create-croissant 0.1.8 → 0.1.9

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/refresh-access-token.d.mts

@@ -1,54 +0,0 @@
-import { AwaitableFunction } from "../types/helper.mjs";
-import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-
-//#region src/oauth2/refresh-access-token.d.ts
-declare function refreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  extraParams,
-  resource
-}: {
-  refreshToken: string;
-  options: AwaitableFunction<Partial<ProviderOptions>>;
-  authentication?: ("basic" | "post") | undefined;
-  extraParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): Promise<{
-  body: URLSearchParams;
-  headers: Record<string, any>;
-}>;
-/**
- * @deprecated use async'd refreshAccessTokenRequest instead
- */
-declare function createRefreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  extraParams,
-  resource
-}: {
-  refreshToken: string;
-  options: ProviderOptions;
-  authentication?: ("basic" | "post") | undefined;
-  extraParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): {
-  body: URLSearchParams;
-  headers: Record<string, any>;
-};
-declare function refreshAccessToken({
-  refreshToken,
-  options,
-  tokenEndpoint,
-  authentication,
-  extraParams
-}: {
-  refreshToken: string;
-  options: Partial<ProviderOptions>;
-  tokenEndpoint: string;
-  authentication?: ("basic" | "post") | undefined;
-  extraParams?: Record<string, string> | undefined;
-}): Promise<OAuth2Tokens>;
-//#endregion
-export { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/refresh-access-token.mjs

@@ -1,73 +0,0 @@
-import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
-//#region src/oauth2/refresh-access-token.ts
-async function refreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }) {
-	options = typeof options === "function" ? await options() : options;
-	return createRefreshAccessTokenRequest({
-		refreshToken,
-		options,
-		authentication,
-		extraParams,
-		resource
-	});
-}
-/**
-* @deprecated use async'd refreshAccessTokenRequest instead
-*/
-function createRefreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }) {
-	const body = new URLSearchParams();
-	const headers = {
-		"content-type": "application/x-www-form-urlencoded",
-		accept: "application/json"
-	};
-	body.set("grant_type", "refresh_token");
-	body.set("refresh_token", refreshToken);
-	if (authentication === "basic") {
-		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
-		if (primaryClientId) headers["authorization"] = "Basic " + base64.encode(`${primaryClientId}:${options.clientSecret ?? ""}`);
-		else headers["authorization"] = "Basic " + base64.encode(`:${options.clientSecret ?? ""}`);
-	} else {
-		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
-		body.set("client_id", primaryClientId);
-		if (options.clientSecret) body.set("client_secret", options.clientSecret);
-	}
-	if (resource) if (typeof resource === "string") body.append("resource", resource);
-	else for (const _resource of resource) body.append("resource", _resource);
-	if (extraParams) for (const [key, value] of Object.entries(extraParams)) body.set(key, value);
-	return {
-		body,
-		headers
-	};
-}
-async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, extraParams }) {
-	const { body, headers } = await createRefreshAccessTokenRequest({
-		refreshToken,
-		options,
-		authentication,
-		extraParams
-	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
-		method: "POST",
-		body,
-		headers
-	});
-	if (error) throw error;
-	const tokens = {
-		accessToken: data.access_token,
-		refreshToken: data.refresh_token,
-		tokenType: data.token_type,
-		scopes: data.scope?.split(" "),
-		idToken: data.id_token
-	};
-	if (data.expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
-	}
-	if (data.refresh_token_expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.refreshTokenExpiresAt = new Date(now.getTime() + data.refresh_token_expires_in * 1e3);
-	}
-	return tokens;
-}
-//#endregion
-export { createRefreshAccessTokenRequest, refreshAccessToken, refreshAccessTokenRequest };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/utils.d.mts

