        if (!parsed)
            return;

        if (JS::RustIntegration::parsed_program_has_errors(parsed)) {
            JS::RustIntegration::free_parsed_program(parsed);
            return;
        }

        auto* compiled = JS::RustIntegration::compile_parsed_program_fully_off_thread(parsed, source->length_in_code_units());
        if (!compiled)
            return;

        auto source_hash = bytecode_cache_source_hash(*source);
        auto blob = JS::RustIntegration::serialize_compiled_program_for_bytecode_cache(*compiled, type, source_hash.bytes());
        JS::RustIntegration::free_compiled_program(compiled);
        if (blob.is_empty())
            return;

        auto origin = event_loop_weak->take();
        if (!origin)
            return;

        origin->deferred_invoke([cache_context = move(cache_context), blob = move(blob)]() mutable {
            if (!ResourceLoader::is_initialized() || !ResourceLoader::the().request_client())
                return;
            (void)ResourceLoader::the().request_client()->store_cache_associated_data(cache_context.url, cache_context.method, *cache_context.request_headers, cache_context.vary_key, HTTP::CacheEntryAssociatedData::JavaScriptBytecode, blob.bytes());
        });
    });
}

static void compile_remaining_functions_off_thread(JS::Bytecode::Executable& executable, NonnullRefPtr<JS::SourceCode const> source_code)
{
    Vector<GC::Root<JS::SharedFunctionInstanceData>> shared_data_roots;
    Vector<void*> function_asts;

    for (auto& shared_data : executable.shared_function_data) {
        if (!shared_data || shared_data->m_executable || !shared_data->m_rust_function_ast)
            continue;

        auto* cloned_ast = JS::RustIntegration::clone_function_ast(shared_data->m_rust_function_ast);
        if (!cloned_ast)
            continue;

        shared_data_roots.append(GC::make_root(*shared_data));
        function_asts.append(cloned_ast);
    }

    if (function_asts.is_empty())
        return;

    auto length = source_code->length_in_code_units();
    auto* callback = new Function<void(Vector<JS::FFI::CompiledFunction*>)>(
        [shared_data_roots = move(shared_data_roots), source_code = move(source_code)](Vector<JS::FFI::CompiledFunction*> compiled_functions) mutable {
            VERIFY(compiled_functions.size() == shared_data_roots.size());
            auto& vm = Bindings::main_thread_vm();
            for (size_t i = 0; i < compiled_functions.size(); ++i) {
                auto* compiled_function = compiled_functions[i];
                if (!compiled_function)
                    continue;

                auto& shared_data = *shared_data_roots[i];
                if (shared_data.m_executable) {
                    compile_remaining_functions_off_thread(*shared_data.m_executable, source_code);
                    JS::RustIntegration::free_compiled_function(compiled_function);
                    continue;
                }

                JS::RustIntegration::materialize_compiled_function(compiled_function, vm, *source_code, shared_data);
            }
        });

    auto event_loop_weak = Core::EventLoop::current_weak();

    Threading::ThreadPool::the().submit([function_asts = move(function_asts), length,
                                            callback,
                                            event_loop_weak = move(event_loop_weak)]() mutable {
        Vector<JS::FFI::CompiledFunction*> compiled_functions;
        compiled_functions.ensure_capacity(function_asts.size());
        for (auto* function_ast : function_asts)
            compiled_functions.append(JS::RustIntegration::compile_function_off_thread(function_ast, length, false));

        auto origin = event_loop_weak->take();
        if (!origin)
            return;
        origin->deferred_invoke([compiled_functions = move(compiled_functions), callback]() mutable {
            (*callback)(move(compiled_functions));
            delete callback;
        });
    });
}

static void compile_remaining_module_functions_off_thread(ModuleScript& module_script, NonnullRefPtr<JS::SourceCode const> source_code)
{
    module_script.record().visit(
        [](Empty) {},
        [](GC::Ref<JS::SyntheticModule>) {},
        [](GC::Ref<WebAssembly::WebAssemblyModule>) {},
        [source_code = move(source_code)](GC::Ref<JS::SourceTextModule> module) mutable {
            if (auto* executable = module->cached_executable()) {
                compile_remaining_functions_off_thread(*executable, source_code);
                return;
            }

            auto* top_level_await_shared_data = module->top_level_await_shared_data();
            if (!top_level_await_shared_data || !top_level_await_shared_data->m_executable)
                return;

            compile_remaining_functions_off_thread(*top_level_await_shared_data->m_executable, source_code);
        });
}

// Submit parsing and top-level bytecode generation to the thread pool, then bounce back to the main thread via
// deferred_invoke once the worker is done. Syntax errors still come back as a ParsedProgram so the main thread can
// report them through the same Script/ModuleScript construction paths; successful programs come back as CompiledProgram
// artifacts whose GC-backed Executable materialization must still happen on the main thread.
// NB: The SourceCode stays on the main thread inside the heap-allocated callback. The worker thread only receives raw
//     UTF-16 data pointers, and the callback intentionally leaks if the event loop is destroyed during compilation.
static void compile_off_thread(NonnullRefPtr<JS::SourceCode const> source_code, JS::RustIntegration::ProgramType type, size_t line_number_offset, Function<void(OffThreadCompiledProgram, NonnullRefPtr<JS::SourceCode const>)> on_compiled)
{
    // Extract the raw data the parser needs while still on the main thread.
    auto const* utf16_data = source_code->utf16_data();
    auto length = source_code->length_in_code_units();

    // Capture source_code in the callback so it stays alive on the main thread and is available for materialization.
    auto* callback = new Function<void(OffThreadCompiledProgram)>(
        [on_compiled = move(on_compiled), source_code = move(source_code)](OffThreadCompiledProgram result) mutable {
            on_compiled(result, move(source_code));
        });

    auto event_loop_weak = Core::EventLoop::current_weak();

    Threading::ThreadPool::the().submit([utf16_data, length, type, line_number_offset,
                                            callback,
                                            event_loop_weak = move(event_loop_weak)]() {
        auto* parsed = JS::RustIntegration::parse_program(utf16_data, length, type, line_number_offset);
        OffThreadCompiledProgram result { .parsed = parsed };
        if (parsed && !JS::RustIntegration::parsed_program_has_errors(parsed)) {
            result.compiled = JS::RustIntegration::compile_parsed_program_off_thread(parsed, length);
            result.parsed = nullptr;
        }

        auto origin = event_loop_weak->take();
        if (!origin)
            return;
        origin->deferred_invoke([result, callback]() {
            (*callback)(result);
            delete callback;
            // AD-HOC: Perform a microtask checkpoint so that any microtasks queued by the callback (e.g. promise
            //         reactions from react_to_promise during module linking) are drained. Without this, module worker
            //         scripts would stall because their promise chains never resolve.
            perform_a_microtask_checkpoint();
        });
    });
}

GC_DEFINE_ALLOCATOR(FetchContext);

OnFetchScriptComplete create_on_fetch_script_complete(GC::Heap& heap, Function<void(GC::Ptr<Script>)> function)
{
    return GC::create_function(heap, move(function));
}

PerformTheFetchHook create_perform_the_fetch_hook(GC::Heap& heap, Function<WebIDL::ExceptionOr<void>(GC::Ref<Fetch::Infrastructure::Request>, TopLevelModule, Fetch::Infrastructure::FetchAlgorithms::ProcessResponseConsumeBodyFunction)> function)
{
    return GC::create_function(heap, move(function));
}

