spec

type Fetcher struct {
	Client *http.Client
	// Strict is used for any candidate that is not the API's own origin, so an
	// insecure granted for a localhost dev certificate cannot follow it away.
	Strict  *http.Client
	Refresh bool
	Offline bool
	Warnf   func(format string, args ...any)

	// Authorize applies credentials to a spec request. It is called only after an
	// unauthenticated attempt has been refused, so a public spec never reaches for
	// a vault.
	Authorize func(ctx context.Context, req *http.Request) error
}

type Meta struct {
	URL          string    `json:"url"`
	ETag         string    `json:"etag,omitempty"`
	LastModified string    `json:"last_modified,omitempty"`
	FetchedAt    time.Time `json:"fetched_at"`
}

type Spec struct {
	Data   []byte
	Meta   Meta
	Path   string
	Status string
}