@@ -1,16 +0,0 @@
-import { OAuth2Tokens } from "./oauth-provider.mjs";
-
-//#region src/oauth2/utils.d.ts
-declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
-/**
- * Return the provider's primary Client ID: the single string, or the entry at
- * array index 0 for the cross-platform form used by ID token audience
- * verification. Index 0 is the designated primary and pairs with
- * `clientSecret` for the authorization code flow; later array entries are
- * only used as additional accepted audiences. Returns `undefined` when the
- * primary value is missing or an empty string.
- */
-declare function getPrimaryClientId(clientId: unknown): string | undefined;
-declare function generateCodeChallenge(codeVerifier: string): Promise<string>;
-//#endregion
-export { generateCodeChallenge, getOAuth2Tokens, getPrimaryClientId };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/utils.mjs

@@ -1,37 +0,0 @@
-import { base64Url } from "@better-auth/utils/base64";
-//#region src/oauth2/utils.ts
-function getOAuth2Tokens(data) {
-	const getDate = (seconds) => {
-		const now = /* @__PURE__ */ new Date();
-		return new Date(now.getTime() + seconds * 1e3);
-	};
-	return {
-		tokenType: data.token_type,
-		accessToken: data.access_token,
-		refreshToken: data.refresh_token,
-		accessTokenExpiresAt: data.expires_in ? getDate(data.expires_in) : void 0,
-		refreshTokenExpiresAt: data.refresh_token_expires_in ? getDate(data.refresh_token_expires_in) : void 0,
-		scopes: data?.scope ? typeof data.scope === "string" ? data.scope.split(" ") : data.scope : [],
-		idToken: data.id_token,
-		raw: data
-	};
-}
-/**
-* Return the provider's primary Client ID: the single string, or the entry at
-* array index 0 for the cross-platform form used by ID token audience
-* verification. Index 0 is the designated primary and pairs with
-* `clientSecret` for the authorization code flow; later array entries are
-* only used as additional accepted audiences. Returns `undefined` when the
-* primary value is missing or an empty string.
-*/
-function getPrimaryClientId(clientId) {
-	const value = Array.isArray(clientId) ? clientId[0] : clientId;
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-async function generateCodeChallenge(codeVerifier) {
-	const data = new TextEncoder().encode(codeVerifier);
-	const hash = await crypto.subtle.digest("SHA-256", data);
-	return base64Url.encode(new Uint8Array(hash), { padding: false });
-}
-//#endregion
-export { generateCodeChallenge, getOAuth2Tokens, getPrimaryClientId };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/validate-authorization-code.d.mts

@@ -1,85 +0,0 @@
-import { AwaitableFunction } from "../types/helper.mjs";
-import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-import * as jose from "jose";
-
-//#region src/oauth2/validate-authorization-code.d.ts
-declare function authorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
-  code: string;
-  redirectURI: string;
-  options: AwaitableFunction<Partial<ProviderOptions>>;
-  codeVerifier?: string | undefined;
-  deviceId?: string | undefined;
-  authentication?: ("basic" | "post") | undefined;
-  headers?: Record<string, string> | undefined;
-  additionalParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): Promise<{
-  body: URLSearchParams;
-  headers: Record<string, any>;
-}>;
-/**
- * @deprecated use async'd authorizationCodeRequest instead
- */
-declare function createAuthorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
-  code: string;
-  redirectURI: string;
-  options: Partial<ProviderOptions>;
-  codeVerifier?: string | undefined;
-  deviceId?: string | undefined;
-  authentication?: ("basic" | "post") | undefined;
-  headers?: Record<string, string> | undefined;
-  additionalParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): {
-  body: URLSearchParams;
-  headers: Record<string, any>;
-};
-declare function validateAuthorizationCode({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  tokenEndpoint,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
-  code: string;
-  redirectURI: string;
-  options: AwaitableFunction<Partial<ProviderOptions>>;
-  codeVerifier?: string | undefined;
-  deviceId?: string | undefined;
-  tokenEndpoint: string;
-  authentication?: ("basic" | "post") | undefined;
-  headers?: Record<string, string> | undefined;
-  additionalParams?: Record<string, string> | undefined;
-  resource?: (string | string[]) | undefined;
-}): Promise<OAuth2Tokens>;
-declare function validateToken(token: string, jwksEndpoint: string, options?: {
-  audience?: string | string[];
-  issuer?: string | string[];
-}): Promise<jose.JWTVerifyResult<jose.JWTPayload> & jose.ResolvedKey>;
-//#endregion
-export { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/validate-authorization-code.mjs

