import * as jose from "jose";

//#region src/utils/temp-jwt.ts
async function verifyTempToken(publicKeyPem, token) {
	const publicKey = await jose.importSPKI(publicKeyPem, "RS256");
	const { payload } = await jose.jwtVerify(token, publicKey, {
		issuer: "inkeep-manage-api",
		audience: "inkeep-run-api"
	});
	if (payload.type !== "temporary") throw new Error("Invalid token type");
	if (!payload.sub) throw new Error("Invalid token: missing subject claim");
	return payload;
}

//#endregion
export { verifyTempToken };