remote

type Config struct {
	// URL is the HTTPS endpoint for wrap operations. Required.
	URL string

	// UnwrapURL overrides URL for unwrap operations when the service uses
	// separate endpoints. Defaults to URL when empty.
	UnwrapURL string

	// Method is the HTTP verb used for wrap and unwrap requests. Defaults to POST.
	Method string

	// Headers are static HTTP headers added to every request.
	// Use this for Authorization, X-Vault-Token, and similar.
	Headers map[string]string

	// TLSCACert is the path to a PEM-encoded CA certificate bundle for
	// private or custom PKI. Uses the system root pool when empty.
	TLSCACert string

	// TLSClientCert and TLSClientKey enable mutual TLS authentication.
	// Both must be set together; if either is empty mTLS is not configured.
	TLSClientCert string
	TLSClientKey  string

	// InsecureSkipVerify disables TLS certificate verification.
	// This MUST NOT be used in production. It exists only for local test servers.
	InsecureSkipVerify bool

	// Timeout is the per-request deadline. Defaults to defaultRequestTimeout.
	Timeout time.Duration

	// WrapRequestTemplate is a Go text/template rendered before the wrap POST.
	// The template receives a single string field {{.DEK}} which is the
	// base64-encoded DEK bytes. When empty, the raw base64 DEK is sent as
	// the request body with Content-Type: text/plain.
	WrapRequestTemplate string

	// WrapResponseJSONPath is a dot-separated key path into the JSON response
	// body to extract the wrapped ciphertext, e.g. "ciphertext" or "data.ciphertext".
	// When empty the entire response body is treated as base64 ciphertext.
	WrapResponseJSONPath string

	// UnwrapRequestTemplate mirrors WrapRequestTemplate for the unwrap request.
	// The template field is {{.Wrapped}} (base64-encoded wrapped ciphertext).
	UnwrapRequestTemplate string

	// UnwrapResponseJSONPath mirrors WrapResponseJSONPath for the unwrap response.
	// The extracted value must be the base64-encoded plaintext DEK.
	UnwrapResponseJSONPath string

	// ExpectedStatusCodes lists HTTP status codes treated as success.
	// Defaults to [200, 204] when nil.
	ExpectedStatusCodes []int

	// RetryCount is the number of retry attempts on transient errors. Default 3.
	RetryCount int

	// RetryBackoff is the initial wait between retries. Default 500 ms.
	// Retries use exponential backoff capped at 8 × RetryBackoff.
	RetryBackoff time.Duration
}

type Provider struct {
	// contains filtered or unexported fields
}