@@ -1,79 +0,0 @@
-import { getOAuth2Tokens } from "./utils.mjs";
-import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
-import { createRemoteJWKSet, jwtVerify } from "jose";
-//#region src/oauth2/validate-authorization-code.ts
-async function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams = {}, resource }) {
-	options = typeof options === "function" ? await options() : options;
-	return createAuthorizationCodeRequest({
-		code,
-		codeVerifier,
-		redirectURI,
-		options,
-		authentication,
-		deviceId,
-		headers,
-		additionalParams,
-		resource
-	});
-}
-/**
-* @deprecated use async'd authorizationCodeRequest instead
-*/
-function createAuthorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams = {}, resource }) {
-	const body = new URLSearchParams();
-	const requestHeaders = {
-		"content-type": "application/x-www-form-urlencoded",
-		accept: "application/json",
-		...headers
-	};
-	body.set("grant_type", "authorization_code");
-	body.set("code", code);
-	codeVerifier && body.set("code_verifier", codeVerifier);
-	options.clientKey && body.set("client_key", options.clientKey);
-	deviceId && body.set("device_id", deviceId);
-	body.set("redirect_uri", options.redirectURI || redirectURI);
-	if (resource) if (typeof resource === "string") body.append("resource", resource);
-	else for (const _resource of resource) body.append("resource", _resource);
-	if (authentication === "basic") {
-		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
-		requestHeaders["authorization"] = `Basic ${base64.encode(`${primaryClientId}:${options.clientSecret ?? ""}`)}`;
-	} else {
-		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
-		body.set("client_id", primaryClientId);
-		if (options.clientSecret) body.set("client_secret", options.clientSecret);
-	}
-	for (const [key, value] of Object.entries(additionalParams)) if (!body.has(key)) body.append(key, value);
-	return {
-		body,
-		headers: requestHeaders
-	};
-}
-async function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, deviceId, headers, additionalParams = {}, resource }) {
-	const { body, headers: requestHeaders } = await authorizationCodeRequest({
-		code,
-		codeVerifier,
-		redirectURI,
-		options,
-		authentication,
-		deviceId,
-		headers,
-		additionalParams,
-		resource
-	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
-		method: "POST",
-		body,
-		headers: requestHeaders
-	});
-	if (error) throw error;
-	return getOAuth2Tokens(data);
-}
-async function validateToken(token, jwksEndpoint, options) {
-	return await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint)), {
-		audience: options?.audience,
-		issuer: options?.issuer
-	});
-}
-//#endregion
-export { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/verify.d.mts

@@ -1,42 +0,0 @@
-import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
-
-//#region src/oauth2/verify.d.ts
-interface VerifyAccessTokenRemote {
-  /** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
-  introspectUrl: string;
-  /** Client Secret */
-  clientId: string;
-  /** Client Secret */
-  clientSecret: string;
-  /**
-   * Forces remote verification of a token.
-   * This ensures attached session (if applicable)
-   * is also still active.
-   */
-  force?: boolean;
-}
-/**
- * Performs local verification of an access token for your APIs.
- *
- * Can also be configured for remote verification.
- */
-declare function verifyJwsAccessToken(token: string, opts: {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>); /** Verify options */
-  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
-}): Promise<JWTPayload>;
-declare function getJwks(token: string, opts: {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
-}): Promise<JSONWebKeySet>;
-/**
- * Performs local verification of an access token for your API.
- *
- * Can also be configured for remote verification.
- */
-declare function verifyAccessToken(token: string, opts: {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>; /** Scopes to additionally verify. Token must include all but not exact. */
-  scopes?: string[]; /** Required to verify access token locally */
-  jwksUrl?: string; /** If provided, can verify a token remotely */
-  remoteVerify?: VerifyAccessTokenRemote;
-}): Promise<JWTPayload>;
-//#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };

package/template/apps/web/node_modules/@better-auth/core/dist/oauth2/verify.mjs

@@ -1,92 +0,0 @@
-import { logger } from "../env/logger.mjs";
-import { APIError } from "better-call";
-import { betterFetch } from "@better-fetch/fetch";
-import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
-//#region src/oauth2/verify.ts
-/** Last fetched jwks used locally in getJwks @internal */
-let jwks;
-/**
-* Performs local verification of an access token for your APIs.
-*
-* Can also be configured for remote verification.
-*/
-async function verifyJwsAccessToken(token, opts) {
-	try {
-		const jwt = await jwtVerify(token, createLocalJWKSet(await getJwks(token, opts)), opts.verifyOptions);
-		if (jwt.payload.azp) jwt.payload.client_id = jwt.payload.azp;
-		return jwt.payload;
-	} catch (error) {
-		if (error instanceof Error) throw error;
-		throw new Error(error);
-	}
-}
-async function getJwks(token, opts) {
-	let jwtHeaders;
-	try {
-		jwtHeaders = decodeProtectedHeader(token);
-	} catch (error) {
-		if (error instanceof Error) throw error;
-		throw new Error(error);
-	}
-	if (!jwtHeaders.kid) throw new Error("Missing jwt kid");
-	if (!jwks || !jwks.keys.find((jwk) => jwk.kid === jwtHeaders.kid)) {
-		jwks = typeof opts.jwksFetch === "string" ? await betterFetch(opts.jwksFetch, { headers: { Accept: "application/json" } }).then(async (res) => {
-			if (res.error) throw new Error(`Jwks failed: ${res.error.message ?? res.error.statusText}`);
-			return res.data;
-		}) : await opts.jwksFetch();
-		if (!jwks) throw new Error("No jwks found");
-	}
-	return jwks;
-}
-/**
-* Performs local verification of an access token for your API.
-*
-* Can also be configured for remote verification.
-*/
-async function verifyAccessToken(token, opts) {
-	let payload;
-	if (opts.jwksUrl && !opts?.remoteVerify?.force) try {
-		payload = await verifyJwsAccessToken(token, {
-			jwksFetch: opts.jwksUrl,
-			verifyOptions: opts.verifyOptions
-		});
-	} catch (error) {
-		if (error instanceof Error) if (error.name === "TypeError" || error.name === "JWSInvalid") {} else if (error.name === "JWTExpired") throw new APIError("UNAUTHORIZED", { message: "token expired" });
-		else if (error.name === "JWTInvalid") throw new APIError("UNAUTHORIZED", { message: "token invalid" });
-		else throw error;
-		else throw new Error(error);
-	}
-	if (opts?.remoteVerify) {
-		const { data: introspect, error: introspectError } = await betterFetch(opts.remoteVerify.introspectUrl, {
-			method: "POST",
-			headers: {
-				Accept: "application/json",
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			body: new URLSearchParams({
-				client_id: opts.remoteVerify.clientId,
-				client_secret: opts.remoteVerify.clientSecret,
-				token,
-				token_type_hint: "access_token"
-			}).toString()
-		});
-		if (introspectError) logger.error(`Introspection failed: ${introspectError.message ?? introspectError.statusText}`);
-		if (!introspect) throw new APIError("INTERNAL_SERVER_ERROR", { message: "introspection failed" });
-		if (!introspect.active) throw new APIError("UNAUTHORIZED", { message: "token inactive" });
-		try {
-			const unsecuredJwt = new UnsecuredJWT(introspect).encode();
-			const { audience: _audience, ...verifyOptions } = opts.verifyOptions;
-			payload = (introspect.aud ? UnsecuredJWT.decode(unsecuredJwt, opts.verifyOptions) : UnsecuredJWT.decode(unsecuredJwt, verifyOptions)).payload;
-		} catch (error) {
-			throw new Error(error);
-		}
-	}
-	if (!payload) throw new APIError("UNAUTHORIZED", { message: `no token payload` });
-	if (opts.scopes) {
-		const validScopes = new Set(payload.scope?.split(" "));
-		for (const sc of opts.scopes) if (!validScopes.has(sc)) throw new APIError("FORBIDDEN", { message: `invalid scope ${sc}` });
-	}
-	return payload;
-}
-//#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };

package/template/apps/web/node_modules/@better-auth/core/dist/social-providers/apple.d.mts