ScriptFetchOptions default_script_fetch_options()
{
    // The default script fetch options are a script fetch options whose cryptographic nonce is the empty string,
    // integrity metadata is the empty string, parser metadata is "not-parser-inserted", credentials mode is "same-origin",
    // referrer policy is the empty string, and fetch priority is "auto".
    return ScriptFetchOptions {
        .cryptographic_nonce = {},
        .integrity_metadata = {},
        .parser_metadata = Fetch::Infrastructure::Request::ParserMetadata::NotParserInserted,
        .credentials_mode = Fetch::Infrastructure::Request::CredentialsMode::SameOrigin,
        .referrer_policy = {},
        .fetch_priority = Fetch::Infrastructure::Request::Priority::Auto
    };
}

// https://html.spec.whatwg.org/multipage/webappapis.html#module-type-from-module-request
String module_type_from_module_request(JS::ModuleRequest const& module_request)
{
    // 1. Let moduleType be "javascript-or-wasm".
    String module_type = "javascript-or-wasm"_string;

    // 2. If moduleRequest.[[Attributes]] has a Record entry such that entry.[[Key]] is "type", then:
    for (auto const& entry : module_request.attributes) {
        if (entry.key != "type"_string)
            continue;

        // 1. If entry.[[Value]] is "javascript-or-wasm", then set moduleType to null.
        if (entry.value == "javascript-or-wasm"_string)
            module_type = ""_string; // FIXME: This should be null!
        // 2. Otherwise, set moduleType to entry.[[Value]].
        else
            module_type = entry.value.to_utf8_but_should_be_ported_to_utf16();
    }

    // 3. Return moduleType.
    return module_type;
}

// https://html.spec.whatwg.org/multipage/webappapis.html#resolve-a-module-specifier
WebIDL::ExceptionOr<URL::URL> resolve_module_specifier(Optional<Script&> referring_script, String const& specifier)
{
    auto& vm = Bindings::main_thread_vm();

    // 1. Let settingsObject and baseURL be null.
    GC::Ptr<EnvironmentSettingsObject> settings_object;
    Optional<URL::URL> base_url;

    // 2. If referringScript is not null, then:
    if (referring_script.has_value()) {
        // 1. Set settingsObject to referringScript's settings object.
        settings_object = referring_script->settings_object();

        // 2. Set baseURL to referringScript's base URL.
        base_url = referring_script->base_url();
    }
    // 3. Otherwise:
    else {
        // 1. Assert: there is a current realm.
        VERIFY(vm.current_realm());

        // 2. Set settingsObject to the current settings object.
        settings_object = current_settings_object();

        // 3. Set baseURL to settingsObject's API base URL.
        base_url = settings_object->api_base_url();
    }

    // 4. Let importMap be an empty import map.
    ImportMap import_map;

    // 5. If settingsObject's global object implements Window, then set importMap to settingsObject's global object's import map.
    if (auto* window = as_if<Window>(settings_object->global_object()))
        import_map = window->import_map();

    // 6. Let serializedBaseURL be baseURL, serialized.
    auto serialized_base_url = base_url->serialize();

    // 7. Let asURL be the result of resolving a URL-like module specifier given specifier and baseURL.
    auto as_url = resolve_url_like_module_specifier(specifier.to_byte_string(), *base_url);

    // 8. Let normalizedSpecifier be the serialization of asURL, if asURL is non-null; otherwise, specifier.
    auto normalized_specifier = as_url.has_value() ? as_url->serialize() : specifier;

    // 9. Let result be a URL-or-null, initially null.
    Optional<URL::URL> result;

    // 10. For each scopePrefix → scopeImports of importMap's scopes:
    for (auto const& entry : import_map.scopes()) {
        // FIXME: Clarify if the serialization steps need to be run here. The steps below assume
        //        scopePrefix to be a string.
        auto const& scope_prefix = entry.key.serialize();
        auto const& scope_imports = entry.value;

        // 1. If scopePrefix is serializedBaseURL, or if scopePrefix ends with U+002F (/) and scopePrefix is a code unit prefix of serializedBaseURL, then:
        if (scope_prefix == serialized_base_url || (scope_prefix.ends_with('/') && Infra::is_code_unit_prefix(scope_prefix, serialized_base_url))) {
            // 1. Let scopeImportsMatch be the result of resolving an imports match given normalizedSpecifier, asURL, and scopeImports.
            auto scope_imports_match = TRY(resolve_imports_match(normalized_specifier.to_byte_string(), as_url, scope_imports));

            // 2. If scopeImportsMatch is not null, then set result to scopeImportsMatch, and break.
            if (scope_imports_match.has_value()) {
                result = scope_imports_match.release_value();
                break;
            }
        }
    }

    // 11. If result is null, set result to the result of resolving an imports match given normalizedSpecifier, asURL, and importMap's imports.
    if (!result.has_value())
        result = TRY(resolve_imports_match(normalized_specifier.to_byte_string(), as_url, import_map.imports()));

    // 12. If result is null, set it to asURL.
    // NOTE: By this point, if result was null, specifier wasn't remapped to anything by importMap, but it might have
    //       been able to be turned into a URL.
    if (!result.has_value())
        result = as_url;

    // 13. If result is not null, then:
    if (result.has_value()) {
        // 1. Add module to resolved module set given settingsObject, serializedBaseURL, normalizedSpecifier, and asURL.
        add_module_to_resolved_module_set(*settings_object, serialized_base_url, normalized_specifier, as_url);

        // 2. Return result.
        return result.release_value();
    }

    // 14. Throw a TypeError indicating that specifier was a bare specifier, but was not remapped to anything by importMap.
    return WebIDL::SimpleException { WebIDL::SimpleExceptionType::TypeError, MUST(String::formatted("Failed to resolve non relative module specifier '{}' from an import map.", specifier)) };
}

// https://html.spec.whatwg.org/multipage/webappapis.html#resolving-an-imports-match
WebIDL::ExceptionOr<Optional<URL::URL>> resolve_imports_match(ByteString const& normalized_specifier, Optional<URL::URL> as_url, ModuleSpecifierMap const& specifier_map)
{
    // 1. For each specifierKey → resolutionResult of specifierMap:
    for (auto const& [specifier_key, resolution_result] : specifier_map) {
        // 1. If specifierKey is normalizedSpecifier, then:
        if (specifier_key.bytes_as_string_view() == normalized_specifier) {
            // 1. If resolutionResult is null, then throw a TypeError indicating that resolution of specifierKey was blocked by a null entry.
            if (!resolution_result.has_value())
                return WebIDL::SimpleException { WebIDL::SimpleExceptionType::TypeError, String::formatted("Import resolution of '{}' was blocked by a null entry.", specifier_key).release_value_but_fixme_should_propagate_errors() };

            // 2. Assert: resolutionResult is a URL.
            // 3. Return resolutionResult.
            return resolution_result;
        }

