request

type Options struct {
	// Headers is a list of "Name: Value" header strings to add to the request.
	Headers []string
	// Query is a list of "key=value" query parameter strings to append.
	Query []string
	// Server overrides the scheme and host (e.g. "https://staging.example.com").
	Server string
	// Insecure disables TLS certificate verification.
	Insecure bool
	// Timeout bounds the full request lifetime, including response body reads.
	// Zero means no timeout.
	Timeout time.Duration
	// HeaderTimeoutOnly treats Timeout as a time-to-first-response deadline.
	// Do still installs a body-read deadline by default so bounded callers keep
	// whole-request behavior; stream callers can remove it after reading
	// response headers with DisableResponseBodyDeadline.
	HeaderTimeoutOnly bool
	// ClientCertPath is the PEM client certificate path for mTLS.
	ClientCertPath string
	// ClientKeyPath is the PEM client private key path for mTLS.
	ClientKeyPath string
	// TLSSignerPath is the executable path of a tls-signer plugin for mTLS.
	TLSSignerPath string
	// TLSSignerName records the logical signer name before CLI resolution.
	TLSSignerName string
	// TLSSignerParams holds plugin-specific configuration for the tls-signer.
	TLSSignerParams map[string]string
	// CACertPath is an optional PEM CA bundle to trust in addition to system roots.
	CACertPath string
	// TLSMinVersion constrains the minimum TLS version when connecting over HTTPS.
	TLSMinVersion uint16
	// AcceptHeader, if non-empty, is sent as the Accept request header.
	AcceptHeader string
	// AcceptEncodingHeader, if non-empty, is sent as the Accept-Encoding header.
	AcceptEncodingHeader string
	// ContentType overrides the Content-Type header when a body is present.
	// If empty and a body is present, the caller is responsible for setting
	// the header via Headers.
	ContentType string
	// PreserveHeaderCase keeps caller-supplied header names in Headers as-is
	// instead of using net/http's canonical MIME casing. This is only useful
	// for broken HTTP/1.x servers; HTTP/2 lowercases header names by protocol.
	PreserveHeaderCase bool
	// UserAgent, if non-empty, is sent when the caller has not supplied a
	// User-Agent header.
	UserAgent string
	// OnRequest, if non-nil, is called after all standard headers and query
	// params have been applied, immediately before the request is sent.
	// Auth handlers use this hook to inject credentials.
	OnRequest func(*http.Request) error
	// OnResponse, if non-nil, is called with the raw HTTP response before it is
	// returned to the caller.
	OnResponse func(*http.Response)
	// OnBeforeRequest, if non-nil, is called after all headers, query params,
	// auth, and request middleware have been applied, immediately before the
	// request is sent through the transport.
	OnBeforeRequest func(*http.Request)
	// OnUnauthorized, when non-nil, is used by callers that want to retry once
	// after a 401 with freshly acquired credentials.
	OnUnauthorized func(*http.Request) error
	// CacheDir, if non-empty, enables RFC 7234 response caching in that
	// directory.  NoCache overrides this and skips the cache entirely.
	CacheDir string
	// NoCache, when true, bypasses the response cache for this request
	// (no read, no write).
	NoCache bool
	// CacheNamespace partitions cache entries for one API/profile tuple.
	// Embedders that set CacheDir and inject auth headers or credential query
	// params should set this to a stable value such as "<api>:<profile>" or set
	// NoCache for ad hoc credentialed requests.
	CacheNamespace string
	// CacheMaxBytes is the maximum size of the HTTP response cache in bytes.
	// If zero, defaults to cache.DefaultMaxBytes.
	CacheMaxBytes int64
	// Retry is the maximum number of retry attempts for network errors and
	// selected transient HTTP responses. Zero disables retries.
	Retry int
	// RetryUnsafe allows retrying methods other than GET and HEAD. When false,
	// Retry applies only to safe methods.
	RetryUnsafe bool
	// RetryBaseDelay is the base delay for the first retry backoff interval.
	// Defaults to 1 s when zero.
	RetryBaseDelay time.Duration
	// RetryMaxWait caps server-provided Retry-After/X-Retry-In delays.
	// Defaults to DefaultRetryMaxWait when zero.
	RetryMaxWait time.Duration
	// Logger receives retry progress warnings on stderr-style output.
	Logger io.Writer
	// WrapTransport, when non-nil, wraps the final transport after TLS, retry,
	// and cache layers are applied.
	WrapTransport func(http.RoundTripper) http.RoundTripper
	// Transport, when passed to BuildTransport, is the underlying transport to
	// wrap with TLS/cache/retry behavior. When passed to Do, it is treated as a
	// fully built transport and reused as-is. Callers that make multiple
	// requests with the same options (e.g. pagination) should pre-build one via
	// BuildTransport and set it here so connection pools are reused.
	Transport http.RoundTripper
}