Retrieve the public key

{
  "success": true,
  "key": {
    "algorithm": "Ed25519",
    "key_id": "ed25519_2b9bc7e214b1209f",
    "public_key": "3VNX3t2NIvzg37o1w-bjxJdJVFtgbfpR-_Q80u4U5tQ",
    "encoding": "base64url"
  },
  "request_id": "req_d9e278f6722a692a5dc3bbe8"
}

// Purpose: inspect one client-callable Sandbox operation, not grant feature access.
// Requires Swift5.7+, Foundation; FoundationNetworking on Linux.
// Build: swiftc -parse-as-library request.swift -o request; run: ./request public-key
// Expected: JSON; exit0 success/1 API rejection/2 setup or transport failure.
// Credentials/body: KDP_* variables. Private terminal only; output may contain secrets.
import Foundation
#if canImport(FoundationNetworking)
import FoundationNetworking
#endif
let contract = #"""
{
  "public-key": {
    "method": "GET",
    "path": "/public-key",
    "auth": "public"
  },
  "activate": {
    "method": "POST",
    "path": "/licenses/activate",
    "auth": "publicApp"
  },
  "validate": {
    "method": "POST",
    "path": "/licenses/validate",
    "auth": "activation"
  },
  "deactivate": {
    "method": "POST",
    "path": "/licenses/deactivate",
    "auth": "activation"
  }
}
"""#
enum SetupError: Error {case invalid}
func required(_ name:String) throws -> String {
    let value=ProcessInfo.processInfo.environment[name] ?? ""
    guard !value.isEmpty && !value.contains("\r") && !value.contains("\n") else {throw SetupError.invalid};return value
}
final class NoRedirect: NSObject, URLSessionTaskDelegate, @unchecked Sendable {
    func urlSession(_ session:URLSession,task:URLSessionTask,willPerformHTTPRedirection response:HTTPURLResponse,newRequest request:URLRequest,completionHandler:@escaping(URLRequest?)->Void){completionHandler(nil)}
}
@main struct Example {
    static func main() async {
        do {
            let env=ProcessInfo.processInfo.environment
            let operations=try JSONSerialization.jsonObject(with:Data(contract.utf8)) as! [String:[String:String]]
            guard CommandLine.arguments.count==2,let op=operations[CommandLine.arguments[1]] else {throw SetupError.invalid}
            let name=CommandLine.arguments[1]
            let base=(env["KDP_BASE_URL"] ?? "https://licensing.kdpika.com/api/v1").replacingOccurrences(of:"/+$",with:"",options:.regularExpression)
            guard let parts=URLComponents(string:base),let host=parts.host else {throw SetupError.invalid}
            let local=parts.scheme=="http" && ["localhost","127.0.0.1"].contains(host) && env["KDP_ALLOW_LOOPBACK"]=="1"
            guard (parts.scheme=="https" || local) && parts.user==nil && parts.password==nil && parts.query==nil && parts.fragment==nil && parts.path=="/api/v1",let url=URL(string:base+op["path"]!) else {throw SetupError.invalid}
            var request=URLRequest(url:url);request.httpMethod=op["method"];request.timeoutInterval=15
            request.setValue("application/json",forHTTPHeaderField:"Accept");request.setValue("KDPikaDocsExample/1.0 Swift",forHTTPHeaderField:"User-Agent")
            if op["auth"]=="publicApp" {request.setValue(try required("KDP_APP_ID"),forHTTPHeaderField:"X-App-ID");request.setValue("SANDBOX",forHTTPHeaderField:"X-Environment")}
            if op["auth"]=="activation" {request.setValue("Bearer "+(try required("KDP_ACTIVATION_TOKEN")),forHTTPHeaderField:"Authorization")}
            if name=="validate" {request.setValue(try required("KDP_INSTALLATION_ID"),forHTTPHeaderField:"X-Installation-ID")}
            if op["method"]=="POST" {
                let body=Data((env["KDP_BODY_JSON"] ?? "{}").utf8)
                guard try JSONSerialization.jsonObject(with:body) is [String:Any] else {throw SetupError.invalid}
                request.httpBody=body;request.setValue("application/json",forHTTPHeaderField:"Content-Type")
            }
            let session=URLSession(configuration:.ephemeral,delegate:NoRedirect(),delegateQueue:nil)
            defer {session.invalidateAndCancel()}
            let (raw,response)=try await session.data(for:request)
            guard let http=response as? HTTPURLResponse,let result=try JSONSerialization.jsonObject(with:raw) as? [String:Any],let text=String(data:raw,encoding:.utf8) else {throw SetupError.invalid}
            _ = text // Decoding above checks UTF-8 without reserializing JSON.
            FileHandle.standardOutput.write(raw);FileHandle.standardOutput.write(Data([10]))
            guard (200..<300).contains(http.statusCode),result["success"] as? Bool == true else {
                FileHandle.standardError.write(Data("API rejection. Inspect error.code/request_id; reconcile mutations before retrying.\n".utf8));exit(1)
            }
        } catch {
            FileHandle.standardError.write(Data("Request unavailable or configuration invalid. Check KDP_* settings/connectivity; do not blindly retry mutations.\n".utf8));exit(2)
        }
    }
}