//! Bundled root verification anchors. Must stay in sync with
//! `plugins/nowhub-plugin-node/src/rootKeys.ts`. Old kids must remain so old
//! JWS envelopes still verify.

pub const AXIS_PLATFORM_ROOT_PUBLIC_KEYS: &[(&str, &str)] = &[(
    "nowhub-root-2026",
    "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA93+XQF4lR62ZNNGOnokY0FpLNCCYnWKNi+HEkYGQ9Lw=\n-----END PUBLIC KEY-----\n",
)];

pub fn root_key_pem(kid: &str) -> Option<&'static str> {
    AXIS_PLATFORM_ROOT_PUBLIC_KEYS
        .iter()
        .find_map(|(name, pem)| if *name == kid { Some(*pem) } else { None })
}