        // 2. If all of the following are true:
        if (
            // - specifierKey ends with U+002F (/);
            specifier_key.bytes_as_string_view().ends_with("/"sv) &&
            // - specifierKey is a code unit prefix of normalizedSpecifier; and
            Infra::is_code_unit_prefix(specifier_key, normalized_specifier) &&
            // - either asURL is null, or asURL is special,
            (!as_url.has_value() || as_url->is_special())
            // then:
        ) {
            // 1. If resolutionResult is null, then throw a TypeError indicating that the resolution of specifierKey was blocked by a null entry.
            if (!resolution_result.has_value())
                return WebIDL::SimpleException { WebIDL::SimpleExceptionType::TypeError, String::formatted("Import resolution of '{}' was blocked by a null entry.", specifier_key).release_value_but_fixme_should_propagate_errors() };

            // 2. Assert: resolutionResult is a URL.
            // 3. Let afterPrefix be the portion of normalizedSpecifier after the initial specifierKey prefix.
            // FIXME: Clarify if this is meant by the portion after the initial specifierKey prefix.
            auto after_prefix = normalized_specifier.substring(specifier_key.bytes_as_string_view().length());

            // 4. Assert: resolutionResult, serialized, ends with U+002F (/), as enforced during parsing.
            VERIFY(resolution_result->serialize().ends_with('/'));

            // 5. Let url be the result of URL parsing afterPrefix with resolutionResult.
            auto url = DOMURL::parse(after_prefix, *resolution_result);

            // 6. If url is failure, then throw a TypeError indicating that resolution of normalizedSpecifier was blocked since the afterPrefix portion
            //    could not be URL-parsed relative to the resolutionResult mapped to by the specifierKey prefix.
            if (!url.has_value())
                return WebIDL::SimpleException { WebIDL::SimpleExceptionType::TypeError, String::formatted("Could not resolve '{}' as the after prefix portion could not be URL-parsed.", normalized_specifier).release_value_but_fixme_should_propagate_errors() };

            // 7. Assert: url is a URL.
            VERIFY(url.has_value());

            // 8. If the serialization of resolutionResult is not a code unit prefix of the serialization of url, then throw a TypeError indicating
            //    that the resolution of normalizedSpecifier was blocked due to it backtracking above its prefix specifierKey.
            if (!Infra::is_code_unit_prefix(resolution_result->serialize(), url->serialize()))
                return WebIDL::SimpleException { WebIDL::SimpleExceptionType::TypeError, String::formatted("Could not resolve '{}' as it backtracks above its prefix specifierKey.", normalized_specifier).release_value_but_fixme_should_propagate_errors() };

            // 9. Return url.
            return url;
        }
    }

    // 2. Return null.
    return Optional<URL::URL> {};
}

// https://html.spec.whatwg.org/multipage/webappapis.html#resolving-a-url-like-module-specifier
Optional<URL::URL> resolve_url_like_module_specifier(StringView specifier, URL::URL const& base_url)
{
    // 1. If specifier starts with "/", "./", or "../", then:
    if (specifier.starts_with("/"sv) || specifier.starts_with("./"sv) || specifier.starts_with("../"sv)) {
        // 1. Let url be the result of URL parsing specifier with baseURL.
        auto url = DOMURL::parse(specifier, base_url);

        // 2. If url is failure, then return null.
        if (!url.has_value())
            return {};

        // 3. Return url.
        return url;
    }

    // 2. Let url be the result of URL parsing specifier (with no base URL).
    auto url = DOMURL::parse(specifier);

    // 3. If url is failure, then return null.
    if (!url.has_value())
        return {};

    // 4. Return url.
    return url;
}

// https://html.spec.whatwg.org/multipage/webappapis.html#set-up-the-classic-script-request
static void set_up_classic_script_request(Fetch::Infrastructure::Request& request, ScriptFetchOptions const& options)
{
    // Set request's cryptographic nonce metadata to options's cryptographic nonce, its integrity metadata to options's
    // integrity metadata, its parser metadata to options's parser metadata, its referrer policy to options's referrer
    // policy, its render-blocking to options's render-blocking, and its priority to options's fetch priority.
    request.set_cryptographic_nonce_metadata(options.cryptographic_nonce);
    request.set_integrity_metadata(options.integrity_metadata);
    request.set_parser_metadata(options.parser_metadata);
    request.set_referrer_policy(options.referrer_policy);
    request.set_render_blocking(options.render_blocking);
    request.set_priority(options.fetch_priority);
}

// https://html.spec.whatwg.org/multipage/webappapis.html#set-up-the-module-script-request
static void set_up_module_script_request(Fetch::Infrastructure::Request& request, ScriptFetchOptions const& options)
{
    // Set request's cryptographic nonce metadata to options's cryptographic nonce, its integrity metadata to options's
    // integrity metadata, its parser metadata to options's parser metadata, its credentials mode to options's credentials
    // mode, its referrer policy to options's referrer policy, its render-blocking to options's render-blocking, and its
    // priority to options's fetch priority.
    request.set_cryptographic_nonce_metadata(options.cryptographic_nonce);
    request.set_integrity_metadata(options.integrity_metadata);
    request.set_parser_metadata(options.parser_metadata);
    request.set_credentials_mode(options.credentials_mode);
    request.set_referrer_policy(options.referrer_policy);
    request.set_render_blocking(options.render_blocking);
    request.set_priority(options.fetch_priority);
}

// https://html.spec.whatwg.org/multipage/webappapis.html#get-the-descendant-script-fetch-options
ScriptFetchOptions get_descendant_script_fetch_options(ScriptFetchOptions const& original_options, URL::URL const& url, EnvironmentSettingsObject& settings_object)
{
    // 1. Let newOptions be a copy of originalOptions.
    auto new_options = original_options;

    // 2. Let integrity be the result of resolving a module integrity metadata with url and settingsObject.
    String integrity = resolve_a_module_integrity_metadata(url, settings_object);

    // 3. Set newOptions's integrity metadata to integrity.
    new_options.integrity_metadata = integrity;

    // 4. Set newOptions's fetch priority to "auto".
    new_options.fetch_priority = Fetch::Infrastructure::Request::Priority::Auto;

    // 5. Return newOptions.
    return new_options;
}

// https://html.spec.whatwg.org/multipage/webappapis.html#resolving-a-module-integrity-metadata
String resolve_a_module_integrity_metadata(URL::URL const& url, EnvironmentSettingsObject& settings_object)
{
    // 1. Let map be settingsObject's global object's import map.
    auto map = settings_object.universal_global_scope().import_map();

    // 2. If map's integrity[url] does not exist, then return the empty string.
    // 3. Return map's integrity[url].
    return map.integrity().get(url).value_or(""_string);
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-script
void fetch_classic_script(GC::Ref<HTMLScriptElement> element, URL::URL const& url, EnvironmentSettingsObject& settings_object, ScriptFetchOptions options, CORSSettingAttribute cors_setting, String character_encoding, OnFetchScriptComplete on_complete)
{
    auto& realm = element->realm();
    auto& vm = realm.vm();

    // 1. Let request be the result of creating a potential-CORS request given url, "script", and CORS setting.
    auto request = create_potential_CORS_request(vm, url, Fetch::Infrastructure::Request::Destination::Script, cors_setting);

    // 2. Set request's client to settings object.
    request->set_client(&settings_object);

    // 3. Set request's initiator type to "script".
    request->set_initiator_type(Fetch::Infrastructure::Request::InitiatorType::Script);

    // 4. Set up the classic script request given request and options.
    set_up_classic_script_request(*request, options);

