/**
 * Identity configuration for a remote domain server.
 *
 * The issuer must be reachable via JWKS at `<issuer>/.well-known/jwks.json`
 * (or registered in the kernel's trust store). The private key is used to
 * sign outbound composed credentials.
 */
export type RemoteIdentityConfig = {
  /** This service's issuer (URL where its JWKS is served, or a registered ID) */
  issuer: string
  /** Optional inbound audience when transport addressing differs from issuer. */
  audience?: string
  /** This service's subject identifier (e.g. "task-service") */
  subject: string
  /** Private key for signing outbound credentials */
  privateKey: JsonWebKey
}