@type consumer() :: :private_key_jwt | :jarm

@type incident_class() ::
  :remote_jwks_fetch_failed
  | :remote_jwks_invalid
  | :remote_jwks_key_unavailable
  | :remote_jwks_signature_invalid

@type summary() :: %{
  applicable?: boolean(),
  status: summary_status() | :not_applicable,
  client_id: String.t() | nil,
  mode: :remote_jwks_uri | :not_configured,
  incident: t() | nil,
  headline: String.t(),
  detail: String.t(),
  next_step: String.t(),
  ownership: String.t(),
  command_hint: String.t() | nil
}

@type summary_status() :: :supported | :incident

@type t() :: %Lockspire.Diagnostics.RemoteJwks{
  bounded_reactive?: true,
  cached_entry_present?: boolean() | nil,
  class: incident_class(),
  consumer: consumer(),
  current_request_fails_closed?: true,
  fetch_status: integer() | nil,
  forced_refresh_attempted?: boolean(),
  jwks_source: :jwks_uri,
  preserves_last_known_good_cache?: boolean(),
  proactive_readiness?: false,
  remediation: String.t(),
  requested_kid_present_in_cached_set?: boolean() | nil,
  stage: atom(),
  subreason: atom() | nil,
  target_safety_reason: atom() | nil
}