    // 5. Fetch request with the following processResponseConsumeBody steps given response response and null, failure,
    //    or a byte sequence bodyBytes:
    Fetch::Infrastructure::FetchAlgorithms::Input fetch_algorithms_input {};
    fetch_algorithms_input.process_response_consume_body = [request, &settings_object, options = move(options), character_encoding = move(character_encoding), on_complete = move(on_complete)](auto response, auto body_bytes) {
        // 1. Set response to response's unsafe response.
        response = response->unsafe_response();

        // 2. If either of the following conditions are met:
        // - bodyBytes is null or failure; or
        // - response's status is not an ok status,
        if (body_bytes.template has<Empty>() || body_bytes.template has<Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag>() || !Fetch::Infrastructure::is_ok_status(response->status())) {
            // then run onComplete given null, and abort these steps.
            on_complete->function()(nullptr);
            return;
        }

        // 3. Let potentialMIMETypeForEncoding be the result of extracting a MIME type given response's header list.
        auto potential_mime_type_for_encoding = Fetch::Infrastructure::extract_mime_type(response->header_list());

        // 4. Set character encoding to the result of legacy extracting an encoding given potentialMIMETypeForEncoding
        //    and character encoding.
        auto extracted_character_encoding = Fetch::Infrastructure::legacy_extract_an_encoding(potential_mime_type_for_encoding, character_encoding);

        // 5. Let source text be the result of decoding bodyBytes to Unicode, using character encoding as the fallback
        //    encoding.
        auto fallback_decoder = TextCodec::decoder_for(extracted_character_encoding);
        VERIFY(fallback_decoder.has_value());

        auto source_text = TextCodec::convert_input_to_utf8_using_given_decoder_unless_there_is_a_byte_order_mark(*fallback_decoder, body_bytes.template get<ByteBuffer>()).release_value_but_fixme_should_propagate_errors();

        // 6. Let muted errors be true if response was CORS-cross-origin, and false otherwise.
        auto muted_errors = response->is_cors_cross_origin() ? ClassicScript::MutedErrors::Yes : ClassicScript::MutedErrors::No;

        // 7. Let script be the result of creating a classic script given source text, settings object's realm, response's URL,
        //    options, and muted errors.
        // FIXME: Pass options.
        auto response_url = response->url().value_or({});

        // If the Rust pipeline is available, parse off the main thread.
        if (JS::RustIntegration::rust_pipeline_available()) {
            auto on_complete_root = GC::make_root(on_complete);
            auto settings_root = GC::make_root(settings_object);
            auto response_url_string = response_url.to_byte_string();
            auto source_code = JS::SourceCode::create(
                String::from_utf8(response_url_string.view()).release_value_but_fixme_should_propagate_errors(),
                Utf16String::from_utf8(source_text));
            auto bytecode_cache_context = bytecode_cache_context_for_request(*request, *response, response_url);
            // Warm-cache fast path: a sidecar arrived with the response, decode it, and try to materialize a script
            // straight from the cached bytecode without parsing or compiling. Pass non-moved source_code / response_url
            // so the fallback compile path below can reuse them if decode or materialization is rejected.
            if (auto const& bytecode = response->javascript_bytecode_cache(); bytecode.has_value()) {
                auto source_hash = bytecode_cache_source_hash(*source_code);
                if (auto* bytecode_cache = JS::RustIntegration::decode_bytecode_cache_blob(bytecode->bytes(), JS::RustIntegration::ProgramType::Script, source_hash.bytes())) {
                    auto script = ClassicScript::create_from_bytecode_cache(response_url_string, source_code, settings_object, response_url, bytecode_cache, muted_errors);
                    // Bytecode validation runs during materialization and may reject a structurally valid blob whose
                    // bytecode is corrupt. Treat that as a cache miss and fall through to off-thread source compile.
                    if (script->parse_error().is_null()) {
                        on_complete->function()(script);
                        return;
                    }
                }
            }

            compile_off_thread(move(source_code), JS::RustIntegration::ProgramType::Script, 1,
                [response_url = move(response_url), response_url_string = move(response_url_string),
                    bytecode_cache_context = move(bytecode_cache_context),
                    muted_errors, on_complete_root = move(on_complete_root),
                    settings_root = move(settings_root)](auto result, auto source_code) mutable {
                    auto source_code_for_background_compile = source_code;
                    auto source_code_for_cache = source_code;
                    auto script = result.compiled
                        ? ClassicScript::create_from_pre_compiled(move(response_url_string), move(source_code), *settings_root, move(response_url), result.compiled, muted_errors)
                        : ClassicScript::create_from_pre_parsed(move(response_url_string), move(source_code), *settings_root, move(response_url), result.parsed, muted_errors);
                    if (auto* script_record = script->script_record()) {
                        if (auto* executable = script_record->cached_executable())
                            compile_remaining_functions_off_thread(*executable, move(source_code_for_background_compile));
                    }
                    on_complete_root->function()(script);
                    if (result.compiled && bytecode_cache_context.has_value())
                        schedule_bytecode_cache_generation(*source_code_for_cache, JS::RustIntegration::ProgramType::Script, 1, bytecode_cache_context.release_value());
                });
        } else {
            auto script = ClassicScript::create(response_url.to_byte_string(), source_text, settings_object, response_url, 1, muted_errors);

            // 8. Run onComplete given script.
            on_complete->function()(script);
        }
    };

    Fetch::Fetching::fetch(element->realm(), request, Fetch::Infrastructure::FetchAlgorithms::create(vm, move(fetch_algorithms_input)));
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-script
WebIDL::ExceptionOr<void> fetch_classic_worker_script(URL::URL const& url, EnvironmentSettingsObject& fetch_client, Fetch::Infrastructure::Request::Destination destination, EnvironmentSettingsObject& settings_object, PerformTheFetchHook perform_fetch, OnFetchScriptComplete on_complete)
{
    auto& realm = settings_object.realm();
    auto& vm = realm.vm();

    // 1. Let request be a new request whose URL is url, client is fetchClient, destination is destination, initiator type is "other",
    //    mode is "same-origin", credentials mode is "same-origin", parser metadata is "not parser-inserted",
    //    and whose use-URL-credentials flag is set.
    auto request = Fetch::Infrastructure::Request::create(vm);
    request->set_url(url);
    request->set_client(&fetch_client);
    request->set_destination(destination);
    request->set_initiator_type(Fetch::Infrastructure::Request::InitiatorType::Other);
    request->set_mode(Fetch::Infrastructure::Request::Mode::SameOrigin);
    request->set_credentials_mode(Fetch::Infrastructure::Request::CredentialsMode::SameOrigin);
    request->set_parser_metadata(Fetch::Infrastructure::Request::ParserMetadata::NotParserInserted);
    request->set_use_url_credentials(true);

    auto process_response_consume_body = [&settings_object, on_complete = move(on_complete)](auto response, auto body_bytes) {
        // 1. Set response to response's unsafe response.
        response = response->unsafe_response();

        // 2. If either of the following conditions are met:
        // - bodyBytes is null or failure; or
        // - response's status is not an ok status,
        if (body_bytes.template has<Empty>() || body_bytes.template has<Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag>() || !Fetch::Infrastructure::is_ok_status(response->status())) {
            // then run onComplete given null, and abort these steps.
            on_complete->function()(nullptr);
            return;
        }

        // 3. If all of the following are true:
        // - response's URL's scheme is an HTTP(S) scheme; and
        // - the result of extracting a MIME type from response's header list is not a JavaScript MIME type,
        auto maybe_mime_type = Fetch::Infrastructure::extract_mime_type(response->header_list());
        auto mime_type_is_javascript = maybe_mime_type.has_value() && maybe_mime_type->is_javascript();

        if (response->url().has_value() && Fetch::Infrastructure::is_http_or_https_scheme(response->url()->scheme()) && !mime_type_is_javascript) {
            auto mime_type_serialized = maybe_mime_type.has_value() ? maybe_mime_type->serialized() : "unknown"_string;
            dbgln("Invalid non-javascript mime type \"{}\" for worker script at {}", mime_type_serialized, response->url().value());

            // then run onComplete given null, and abort these steps.
            on_complete->function()(nullptr);
            return;
        }
        // NOTE: Other fetch schemes are exempted from MIME type checking for historical web-compatibility reasons.
        //       We might be able to tighten this in the future; see https://github.com/whatwg/html/issues/3255.