@@ -1,126 +0,0 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
-//#region src/social-providers/apple.d.ts
-interface AppleProfile {
-  /**
-   * The subject registered claim identifies the principal that’s the subject
-   * of the identity token. Because this token is for your app, the value is
-   * the unique identifier for the user.
-   */
-  sub: string;
-  /**
-   * A String value representing the user's email address.
-   * The email address is either the user's real email address or the proxy
-   * address, depending on their status private email relay service.
-   */
-  email: string;
-  /**
-   * A string or Boolean value that indicates whether the service verifies
-   * the email. The value can either be a string ("true" or "false") or a
-   * Boolean (true or false). The system may not verify email addresses for
-   * Sign in with Apple at Work & School users, and this claim is "false" or
-   * false for those users.
-   */
-  email_verified: true | "true";
-  /**
-   * A string or Boolean value that indicates whether the email that the user
-   * shares is the proxy address. The value can either be a string ("true" or
-   * "false") or a Boolean (true or false).
-   */
-  is_private_email: boolean;
-  /**
-   * An Integer value that indicates whether the user appears to be a real
-   * person. Use the value of this claim to mitigate fraud. The possible
-   * values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal). For
-   * more information, see ASUserDetectionStatus. This claim is present only
-   * in iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14
-   * and later. The claim isn’t present or supported for web-based apps.
-   */
-  real_user_status: number;
-  /**
-   * The user’s full name in the format provided during the authorization
-   * process.
-   */
-  name: string;
-  /**
-   * The URL to the user's profile picture.
-   */
-  picture: string;
-  user?: AppleNonConformUser | undefined;
-}
-/**
- * This is the shape of the `user` query parameter that Apple sends the first
- * time the user consents to the app.
- * @see https://developer.apple.com/documentation/signinwithapplerestapi/request-an-authorization-to-the-sign-in-with-apple-server./
- */
-interface AppleNonConformUser {
-  name: {
-    firstName: string;
-    lastName: string;
-  };
-  email: string;
-}
-interface AppleOptions extends ProviderOptions<AppleProfile> {
-  clientId: string | string[];
-  appBundleIdentifier?: string | undefined;
-  audience?: (string | string[]) | undefined;
-}
-declare const apple: (options: AppleOptions) => {
-  id: "apple";
-  name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
-    state: string;
-    codeVerifier: string;
-    scopes?: string[] | undefined;
-    redirectURI: string;
-    display?: string | undefined;
-    loginHint?: string | undefined;
-  }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
-    code: string;
-    redirectURI: string;
-    codeVerifier?: string | undefined;
-    deviceId?: string | undefined;
-  }) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
-  refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  getUserInfo(token: OAuth2Tokens & {
-    user?: {
-      name?
-      /**
-      * An Integer value that indicates whether the user appears to be a real
-      * person. Use the value of this claim to mitigate fraud. The possible
-      * values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal). For
-      * more information, see ASUserDetectionStatus. This claim is present only
-      * in iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14
-      * and later. The claim isn’t present or supported for web-based apps.
-      */
-      : {
-        firstName?: string;
-        lastName?: string;
-      };
-      email?: string;
-    } | undefined;
-  }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
-  } | null>;
-  options: AppleOptions;
-};
-declare const getApplePublicKey: (kid: string) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
-//#endregion
-export { AppleNonConformUser, AppleOptions, AppleProfile, apple, getApplePublicKey };