        // 4. Let sourceText be the result of UTF-8 decoding bodyBytes.
        auto decoder = TextCodec::decoder_for("UTF-8"sv);
        VERIFY(decoder.has_value());
        auto source_text = TextCodec::convert_input_to_utf8_using_given_decoder_unless_there_is_a_byte_order_mark(*decoder, body_bytes.template get<ByteBuffer>()).release_value_but_fixme_should_propagate_errors();

        // 5. Let script be the result of creating a classic script using sourceText, settingsObject,
        //    response's URL, and the default classic script fetch options.
        auto response_url = response->url().value_or({});
        auto script = ClassicScript::create(response_url.to_byte_string(), source_text, settings_object, response_url);

        // 6. Run onComplete given script.
        on_complete->function()(script);
    };

    // 2. If performFetch was given, run performFetch with request, true, and with processResponseConsumeBody as defined below.
    if (perform_fetch != nullptr) {
        TRY(perform_fetch->function()(request, TopLevelModule::Yes, move(process_response_consume_body)));
    }

    // Otherwise, fetch request with processResponseConsumeBody set to processResponseConsumeBody as defined below.
    else {
        Fetch::Infrastructure::FetchAlgorithms::Input fetch_algorithms_input {};
        fetch_algorithms_input.process_response_consume_body = move(process_response_consume_body);
        Fetch::Fetching::fetch(realm, request, Fetch::Infrastructure::FetchAlgorithms::create(vm, move(fetch_algorithms_input)));
    }
    return {};
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-classic-worker-imported-script
WebIDL::ExceptionOr<GC::Ref<ClassicScript>> fetch_a_classic_worker_imported_script(URL::URL const& url, HTML::EnvironmentSettingsObject& settings_object, PerformTheFetchHook perform_fetch)
{
    auto& realm = settings_object.realm();
    auto& vm = realm.vm();

    // 1. Let response be null.
    IGNORE_USE_IN_ESCAPING_LAMBDA GC::Ptr<Fetch::Infrastructure::Response> response = nullptr;

    // 2. Let bodyBytes be null.
    Fetch::Infrastructure::FetchAlgorithms::BodyBytes body_bytes;

    // 3. Let request be a new request whose URL is url, client is settingsObject, destination is "script", initiator type is "other",
    //    parser metadata is "not parser-inserted", and whose use-URL-credentials flag is set.
    auto request = Fetch::Infrastructure::Request::create(vm);
    request->set_url(url);
    request->set_client(&settings_object);
    request->set_destination(Fetch::Infrastructure::Request::Destination::Script);
    request->set_initiator_type(Fetch::Infrastructure::Request::InitiatorType::Other);
    request->set_parser_metadata(Fetch::Infrastructure::Request::ParserMetadata::NotParserInserted);
    request->set_use_url_credentials(true);

    auto process_response_consume_body = [&response, &body_bytes](GC::Ref<Fetch::Infrastructure::Response> res, Fetch::Infrastructure::FetchAlgorithms::BodyBytes bb) {
        // 1. Set bodyBytes to bb.
        body_bytes = move(bb);

        // 2. Set response to res.
        response = res;
    };

    // 4. If performFetch was given, run performFetch with request, isTopLevel, and with processResponseConsumeBody as defined below.
    if (perform_fetch) {
        TRY(perform_fetch->function()(request, TopLevelModule::Yes, move(process_response_consume_body)));
    }
    // Otherwise, fetch request with processResponseConsumeBody set to processResponseConsumeBody as defined below.
    else {
        Fetch::Infrastructure::FetchAlgorithms::Input fetch_algorithms_input {};
        fetch_algorithms_input.process_response_consume_body = move(process_response_consume_body);
        Fetch::Fetching::fetch(realm, request, Fetch::Infrastructure::FetchAlgorithms::create(vm, move(fetch_algorithms_input)));
    }

    // 5. Pause until response is not null.
    // FIXME: Consider using a "response holder" to avoid needing to annotate response as IGNORE_USE_IN_ESCAPING_LAMBDA.
    auto& event_loop = settings_object.responsible_event_loop();
    event_loop.spin_until(GC::create_function(vm.heap(), [&]() -> bool {
        return response;
    }));

    // 6. Set response to response's unsafe response.
    response = response->unsafe_response();

    // 7. If any of the following are true:
    //    - bodyBytes is null or failure;
    //    - response's status is not an ok status; or
    //    - the result of extracting a MIME type from response's header list is not a JavaScript MIME type,
    //    then throw a "NetworkError" DOMException.
    if (body_bytes.template has<Empty>() || body_bytes.template has<Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag>()
        || !Fetch::Infrastructure::is_ok_status(response->status())
        || !Fetch::Infrastructure::extract_mime_type(response->header_list()).has_value() || !Fetch::Infrastructure::extract_mime_type(response->header_list())->is_javascript()) {
        return WebIDL::NetworkError::create(realm, "Network error"_utf16);
    }

    // 8. Let sourceText be the result of UTF-8 decoding bodyBytes.
    auto decoder = TextCodec::decoder_for("UTF-8"sv);
    VERIFY(decoder.has_value());
    auto source_text = TextCodec::convert_input_to_utf8_using_given_decoder_unless_there_is_a_byte_order_mark(*decoder, body_bytes.get<ByteBuffer>()).release_value_but_fixme_should_propagate_errors();

    // 9. Let mutedErrors be true if response was CORS-cross-origin, and false otherwise.
    auto muted_errors = response->is_cors_cross_origin() ? ClassicScript::MutedErrors::Yes : ClassicScript::MutedErrors::No;

    // 10. Let script be the result of creating a classic script given sourceText, settingsObject, response's URL, the default classic script fetch options, and mutedErrors.
    auto response_url = response->url().value_or({});
    auto script = ClassicScript::create(response_url.to_byte_string(), source_text, settings_object, response_url, 1, muted_errors);

    // 11. Return script.
    return script;
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-module-worker-script-tree
WebIDL::ExceptionOr<void> fetch_module_worker_script_graph(URL::URL const& url, EnvironmentSettingsObject& fetch_client, Fetch::Infrastructure::Request::Destination destination, EnvironmentSettingsObject& settings_object, PerformTheFetchHook perform_fetch, OnFetchScriptComplete on_complete)
{
    return fetch_worklet_module_worker_script_graph(url, fetch_client, destination, settings_object, move(perform_fetch), move(on_complete));
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-worklet/module-worker-script-graph
WebIDL::ExceptionOr<void> fetch_worklet_module_worker_script_graph(URL::URL const& url, EnvironmentSettingsObject& fetch_client, Fetch::Infrastructure::Request::Destination destination, EnvironmentSettingsObject& settings_object, PerformTheFetchHook perform_fetch, OnFetchScriptComplete on_complete)
{
    auto& realm = settings_object.realm();
    auto& vm = realm.vm();

    // 1. Let options be a script fetch options whose cryptographic nonce is the empty string,
    //    integrity metadata is the empty string, parser metadata is "not-parser-inserted",
    //    credentials mode is credentialsMode, referrer policy is the empty string, and fetch priority is "auto".
    // FIXME: credentialsMode
    auto options = ScriptFetchOptions {
        .cryptographic_nonce = String {},
        .integrity_metadata = String {},
        .parser_metadata = Fetch::Infrastructure::Request::ParserMetadata::NotParserInserted,
        .credentials_mode = Fetch::Infrastructure::Request::CredentialsMode::SameOrigin,
        .referrer_policy = ReferrerPolicy::ReferrerPolicy::EmptyString,
        .fetch_priority = Fetch::Infrastructure::Request::Priority::Auto
    };

    // onSingleFetchComplete given result is the following algorithm:
    auto on_single_fetch_complete = create_on_fetch_script_complete(vm.heap(), [&realm, &fetch_client, destination, perform_fetch = perform_fetch, on_complete = move(on_complete)](auto result) mutable {
        // 1. If result is null, run onComplete with null, and abort these steps.
        if (!result) {
            dbgln("on single fetch complete with nool");
            on_complete->function()(nullptr);
            return;
        }

        // 2. Fetch the descendants of and link result given fetchClient, destination, and onComplete. If performFetch was given, pass it along as well.
        fetch_descendants_of_and_link_a_module_script(realm, as<ModuleScript>(*result), fetch_client, destination, move(perform_fetch), on_complete);
    });

    // 2. Fetch a single module script given url, fetchClient, destination, options, settingsObject, "client", true,
    //    and onSingleFetchComplete as defined below. If performFetch was given, pass it along as well.
    fetch_single_module_script(realm, url, fetch_client, destination, options, settings_object, Fetch::Infrastructure::Request::Referrer::Client, {}, TopLevelModule::Yes, move(perform_fetch), on_single_fetch_complete);

    return {};
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-destination-from-module-type
Fetch::Infrastructure::Request::Destination fetch_destination_from_module_type(Fetch::Infrastructure::Request::Destination default_destination, ByteString const& module_type)
{
    // 1. If moduleType is "json", then return "json".
    if (module_type == "json"sv)
        return Fetch::Infrastructure::Request::Destination::JSON;

    // 2. If moduleType is "css", then return "style".
    if (module_type == "css"sv)
        return Fetch::Infrastructure::Request::Destination::Style;

    // 3. Return defaultDestination.
    return default_destination;
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-single-module-script
void fetch_single_module_script(JS::Realm& realm,
    URL::URL const& url,
    EnvironmentSettingsObject& fetch_client,
    Fetch::Infrastructure::Request::Destination destination,
    ScriptFetchOptions const& options,
    EnvironmentSettingsObject& settings_object,
    Web::Fetch::Infrastructure::Request::ReferrerType const& referrer,
    Optional<JS::ModuleRequest> const& module_request,
    TopLevelModule is_top_level,
    PerformTheFetchHook perform_fetch,
    OnFetchScriptComplete on_complete)
{
    // 1. Let moduleType be "javascript-or-wasm".
    String module_type = "javascript-or-wasm"_string;

    // 2. If moduleRequest was given, then set moduleType to the result of running the module type from module request steps given moduleRequest.
    if (module_request.has_value())
        module_type = module_type_from_module_request(*module_request);

    // 3. Assert: the result of running the module type allowed steps given moduleType and settingsObject is true.
    //    Otherwise we would not have reached this point because a failure would have been raised when inspecting moduleRequest.[[Assertions]]
    //    in create a JavaScript module script or fetch a single imported module script.
    VERIFY(module_type_allowed(settings_object, module_type));

    // 4. Let moduleMap be settingsObject's module map.
    auto& module_map = settings_object.module_map();

    // 5. If moduleMap[(url, moduleType)] is "fetching", wait in parallel until that entry's value changes,
    //    then queue a task on the networking task source to proceed with running the following steps.
    if (module_map.is_fetching(url, module_type.to_byte_string())) {
        module_map.wait_for_change(realm.heap(), url, module_type.to_byte_string(), [on_complete, &realm](auto entry) -> void {
            HTML::queue_global_task(HTML::Task::Source::Networking, realm.global_object(), GC::create_function(realm.heap(), [on_complete, entry] {
                // FIXME: This should run other steps, for now we just assume the script loaded.
                VERIFY(entry.type == ModuleMap::EntryType::ModuleScript || entry.type == ModuleMap::EntryType::Failed);

                on_complete->function()(entry.module_script);
            }));
        });

        return;
    }

    // 6. If moduleMap[(url, moduleType)] exists, run onComplete given moduleMap[(url, moduleType)], and return.
    auto entry = module_map.get(url, module_type.to_byte_string());
    if (entry.has_value()) {
        on_complete->function()(entry->module_script);
        return;
    }

    // 7. Set moduleMap[(url, moduleType)] to "fetching".
    module_map.set(url, module_type.to_byte_string(), { ModuleMap::EntryType::Fetching, nullptr });

    // 8. Let request be a new request whose URL is url, mode is "cors", referrer is referrer, and client is fetchClient.
    auto request = Fetch::Infrastructure::Request::create(realm.vm());
    request->set_url(url);
    request->set_mode(Fetch::Infrastructure::Request::Mode::CORS);
    request->set_referrer(referrer);
    request->set_client(&fetch_client);

    // 9. Set request's destination to the result of running the fetch destination from module type steps given destination and moduleType.
    request->set_destination(fetch_destination_from_module_type(destination, module_type.to_byte_string()));

    // 10. If destination is "worker", "sharedworker", or "serviceworker", and isTopLevel is true, then set request's mode to "same-origin".
    if ((destination == Fetch::Infrastructure::Request::Destination::Worker || destination == Fetch::Infrastructure::Request::Destination::SharedWorker || destination == Fetch::Infrastructure::Request::Destination::ServiceWorker) && is_top_level == TopLevelModule::Yes)
        request->set_mode(Fetch::Infrastructure::Request::Mode::SameOrigin);

    // 11. Set request's initiator type to "script".
    request->set_initiator_type(Fetch::Infrastructure::Request::InitiatorType::Script);

    // 12. Set up the module script request given request and options.
    set_up_module_script_request(request, options);

    // 13. If performFetch was given, run performFetch with request, isTopLevel, and with processResponseConsumeBody as defined below.
    //     Otherwise, fetch request with processResponseConsumeBody set to processResponseConsumeBody as defined below.
    //     In both cases, let processResponseConsumeBody given response response and null, failure, or a byte sequence bodyBytes be the following algorithm:
    auto process_response_consume_body = [request, &module_map, url, module_type, &settings_object, on_complete](GC::Ref<Fetch::Infrastructure::Response> response, Fetch::Infrastructure::FetchAlgorithms::BodyBytes body_bytes) {
        auto internal_response = response->unsafe_response();

        // 1. If any of the following are true:
        //    - bodyBytes is null or failure; or
        //    - response's status is not an ok status,
        if (body_bytes.has<Empty>() || body_bytes.has<Fetch::Infrastructure::FetchAlgorithms::ConsumeBodyFailureTag>() || !Fetch::Infrastructure::is_ok_status(response->status())) {
            // then set moduleMap[(url, moduleType)] to null, run onComplete given null, and abort these steps.
            module_map.set(url, module_type.to_byte_string(), { ModuleMap::EntryType::Failed, nullptr });
            on_complete->function()(nullptr);
            return;
        }

        // 2. Let mimeType be the result of extracting a MIME type from response's header list.
        auto mime_type = Fetch::Infrastructure::extract_mime_type(response->header_list());

        // 3. Let moduleScript be null.
        GC::Ptr<ModuleScript> module_script;

        // FIXME: 4. Let referrerPolicy be the result of parsing the `Referrer-Policy` header given response. [REFERRERPOLICY]
        // FIXME: 5. If referrerPolicy is not the empty string, set options's referrer policy to referrerPolicy.

        //  6. If mimeType's essence is "application/wasm" and moduleType is "javascript-or-wasm", then set moduleScript
        //     to the result of creating a WebAssembly module script given bodyBytes, moduleMapRealm, response's URL, and
        //     options.
        // FIXME: Pass options.
        if (mime_type.has_value() && mime_type->essence() == "application/wasm"sv && module_type == "javascript-or-wasm") {
            module_script = ModuleScript::create_a_webassembly_module_script(url.to_byte_string(), body_bytes.get<ByteBuffer>(), settings_object, response->url().value_or({})).release_value_but_fixme_should_propagate_errors();
        }

        // 7. Otherwise
        else {
            // 1. Let sourceText be the result of UTF-8 decoding bodyBytes.
            auto decoder = TextCodec::decoder_for("UTF-8"sv);
            VERIFY(decoder.has_value());
            auto source_text = TextCodec::convert_input_to_utf8_using_given_decoder_unless_there_is_a_byte_order_mark(*decoder, body_bytes.get<ByteBuffer>()).release_value_but_fixme_should_propagate_errors();

            // 2. If mimeType is a JavaScript MIME type and moduleType is "javascript-or-wasm", then set moduleScript to
            //    the result of creating a JavaScript module script given sourceText, moduleMapRealm, response's URL,
            //    and options.
            // FIXME: Pass options.
            if (mime_type.has_value() && mime_type->is_javascript() && module_type == "javascript-or-wasm") {
                // If the Rust pipeline is available, parse off the main thread.
                if (JS::RustIntegration::rust_pipeline_available()) {
                    auto on_complete_root = GC::make_root(on_complete);
                    auto settings_root = GC::make_root(settings_object);
                    auto url_string = url.to_byte_string();
                    auto response_url = response->url().value_or({});
                    auto module_type_string = module_type.to_byte_string();
                    auto source_code = JS::SourceCode::create(
                        String::from_utf8(url_string.view()).release_value_but_fixme_should_propagate_errors(),
                        Utf16String::from_utf8(source_text));
                    auto bytecode_cache_context = bytecode_cache_context_for_request(*request, *internal_response, response_url);
                    if (auto const& bytecode = internal_response->javascript_bytecode_cache(); bytecode.has_value()) {
                        auto source_hash = bytecode_cache_source_hash(*source_code);
                        if (auto* bytecode_cache = JS::RustIntegration::decode_bytecode_cache_blob(bytecode->bytes(), JS::RustIntegration::ProgramType::Module, source_hash.bytes())) {
                            auto module_script = ModuleScript::create_from_bytecode_cache(url_string, source_code, settings_object, response_url, bytecode_cache).release_value_but_fixme_should_propagate_errors();
                            if (module_script && module_script->parse_error().is_null()) {
                                settings_object.module_map().set(url, module_type_string, { ModuleMap::EntryType::ModuleScript, module_script });
                                on_complete->function()(module_script);
                                return;
                            }
                        }
                    }

                    compile_off_thread(move(source_code), JS::RustIntegration::ProgramType::Module, 0,
                        [url = move(url), url_string = move(url_string), response_url = move(response_url),
                            module_type_string = move(module_type_string),
                            bytecode_cache_context = move(bytecode_cache_context),
                            on_complete_root = move(on_complete_root),
                            settings_root = move(settings_root)](auto result, auto source_code) mutable {
                            auto source_code_for_background_compile = source_code;
                            auto source_code_for_cache = source_code;
                            auto module_script = result.compiled
                                ? ModuleScript::create_from_pre_compiled(url_string, move(source_code), *settings_root, move(response_url), result.compiled).release_value_but_fixme_should_propagate_errors()
                                : ModuleScript::create_from_pre_parsed(url_string, move(source_code), *settings_root, move(response_url), result.parsed).release_value_but_fixme_should_propagate_errors();
                            if (module_script)
                                compile_remaining_module_functions_off_thread(*module_script, move(source_code_for_background_compile));
                            settings_root->module_map().set(url, module_type_string, { ModuleMap::EntryType::ModuleScript, module_script });
                            on_complete_root->function()(module_script);
                            if (result.compiled && bytecode_cache_context.has_value())
                                schedule_bytecode_cache_generation(*source_code_for_cache, JS::RustIntegration::ProgramType::Module, 0, bytecode_cache_context.release_value());
                        });
                    return;
                }
                module_script = ModuleScript::create_a_javascript_module_script(url.to_byte_string(), source_text, settings_object, response->url().value_or({})).release_value_but_fixme_should_propagate_errors();
            }

            // FIXME: 3. If mimeType is a JavaScript MIME type and moduleType is "javascript-or-wasm", then set moduleScript to
            //    the result of creating a JavaScript module script given sourceText, settingsObject, response's URL, and options.

            // 4. If the MIME type essence of mimeType is "text/css" and moduleType is "css", then set moduleScript to
            //    the result of creating a CSS module script given sourceText and settingsObject.
            if (mime_type.has_value() && mime_type->essence() == "text/css"sv && module_type == "css")
                module_script = ModuleScript::create_a_css_module_script(url.to_byte_string(), source_text, settings_object).release_value_but_fixme_should_propagate_errors();

            // 4. If mimeType is a JSON MIME type and moduleType is "json", then set moduleScript to the result of
            //    creating a JSON module script given sourceText and settingsObject.
            if (mime_type.has_value() && mime_type->is_json() && module_type == "json")
                module_script = ModuleScript::create_a_json_module_script(url.to_byte_string(), source_text, settings_object).release_value_but_fixme_should_propagate_errors();
        }

        // 8. Set moduleMap[(url, moduleType)] to moduleScript, and run onComplete given moduleScript.
        module_map.set(url, module_type.to_byte_string(), { ModuleMap::EntryType::ModuleScript, module_script });
        on_complete->function()(module_script);
    };

    if (perform_fetch != nullptr) {
        perform_fetch->function()(request, is_top_level, move(process_response_consume_body)).release_value_but_fixme_should_propagate_errors();
    } else {
        Fetch::Infrastructure::FetchAlgorithms::Input fetch_algorithms_input {};
        fetch_algorithms_input.process_response_consume_body = move(process_response_consume_body);
        Fetch::Fetching::fetch(realm, request, Fetch::Infrastructure::FetchAlgorithms::create(realm.vm(), move(fetch_algorithms_input)));
    }
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-module-script-tree
void fetch_external_module_script_graph(JS::Realm& realm, URL::URL const& url, EnvironmentSettingsObject& settings_object, ScriptFetchOptions const& options, OnFetchScriptComplete on_complete)
{
    auto steps = create_on_fetch_script_complete(realm.heap(), [&realm, &settings_object, on_complete, url](auto result) mutable {
        // 1. If result is null, run onComplete given null, and abort these steps.
        if (!result) {
            on_complete->function()(nullptr);
            return;
        }

        // 2. Fetch the descendants of and link result given settingsObject, "script", and onComplete.
        auto& module_script = as<ModuleScript>(*result);
        fetch_descendants_of_and_link_a_module_script(realm, module_script, settings_object, Fetch::Infrastructure::Request::Destination::Script, nullptr, on_complete);
    });

    // 1. Fetch a single module script given url, settingsObject, "script", options, settingsObject, "client", true, and with the following steps given result:
    fetch_single_module_script(realm, url, settings_object, Fetch::Infrastructure::Request::Destination::Script, options, settings_object, Web::Fetch::Infrastructure::Request::Referrer::Client, {}, TopLevelModule::Yes, nullptr, steps);
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-an-inline-module-script-graph
void fetch_inline_module_script_graph(JS::Realm& realm, ByteString const& filename, ByteString const& source_text, URL::URL const& base_url, EnvironmentSettingsObject& settings_object, OnFetchScriptComplete on_complete)
{
    // 1. Let script be the result of creating a JavaScript module script using sourceText, settingsObject, baseURL, and options.
    auto script = ModuleScript::create_a_javascript_module_script(filename, source_text.view(), settings_object, base_url).release_value_but_fixme_should_propagate_errors();

    // 2. Fetch the descendants of and link script, given settingsObject, "script", and onComplete.
    fetch_descendants_of_and_link_a_module_script(realm, *script, settings_object, Fetch::Infrastructure::Request::Destination::Script, nullptr, on_complete);
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-single-imported-module-script
void fetch_single_imported_module_script(JS::Realm& realm,
    URL::URL const& url,
    EnvironmentSettingsObject& fetch_client,
    Fetch::Infrastructure::Request::Destination destination,
    ScriptFetchOptions const& options,
    EnvironmentSettingsObject& settings_object,
    Fetch::Infrastructure::Request::ReferrerType referrer,
    JS::ModuleRequest const& module_request,
    PerformTheFetchHook perform_fetch,
    OnFetchScriptComplete on_complete)
{
    // 1. Assert: moduleRequest.[[Attributes]] does not contain any Record entry such that entry.[[Key]] is not "type",
    //    because we only asked for "type" attributes in HostGetSupportedImportAttributes.
    for (auto const& entry : module_request.attributes)
        VERIFY(entry.key == "type"sv);

    // 2. Let moduleType be the result of running the module type from module request steps given moduleRequest.
    auto module_type = module_type_from_module_request(module_request);

    // 3. If the result of running the module type allowed steps given moduleType and settingsObject is false,
    //    then run onComplete given null, and return.
    if (!module_type_allowed(settings_object, module_type)) {
        on_complete->function()(nullptr);
        return;
    }

    // 4. Fetch a single module script given url, fetchClient, destination, options, settingsObject, referrer, moduleRequest, false,
    //    and onComplete. If performFetch was given, pass it along as well.
    fetch_single_module_script(realm, url, fetch_client, destination, options, settings_object, referrer, module_request, TopLevelModule::No, perform_fetch, on_complete);
}

// https://html.spec.whatwg.org/multipage/webappapis.html#fetch-the-descendants-of-and-link-a-module-script
void fetch_descendants_of_and_link_a_module_script(JS::Realm& realm,
    ModuleScript& module_script,
    EnvironmentSettingsObject& fetch_client,
    Fetch::Infrastructure::Request::Destination destination,
    PerformTheFetchHook perform_fetch,
    OnFetchScriptComplete on_complete)
{
    // 1. Let record be moduleScript's record.
    auto record = module_script.record();

    // 2. If record is null, then:
    if (record.has<Empty>()) {
        // 1. Set moduleScript's error to rethrow to moduleScript's parse error.
        module_script.set_error_to_rethrow(module_script.parse_error());

        // 2. Run onComplete given moduleScript.
        on_complete->function()(module_script);

        // 3. Return.
        return;
    }

    // 3. Let state be Record { [[ErrorToRethrow]]: null, [[Destination]]: destination, [[PerformFetch]]: null, [[FetchClient]]: fetchClient }.
    auto state = realm.heap().allocate<FetchContext>(JS::js_null(), destination, nullptr, fetch_client);

    // 4. If performFetch was given, set state.[[PerformFetch]] to performFetch.
    state->perform_fetch = perform_fetch;

    // FIXME: These should most likely be steps in the spec.
    // NOTE: For reasons beyond my understanding, we cannot use TemporaryExecutionContext here.
    //       Calling perform_a_microtask_checkpoint() on the fetch_client's responsible_event_loop
    //       prevents this from functioning properly. HTMLParser::the_end would be run before
    //       HTMLScriptElement::prepare_script had a chance to setup the callback to mark_done properly,
    //       resulting in the event loop hanging forever awaiting for the script to be ready for parser
    //       execution.
    realm.vm().push_execution_context(fetch_client.realm_execution_context());
    prepare_to_run_callback(fetch_client);

    // 5. Let loadingPromise be record.LoadRequestedModules(state).
    auto loading_promise = record.visit(
        [](Empty) -> GC::Ref<JS::PromiseCapability> { VERIFY_NOT_REACHED(); },
        [&](GC::Ref<JS::Module> module) { return GC::Ref { module->load_requested_modules(state) }; });

    WebIDL::react_to_promise(loading_promise,
        // 6. Upon fulfillment of loadingPromise, run the following steps:
        GC::create_function(realm.heap(), [&realm, record, &module_script, on_complete](JS::Value) -> WebIDL::ExceptionOr<JS::Value> {
            // 1. Perform record.Link().
            auto linking_result = record.visit(
                [](Empty) -> JS::ThrowCompletionOr<void> { VERIFY_NOT_REACHED(); },
                [&](GC::Ref<JS::Module> module) { return module->link(realm.vm()); });

            // If this throws an exception, set result's error to rethrow to that exception.
            if (linking_result.is_throw_completion())
                module_script.set_error_to_rethrow(linking_result.release_error().value());

            // 2. Run onComplete given moduleScript.
            on_complete->function()(module_script);

            return JS::js_undefined();
        }),

        // 7. Upon rejection of loadingPromise, run the following steps:
        GC::create_function(realm.heap(), [state, &module_script, on_complete](JS::Value) -> WebIDL::ExceptionOr<JS::Value> {
            // 1. If state.[[ErrorToRethrow]] is not null, set moduleScript's error to rethrow to state.[[ErrorToRethrow]] and run
            //    onComplete given moduleScript.
            if (!state->error_to_rethrow.is_null()) {
                module_script.set_error_to_rethrow(state->error_to_rethrow);

                on_complete->function()(module_script);
            }
            // 2. Otherwise, run onComplete given null.
            else {
                on_complete->function()(nullptr);
            }

            return JS::js_undefined();
        }));

    clean_up_after_running_callback(fetch_client);

    realm.vm().pop_execution_context();
}

}